Post #3213621
2026-06-05 07:47 UTC
Taylor Hornby, paired with Opus 4.8, found a money minting bug in the Zero Knowledge Proof circuit of Zcash.
An element of the Orchard circuit was under-constrained element therefore it was possible to put arbitrary false inputs into an elliptic curve multiplication and still have the multiplication check pass.
Shielded Labs is initiating a project to formally verify the Orchard circuit.
https://shieldedlabs.net/the-orchard-counterfeiting-vulnerability/
Replies (2)
-
@fj@mastodon.social 2026-06-05 07:48
Between this and the Google Quantum Circuit ZKP bug/forgeries, I think it should become standard practice to formally verify zero-knowledge proof circuits. Otherwise, we really have zero-knowledge about what's being proven.
-
@ligasser@social.epfl.ch 2026-06-05 08:31
@fj@mastodon.social Ouch - we're currently using "noir" to create ZKPs for the Swiss e-ID. I wonder what can go wrong in there?