The vulnerability arises because agg_agg forwards a compacted message stream into a public messages array without checking that the unused tail elements are zero. This leads to a circuit soundness failure where the proof system accepts a public statement containing messages not derived from the verified inner proofs. An attacker who becomes a registered prover can exploit this by inserting an extra burn message after the legitimate messages, causing the RollupV1.verifyRollup() function to parse and execute an unauthorized USDC transfer. The current deployment limits proof submission to an allowlisted prover, preventing direct exploitation by arbitrary public callers. However, under the permissionless prover model, any registered prover who stakes can submit such invalid proofs. The vulnerability is fixed in Payy version 1.3.0.

An attacker who is a registered prover can create a valid agg_final proof containing unauthorized burn messages, leading to unauthorized USDC transfers from the rollup contract to the attacker. This compromises the integrity of the rollup's transaction proofs and results in financial loss. The vulnerability represents a severe circuit soundness failure in the zk-rollup proof system. Current deployments restrict proof submission to allowlisted provers, limiting immediate exploitation, but the vulnerability is exploitable in permissionless prover environments.

This vulnerability has been patched in Payy version 1.3.0. Users and operators should upgrade to version 1.3.0 or later to remediate this issue. The current deployment restricts proof submission to allowlisted provers, which limits exploitation risk, but upgrading is necessary to fully resolve the circuit soundness failure.