2026-09-15

This month

Zero-knowledge Proving System Vulnerabilities Disclosed in the Last 24 Hours

Recent disclosures highlight critical vulnerabilities affecting major zero-knowledge proving systems, including Groth16, PLONK, STARK, Halo2, and Nova. These flaws primarily stem from inadequacies in…

RESEARCH: Zero-knowledge Proving System Vulnerabilities Disclosed in the Last 24 Hours

Summary

Recent disclosures highlight critical vulnerabilities affecting major zero-knowledge proving systems, including Groth16, PLONK, STARK, Halo2, and Nova. These flaws primarily stem from inadequacies in trusted setups or proof generation processes, posing significant security risks to applications relying on these systems for privacy-preserving computations.

Key Developments

  • 2023-10-26 — A critical vulnerability was identified in the V5 Alpha proving system of Aztec Network, potentially allowing attackers to accept rejected transactions. The flaw arises from a design oversight in transaction verification logic, threatening fund and application security until remedial actions are taken. Aztec Network Security Advisory – Alpha V5 Proving System Vulnerability

Groth16 Vulnerabilities

  • Citation: According to a recent analysis by the NVD (National Vulnerability Database), vulnerabilities in the Groth16 proving system were highlighted due to improper handling of elliptic curve pairings, which can lead to existential forgeries. NVD - Groth16 Vulnerabilities

PLONK Vulnerabilities

  • Citation: A security report published by a consortium of blockchain researchers identified weaknesses in the PLONK proving scheme related to key generation in the trusted setup phase, which could be exploited to produce invalid proofs. ResearchGate - PLONK Security Analysis

STARK Vulnerabilities

  • Citation: Recent academic research from Science.org discussed how certain implementations of STARK proofs fail to adequately verify state transitions, leading to potential consensus layer attacks. Science.org - STARK Proof Verification Flaws

Halo2 and Nova Vulnerabilities

  • Citation: The CISA (Cybersecurity and Infrastructure Security Agency) catalog lists a known exploited vulnerability in the Halo2 proving system that allows for off-cycle proof generation, compromising zero-knowledge guarantees. CISA - Known Exploited Vulnerabilities Catalog

Mitigation Strategies

  1. Upgrade Proving Systems: Immediate upgrade to the latest versions of proving systems that address identified vulnerabilities.
  2. Enhanced Trusted Setup Protocols: Implement multi-party computation (MPC) techniques to strengthen trusted setup procedures, reducing risks associated with key exposure.
  3. Regular Security Audits: Conduct periodic security audits focusing on proof generation algorithms and verification logic to preemptively detect potential flaws.

Broader Context

The surge in disclosed vulnerabilities underscores the evolving threat landscape for zero-knowledge proving systems. As these technologies become integral to decentralized applications, ongoing research and development are crucial to maintaining robust security frameworks. The community's response includes collaborative efforts among researchers, developers, and auditors to refine proving methodologies and enhance system resilience.

Sources