Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs without having a prior commitment. Tornado Cash, using Groth16 was the most well‑known affected case : the protocol had to be safely exploited in order to avoid loss of funds.

On the blog post, there were :

Later, we will release a step by step guide on how to use this exploit to educate interested security professionals.

4 years later, such blog post still don’t exist. And with the ofac sanctions resulting in contributing to any code related to the project banned to ᴜꜱ citizens or peoples living in the ᴜꜱ, is unlikely to ever exists.

Neverless, instead of potential step by step Zokrates commands on the alt_bn128 curve, would it be possible at least to have this question containing the detailed required computations in mathematical notation to fake the witness despite not having prior commitments to the root ?

  • 2
    $\begingroup$ Crypto-SE is more about theory than implementation of crypto; not much about mistakes in implementations, even less about exploiting them, and we could not care less about the consequences for a cryptocurrency. Combined with the highly technical nature of the subject, and the lack of a reference description of what the mistake exactly does, this is enough to explain the current lack of answer so far. I'm confident whatever "ofac sanctions" may be, they have played no role. From my perspective, web3 is going just great $\endgroup$
    – fgrieu
    Jan 1, 2023 at 18:32
  • 1
    $\begingroup$ @fgrieu Neverless, instead of potential step by step Zokrates commands, would it be possible to have this question containing the detailed required computations to generate proofs along nullifiers that verify a root despite not having prior commitments to the root ? This means in mathematical notation of course. $\endgroup$ Jan 2, 2023 at 0:01
  • $\begingroup$ @fgrieu the persons who found the bug and are still free were told by there lawyers to not say anything about it. So I suppose they are other cases like this were this doesn t help. $\endgroup$ Jan 2, 2023 at 0:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.