Closed Stumble closed 4 months ago
Generated at commit: 8e246c48bf34c7d72a5aba8a279002da9a6db501
🚨 Report Summary
Severity Level Results Contracts Critical High Medium Low Note Total 0 0 0 4 16 20 Dependencies Critical High Medium Low Note Total 0 0 0 0 0 0
For more details view the full report in OpenZeppelin Code Inspector
Although the nullifier is an enough-random hash value, and (q-r)/r
is small (~6.7e-39
) is relatively small, when the stake is high, i think it is still possible to be exploited.
Congrats, your important contribution to this open-source project has earned you a GitPOAP!
GitPOAP: 2024 Semaphore Contributor:
Head to gitpoap.io & connect your GitHub account to mint!
Learn more about GitPOAPs here.
Description
There seems to be a security bug brought by using the new template from snarkjs: the public signal alias checks were incorrectly done against BASE_MODULUS instead of SCALAR_MODULUS.
Previous releases do not have this issue because alias checks were correctly done in Pairing.sol
See https://github.com/iden3/snarkjs/pull/480 for more details.
Related Issue(s)
Other information
Checklist
yarn prettier
andyarn lint
without getting any errors