Document use of params for sound proof generation, with counter-examples.

AztecProtocol / dev-rel

All of Aztec's workshops, resources, tutorials, ideas, and useful tools

46 stars 19 forks source link

Document use of params for sound proof generation, with counter-examples. #375

Open jzaki opened 2 months ago

jzaki commented 2 months ago

In hackathons there are often submissions that generate proofs, but can be misused to either prove different things or not uniquely prove what their solution proposes. Allowing a bad actor to either affect other users, or just advantage themselves.

critesjosh commented 1 month ago

It would be good to list specific examples anti-patterns, perhaps with links to projects.

Some that come to mind:

passing proofs on chain that don't have replay protection
voting applications that don't protect against replay attacks
user supplied public inputs that are not checked or enforced. Eg a user can provide false inputs. Should be passed by a contract where possible