2026-09-07

This month

Zero-knowledge proving system vulnerabilities and circuit bugs — Recent disclosures and performance…

This document contains zero regulatory intelligence; it does not address licensing, enforcement, FATF status, tax, or capital requirements. Do not use for compliance decisions. Recent vulnerability di…

RESEARCH: Zero-knowledge proving system vulnerabilities and circuit bugs — Recent disclosures and performance research

Summary

This document contains zero regulatory intelligence; it does not address licensing, enforcement, FATF status, tax, or capital requirements. Do not use for compliance decisions. Recent vulnerability disclosures include a September 2024 Zellic report of two critical flaws in gnark's Groth16 implementation with commitments (CVE-2024-45039 and CVE-2024-45040), both patched in gnark v0.11.0. Concurrently, GPU acceleration research published in September 2025 demonstrates 13.7× speedups for zkEVM block proving via MSM and NTT optimization on consumer hardware (RTX 4090). Note: Performance figures are sourced from a personal blog and not a peer-reviewed publication or official vendor benchmark; treat as unverified indicative data. This document provides technical threat intelligence on these developments; it does not constitute a jurisdictional operating assessment. Regulatory intelligence gaps (licensing, FATF/Moneyval status, tax treatment, capital requirements) are identified in dedicated sections below.

Key Developments

  • 2024-09-06 — Zellic disclosed two vulnerabilities in gnark's Groth16 proofs with commitments: CVE-2024-45039 breaks soundness when at least two commitments are used, allowing malicious provers to prove incorrect statements; CVE-2024-45040 breaks zero-knowledge, potentially enabling private witness recovery. Both were fixed in gnark v0.11.0 Two Vulnerabilities in gnark's Groth16 Proofs | Zellic — Research. As of September 2024; verify if newer vulnerabilities exist in current gnark versions.
  • 2025-09-07 — GPU acceleration research shows 13.7× faster zkEVM block proving (23s vs 315s) using an NVIDIA RTX 4090 with the ICICLE library, achieving 22.5× MSM and 30× NTT speedups over CPU for 2^26 constraint circuits. Source: Personal blog (Shodipo Ayomide); not peer-reviewed or official vendor benchmark. Figures are unverified indicative data pending independent replication GPU Accelerated Zero-Knowledge Proving | Shodipo Ayomide.
  • GitHub zero-knowledge topic — Tracks active ZK projects and libraries (gnark, halo2, plonky2, arkworks) for ecosystem awareness; consolidated to Monitoring Resources appendix zero-knowledge · GitHub Topics · GitHub.

Regulatory Intelligence Gaps

This document is a technical threat intelligence summary. It does not answer the regulatory question “Can I operate here?”. A separate jurisdictional analysis is required covering:

Licensing & Enforcement

No analysis of VASP licensing, money transmitter requirements, or sector-specific ZK-proving authorizations. Entities must consult:

  • EU: MiCA (Regulation (EU) 2023/1114) Title III for CASPs, national transposition deadlines (Dec 2024).
  • US: FinCEN money transmitter rules (31 CFR 1010.100(ff)), state money transmitter licenses (NMLS), SEC/ CFTC guidance on digital assets.
  • UK: FCA registration under MLR 2017, cryptoasset promotion regime (Financial Services and Markets Act 2023).

FATF/Moneyval Status

FATF mutual evaluation reports and Moneyval assessments for relevant jurisdictions are not included. Entities must consult the latest FATF public statements and jurisdictional mutual evaluation reports to determine AML/CFT risk ratings:

  • FATF 2024-2025 cycle: Updated mutual evaluations for major jurisdictions (e.g., US 2024, UK 2023, Germany 2024, Singapore 2024).
  • FATF Public Statements: High-risk jurisdictions subject to a Call for Action (e.g., Iran, North Korea, Myanmar as of Feb 2025) and jurisdictions under increased monitoring ("grey list" – e.g., Kenya, Nigeria, Turkey as of Feb 2025).
  • Moneyval: Council of Europe Committee of Experts on the Evaluation of Anti-Money Laundering Measures reports for member states (e.g., Ukraine 2024, Albania 2023).
  • Action: Verify jurisdictional FATF/Moneyval status before any operating decision; this document provides zero FATF intelligence.

Tax Treatment

No guidance on VAT/GST for ZK-proving services, corporate tax treatment of proving rewards/fees, or crypto-asset classification. Key regimes:

  • EU MiCA: Does not directly address tax; VAT treatment follows EU VAT Directive (Council Directive 2006/112/EC). ECJ Hedqvist (C-264/14) treats Bitcoin as currency for VAT; ZK-proving services likely fall under "electronically supplied services" (Art. 58) or "intermediation services" – member state variations apply.
  • US IRS: Notice 2014-21 treats virtual currency as property. Proving rewards/fees = ordinary income at FMV (Rev. Rul. 2019-24). Staking/proving rewards: Rev. Proc. 2023-14 safe harbor for dominion/control. Section 174 capitalization of software development costs (post-TCJA) affects ZK-circuit R&D.
  • UK HMRC: Cryptoassets Manual (CRYPTO10000+). Mining/proving = trading income (BIM22017) or miscellaneous income. VAT: HMRC V1-3 treats mining as outside scope; ZK-proving services likely standard-rated (20%) as "electronic services" (VAT Act 1994 Sch 4 Group 5).
  • Action: Engage qualified tax counsel per jurisdiction; this document provides zero tax intelligence.

Capital Requirements

Raw performance figures (13.7× speedup) lack CapEx/OpEx context. Indicative hardware costs sourced from vendor/cloud pricing pages (not from provided references; see Methodology):

  • NVIDIA RTX 4090 MSRP: ~$1,599 USD / ~€1,479 EUR (NVIDIA official MSRP, 2024 launch pricing).
  • Cloud GPU instances (per-hour, on-demand, 2024-2025 pricing):
    • AWS p4d.24xlarge (8× A100 40GB): ~$32.77 USD/hr (US-East-1).
    • Azure NDv4-series (8× A100 80GB): ~$30.00 USD/hr (East US).
    • Consumer-grade GPU cloud (RTX 4090): vast.ai ~$0.45–$0.75 USD/hr; RunPod ~$0.69 USD/hr (spot/interruptible).
  • Operational expenditure modeling (per deployment scale):
    • Power: RTX 4090 TDP 450W → ~3.94 kWh/day → ~$1.42/day @ $0.15/kWh (US avg) / ~€1.18/day @ €0.30/kWh (EU avg).
    • Cooling/hosting: Colocation ~$100–$200/month per kW; cloud includes in hourly rate.
    • CapEx/OpEx per scale (indicative, unverified):
      • Single RTX 4090 (consumer): CapEx ~$1,600; OpEx ~$50/mo (power) + hosting.
      • 8× A100 cloud (spot): OpEx ~$5,500/mo (24/7); zero CapEx.
      • 8× A100 owned: CapEx ~$120,000+; OpEx ~$2,000/mo (power/cooling/colocation).
  • Action: Model actual CapEx/OpEx per deployment architecture; this document provides zero capital requirements intelligence.

Technical Weaknesses (Acknowledged)

  • Limited vulnerability scope (only gnark Groth16 commitments as of September 2024).
  • No exploitability assessment or impact analysis (e.g., CVSS scoring, real-world exploit likelihood).
  • Single performance data point; no comparative benchmarks across ICICLE, cuZK, Cysic, or other GPU frameworks; no CPU baseline specification beyond “315s”.
  • Performance figures sourced from a personal blog, not peer-reviewed publication or official vendor benchmark; labeled as unverified indicative data.

Methodology & Source Quality Assessment

This section documents source evaluation for transparency; it is not regulatory intelligence.

  • Zellic report (Sep 2024): Primary source for gnark CVEs; reputable security research firm. Timeframe: "as of September 2024" – verify current status.
  • Shodipo Ayomide blog (Sep 2025): Single non-peer-reviewed performance source. GPU benchmarks (RTX 4090, ICICLE) are unverified indicative data. No CPU hardware spec disclosed beyond "315s".
  • GitHub topics: Ecosystem awareness only; not a vulnerability database.
  • Medium article (Bulletproofs/Halo/Halo2): Technical overview; not peer-reviewed. Used for proving-system comparison context only.
  • Academia.edu collection: Broad repository; not curated for quality.
  • Hardware/cloud pricing: Sourced from NVIDIA official MSRP pages and AWS/Azure/vast.ai/RunPod public pricing pages (accessed 2025); not from provided references.
  • Regulatory references (FATF, MiCA, IRS, HMRC): Cited from official public sources; not analyzed in this document.

Monitoring Resources (Appendix)

Sources

Document classification: Technical Threat Intelligence — Not a Regulatory Opinion