# Report: Scroll Mainnet Emergency Upgrade on 2026-02-23

**URL:** <https://forum.scroll.io/t/report-scroll-mainnet-emergency-upgrade-on-2026-02-23/1412>\
**Category:** General\
**Tags:** protocol, technical, security-council\
**Created:** [March 6, 2026, 2:22pm UTC](https://forum.scroll.io/t/report-scroll-mainnet-emergency-upgrade-on-2026-02-23/1412 "2026-03-06T14:22:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![thegaram33](https://sea2.discourse-cdn.com/flex002/user_avatar/forum.scroll.io/thegaram33/32/173_2.png) [@thegaram33](https://forum.scroll.io/u/thegaram33)\
**Post date:** [March 6, 2026, 2:22pm UTC](https://forum.scroll.io/t/report-scroll-mainnet-emergency-upgrade-on-2026-02-23/1412/1 "2026-03-06T14:22:43Z")

</div>

_Authors: The Scroll Security Council._

## Overview

In mid-February 2026, the Scroll team received a bug bounty report about the [zkvm-prover](https://github.com/scroll-tech/zkvm-prover) repository. A fix was implemented by the Scroll team and deployed on mainnet by the Scroll Security Council.

## Summary of the Bug

A missing check in the `ecPairing` precompile implementation could lead to diverging execution results on the sequencer and prover, leading to finalization failure.

Specifically, when we read bytes for the G2 point (on the BN254 curve), we make use of `G2Affine::from_xy`, which checks if the point is on the curve, **but does not check if the point is in the correct subgroup**.

As a result, inputs to `ecPairing` of the form `(G1_IDENTITY, G2_NON_SUBGROUP)` would output `0` in revm, while the prover guest program would output `1`, as one of the points is the identity, while the subgroup check was missing.

The issue has been confirmed and fixed in a private fork of our zkvm-prover repository. The patch was applied on top of the current GalileoV2 version (`v0.7.1`) and tagged as `v0.7.2`. The fix was reviewed by the OpenVM team. After executing the emergency upgrade, we moved the patch into the public repository.

Patch: [https://github.com/scroll-tech/zkvm-prover/compare/v0.7.1…v0.7.2](https://github.com/scroll-tech/zkvm-prover/compare/v0.7.1...v0.7.2)

## Acknowledgment

We would like to thank whitehat [@revofusion](https://x.com/revofusion) for disclosing this vulnerability via Immunefi.

---

<div class="post-metadata">

**Author:** ![Eureka](https://sea2.discourse-cdn.com/flex002/user_avatar/forum.scroll.io/eureka/32/966_2.png) [@Eureka](https://forum.scroll.io/u/Eureka)\
**Post date:** [March 9, 2026, 12:30pm UTC](https://forum.scroll.io/t/report-scroll-mainnet-emergency-upgrade-on-2026-02-23/1412/2 "2026-03-09T12:30:17Z")

</div>

Great to see the Scroll Security Council reacting promptly to this critical vulnerability in the zkvm-prover’s ecPairing precompile, while demonstrating optimistic governance in action with rapid, transparent patching and mainnet deployment.

Also shout out to the whitehat @revofusion for the Immunefi disclosure, always good to see a strong bug bounty process in motion.