Security Digest · Critical advisory (no CVE assigned)
GHSA-7p92-x423-vwj6: Plonk verifier KZG multi point verification
Impact The vulnerability allows a third party to derive a valid proof from a valid initial tuple {proof, publicinputs}, corresponding to the same public inputs as the initial proof.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/consensys/gnark | < 0.9.1 | 0.9.1 |
Details
Impact
The vulnerability allows a third party to derive a valid proof from a valid initial tuple {proof, publicinputs}, corresponding to the same public inputs as the initial proof. It is due to a randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of freedom in the transcript.
Note that the impact is limited to the PlonK verifier smart contract.
Patches
We still use a hash function on some data to have a pseudo rng, but instead of hashing the first 32 bytes of the state ( let random := mod(keccak256(state, 0x20), rmod) )
we hash the whole state at this point of the verifier as if it was a Fiat Shamir transcript:
Workarounds
In the function batchverifymultipoints, the variable random (corresponding to u in the paper, step 12 of the plonk verification process) should depend on statefoldeddigestsx, statefoldeddigestsy, proofgrandproductcommitmentx, proofgrandproductcommitmenty and statezeta (by hashing those values for instance).
Sources and references
- GitHub Advisory GHSA-7p92-x423-vwj6 github.com
- github.com github.com
- github.com github.com