6
$\begingroup$

Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs without having a prior commitment. Tornado Cash, using Groth16 was the most well‑known affected case : the protocol had to be safely exploited in order to avoid loss of funds.

On the blog post, there were :

Later, we will release a step by step guide on how to use this exploit to educate interested security professionals.

4 years later, such blog post still don’t exist. And with the ofac sanctions resulting in contributing to any code related to the project banned to ᴜꜱ citizens or peoples living in the ᴜꜱ, is unlikely to ever exists.

Neverless, instead of potential step by step Zokrates commands on the alt_bn128 curve, would it be possible to have this question containing the detailed required computations in mathematical notation to generate proofs along nullifiers that verify a root despite not having prior commitments to the root ?

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ Crypto-SE is more about theory than implementation of crypto; not much about mistakes in implementations, even less about exploiting them, and we could not care less about the consequences for a cryptocurrency. Combined with the highly technical nature of the subject, and the lack of a reference description of what the mistake exactly does, this is enough to explain the current lack of answer so far. I'm confident whatever "ofac sanctions" may be, they have played no role. From my perspective, web3 is going just great… $\endgroup$
    – fgrieu ♦
    Jan 1 at 18:32
  • 1
    $\begingroup$ @fgrieu Neverless, instead of potential step by step Zokrates commands, would it be possible to have this question containing the detailed required computations to generate proofs along nullifiers that verify a root despite not having prior commitments to the root ? This means in mathematical notation of course. $\endgroup$
    – user2284570
    Jan 2 at 0:01
  • $\begingroup$ @fgrieu the persons who found the bug and are still free were told by there lawyers to not say anything about it. So I suppose they are other cases like this were this doesn t help. $\endgroup$
    – user2284570
    Jan 2 at 0:16

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.