CVE-2026-48100
Received Received - Intake

Circuit Soundness Failure in Payy zk-Rollup

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description
Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the unused tail of the outer array is zero. A registered prover can build a valid agg_final proof for an approved rollup block while inserting an extra burn message after the real messages. RollupV1.verifyRollup() then parses that public input as a normal burn and transfers USDC from the rollup contract to the attacker. This is a severe circuit soundness failure: the proof system accepts a public statement whose messages array is not fully derived from the verified inner proofs. On the current deployment, verifyRollup() is restricted to the existing allowlisted prover, so a fresh public caller cannot submit the invalid proof directly. That gate limits who can reach L1 today; it does not make the circuit statement sound. The issue becomes permissionless under the prover model described in the Payy whitepaper. Section 3.3.2 states: "To join as a prover, the prover is required to submit a small stake", and Section 3.3.1 states that if a prover fails to submit, "other nodes can submit the block proof instead." In that model, an attacker only needs to become a registered prover and use public validator approval data for an already approved block. This issue has been patched in version 1.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-48100
EUVD
EUVD-2026-88359

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
payy payy to 1.3.0 (exc)
polybase payy 1.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-349 The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48100 is a critical vulnerability in the Payy zk-rollup system where the agg_agg circuit fails to check if unused slots in a public messages array are zero. This allows a registered prover to inject an extra burn message into a valid proof, tricking the system into transferring USDC from the rollup contract to the attacker.

Detection Guidance

To detect this vulnerability, inspect the agg_agg circuit implementation for missing zero-tail checks on the messages array. Verify if the circuit properly validates that all unused slots in the public messages array are zero after processing inner proofs. Check for any instances where agg_final proofs include burn messages beyond the compacted message prefix.

Impact Analysis

If exploited, this vulnerability could allow an attacker to steal USDC funds from the Payy rollup contract. The attack requires becoming a registered prover, which may be possible under the future permissionless prover model described in the Payy whitepaper.

Compliance Impact

This vulnerability could undermine compliance with financial regulations like anti-money laundering (AML) and know-your-customer (KYC) requirements by enabling unauthorized transfers of USDC from the rollup contract. The forged burn messages could facilitate illicit transactions while appearing legitimate, potentially violating regulatory standards for transaction integrity and auditability.

Mitigation Strategies

Update Payy to version 1.3.0 or later to patch the vulnerability. Add a tail-zero check in the agg_agg circuit to ensure the messages array is fully constrained. Regenerate verification keys and redeploy the verifier on L1.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48100. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart