Compromising ≥75% of the Security Council should be the only way (other than bugs) for a rollup to indefinitely block an L2→L1 message (e.g. a withdrawal) or push an invalid L2→L1 message (e.g. an invalid withdrawal).

Learn more about the new requirements

Value Secured

2024 May 23 — 2025 May 23

View TVS breakdown

Total value securedTotal

$236.83 M3.49%

Canonically BridgedCanonically Bridged ValueCanonical

$101.54 M1.19%

Natively MintedNatively Minted TokensNative

$66.17 M9.85%

Externally BridgedExternally Bridged ValueExternal

$69.10 M0.14%

View TVS breakdown

Activity

Onchain costs

The section shows the operating costs that L2s pay to Ethereum.

2024 May 24 — 2025 May 23

Show data posted

1 year total cost

$2.16 M

Avg cost per L2 UOP

$0.033358

1 year data posted

1.07 GiB

Avg size per L2 UOP

163.63 B

Liveness

The chart illustrates how "live" the project's operators are by displaying how frequently they submit transactions of the selected type and if these intervals deviate from their typical schedule.

2025 Apr 24 — May 22

30D avg. tx data subs. interval

1 hour

30D avg. proof subs. interval

4 hours

30D avg. state updates interval

4 hours

Past 30 days anomalies

Milestones & Incidents

Scroll Euclid upgrade

2025 Apr 24th

Scroll becomes Stage 1 by improving permissions and introducing enforced batch mode.

Learn more

SCR token launch

2024 Oct 19th

Scroll launches its SCR token.

Learn more

Risk summary

Funds can be stolen if

a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).

MEV can be extracted if

the operator exploits their centralized position and frontruns user transactions.

Risk analysis

Sequencer failureState validationData availabilityExit windowProposer failure

Sequencer failure

Self sequence

In the event of a sequencer failure, users can force transactions to be included in the project’s chain by sending them to L1. There can be up to a 7d delay on this operation. Proposing new blocks requires creating ZK proofs.

State validation

ZK proofs (SN)

SNARKs are zero knowledge proofs that ensure state correctness, but require trusted setup.

Data availability

Onchain

All of the data needed for proof construction is published on Ethereum L1.

Exit window

None

There is no window for users to exit in case of an unwanted regular upgrade since contracts are instantly upgradable.

Proposer failure

Self propose

If the Proposer fails, users can leverage the source available prover to submit proofs to the L1 bridge.

Rollup stage

Scroll is a

Stage 1

ZK Rollup.

New requirements coming soon

65d

23h

27m

15s

The project will be downgraded to

Stage 0

because it does not satisfy an upcoming Stage 1 principle.

Learn more about the new requirements

Learn more about Rollup stages

Please keep in mind that these stages do not reflect rollup security, this is an opinionated assessment of rollup maturity based on subjective criteria, created with a goal of incentivizing projects to push toward better decentralization. Each team may have taken different paths to achieve this goal.

Data availability

All data required for proofs is published on chain

All the data that is used to construct the system state is published on chain in the form of cheap blobs or calldata. This ensures that it will be available for enough time.

ScrollChain.sol - Etherscan source code commitBatch() and commitBatchWithBlobProof() functions

Learn more about the DA layer here:

Ethereum

State derivation

Node software

The node software to reconstruct the state is available here. Note that it uses the L2 p2p network to fetch blocks, and not the L1 network. The consistency with L1 data can be checked by running the scroll-geth node with the --rollup.verify flag.

Compression scheme

Data batches are compressed using the zlib algorithm with best compression level.

Genesis state

The genesis file can be found here, which contains two prefunded addresses and five predeployed contracts.

Data format

Blocks are grouped into chunks, chunks are grouped into batches, and batches are grouped into bundles. Chunk encoding format can be found here, and batch encoding format can be found here.

State validation

Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid user transactions to the previous state. These proofs are then verified on Ethereum by a smart contract.

Prover Architecture

The prover code can be found here.

ZK Circuits

Scroll circuits are openvm based Guest Programs based on the Halo2 proof system. The source code of the base circuits can be found here.

Verification Keys Generation

SNARK verification keys can be generated and checked against Ethereum verifier contract using this guide. The system requires a trusted setup.

Validity proofs

ScrollChain.sol - Etherscan source code, verifyAggregateProof() and verifyBundleProof() calls

Operator

The system has a centralized sequencer

While forcing transaction is open to anyone the system employs a privileged sequencer that has priority for submitting transaction batches and ordering transactions.

MEV can be extracted if the operator exploits their centralized position and frontruns user transactions.

ScrollChain.sol - Etherscan source code, finalizeBundlePostEuclidV2() function modifier

Users can force any transaction

Because the state of the system is based on transactions submitted on the underlying host chain and anyone can submit their transactions there it allows the users to circumvent censorship by interacting with the smart contract on the host chain directly. The enforced liveness mechanism is activated if either an L1 message has not been finalized for more than 7d or a batch has not been finalized for more than 7d. When activated, transactions that were directly posted to the smart contract can be forcefully included by anyone on the host chain, which finalizes their ordering.

Withdrawals

Regular messaging

The user initiates L2->L1 messages by submitting a regular transaction on this chain. When the block containing that transaction is settled, the message becomes available for processing on L1. ZK proofs are required to settle blocks.

L1ETHGateway.sol - Etherscan source code, finalizeWithdrawETH function

Upgrades & Governance

A diagram of the upgrades and governance

All core contracts in the Scroll protocol are upgradable by the ProxyAdmin, which is controlled by the Security Council through the ScrollOwner contract. The ScrollOwner is a central governance contract controlled by four distinct Timelocks: two governed by the Security Council multisig and two by the Scroll team multisigs. Each multisig can initiate specific types of changes with differing delay guarantees. The team can change parameters that affect L1->L2 messaging and the activation of permissionless sequencing (i.e., enforcedBatchMode), such as by calling the updateMessageQueueParameters and updateEnforcedBatchParameters functions through the TimelockFast, or by pausing the EnforcedTXGateway through the TimelockEmergency. It also has authority to revert unfinalized batches and add or remove sequencers and provers while sequencing is in permissioned mode. As the ScrollOwner admin, the Security Council can revert the team actions by revoking the team roles in the ScrollOwner contract (through the TimelockSCSlow) and upgrading the affected contracts. SCR token holders perform onchain voting on governance proposal through the AgoraGovernor contract on L2. However, upgrades are not triggered automatically, the Security Council is in charge of executing upgrades.

Permissions

A dashboard to explore contracts and permissions

Go to Disco

Explore in Disco

Ethereum

Actors:

Scroll Security Council 0x1a37…24DD

A Multisig with 9/12 threshold.
Can interact with TimelockSCEmergency
- cancel queued transactions
- execute transactions that are ready
- propose transactions
- update the minimum delay and manage all access control roles of the timelock
  
  via
  - acting via TimelockSCEmergency - or - acting directly
Can interact with TimelockSCSlow
- cancel queued transactions
- execute transactions that are ready
- propose transactions
- update the minimum delay and manage all access control roles of the timelock with 3d delay or with no delay
  
  via
  - acting via TimelockSCSlow with 3d delay - or - acting directly
Can interact with ScrollOwner
- disable enforced batch mode
  
  via
  - acting via TimelockSCEmergency
- update ScrollChain zk proof verifier
  
  via
  - acting via TimelockSCEmergency
- upgrade all core contracts of the system
  
  via
  - acting via TimelockSCEmergency

Participants (12):

0x0f50…A4dA 0x70DF…a86d 0xE47D…0f2a 0x9B2C…81D4 Safe 0x3031…f443 Safe 0x383C…e3B7 Safe Safe GnosisSafeL2 0xFb77…DaFf

Security Council members - Scroll Docs

Scroll Multisig 3 0xEfc9…4dbe

A Multisig with 3/5 threshold.
Can interact with TimelockFast
- cancel queued transactions
- propose transactions
- update the minimum delay and manage all access control roles of the timelock with 1d delay or with no delay
  
  via
  - acting via TimelockFast with 1d delay - or - acting directly
Can interact with ScrollOwner
- add permissioned batchers and provers to the whitelist with 1d delay
  
  via
  - acting via TimelockFast with 1d delay
- set ERC20 gateways in the L1GatewayRouter with 1d delay
  
  via
  - acting via TimelockFast with 1d delay
- update the L1ScrollMessenger fee vault address with 1d delay
  
  via
  - acting via TimelockFast with 1d delay
- update the minimum delay message queue parameters and enforced mode parameters with 1d delay
  
  via
  - acting via TimelockFast with 1d delay

Participants (5):

0xFCf6…c072 0x8460…30ae 0xEbbe…Dc68 0xfc31…E384 0xd33b…177f

Scroll Multisig 2 0xbdA1…0cBc

A Multisig with 2/4 threshold.
Can interact with ScrollOwner
- pause the L1 -> L2 messenger and enforced transaction mode
  
  via
  - acting via TimelockEmergency
- remove permissioned batchers and provers to the whitelist, and update the sequencer address
  
  via
  - acting via TimelockEmergency
- revert unfinalized batches
  
  via
  - acting via TimelockEmergency
Can interact with TimelockEmergency
- cancel queued transactions
- propose transactions
- update the minimum delay and manage all access control roles of the timelock
  
  via
  - acting via TimelockEmergency - or - acting directly

Participants (4):

EOA 1 EOA 3 EOA 4 EOA 2

Scroll Multisig 1 0x1FF1…236f

A Multisig with 1/4 threshold.

Participants (4):

EOA 3 EOA 4 EOA 1 EOA 2

EOA 1 0x0c5c…f774

Member of Scroll Multisig 1, Scroll Multisig 4, Scroll Multisig 2.
Can interact with TimelockSCEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockFast
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockSCSlow
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1

EOA 2 0x26ec…56c5

Member of Scroll Multisig 1, Scroll Multisig 2.
Can interact with TimelockSCEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockFast
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockSCSlow
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1

EOA 3 0xEe9b…0D5B

Member of Scroll Multisig 1, Scroll Multisig 2.
Can interact with TimelockSCEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockFast
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockSCSlow
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1

EOA 4 0xFcf1…9402

Member of Scroll Multisig 1, Scroll Multisig 4, Scroll Multisig 2.
Can interact with TimelockSCEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockFast
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockSCSlow
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1

Scroll

Actors:

Scroll Security Council 0x1a37…24DD

A Multisig with 9/12 threshold.
Can interact with ScrollOwner
- disable enforced batch mode
  
  via
  - acting via TimelockSCEmergency
- update ScrollChain zk proof verifier
  
  via
  - acting via TimelockSCEmergency
- upgrade all core contracts of the system
  
  via
  - acting via TimelockSCEmergency
Can interact with TimelockSCEmergency
- cancel queued transactions
- execute transactions that are ready
- propose transactions
- update the minimum delay and manage all access control roles of the timelock
  
  via
  - acting via TimelockSCEmergency - or - acting directly
Can interact with AgoraGovernor
- can configure contract settings such as voting delay, quorum, contract manager with 3d delay
  
  via
  - acting via TimelockSCSlow with 3d delay

Participants (12):

0x0f50…A4dA 0x70DF…a86d 0xE47D…0f2a 0x9B2C…81D4 SafeL2 0x3031…f443 SafeL2 0x383C…e3B7 SafeL2 SafeL2 GnosisSafeL2 0xFb77…DaFf

Scroll Multisig 2 0xbdA1…0cBc

A Multisig with 2/4 threshold.
Can interact with TimelockEmergency
- cancel queued transactions
- propose transactions
- update the minimum delay and manage all access control roles of the timelock
  
  via
  - acting via TimelockEmergency - or - acting directly

Participants (4):

EOA 1 EOA 3 EOA 4 EOA 2

Scroll Multisig 3 0xEfc9…4dbe

A Multisig with 3/5 threshold.
Can interact with TimelockFast
- cancel queued transactions
- propose transactions
- update the minimum delay and manage all access control roles of the timelock with 1d delay or with no delay
  
  via
  - acting via TimelockFast with 1d delay - or - acting directly

Participants (5):

0xFCf6…c072 0x8460…30ae 0xEbbe…Dc68 0xfc31…E384 0xd33b…177f

GnosisSafeL2 0x2B2A…4351

A Multisig with 2/3 threshold.
Can interact with AgoraGovernor
- can propose new onchain governance proposals without the required threshold of votes

Participants (3):

0xd5A0…b593 0x1Da4…8f50 0x1084…ff6f

Scroll Multisig 1 0x1FF1…236f

A Multisig with 1/4 threshold.

Participants (4):

EOA 3 EOA 4 EOA 1 EOA 2

EOA 1 0x0c5c…f774

Member of Scroll Multisig 1, Scroll Multisig 2.
Can interact with TimelockSCEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockFast
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1

EOA 2 0x26ec…56c5

Member of Scroll Multisig 1, Scroll Multisig 2.
Can interact with TimelockSCEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockFast
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1

EOA 3 0xEe9b…0D5B

Member of Scroll Multisig 1, Scroll Multisig 2.
Can interact with TimelockSCEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockFast
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1

EOA 4 0xFcf1…9402

Member of Scroll Multisig 1, Scroll Multisig 2.
Can interact with TimelockSCEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockFast
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1
Can interact with TimelockEmergency
- execute transactions that are ready
  
  via
  - acting via Scroll Multisig 1

Smart contracts

A dashboard to explore contracts and permissions

Go to Disco

Explore in Disco

A diagram of the smart contract architecture

Ethereum

MultipleVersionRollupVerifier 0x4CEA…ad3F

Contract used to update the verifier and keep track of current and old versions.

L1MessageQueueV2 0x5697…D18a Implementation (Upgradable)Admin

Contains the array of queued L1 -> L2 messages, either appended using the L1ScrollMessenger or the EnforcedTxGateway.

Roles:
- admin: ProxyAdmin

L1ScrollMessenger 0x6774…b367 Implementation (Upgradable)Admin

Contract used to send L1 -> L2 and relay messages from L2. It allows to replay failed messages and to drop skipped messages. L1 -> L2 messages sent using this contract pay for L2 gas on L1 and will have the aliased address of this contract as the sender.

Roles:
- admin: ProxyAdmin
This contract stores the following tokens: ETH.

EnforcedTxGateway 0x72CA…7A5d Implementation (Upgradable)Admin

Contracts to force L1 -> L2 messages with the proper sender.

Roles:
- admin: ProxyAdmin

ScrollOwner 0x7985…26a6

Owner of all contracts in the system. It implements an extension of AccessControl that manages roles and functions allowed to be called by each role.

Roles:
- opsFast: TimelockFast; ultimately Scroll Multisig 3
- opsNoDelay: TimelockEmergency; ultimately Scroll Multisig 2
- scNoDelay: TimelockSCEmergency; ultimately Scroll Security Council

SystemConfig 0x8432…7a4D Implementation (Upgradable)Admin

System configuration contract for Scroll, contains enforcedBatchParameters and messageQueueParameters determining permissionless mode.

Roles:
- admin: ProxyAdmin
- owner: ScrollOwner

ScrollChain 0xa13B…E556 Implementation (Upgradable)Admin

The main contract of the Scroll chain. Allows to post transaction data and state roots, along with proofs. Sequencing and proposing are behind a whitelist unless enforcedBatchMode is activated.

Roles:
- admin: ProxyAdmin

TimelockSCEmergency 0x0CD4…CA44

A timelock with access control. The current minimum delay is 0s. Proposals that passed their minimum delay can be executed by the anyone.

Roles:
- canceller: Scroll Security Council
- executor: Scroll Multisig 1, Scroll Security Council; ultimately EOA 1, EOA 2, EOA 3, EOA 4
- proposer: Scroll Security Council
- timelockAdmin: Scroll Security Council, TimelockSCEmergency; ultimately Scroll Security Council

TimelockFast 0x0e58…C4F4

A timelock with access control. The current minimum delay is 1d. Proposals that passed their minimum delay can be executed by the anyone.

Roles:
- canceller: Scroll Multisig 3
- executor: Scroll Multisig 1; ultimately EOA 1, EOA 2, EOA 3, EOA 4
- proposer: Scroll Multisig 3
- timelockAdmin: Scroll Multisig 3, TimelockFast; ultimately Scroll Multisig 3

TimelockSCSlow 0x3f90…a9fd

A timelock with access control. The current minimum delay is 3d. Proposals that passed their minimum delay can be executed by the anyone.

Roles:
- canceller: Scroll Security Council
- executor: Scroll Multisig 1, Scroll Security Council; ultimately EOA 1, EOA 2, EOA 3, EOA 4
- proposer: Scroll Security Council
- timelockAdmin: Scroll Security Council, TimelockSCSlow; ultimately Scroll Security Council

TimelockEmergency 0x8267…216b

A timelock with access control. The current minimum delay is 0s. Proposals that passed their minimum delay can be executed by the anyone.

Roles:
- canceller: Scroll Multisig 2
- executor: Scroll Multisig 1; ultimately EOA 1, EOA 2, EOA 3, EOA 4
- proposer: Scroll Multisig 2
- timelockAdmin: Scroll Multisig 2, TimelockEmergency; ultimately Scroll Multisig 2

L1ERC721Gateway 0x6260…554B Implementation (Upgradable)Admin

Contract used to bridge ERC721 tokens from L1 to L2.

Roles:
- admin: ProxyAdmin

L1ETHGateway 0x7F2b…E905 Implementation (Upgradable)Admin

Contract used to bridge ETH from L1 to L2.

Roles:
- admin: ProxyAdmin

pufETHEscrow 0xA033…2b2a Implementation (Upgradable)Admin

Contract used to bridge ERC20 tokens from L1 to L2. It allows to change the token mappings.

This contract stores the following tokens: pufETH.

L1CustomERC20Gateway 0xb2b1…B6ff Implementation (Upgradable)Admin

Contract used to bridge ERC20 tokens from L1 to L2. It allows to change the token mappings.

Roles:
- admin: ProxyAdmin
This contract can store any token.

L1ERC1155Gateway 0xb94f…75B6 Implementation (Upgradable)Admin

Contract used to bridge ERC1155 tokens from L1 to L2.

Roles:
- admin: ProxyAdmin

L1StandardERC20Gateway 0xD8A7…F8f9 Implementation (Upgradable)Admin

Contract used to bridge ERC20 tokens from L1 to L2. It uses a fixed token list.

Roles:
- admin: ProxyAdmin
This contract can store any token.

L1GatewayRouter 0xF8B1…1Fd6 Implementation (Upgradable)Admin

Main entry point for depositing ETH and ERC20 tokens, which are then forwarded to the correct gateway.

Roles:
- admin: ProxyAdmin

wstETHescrowLido 0x6625…f504 Implementation (Upgradable)Admin

This contract stores the following tokens: wstETH.

DaiEscrow 0x6726…F515 Implementation (Upgradable)Admin

Roles:
- admin: ProxyAdmin
This contract stores the following tokens: DAI.

L1WETHGateway 0x7AC4…D4fE Implementation (Upgradable)Admin

Contract used to bridge WETH from L1 to L2.

Roles:
- admin: ProxyAdmin

L1USDCGateway 0xf1AF…5c7B Implementation (Upgradable)Admin

Contract used to bridge USDC tokens from L1 to L2.

Roles:
- admin: ProxyAdmin
This contract stores the following tokens: USDC.

ZkEvmVerifierPostEuclid 0x3399…0828

Contract used to verify zk proofs given the aggregate proof and the public input hash.

PlonkVerifierPostEuclid-2 0x9F66…f79a

Source Code

ProxyAdmin 0xEB80…d072

Roles:
- owner: ScrollOwner

Scroll

ScrollOwner 0x13D2…437B

Owner of all contracts in the system. It implements an extension of AccessControl that manages roles and functions allowed to be called by each role.

Roles:
- scNoDelay: TimelockSCEmergency; ultimately Scroll Security Council

L2GatewayRouter 0xE2b4…447A Implementation (Upgradable)Admin

Contract used to withdraw ERC20 tokens on L2 and finalize deposit the tokens from L1.

Roles:
- admin: ProxyAdmin

TimelockSCEmergency 0x1f80…78b4

A timelock with access control. The current minimum delay is 0s. Proposals that passed their minimum delay can be executed by the anyone.

Roles:
- canceller: Scroll Security Council
- executor: Scroll Multisig 1, Scroll Security Council; ultimately EOA 1, EOA 2, EOA 3, EOA 4
- proposer: Scroll Security Council
- timelockAdmin: Scroll Security Council, TimelockSCEmergency; ultimately Scroll Security Council

TimelockFast 0x2b14…d376

A timelock with access control. The current minimum delay is 1d. Proposals that passed their minimum delay can be executed by the anyone.

Roles:
- canceller: Scroll Multisig 3
- executor: Scroll Multisig 1; ultimately EOA 1, EOA 2, EOA 3, EOA 4
- proposer: Scroll Multisig 3
- timelockAdmin: Scroll Multisig 3, TimelockFast; ultimately Scroll Multisig 3

AgoraGovernor 0x2f3F…14f0 Implementation (Upgradable)Admin

Used to propose and manage onchain governance proposals.

Roles:
- admin: ProxyAdmin
- manager: GnosisSafeL2
- timelock: TimelockSCSlow; ultimately Scroll Security Council

TimelockEmergency 0xA77D…734f

A timelock with access control. The current minimum delay is 0s. Proposals that passed their minimum delay can be executed by the anyone.

Roles:
- canceller: Scroll Multisig 2
- executor: Scroll Multisig 1; ultimately EOA 1, EOA 2, EOA 3, EOA 4
- proposer: Scroll Multisig 2
- timelockAdmin: Scroll Multisig 2, TimelockEmergency; ultimately Scroll Multisig 2