---
title: "GHSA-7p92-x423-vwj6: Plonk verifier KZG multi point verification"
url: https://erroneo.us/security/ghsa/GHSA-7p92-x423-vwj6/
description: "GHSA-7p92-x423-vwj6 (critical, Go): Plonk verifier KZG multi point verification. Impact The vulnerability allows a third party to derive a valid proof from…"
type: advisory
section: "Security Digest"
date_published: 2023-10-17
date_modified: 2024-01-26
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-7p92-x423-vwj6"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-7p92-x423-vwj6: Plonk verifier KZG multi point verification

## Affected packages

- Go `github.com/consensys/gnark` < 0.9.1 → fixed: 0.9.1

## Details

Impact The vulnerability allows a third party to derive a valid proof from a valid initial tuple {proof, publicinputs}, corresponding to the same public inputs as the initial proof. It is due to a randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of freedom in the transcript. Note that the impact is limited to the PlonK verifier smart contract. Patches We still use a hash function on some data to have a pseudo rng, but instead of hashing the first 32 bytes of the state ( let random := mod(keccak256(state, 0x20), rmod) ) we hash the whole state at this point of the verifier as if it was a Fiat Shamir transcript: Workarounds In the function batchverifymultipoints, the variable random (corresponding to u in the paper, step 12 of the plonk verification process) should depend on statefoldeddigestsx, statefoldeddigestsy, proofgrandproductcommitmentx, proofgrandproductcommitmenty and statezeta (by hashing those values for instance).

## Sources

- [GitHub Advisory GHSA-7p92-x423-vwj6](https://github.com/advisories/GHSA-7p92-x423-vwj6)
- [github.com](https://github.com/Consensys/gnark/security/advisories/GHSA-7p92-x423-vwj6)
- [github.com](https://github.com/Consensys/gnark/commit/3421eaa7d544286abf3de8c46282b8d4da6d5da0)

---
Source page: https://erroneo.us/security/ghsa/GHSA-7p92-x423-vwj6/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt