Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48100— Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages

Quick assessment

Affected
polybase payy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Payy 是一个基于以太坊 Layer 2 的零知识卷叠（zk-rollup）协议，旨在实现保护隐私且符合监管要求的交易。在 1.3.0 版本之前， 合约会将其内部证明（inner proofs）压缩后的消息流转发到一个公开的 数组中，但从未检查该外部数组未使用的尾部部分是否为零。一个已注册的证明者（prover）可以针对一个已批准的回滚区块（rollup block）构建一个有效的 证明，同时在真实消息之后插入一条额外的销毁（burn）消息。随后， 函数会将该公共输入解析为一条常规的销毁请求，并从回滚合约中转账

CVSS 8.7 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
polybase payy < 1.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48100

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages
Source: CVE Program / CVE List V5
Vulnerability Description
Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the unused tail of the outer array is zero. A registered prover can build a valid agg_final proof for an approved rollup block while inserting an extra burn message after the real messages. RollupV1.verifyRollup() then parses that public input as a normal burn and transfers USDC from the rollup contract to the attacker. This is a severe circuit soundness failure: the proof system accepts a public statement whose messages array is not fully derived from the verified inner proofs. On the current deployment, verifyRollup() is restricted to the existing allowlisted prover, so a fresh public caller cannot submit the invalid proof directly. That gate limits who can reach L1 today; it does not make the circuit statement sound. The issue becomes permissionless under the prover model described in the Payy whitepaper. Section 3.3.2 states: "To join as a prover, the prover is required to submit a small stake", and Section 3.3.1 states that if a prover fails to submit, "other nodes can submit the block proof instead." In that model, an attacker only needs to become a registered prover and use public validator approval data for an already approved block. This issue has been patched in version 1.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在可信数据中接受外来的不可信数据
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
polybase payy < 1.3.0 -

II. Public POCs for CVE-2026-48100

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-48100

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-48100 (1)

IV. Related Vulnerabilities

Same weakness: CWE-349

V. Comments for CVE-2026-48100

No comments yet

Leave a comment