chore: deploy Polygon_SpokePool

F-ACROSS-009-001

Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.

Recorded evidence

—score not recorded

across-protocol/contractsReported fixacross-protocol/contracts

chore: deploy Polygon_SpokePool

fixed and deployed publicly

details

Finding IDs: F-ACROSS-009-001
Status: fixed and deployed publicly
Reported via: private security contact
Note: nested tryMulticall bypass in Polygon_SpokePool multicall validation. initial PR #1363 added commit 3d163b8 on 2026-03-11 to block MultiCallerUpgradeable.tryMulticall.selector alongside multicall.selector, then closed unmerged for audit. PR #1405 merged the same fix on 2026-04-08 via merge commit 5388448 and deployed a new Polygon_SpokePool implementation. Across docs list Polygon chain id 137 SpokePool proxy 0x9295...F096; verified production implementation mapping reported as 0x4a84a43274f5f99e94aa0ebef53bc06af8bc3dfb.

F-ACROSS-009-001: Access control. Nested tryMulticall bypasses a forbidden-selector policy. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-ACROSS-009-001

Security area (1seal assessment): Authorization. Nested tryMulticall is added to the forbidden selectors so call nesting cannot bypass the Polygon SpokePool operation guard. Reviewed 21 Sep 2026.

Clarify or correct this record privately. The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy.

How this page groups evidence

This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.