Michael Boyle

Security Engineer at Asymmetric Research 🏈 Former CSU Kicker

[asymmetric research @asymmetric_re]

Today we're launching Crucible, a coverage-guided fuzzing framework for Solana programs. Built for Anchor, with v2 support from day one.

Just one example of what Crucible can find: a years-old bug in Solana's stake program, surfaced in seconds ↓

[Kohl's Kicking Camps @KohlsKicking]

Kicker Andrew Boyle of Oregon has received a camp invite from the Tampa Bay Buccaneers.

#KohlsElite // #NFLDraft

[asymmetric research @asymmetric_re]

CU optimizations come with risks.

@_fel1x discusses a critical bug we found in p-token before mainnet, subtle enough to survive in a heavily scrutinized codebase.

[asymmetric research @asymmetric_re]

With support from Solana Foundation, we're launching STRIDE, a comprehensive security program that sets clear standards for @solana ecosystem projects.

STRIDE will provide independent opsec evaluations with public findings for real transparency into protocol security posture.

[Michael Boyle @Michael_Boyle__]

@StaniKulechov https://t.co/kdjadym29K

[asymmetric research @asymmetric_re]

New blog post: An Intro to Differential Fuzzing in Rust, by @nl_gripto & @anarcheuz. It walks through building a pure-Rust JSON fuzzer from scratch, then extending it into a differential fuzzing harness capable of surfacing consensus bugs.
https://t.co/yrwtnxAozi

[Pavel Shabarkin @shabarkin]

On Feb 17 2025 I reported a critical vulnerability to @Scroll_ZKP. $100m+ in TVL was at risk for more than 2 months.

Anyone could force Scroll L2 into an indefinite re-org, halting the chain so that no user transactions would be included in blocks and the chain would not move forward. All funds on L2 would be frozen.

@Scroll_ZKP downplayed the report. There was no meaningful communication about the issue—only continuous ghosting and silence. The @immunefi team mediated, yet did not correctly classify the vulnerability, which clearly falls under "Primacy of Impact." When I requested a re-evaluation, I received no response.

As a result, I am disclosing this to the public to highlight Scroll's lack of security proficiency, their unfair resolution process, and their treatment of white-hats.

You can find the link to the full report and complete timeline below.

@redhairshanks86 @0xBalloonLover @Wublockchain @coindesk @cointelegraph @TheBlock__ @aave @EtherFi @ambient_finance @l2beat

Full impact of the issue:

- The Scroll chain can be halted deliberately at zero cost to the attacker.
- Withdrawals remain blocked for the duration of the attack (potentially indefinitely, as it is free to sustain).
- Halted block production prevents critical time-dependent DeFi actions (e.g., topping up positions to avoid liquidation, oracle price updates), putting user funds at risk.
- The sequencer stops collecting transaction fees because no L2 user transactions can be included in blocks.
- Anyone on the internet can trigger the attack, and Scroll has no preventative measures.

---

Timeline

- **Feb 17 2025** – Issue submitted on Immunefi.
- **Feb 18 2025** – Scroll claims the issue was known from a Trail of Bits audit 14 months earlier and says it will be fixed in the Euclid upgrade (still 2+ months away). Scroll closes the report.
- **Feb 18 2025** – I request Immunefi triage, providing code commits that show Scroll attempted—but failed—to fix the issue. I emphasize that, while the attack vector is similar, the impact and exploitation mechanism are different.
- **Feb 24 2025** – Immunefi reopens the report for discussion with Scroll.
- **Feb 27 2025** – Immunefi asks Scroll for an update.
- **Mar 03 2025** – I contact Scroll to stress that the issue is public and exploitable on the live protocol.
- **Mar 03 2025** – I DM @yezhang1998 on Twitter about the Immunefi report.
- **Mar 04 2025** – Scroll says the issue is out of scope, labeling it "Throttling or suppression of operations without loss of user funds," and notes a similar report from Nov 06 2024.
- **Mar 04 2025** – I request Immunefi mediation to confirm the submission's uniqueness and ensure a fair bounty.
- **Mar 13 2025** – I ask Immunefi for an update.
- **Mar 17 2025** – Immunefi classifies the issue as **High severity** ("causing network processing nodes to handle transactions from the mempool beyond set parameters"). They confirm the bug is unique, acknowledge Scroll's attempted fix was ineffective, and suggest a goodwill bounty because Euclid will deprecate the vulnerable functionality (in ~1.5 months).
- **Mar 17 2025** – I reiterate that an attacker could freeze $100m+ on L2 and highlight Scroll's "Primacy of Impact" policy, which requires considering broader consequences.
- **Mar 19 2025** – Scroll acknowledges receipt and promises to follow up shortly.
- **Mar 27 2025** – I ask Scroll for an update.
- **Apr 03 2025** – I ask Scroll for an update.
- **Apr 03 2025** – Immunefi also asks Scroll for an update.
- **Apr 09 2025** – Immunefi contacts Scroll directly.
- **Apr 09 2025** – Scroll offers a payment of only **$1000**, stating the mechanism will be deprecated in the Euclid upgrade (3-4 weeks away).
- **Apr 09 2025** – I reject the bounty, explaining the protocol is still vulnerable and detailing potential losses had the vulnerability been exploited on Feb 17 2025.
- **Apr 15 2025** – I ask Immunefi to confirm "Primacy of Impact" applies and that the network remains vulnerable.
- **Apr 22 2025** – Scroll responds with a single "." and closes the report.
- **Apr 22 2025** – I ask Immunefi to explain Scroll's response and provide an update.
- **Apr 29 2025** – I notify both Scroll and Immunefi that I will publicly disclose the vulnerability on Apr 30 2025 unless the report is treated and rewarded fairly.

Here is the full audit report with a complete explanation of the issue, PoC scripts, a local network setup guide, and a PoC video. A full triage history (screenshots) is included at the end of the blog post—please review it!

https://t.co/dOqk0vh9ng

[Dan Lanning @CoachDanLanning]

Wishing @AndrewxBoyle a happy birthday! #GoDucks

[Quantstamp @Quantstamp]

Hi @EthereumDenver!

ICYMI: earlier this week, Auditing Engineers Jon Mevs @jonnymevs & Michael Boyle @michael_boyle__, presented “Easy-to-Miss Solidity Bugs” 👀🐛

[Zircuit @Zircuit]

NO MORE WEN TOKEN.

$ZRC officially becomes transferrable on 11.25.2024

ps: big product dropping next week, devs cooking gud - but patience, this is a Michelin, not McDonalds 👨‍🔬

🧵👇

[Kicker Update @kickerupdate]

An unbelievable Oregon onside 🦆

K Andrew Boyle drives an onside kick right at the Ohio St. defender on Saturday, and ends up with the recovery!

[Michael Boyle @Michael_Boyle__]

@seanclarke911 @coinbase My account has been locked for over a month because I received crypto from my self custody wallets and they asked me for screenshots showing the name and email address associated with the “external accounts”???

[Zircuit @Zircuit]

2 BILLION!!! 💚

stay tuned—we're cooking

[Michael Boyle @Michael_Boyle__]

i’m so early to @zircuit that they made me tweet this

https://t.co/7FehTLMf3D

[Zircuit @Zircuit]

1 BILLION 💚

[Quantstamp @Quantstamp]

The Quantstamp team is at @EthereumDenver this week!

Here's where you can find us ⬇️

[San Francisco 49ers @49ers]

That's a touchdown for the rookie fullback 🙌 @Jackcolletto

📺 #DENvsSF on KPIX
📱 NFL+ // https://t.co/KTh0i4oaLh

[Michael Boyle @Michael_Boyle__]

@DeGatchi This one is good: https://t.co/z0AkBQLIbL

[Michael Boyle @Michael_Boyle__]

@0xOwenThurm 👋🏻

[Colorado State Football @CSUFootball]

Michael Boyle, K (@Michael_Boyle__)
Camas, Wash.

👏