The flaw lies in the agg_agg component of Payy, an Ethereum L2 zk-rollup, where the system forwards an array of compacted messages to a public messages list without validating that the unused tail of the array is zero. This omission means a prover can construct a valid aggregated proof that includes forging an additional burn message after legitimate ones. During RollupV1.verifyRollup() the rollup contract interprets this forged burn as a legitimate instruction and transfers USDC from the contract to the attacker. The CVSS score of 8.7 classifies this as a high‑severity attack that grants an attacker unauthorized transfer of funds, meeting the criteria of CWE‑349 for insufficient verification of critical data.

All deployments of the polybase:payy zk‑rollup running a version older than 1.3.0 are affected. The current production setup restricts verification to an allowlisted prover, mitigating immediate exploitation, but the vulnerability becomes permissionless under the prover model described in the whitepaper once a prover stakes and is approved. Thus any node that can join as a prover could potentially use approved block data to construct a malicious proof.

With a CVSS score of 8.7 the risk is high, although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack requires the attacker to become a registered prover or to rely on a future prover model that permits stake‑based registration. Once a prover is in place, the malicious proof can be submitted to the rollup contract, triggering an immediate transfer of USDC. The vulnerability thus poses a significant threat to the financial integrity of the rollup system.