Payy
Monthly
Circuit soundness failure in Payy (polybase/payy) prior to 1.3.0 lets an authorized rollup prover smuggle an extra burn message into the public messages[1000] array accepted by RollupV1.verifyRollup(), causing the rollup contract to transfer USDC from the contract to an attacker-controlled recipient. The attacker must be a registered prover with the ability to construct a valid agg_final proof for an already-approved rollup block and to manipulate the unconstrained tail of the public input array, so the assessed vector is authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, integrity-only impact with no confidentiality or availability loss). Exploitability today is further limited because verifyRollup() is restricted to the existing allowlisted prover, but the flaw becomes effectively unauthenticated under the permissionless prover model in the Payy whitepaper (Section 3.3.2 stake-to-join and Section 3.3.1 fallback submission by other nodes). No public exploit code had been identified at time of analysis, and the vendor-released patch is version 1.3.0.
Circuit soundness failure in Payy (polybase/payy) prior to 1.3.0 lets an authorized rollup prover smuggle an extra burn message into the public messages[1000] array accepted by RollupV1.verifyRollup(), causing the rollup contract to transfer USDC from the contract to an attacker-controlled recipient. The attacker must be a registered prover with the ability to construct a valid agg_final proof for an already-approved rollup block and to manipulate the unconstrained tail of the public input array, so the assessed vector is authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, integrity-only impact with no confidentiality or availability loss). Exploitability today is further limited because verifyRollup() is restricted to the existing allowlisted prover, but the flaw becomes effectively unauthenticated under the permissionless prover model in the Payy whitepaper (Section 3.3.2 stake-to-join and Section 3.3.1 fallback submission by other nodes). No public exploit code had been identified at time of analysis, and the vendor-released patch is version 1.3.0.