I spotted the pattern at 3:47 AM CET on a Sunday. A series of 0x12b transactions flowing from a single address to a popular L2 bridge contract every 2.1 seconds. Not a bot. Not a DCA strategy. The gas limit per call was 41,230 – exactly the same each time. That’s not human. That’s an oracle ingest loop hitting the sequencer directly. But here’s the catch: the sequencer’s mempool wasn’t supposed to expose pending transactions. The L2’s documentation claimed “private mempool with encrypted bundles.” The hash does not lie, only the narrative does. I traced the blood trail through the blockchain and found a backdoor that let anyone with a dumpster-dive script read every pending user action before finality. The project raised $40M six months ago. The sequencer is still a single AWS EC2 instance in us-east-1. Silence is the loudest proof in the ledger.
This L2 calls itself “the ultra-scalable zkEVM for mass adoption.” I won’t name it here because the exploit is still live and the team hasn’t patched it, but any reader with basic Python and a WebSocket connection can verify my claim. The protocol launched mainnet in February 2025 after a $40M Series A led by a top-tier VC. Its pitch: “decentralized sequencing via DPoS validator set, with zero-knowledge proof aggregation for privacy.” The TVL sits at $340M as of yesterday, largely from a liquid staking derivative and a perpetual DEX. The bull case is that it will replace Arbitrum and Optimism by offering native privacy and sub-second finality. The reality is that its sequencer, as of block 4,291,007, runs a modified version of Geth with a single transaction ordering endpoint that anyone can query. I set up a node using their open-source code 48 hours ago. The first thing I noticed: the eth_newPendingTransactionFilter RPC call returned results even when the sequencer was under load. That should be disabled for any production L2 sequencer with a claim to privacy. But it wasn’t. Worse, the filter exposed the raw transaction payloads – including the data field – before they entered the prover queue. That means any MEV searcher, any malicious actor, any state actor can see your swap, your deposit, your withdrawal, your multisig execution before it gets proven on L1.
I spent the next six hours performing a systematic teardown. First, I captured 1,200 consecutive pending transactions via a local script. I categorized them: 62% were standard ERC-20 transfers, 23% were swap transactions on the native DEX, 10% were L1→L2 deposits, and 5% were contract interactions with the liquid staking vault. Of those, I found 14 transactions that contained sensitive metadata – one was a whale wallet unwinding a $2.3M staking position, another was a multisig proposal to change the fee oracle address. Because the sequencer leaked the full data field, I could reconstruct the exact parameters of the multisig call. The proposal was to set a new fee recipient to an address that, upon further chain tracing, I found to be funded by a fresh Binance deposit of 500 ETH. The deposit came from an account that had been dormant for 17 months. The fee recipient address had never interacted with any protocol before. Minting errors are not bugs; they are confessions. In this case, the error was the RPC filter that should have been turned off. The confession is that someone inside the team – or someone who bought a validator seat – intended to redirect fees without public scrutiny.
I dissect the code to find the human error. The human error here is not the exposed RPC per se – that’s a configuration oversight. The real error is the architectural decision to attach the sequencer’s RPC layer directly to the same state database that feeds the prover. In a properly designed zkEVM, the sequencer should operate on a separate, ephemeral state that is discarded after each batch. What I found: the sequencer writes pending transactions directly into the same MPT (Merkle Patricia Trie) that the prover reads. That means any pending transaction that isn’t yet included in a batch is still accessible through the eth_getBalance and eth_getTransactionByHash endpoints – which were also exposed. I tested this by sending a 0-value transaction to myself from a freshly created address. Within 0.3 seconds, I could query the sequencer’s public endpoint and see the tx before it was in any batch. The L2’s “private mempool” is an illusion. The sequencer is a single node. The “DPoS validator set” turns out to be 21 validators, but they all connect to the same sequencer instance. There is no redundancy, no failover, no multiple proposers. It is a centralized server with a fancy ZK wrapper.
Now, the contrarian angle. The bulls will say: “This is just a testnet bug, mainnet will be fixed.” Or: “The RPC leak doesn’t affect funds, only privacy.” They have a point about fund safety – I saw no reentrancy vulnerabilities, no flash loan attack vectors. The smart contracts themselves are audited by a top firm and the code is clean. The sequencer configuration, however, is not part of the audit scope. That is a critical blind spot. The bull case also holds that the team has a progressive decentralization roadmap – they plan to hand over sequencer control to the validator set in Q3 2025. But every project says that. My concern: the prerequisite for decentralized sequencing is that the sequencer cannot be a single point of failure for privacy and censorship resistance. This sequencer, as deployed, is a single point of failure for transaction visibility. If the team cannot even turn off the pendingTransactionFilter in production, what confidence can we have that they will properly implement threshold encryption or multi-party computation for the sequencer? The bulls are correct that the core zk-proof logic is sound. I verified the batch submission contract on L1 – the proofs check out. But the sequencer is the admission control point. If that point is leaky, the entire system’s privacy promise is broken.
So where does this leave us? The project will likely patch the RPC filter within 24 hours of this article. They will release a statement saying it was a “bug in the public endpoint configuration” and that “no user funds were at risk.” They will be right about the funds. But they will be wrong about the root cause. The root cause is the culture that treats the sequencer as a monolithic black box rather than a distributed state machine. Until every L2 runs multiple independent sequencers under separate administrative control, the “centralized sequencer” is not a phase – it is a design choice. I am not calling for panic. I am calling for accountability. The chain remembers what the mind tries to forget. This leak will be forgotten in two weeks because no money was lost. But the pattern will repeat. Next time, the leak might be a validator key. Next time, the leak might be the prover’s secret input. The only way to break the cycle is to audit the infrastructure, not just the contracts. I set up my own node to verify. I ran the tests. I captured the data. I am publishing the script on GitHub under an MIT license. You can run it yourself right now against the same endpoint. The hash does not lie. The narrative does.
Take this as a warning, not a scoop. The current bull market euphoria is blinding teams and investors to operational security holes. When TVL is growing 15% week-over-week, nobody wants to slow down and check the RPC configuration. But I am not a trader. I am not a marketer. I am an on-chain detective. My job is to find the blood trail before the bleeding starts. This one is still fresh. The sequencer is still central. The privacy promise is still a PowerPoint. And the next exploit will use this exact attack surface. The chain remembers.