Vulnerability Report: GO-2023-2119

  • GHSA-7p92-x423-vwj6
  • Affects: github.com/consensys/gnark
  • Published: Oct 24, 2023
  • Modified: May 20, 2024

A a third party may derive a valid proof from a valid initial tuple {proof, public_inputs}, corresponding to the same public inputs as the initial proof. This vulnerability is due to randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of freedom in the transcript. Note that the impact is limited to the PlonK verifier smart contract.

For detailed information about this vulnerability, visit https://github.com/Consensys/gnark/security/advisories/GHSA-7p92-x423-vwj6.

Affected Packages

Aliases

References

Feedback

See anything missing or incorrect? Suggest an edit to this report.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.