| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | ID | Name | Project | Source Category | Source Link | ZK Framework (Circuit only) | Application Language (Application only) | Source Code | Fix | Layer | Vulnerability | Root Cause | Impact | |||||||||||||
2 | 1 | Non-Committing Encryption Used in InputID::Private | Aleo snarkVM | Audit Report | https://www.zksecurity.xyz/blog/2023-aleo-synthesizer.pdf | Varuna | | https://github.com/AleoHQ/snarkVM/blob/9f5246d8c28afc0aef769b723eeaa4ec4a402b9c/circuit/program/src/request/verify.rs#L182 | Application | Proof Composition Error | Application/Application Design Error | Soundness | ||||||||||||||
3 | 2 | Non-Committing Encryption Used in OutputID::Private | Aleo snarkVM | Audit Report | https://www.zksecurity.xyz/blog/2023-aleo-synthesizer.pdf | Varuna | | https://github.com/AleoHQ/snarkVM/blob/9f5246d8c28afc0aef769b723eeaa4ec4a402b9c/circuit/program/src/response/from_outputs.rs#L79 | Application | Proof Composition Error | Application/Application Design Error | Soundness | ||||||||||||||
4 | 3 | Incorrect Fiat-Shamir Transform in Circuit Certification | Aleo snarkVM | Audit Report | https://www.zksecurity.xyz/blog/2023-aleo-synthesizer.pdf | | | Backend | Prover Error | Framework/Incorrect Fiat-Shamir Transformation | Soundness | |||||||||||||||
5 | 4 | Proof Delegation Is Subject To Truncation | Aleo snarkVM | Audit Report | https://www.zksecurity.xyz/blog/2023-aleo-synthesizer.pdf | Varuna | | Application | Proof Delegation Error | Application/Application Design Error | Soundness | |||||||||||||||
6 | 7 | Hashing to G2 Exposes a Discrete Log Relation to the Generator | Aleo snarkVM | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Aleo/LeastAuthority_Aleo_Trusted_Setup_Phase_1_Final_Audit_Report.pdf | | | Backend | Setup Error | Framework/Informational Leakage | Soundness | |||||||||||||||
7 | 8 | Unsound Addition Gadget | Reclaim ChaCha20 | Audit Report | https://www.zksecurity.xyz/blog/2023-reclaim-chacha20.pdf | Circom | | https://github.com/reclaimprotocol/circom-chacha20/commit/4551ca64c9fe536b7b9b7498a1feb1ecdc847474 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
8 | 9 | Unsound Left Rotation Gadget | Reclaim ChaCha20 | Audit Report | https://www.zksecurity.xyz/blog/2023-reclaim-chacha20.pdf | Circom | | https://github.com/reclaimprotocol/circom-chacha20/commit/e5e756375fc1fc8dc48667b00cdf38c79a0fdf50 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
9 | 10 | Unsound XOR gadget | Reclaim ChaCha20 | Audit Report | https://www.zksecurity.xyz/blog/2023-reclaim-chacha20.pdf | Circom | | https://github.com/reclaimprotocol/circom-chacha20/commit/ef9f5a5ad899d852740a26b30eabe5765673c71f | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
10 | 11 | Potentially Easy-to-Misuse Interface | Reclaim ChaCha20 | Audit Report | https://www.zksecurity.xyz/blog/2023-reclaim-chacha20.pdf | Circom | | https://github.com/reclaimprotocol/circom-chacha20/commit/959fa1557225aed748a5d5ed468222c110faaef9 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
11 | 12 | Missing range checks in BigMod | Circom-ECDSA | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/0xPARC/circom-ecdsa/commit/d3edd7503f48f98a71b6013c248ef3ad55e19703 | Circuit | Under-Constrained | Circuit/Arithmetic Field Errors | Soundness | ||||||||||||||
12 | 13 | Decoder accepting bogus output signal | Circomlib | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/iden3/circomlib/blob/cff5ab6288b55ef23602221694a6a38a0239dcc0/circuits/multiplexer.circom#L78 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
13 | 14 | Underconstrained points in Edwards2Montgomery | Circomlib | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/iden3/circomlib/blob/cff5ab6288b55ef23602221694a6a38a0239dcc0/circuits/montgomery.circom#L30 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
14 | 15 | Underconstrained points in Montgomery2Edwards | Circomlib | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/iden3/circomlib/blob/cff5ab6288b55ef23602221694a6a38a0239dcc0/circuits/montgomery.circom#L49 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
15 | 16 | Underconstrained points in MontgomeryAdd | Circomlib | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/iden3/circomlib/blob/cff5ab6288b55ef23602221694a6a38a0239dcc0/circuits/montgomery.circom#L89 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
16 | 17 | Underconstrained points in MontgomeryDouble | Circomlib | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/iden3/circomlib/blob/cff5ab6288b55ef23602221694a6a38a0239dcc0/circuits/montgomery.circom#L122 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
17 | 18 | Underconstrained outputs in BitElementMulAny | Circomlib | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/iden3/circomlib/blob/cff5ab6288b55ef23602221694a6a38a0239dcc0/circuits/escalarmulany.circom#L34 | Circuit | Under-Constrained | Circuit/Unsafe Reuse of Circuit | Soundness | ||||||||||||||
18 | 19 | Underconstrained outputs in Window4 | Circomlib | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/iden3/circomlib/blob/cff5ab6288b55ef23602221694a6a38a0239dcc0/circuits/pedersen.circom#L25 | Circuit | Under-Constrained | Circuit/Unsafe Reuse of Circuit | Soundness | ||||||||||||||
19 | 20 | Underconstrained outputs in WindowMulFix | Circomlib | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/02/VAR-circom-bigint.pdf | Circom | | https://github.com/iden3/circomlib/blob/cff5ab6288b55ef23602221694a6a38a0239dcc0/circuits/escalarmulfix.circom#L48 | Circuit | Under-Constrained | Circuit/Unsafe Reuse of Circuit | Soundness | ||||||||||||||
20 | 22 | Initial Conditions Are Not Properly Enforced | MACI | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/MACI/20210922%20Hashcloak%20audit%20report.pdf | Circom | | https://github.com/privacy-scaling-explorations/maci/pull/277/files | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
21 | 23 | CVF-1 Missing range checks for negative values | Herodotus | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Herodotus/ABDK_Herodotus_Herodotus_v_3_0.pdf | Cairo | | https://github.com/HerodotusDev/offchain-evm-headers-processor/pull/11/commits/eb30c321f41880b35a7af069f7f52fd98d584616 | Circuit | Under-Constrained | Circuit/Arithmetic Field Errors | Soundness | ||||||||||||||
22 | 24 | CVF-3 Function doesn’t ensure that “y” is a power of two. | Herodotus | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Herodotus/ABDK_Herodotus_Herodotus_v_3_0.pdf | Cairo | | https://github.com/HerodotusDev/offchain-evm-headers-processor/pull/11/commits/af97dae8be5cca025f42da9334596de50762c855 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
23 | 25 | CVF-4 Implicitly requires “value” to fit into 128+32=160 bits. | Herodotus | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Herodotus/ABDK_Herodotus_Herodotus_v_3_0.pdf | Cairo | | https://github.com/HerodotusDev/offchain-evm-headers-processor/pull/11/commits/af97dae8be5cca025f42da9334596de50762c855 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
24 | 26 | CVF-10 Behaviour is undefined if mmr_len is not range checked. | Herodotus | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Herodotus/ABDK_Herodotus_Herodotus_v_3_0.pdf | Cairo | | https://github.com/HerodotusDev/offchain-evm-headers-processor/pull/11/commits/af97dae8be5cca025f42da9334596de50762c855 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
25 | 27 | CVF-11 Behaviour is undefined if mmr_offset is not range checked. | Herodotus | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Herodotus/ABDK_Herodotus_Herodotus_v_3_0.pdf | Cairo | | https://github.com/HerodotusDev/offchain-evm-headers-processor/pull/11/commits/af97dae8be5cca025f42da9334596de50762c855 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
26 | 28 | CVF-12 Behaviour is undefined if position is not range checked. | Herodotus | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Herodotus/ABDK_Herodotus_Herodotus_v_3_0.pdf | Cairo | | https://github.com/HerodotusDev/offchain-evm-headers-processor/pull/11/commits/af97dae8be5cca025f42da9334596de50762c855 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
27 | 29 | CVF-13 Behaviour is undefined if peaks_len is not range checked. | Herodotus | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Herodotus/ABDK_Herodotus_Herodotus_v_3_0.pdf | Cairo | | https://github.com/HerodotusDev/offchain-evm-headers-processor/pull/11/commits/af97dae8be5cca025f42da9334596de50762c855 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
28 | 30 | Data are not fully verified during state update | MACI | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/MACI/202220930_Hashcloak_audit_report.pdf | Circom | | https://github.com/privacy-scaling-explorations/maci/pull/522/commits/6df6a4054da926b07f35c5befab4f1f8af33dcc6 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
29 | 32 | Integer overflow problem & improper bit length restrictions | MACI | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/MACI/202220930_Hashcloak_audit_report.pdf | | Solidity | https://github.com/privacy-scaling-explorations/maci/pull/523/commits/c8eb37ad593ee671652f11458909df2a95db3581 | Application | Passing Unchecked Data | Application/Missing Validation Input | Soundness | ||||||||||||||
30 | 33 | MessageQueue in PollFactory is uninitialized | MACI | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/MACI/202220930_Hashcloak_audit_report.pdf | | Solidity | https://github.com/privacy-scaling-explorations/maci/pull/522/commits/04f21b358b9efc17cffb8732c96f338ec56462d3 | Application | Passing Unchecked Data | Application/Missing Validation Input | Completeness | ||||||||||||||
31 | 34 | Invalid Comparisons on Fixed-Point Values are Accepted by the Circuit Verifier | Penumbra | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Penumbra/NCC_Group_PenumbraLabs_E008695_Report_2023-08-18_v1.0.pdf | Arkworks | | https://github.com/penumbra-zone/penumbra/blob/a43b5944dfac702fd76fee6aab81de05f97de898/crates/core/num/src/fixpoint.rs#L428-L459 | https://github.com/penumbra-zone/penumbra/pull/2911/files#diff-954b3b2e678075baf1e06279ea41bb2823e540c76ddb80ba44b52476dfd3f55f | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | |||||||||||||
32 | 35 | Double-voting due to lack of duplicate nullifiers check | Penumbra | Audit Report | https://penumbra.zone/pdfs/zksecurity_penumbra_2023.pdf | | | https://github.com/penumbra-zone/penumbra/commit/4574c1acc26b8f83f264ec46be1ee48fb4ab4010#diff-95f89980636c07de4c1ac6308aed8f0db161b726cc53a031e7369a828864ab68 | Application | ZKP Complementary Logic Error | Application/Missing Validation Input | Soundness | ||||||||||||||
33 | 36 | Double spending due to incoming viewing key (ivk) derivation not constrained | Penumbra | Audit Report | https://penumbra.zone/pdfs/zksecurity_penumbra_2023.pdf | Arkworks | | https://github.com/penumbra-zone/penumbra/commit/e019839939968012ed2d24cf65bdd86d239b50e9 | Circuit | Under-Constrained | Circuit/Out-of-Circuit Computation Not Being Constrained | Soundness | ||||||||||||||
34 | 37 | Unsound fixed-point addition | Penumbra | Audit Report | https://penumbra.zone/pdfs/zksecurity_penumbra_2023.pdf | Arkworks | | https://github.com/penumbra-zone/penumbra/commit/ddab070acff5567f23eb36a4a877358f2c062d9b | Circuit | Computational Error | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
35 | 38 | Unsound fixed-point multiplication | Penumbra | Audit Report | https://penumbra.zone/pdfs/zksecurity_penumbra_2023.pdf | Arkworks | | https://github.com/penumbra-zone/penumbra/commit/1fdbe1ea10a270180c035aeb8bb7f4a3ff25d99e | Circuit | Computational Error | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
36 | 39 | Input signal s is not constrained in eff_ecdsa.circom | Spartan-ECDSA | Audit Report | https://github.com/zBlock-1/spartan-ecdsa-audit-report | Circom | | https://github.com/personaelabs/spartan-ecdsa/blob/3386b30d9b5b62d8a60735cbeab42bfe42e80429/packages/circuits/eff_ecdsa_membership/eff_ecdsa.circom#L11 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
37 | 40 | Knowledge of any member signature allow to generate proof of membership | Spartan-ECDSA | Audit Report | https://github.com/zBlock-1/spartan-ecdsa-audit-report | Circom | | https://github.com/personaelabs/spartan-ecdsa/blob/3386b30d9b5b62d8a60735cbeab42bfe42e80429/packages/circuits/eff_ecdsa_membership/eff_ecdsa.circom | Circuit | Under-Constrained | Circuit/Circuit Design Errors | Soundness | ||||||||||||||
38 | 43 | CVF-9 There must be range check and field check for the amount and field element | Railgun | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Railgun/ABDK_Railgun_CircomSolidity_v_2_0.pdf | | Solidity | https://github.com/Railgun-Privacy/contract/blob/6281cb0dac6a6e0da743e3ba56c437803657872d/contracts/logic/RailgunLogic.sol#L228 | https://github.com/Railgun-Privacy/contract/commit/ee203f9865b17a69b232c6b61b9b9822277efcaf#diff-5927624b674e4cb54530a97fa06431c2e9279c84d5cf69062fa3e02a51b4a1bfR244 | Application | Passing Unchecked Data | Application/Missing Validation Input | Soundness | |||||||||||||
39 | 44 | CVF-21 Check that these parameters are valid field elements | Railgun | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Railgun/ABDK_Railgun_CircomSolidity_v_2_0.pdf | | Solidity | https://github.com/Railgun-Privacy/contract/blob/6281cb0dac6a6e0da743e3ba56c437803657872d/contracts/logic/Verifier.sol#L277 | https://github.com/Railgun-Privacy/contract/commit/ee203f9865b17a69b232c6b61b9b9822277efcaf#diff-1e1d28adcf374653075f7eba18e89d4f95ed96ba1c542d2b6a0a5539b529e9e7R306 | Application | Passing Unchecked Data | Application/Missing Validation Input | Soundness | |||||||||||||
40 | 46 | CVF-2 This function cannot handle the case when n_risk_factor_segments is zero. | Starkware | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/StarkWare/ABDK_StarkWare_Perpetual__V3_2_v_1_0.pdf | Cairo | | https://github.com/starkware-libs/stark-perpetual/commit/3eb3a26366f412cf8d0643f65e33d8b2eb5904fc#diff-46c339368cad1ecf4fe1706202e777540962872f3f18dc45519fd8ea49c79d41 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
41 | 47 | Prover can lock user funds by including ill-formed BigInts in public key commitment (Rotate Function) | Succinct | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Succinct/2023-02-succinct-securityreview.pdf | Circom | | https://github.com/succinctlabs/telepathy-circuits/commit/b0c839cef30c3c25ef41d1ad3000081784766934#diff-7db11ff1faea3f19f0b35882d9719c3e5ee31d108a8eb611ba6d7c225046042d | Circuit | Under-Constrained | Circuit/Unsafe Reuse of Circuit | Completeness | ||||||||||||||
42 | 48 | Prover can lock user funds by supplying non-reduced Y values to G1BigIntToSignFlag (Rotate) | Succinct | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Succinct/2023-02-succinct-securityreview.pdf | Circom | | https://github.com/succinctlabs/telepathy-circuits/commit/b0c839cef30c3c25ef41d1ad3000081784766934#diff-7db11ff1faea3f19f0b35882d9719c3e5ee31d108a8eb611ba6d7c225046042d | Circuit | Under-Constrained | Circuit/Unsafe Reuse of Circuit | Completeness | ||||||||||||||
43 | 49 | Incorrect handling of point doubling can allow signature forgery | Succinct | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Succinct/2023-02-succinct-securityreview.pdf | Circom | | https://github.com/succinctlabs/telepathy-circuits/commit/d5c77710b8c3bf0e91fe81c0ca97ec88cb4c3f81#diff-f3d82d89d6fd63924b2eb1427dd947f9ff49a2c2d19b0fdee4b841a8510ad199 | Circuit | Under-Constrained | Circuit/Unsafe Reuse of Circuit | Soundness | ||||||||||||||
44 | 50 | ArrayXOR is under constrained | Succinct | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/04/VAR-Succinct.pdf | Circom | | https://github.com/succinctlabs/telepathy-circuits/commit/9c84fb0f38531718296d9b611f8bd6107f61a9b8#diff-607de500fc785017151611cff09fc7313b26ac62f29a1a627ecfec4647306c84R226 | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | ||||||||||||||
45 | 51 | Zero Padding for Sha256 in ExpandMessageXMD is vulnerable to an overflow | Succinct | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/04/VAR-Succinct.pdf | Circom | | https://github.com/succinctlabs/telepathy-circuits/commit/9c84fb0f38531718296d9b611f8bd6107f61a9b8#diff-607de500fc785017151611cff09fc7313b26ac62f29a1a627ecfec4647306c84R138 | Circuit | Under-Constrained | Circuit/Arithmetic Field Errors | Soundness | ||||||||||||||
46 | 52 | Underflow is possible during subtraction in Verifier.sol | Term Structure Labs | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Term%20Structure%20Labs/ABDK_TermStructure_TermStructurePartII_v_1_0.pdf | | Solidity | Backend | Unsafe Verifier | Framework/Programming Error | Soundness | |||||||||||||||
47 | 53 | Underflow is possible during subtraction in EvacuVerifier.sol | Term Structure Labs | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Term%20Structure%20Labs/ABDK_TermStructure_TermStructurePartII_v_1_0.pdf | | Solidity | Backend | Unsafe Verifier | Framework/Programming Error | Soundness | |||||||||||||||
48 | 54 | Underconstrained Circuit allows Invalid Comparison | Unirep | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/08/VAR-Unirep.pdf | Circom | | https://github.com/Unirep/Unirep/commit/3348caa362d5d632d29c532ffa88023d55628eab#diff-3ea3a21c0a56b33e02719a3394b589e4e8b183d7705c48830ef86ee419656d55 | Circuit | Under-Constrained | Circuit/Arithmetic Field Errors | Soundness | ||||||||||||||
49 | 55 | Missing Range Checks on Comparison Circuits | Unirep | Audit Report | https://f8t2x8b2.rocketcdn.me/wp-content/uploads/2023/08/VAR-Unirep.pdf | Circom | | https://github.com/Unirep/Unirep/commit/3348caa362d5d632d29c532ffa88023d55628eab#diff-d1bd5150dd2d2884d8328e647bc95262d91066c21f98af65eeff5bac8cd51e72 | Circuit | Under-Constrained | Circuit/Unsafe Reuse of Circuit | Soundness | ||||||||||||||
50 | 57 | CVF-1 This code does nothing. Should enforce constraint | zkLink | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/ZKlink/ABDK_zkLink_CircuitsSmartContracts_v_6_0.pdf | Bellman | | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | |||||||||||||||
51 | 58 | CVF-4 This may overflow if the nonce has been just taken from the updated order, which is not checked for non-overflow. | zkLink | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/ZKlink/ABDK_zkLink_CircuitsSmartContracts_v_6_0.pdf | Bellman | | Circuit | Under-Constrained | Circuit/Arithmetic Field Errors | Soundness | |||||||||||||||
52 | 60 | Previously Correct Ownership Proof Disabled via Code Changes | ZKorpu | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/ZKopru/LeastAuthority_Ethereum_Foundation_Zkopru_zk-SNARK_Circuits_Smart_Contracts_Final_Audit_Report.pdf | Circom | | https://github.com/zkopru-network/zkopru/blob/13942ebd95c4a2da220ad4ea7014707fe57083b6/packages/circuits/lib/ownership_proof.circom#L10 | Circuit | Under-Constrained | Circuit/Other Programming Errors | Soundness | ||||||||||||||
53 | 61 | Circuit Does Not Check the ERC-20 Sum Correctly | ZKorpu | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/ZKopru/LeastAuthority_Ethereum_Foundation_Zkopru_zk-SNARK_Circuits_Smart_Contracts_Final_Audit_Report.pdf | Circom | | https://github.com/zkopru-network/zkopru/commit/30a19913ce1a018ce26a34d3d6621fcd38579171 | Circuit | Under-Constrained | Circuit/Circuit Design Errors | Soundness | ||||||||||||||
54 | 62 | CIRCUIT NOT PROPERLY WORKING WHEN USING SHARD ID > 0 | zkSync Era | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/ZKsync/MatterLabs_zkSync_Era_Circuits_Zero_Knowledge_Security_Audit_Report_Halborn_Final..pdf | Bellman | | Circuit | Computational Error | Circuit/Other Programming Errors | Completeness | |||||||||||||||
55 | 63 | MISSING CONSTRAINT IN PIL LEADING TO PROVING FAKE INCLUSION IN THE SMT | Polygon zkEVM | Audit Report | https://github.com/0xPolygonHermez/zkevm-rom/blob/main/audits/Hexens_Polygon_zkEVM_PUBLIC_27.02.23.pdf | PIL | | https://github.com/0xPolygonHermez/zkevm-proverjs/commit/40d1846b50aa6b9e006a85fde99261a8c5c7b8f2 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
56 | 66 | MISSING CONSTRAINT IN PIL LEADING TO EXECUTION FLOW HIJACK | Polygon zkEVM | Audit Report | https://github.com/0xPolygonHermez/zkevm-rom/blob/main/audits/Hexens_Polygon_zkEVM_PUBLIC_27.02.23.pdf | PIL | | https://github.com/0xPolygonHermez/zkevm-proverjs/commit/9d6a8948636c05d508694a90d192a0713562ce29 | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
57 | 79 | Batch Proof Verification Bypass | gigner | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Zendoo/NCC_Group_ZenBlockchainFoundation_E001741_Report_2021-11-29_v1.2.pdf | | | https://github.com/HorizenOfficial/ginger-lib/pull/112/commits/69acc7b324afae6f16c906ebf3153d6a7a3d1373 | Backend | Unsafe Verifier | Framework/Programming Error | Soundness | ||||||||||||||
58 | 80 | Incorrect Random Polynomial Generation | gigner | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Zendoo/NCC_Group_ZenBlockchainFoundation_E001741_Report_2021-11-29_v1.2.pdf | | | https://github.com/HorizenOfficial/ginger-lib/pull/112/commits/56bed012e24e1c63627b017491ff5431d31a5358 | Backend | Prover Error | Framework/Bad Randmoness | Zero-Knowledge | ||||||||||||||
59 | 84 | Missing overflow check of a nullifier (~ unique ID of a shielded payment) | Semaphore | Bug Tracker | https://github.com/semaphore-protocol/semaphore/issues/16 | | Solidity | https://github.com/semaphore-protocol/semaphore/pull/19/files | Application | Passing Unchecked Data | Application/Missing Validation Input | Soundness | ||||||||||||||
60 | 85 | Missing checks to ensure zk proof inputs are less than SNARK_SCALAR_FIELD | Semaphore | Bug Tracker | https://github.com/semaphore-protocol/semaphore/issues/90 | | Solidity | https://github.com/semaphore-protocol/semaphore/pull/91/files | Application | Passing Unchecked Data | Application/Missing Validation Input | Completeness | ||||||||||||||
61 | 86 | Missing checks to ensure 'zero' is less than SNARK_SCALAR_FIELD | zk-kit | Bug Tracker | https://github.com/privacy-scaling-explorations/zk-kit/issues/23 | | Solidity | https://github.com/privacy-scaling-explorations/zk-kit/pull/24/files | Application | Passing Unchecked Data | Application/Missing Validation Input | Soundness | ||||||||||||||
62 | 87 | Vulnerability if not checking proof security level | Winterfell | Disclosure | https://github.com/facebook/winterfell/issues/160 | | | https://github.com/facebook/winterfell/pull/219 | Backend | Unsafe Verifier | Framework/Programming Error | Soundness | ||||||||||||||
63 | 88 | Missing check that Merkle proofs have the proper length and leaf size | Plonky2 | Bug Tracker | https://github.com/0xPolygonZero/plonky2/pull/709 | | | https://github.com/0xPolygonZero/plonky2/pull/723 | Backend | Unsafe Verifier | Framework/Programming Error | Soundness | ||||||||||||||
64 | 89 | Add missing public input for replica-id | Filecoin | Disclosure | https://trapdoortech.medium.com/filecoin-one-porep-vulnerability-found-by-trapdoor-tech-7fc7beb4557b | Bellperson | | https://github.com/filecoin-project/rust-fil-proofs/pull/1088/files#diff-a4c25bedaaa3099e89770d704ba3bee2cbec87c3fd7e4f5fabbcb1bce7aa9fceL13 | Circuit | Under-Constrained | Circuit/Circuit Design Errors | Soundness | ||||||||||||||
65 | 90 | a16z ZkDrops: Missing Nullifier Range Check | zkDrop | Bug Tracker | https://github.com/a16z/zkdrops/pull/2 | | Solidity | https://github.com/a16z/zkdrops/pull/2 | Application | Passing Unchecked Data | Application/Missing Validation Input | Soundness | ||||||||||||||
66 | 91 | ProcessMessages circuit to prevent message censorship by the coordinator | MACI | Bug Tracker | https://github.com/privacy-scaling-explorations/maci/issues/320 | Circom | | https://github.com/privacy-scaling-explorations/maci/pull/329/files | Circuit | Under-Constrained | Circuit/Circuit Design Errors | Completeness | ||||||||||||||
67 | 92 | MiMC Hash: Assigned but not Constrained | Circomlib | Disclosure | https://tornado-cash.medium.com/tornado-cash-got-hacked-by-us-b1e012a3c9a8 | Circom | | https://github.com/iden3/circomlib/pull/22/files | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | ||||||||||||||
68 | 93 | Arkworks: enforce mul_by_inverse | arkworks | Bug Tracker | https://github.com/arkworks-rs/r1cs-std/pull/70 | | | https://github.com/arkworks-rs/r1cs-std/pull/70 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
69 | 94 | Ensures public inputs are less than the scalar field size | snarkjs | Bug Tracker | https://github.com/semaphore-protocol/semaphore/issues/16 | | | https://github.com/iden3/snarkjs/pull/26/files | Backend | Unsafe Verifier | Framework/Programming Error | Soundness | ||||||||||||||
70 | 95 | Missing overflow check (of a public circuit input) | Oasis | Bug Tracker | https://github.com/eea-oasis/baseline/issues/34 | | Solidity | https://github.com/eea-oasis/baseline/pull/43/files | Backend | Unsafe Verifier | Framework/Programming Error | Soundness | ||||||||||||||
71 | 96 | Constant assignment to check bug | Summa | Bug Tracker | https://github.com/summa-dev/summa-solvency/issues/32 | Halo2 | | https://github.com/summa-dev/summa-solvency/pull/40/files | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | ||||||||||||||
72 | 97 | Dusk Network: Missing Blinding Factors | Dusk | Bug Tracker | https://github.com/dusk-network/plonk/issues/650 | | | https://github.com/dusk-network/plonk/pull/651/files | Backend | Prover Error | Framework/Programming Error | Zero-Knowledge | ||||||||||||||
73 | 98 | Lack of range constraints for the tree_index variable | Aztec | Disclosure | https://hackmd.io/@aztec-network/disclosure-of-recent-vulnerabilities | Aztec-circuits | | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | |||||||||||||||
74 | 99 | Insufficient range checks while emulating non-native field operations | Aztec | Disclosure | https://hackmd.io/@aztec-network/disclosure-of-recent-vulnerabilities | Aztec-circuits | | Circuit | Under-Constrained | Circuit/Arithmetic Field Errors | Soundness | |||||||||||||||
75 | 100 | Aztec Plonk Verifier: 0 Bug | Aztec | Disclosure | https://github.com/cryptosubtlety/00/blob/main/00.pdf | | | Backend | Unsafe Verifier | Framework/Programming Error | Soundness | |||||||||||||||
76 | 101 | Pedersen hash input checks | Aztec | Disclosure | https://medium.com/aztec-protocol/vulnerabilities-found-in-aztec-2-0-9b80c8bf416c | Aztec-circuits | | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | |||||||||||||||
77 | 102 | Merkle root position check | Aztec | Disclosure | https://medium.com/aztec-protocol/vulnerabilities-found-in-aztec-2-0-9b80c8bf416c | Aztec-circuits | | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | |||||||||||||||
78 | 103 | Generating randomness | Aztec | Disclosure | https://medium.com/aztec-protocol/vulnerabilities-found-in-aztec-2-0-9b80c8bf416c | | | Backend | Prover Error | Framework/Bad Randmoness | Zero-Knowledge | |||||||||||||||
79 | 105 | Not checking decrypted note details match insertion to tree | Aztec | Disclosure | https://medium.com/aztec-protocol/vulnerabilities-found-in-aztec-2-0-9b80c8bf416c | | | Application | Passing Unchecked Data | Application/Missing Validation Input | Soundness | |||||||||||||||
80 | 106 | S-LRK-01:[circuits]Soundness failure due to 0 value not enforced | Lurk | Audit Report | https://blog.lurk-lang.org/posts/alpha-audit/inference-security-assessment-3-2023.pdf | Bellperson | | https://github.com/lurk-lab/lurk-rs/pull/168/files | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | ||||||||||||||
81 | 107 | S-LRK-02:[circuits]Soundness failure due toaccumulator 1 initial value not enforced | Lurk | Audit Report | https://blog.lurk-lang.org/posts/alpha-audit/inference-security-assessment-3-2023.pdf | Bellperson | | https://github.com/lurk-lab/lurk-rs/pull/168/files | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | ||||||||||||||
82 | 108 | S-LRK-03:[circuits]Vectors not constrained to be of the same size | Lurk | Audit Report | https://blog.lurk-lang.org/posts/alpha-audit/inference-security-assessment-3-2023.pdf | Bellperson | | https://github.com/lurk-lab/lurk-rs/commit/d2c7c69efec6b36dfcb55a0586c21df88f0a00b6 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
83 | 109 | S-LRK-04:[circuits]Multicase number of defaults not enforced | Lurk | Audit Report | https://blog.lurk-lang.org/posts/alpha-audit/inference-security-assessment-3-2023.pdf | Bellperson | | https://github.com/lurk-lab/lurk-rs/commit/edcda9760a66088db78f64994513fa19d67caa79#diff-7afbe1a682416c0bc156ad4957f239403a3795a4fee30b3a025528c63b094e9b | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
84 | 110 | S-LRK-05:[circuit]Under-constrained outputs in reduce_sym | Lurk | Audit Report | https://blog.lurk-lang.org/posts/alpha-audit/inference-security-assessment-3-2023.pdf | Bellperson | | https://github.com/lurk-lab/lurk-rs/pull/213/commits/7236df555c2cfc7c37d290666d7d5167b3447032 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
85 | 111 | S-LRK-06:[neptune]Zero padding not enforced | Lurk | Audit Report | https://blog.lurk-lang.org/posts/alpha-audit/inference-security-assessment-3-2023.pdf | Bellperson | | https://github.com/lurk-lab/neptune/pull/169/commits/2415d641dcbdab17b3264d2254705a382c86ce73 | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | ||||||||||||||
86 | 114 | ModGadget is underconstrained and allows incorrect MULMOD operations to be proven | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-04-scroll-zkEVM-wave1-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/pull/512/files#diff-069477d3efd1b4fb19640ff1d9dcd4fb3e3c9e5f3adc646e1bfc7ad0f07a0162 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
87 | 115 | The RlpU64Gadget is underconstrained when is_lt_128 is false | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-04-scroll-zkEVM-wave1-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/commit/2a69a55562336a54ce2b1a13748db7cf807c8e2a | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
88 | 116 | The BLOCKHASH opcode is underconstrained and allows the hash of any block to be computed | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-04-scroll-zkEVM-wave1-securityreview.pdf | Halo2 | | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | |||||||||||||||
89 | 117 | Underconstrained warm status on CALL opcodes allows gas cost forgery | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-04-scroll-zkEVM-wave1-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/pull/512/files#diff-e72a6a818cbda6c14cb551573432e59fe61ce109345dd4c088508a60c27979af | Circuit | Under-Constrained | Circuit/Assigned but Unconstrained | Soundness | ||||||||||||||
90 | 118 | The CREATE and CREATE2 opcodes can be called within a static context | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-04-scroll-zkEVM-wave1-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/pull/512/files#diff-66e8458ad6b55447e17de7f715e4395be943d682483be4a945b51f98a4cc50ae | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
91 | 119 | The gas cost for the CALL opcode is underconstrained | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-04-scroll-zkEVM-wave1-securityreview.pdf | Halo2 | | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | |||||||||||||||
92 | 120 | Unconstrained opcodes allow nondeterministic execution | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-04-scroll-zkEVM-wave1-securityreview.pdf | Halo2 | | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | |||||||||||||||
93 | 121 | Nondeterministic execution of ReturnDataCopyGadget and ErrorReturnDataOutOfBoundGadget | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-04-scroll-zkEVM-wave1-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/commit/48172be100d36c89256fd55337997a56ba26d711#diff-514fb5b574f54a3e4f3f53db1bf98c703ede97b64475975b8c18bc1d329f1711 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
94 | 122 | The NonceChanged configuration circuit does not constrain the new value nonce value | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-08-scroll-zkEVM-wave2-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/mpt-circuit/blob/7b56d0b323e92ac11e54213520f6e7db41941cd0/src/gadgets/mpt_update.rs#L1224 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
95 | 123 | The “invalid creation” error handling circuit is unconstrained | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-08-scroll-zkEVM-wave2-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/commit/799450ce1434270c27e98916817935586369d8c8 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
96 | 124 | The OneHot primitive allows more than one value at once | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-08-scroll-zkEVM-wave2-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/mpt-circuit/commit/34af759e94f4b342507778145e7ae364a6d5566e | Circuit | Under-Constrained | Circuit/Missing Input Constraints | Soundness | ||||||||||||||
97 | 125 | Incorrect state transitions can be proven for any chunk by manipulating padding flags | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/2023-09-scroll-zkEVM-wave3-securityreview.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/commit/138b7a3d7381932d02caef4462e47f7990c72b82 | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
98 | 126 | mpt_only being true leads to overconstrained circuits | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/Scroll_zkEVM_-_Audit_Report.pdf | Halo2 | | https://github.com/scroll-tech/poseidon-circuit/commit/912f5ed2c6cacd64a0006e868e3cb4b624acc019 | Circuit | Over-Constrained | Circuit/Other Programming Errors | Completeness | ||||||||||||||
99 | 127 | padding_shift is underconstrained in the bytecode circuit | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/Scroll_zkEVM_-_Audit_Report.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/commit/e8aecb68ccd87759dc4ea46e2cec9649a0803f5b | Circuit | Under-Constrained | Circuit/Wrong translation of logic into constraints | Soundness | ||||||||||||||
100 | 128 | Missing range checks in MulAdd chip | Scroll | Audit Report | https://github.com/nullity00/zk-security-reviews/blob/main/Scroll/Scroll_zkEVM_-_Audit_Report.pdf | Halo2 | | https://github.com/scroll-tech/zkevm-circuits/commit/b20bed27e0a1b1345c125a2975875be555d2dff9#diff-842476c9d0fbe7d993552c2efefeb36950f742c1f930311c9569fe012857b30c | Circuit | Under-Constrained | Circuit/Arithmetic Field Errors | Soundness |