Circuit Layer Vulnerabilities Pose the Most Significant Threat to SNARK-Based Systems, Researchers Find

According to researchers at Imperial College London, vulnerabilities at the circuit layer pose the most significant threat to systems based on Succinct Non-Interactive Arguments of Knowledge, or SNARKs.

Researchers at Imperial College London have found that vulnerabilities at the circuit layer pose the most significant threat to systems based on Succinct Non-Interactive Arguments of Knowledge (SNARKs).

The investigation examined 141 vulnerabilities from 107 audit reports, 16 vulnerability disclosures, and various bug trackers associated with popular SNARK projects. The findings were presented on Aug. 7 at the Science of Blockchain Conference at Columbia University.

SNARKs are a type of zero-knowledge (ZK) proof that allows one to demonstrate that a statement is true without revealing any information about the statement. They are used extensively in Web3 to compress large computations and enable efficient on-chain verification.

However, the complexity and abstraction of ZK circuits can introduce vulnerabilities that might go unnoticed during the development and auditing processes.

To identify and categorize these vulnerabilities, the research team, led by Stefanos Chaliasos, a Ph.D. candidate at Imperial College London, proposed a vulnerability taxonomy and applied it to the analysis of vulnerabilities in circuit layers of several SNARK systems.

The team identified three main types of vulnerabilities in circuit layers: under-constrained, over-constrained and computational/hints error. The most frequent vulnerability found on zero knowledge circuits arises from insufficient constraints, which cause a verifier to accept invalid proofs, thus compromising a system’s soundness or completeness.

According to the research, 95 of the identified issues on SNARK-based systems affected soundness and four affected completeness. For instance, an attacker could exploit an insufficient input constraint to forge a valid proof for an invalid statement or to create a valid proof for a different statement than the one being proven.

“The primary challenge for developers lies in adapting to a different level of abstraction and optimizing circuits for efficiency, which directly impacts the cost of using SNARKs,” the paper notes.

Other root causes for vulnerabilities on ZK circuits include distinguishing between assignments and constraints, missing input constraints and unsafe reuse of circuits, among others.

The research team also highlighted the importance of clear documentation and tooling to help developers identify and fix vulnerabilities early on in the development process.

“The goal is to integrate these findings into a vulnerability scanner that will automatically identify and classify vulnerabilities in ZK circuits,” Chaliasos told Blockworks.

Weighted VRFsThe first day of the conference also featured the Aptos team presenting their recently implemented weighted verifiable random functions, or weighted VRFs — a mechanism designed to enhance the randomness in the consensus process.

The approach extends the concept of VRFs by incorporating weights into the random selection process of verifying inputs and outputs on-chain. With weights, participants in the consensus mechanism have different probabilities of being chosen based on their stake (weights).

Aptos deployed the mechanism on its mainnet in June. “As far as you can tell, this is the first time you see a previously granular script that is unbiaseable, unpredictable, and operates as fast as the network,” said Alin Tomescu, head of cryptography at Aptos, during the presentation.

According to Tomescu, Aptos has processed half a million calls through the new randomness API, with the distributed key generation (DKG) lasting about 20 seconds.