Announcement: OpenVM v2.0.0 Upgrade on Scroll

General
1

Overview

This upgrade bumps Scroll’s zkVM prover stack from OpenVM v1.6.0 to v2.0.0. OpenVM v2.0 replaces the underlying proof system with SWIRL (via STARK Backend v2.0.0), and the upgrade also brings in the security fixes shipped in OpenVM v1.7.0. Because the proof system and circuits change, this is a breaking change at the zk layer and requires deploying a new on-chain verifier contract. There are no changes to the external protocol, the EVM, the fee model, or any user-facing interfaces.

As this is a prover-stack maintenance upgrade with no protocol-parameter changes, it proceeds as an announcement only.

Motivation

  • Security: OpenVM v1.7.0 fixes three security advisories affecting v1.6.0 and earlier, including two in the Solidity verifier wrapper. Moving to v2.0 keeps Scroll’s validity proofs on a supported release that includes these fixes.
  • Proof system: OpenVM v2.0 is the new major line of the upstream prover, built on the SWIRL proof system. New development and fixes upstream now target v2.x.

What’s changing

From OpenVM v1.7.0 (security fixes)

  • GHSA-396x-v8w4-9x82: MemoryMerkleAir allows below-leaf rows to alter memory roots
  • GHSA-j29p-wr24-hp4f: OpenVmHalo2Verifier self-call can bypass proof verification
  • GHSA-w82q-w67c-67wv: OpenVmHalo2Verifier accepts non-canonical app commitments

From OpenVM v2.0.0 (new proof system)

  • Prover moves to the SWIRL proof system, implemented in STARK Backend v2.0.0.
  • New recursive verifier circuit for SWIRL, plus a new continuation aggregation pipeline and deferral framework.
  • Memory access adapters removed from the VM memory system.
  • The SHA-256-specific AIR is replaced by SHA-2 family AIRs (SHA-256/384/512), and the Keccak-256 AIRs are redesigned into separate operation and permutation AIRs.

On-chain changes

A new zk verifier contract is deployed to match the upgraded prover:

  • Verifier contract (Scroll Mainnet): 0x7966FE0De13e3B81533470640Ac489223476B254

Timeline

  • Scroll Mainnet: September 22, 02:00 UTC (10:00 UTC+8)

Impact

  • Users, developers, and dApps don’t need to do anything. The external protocol, RPC, and contract interfaces stay the same.
  • During the upgrade window, batch finalization will be delayed by approximately one hour. Transactions, deposits, and L2 execution continue normally; only L1 finalization is briefly paused.
  • The breaking change only affects the zk proving system and the verifier contract. Applications stay compatible.

References

1 Like