CVE-2026-48100 Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages
A registered prover can forge burn messages in the rollup proof, allowing unauthorized USDC transfers from the contract.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48100?
CVE-2026-48100 is a high-severity vulnerability in polybase payy, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the unused tail of the outer array is zero. A registered prover can build a valid agg_final proof for an approved rollup block while inserting an extra burn message after the real messages. RollupV1.verifyRollup() then parses that public input as a normal burn and transfers USDC from the rollup contract to the attacker. This is a severe circuit soundness failure: the proof system accepts a public statement whose messages array is not fully derived from the verified inner proofs. On the current deployment, verifyRollup() is restricted to the existing allowlisted prover, so a fresh public caller cannot submit the invalid proof directly. That gate limits who can reach L1 today; it does not make the circuit statement sound. The issue becomes permissionless under the prover model described in the Payy whitepaper. Section 3.3.2 states: "To join as a prover, the prover is required to submit a small stake", and Section 3.3.1 states that if a prover fails to submit, "other nodes can submit the block proof instead." In that model, an attacker only needs to become a registered prover and use public validator approval data for an already approved block. This issue has been patched in version 1.3.0.
Weakness: CWE-349
Which versions are affected by CVE-2026-48100?
How do I fix CVE-2026-48100?
No fix has been published for CVE-2026-48100 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-48100 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48100 exists.