Payy CVE-2026-48100

Exploitation requires the attacker to be an authorized prover for the Payy rollup. On the current deployment, RollupV1.verifyRollup() is restricted to an existing allowlisted prover, so a public caller cannot submit the malicious proof - this is the primary limiting factor today. The attacker must also possess the ability to construct a valid agg_final proof for an already-approved rollup block and inject an extra burn message into the unchecked tail of the public messages[1000] array, which demands specialized zk-circuit knowledge. The condition broadens to effectively unauthenticated only under the permissionless prover model in the Payy whitepaper (§3.3.2 stake-to-join, §3.3.1 fallback submission by other nodes), where any staked party can register as a prover. Only affects Payy versions prior to 1.3.0.

This is a genuine, high-severity soundness flaw in a zk-rollup proof system, but its real-world exploitability is heavily gated. The vendor CVSS 4.0 score of 8.7 (VI:H, integrity-only) reflects that a successful attack lets a malicious prover steal USDC directly from the RollupV1 contract - a direct financial-loss/integrity impact, not confidentiality (VC:N) or availability (VA:N). However, the vendor's PR:N (unauthenticated) is misleading for the CURRENT deployment: the description explicitly states verifyRollup() is restricted to an allowlisted prover, so a fresh public caller cannot submit the invalid proof today - that is effectively PR:H right now. PR:N only becomes realistic under the permissionless prover model described in the Payy whitepaper (stake-to-join), which is a future/design condition, not the present state. Verify deployment mode with the vendor before treating this as unauthenticated. No EPSS score, no CISA KEV listing, and no public exploit code are provided - exploitation status is 'no public exploit identified at time of analysis.' Realistic priority is elevated for anyone running or integrating Payy (fund theft, patched), but the combination of prover-allowlist gating, the specialized zk-circuit knowledge needed to craft a malicious agg_final proof, and the tiny deployment footprint means this is a targeted, high-skill issue rather than a mass-exploitation threat.

An entity that is (or becomes) a registered/allowlisted Payy prover takes an already-approved rollup block and its public validator approval data, then builds a valid agg_final proof while appending an extra burn message into the unchecked tail of the public messages array. When RollupV1.verifyRollup() parses that public input, it treats the injected burn as legitimate and transfers USDC from the rollup contract to the attacker's address. No public exploit code was identified at time of analysis; exploitation requires prover status and deep zk-circuit knowledge.