Skip to content

Abort extracting vk when there are no phase 2 contributions #620

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
StefanosChaliasos wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Abort extracting vk when there are no phase 2 contributions #620

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
14daebb
Abort extracting vk when there are no phase 2 contributions
StefanosChaliasos Feb 26, 2026
cd20312
Apply suggestion from @Copilot
OBrezhniev Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/groth16_verify.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,11 @@ export default async function groth16Verify(_vk_verifier, _publicSignals, _proof
const vk_alpha_1 = curve.G1.fromObject(vk_verifier.vk_alpha_1);
const vk_beta_2 = curve.G2.fromObject(vk_verifier.vk_beta_2);

if (curve.G2.eq(vk_gamma_2, vk_delta_2)) {
if (logger) logger.error("SOUNDNESS ERROR: vk_gamma_2 and vk_delta_2 are equal. This verification key is insecure, the zkey likely has no phase 2 contribution. Proofs can be forged. Aborting verification.");
return false;
}
Comment on lines +72 to +75
Copy link

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New behavior returns false when vk_gamma_2 equals vk_delta_2, but there doesn’t appear to be a test exercising this soundness guard. Adding a unit/integration test that verifies groth16.verify rejects an insecure verification key (e.g., by crafting a VK with vk_delta_2 copied from vk_gamma_2, or by exporting from an un-contributed zkey if that produces equality) would prevent regressions.

Copilot uses AI. Check for mistakes.

const res = await curve.pairingEq(
curve.G1.neg(pi_a) , pi_b,
cpub , vk_gamma_2,
Expand Down
8 changes: 8 additions & 0 deletions src/zkey_export_solidityverifier.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,14 @@ export default async function exportSolidityVerifier(zKeyName, templates, logger

const verificationKey = await exportVerificationKey(zKeyName, logger);

if (verificationKey.protocol === "groth16") {
const vkGamma2 = JSON.stringify(verificationKey.vk_gamma_2);
const vkDelta2 = JSON.stringify(verificationKey.vk_delta_2);
if (vkGamma2 === vkDelta2) {
throw new Error("SOUNDNESS ERROR: vk_gamma_2 and vk_delta_2 are equal. This zkey is insecure, it likely has no phase 2 contribution. Proofs can be forged. Run 'snarkjs zkey contribute' before exporting.");
}
}

Comment thread
OBrezhniev marked this conversation as resolved.
Outdated
if ("fflonk" === verificationKey.protocol) {
return fflonkExportSolidityVerifierCmd(verificationKey, templates, logger);
}
Expand Down
4 changes: 4 additions & 0 deletions src/zkey_export_verificationkey.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,10 @@ async function groth16Vk(zkey, fd, sections) {
const curve = await getCurve(zkey.q);
const sG1 = curve.G1.F.n8 * 2;

if (curve.G2.eq(zkey.vk_gamma_2, zkey.vk_delta_2)) {
throw new Error("SOUNDNESS ERROR: vk_gamma_2 and vk_delta_2 are equal. This zkey is insecure, it likely has no phase 2 contribution. Proofs can be forged. Run 'snarkjs zkey contribute' before exporting.");
}
Comment on lines +59 to +61
Copy link

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Throwing here will skip the fd.close() in zkeyExportVerificationKey (it’s only reached on the success path), which can leak the underlying file handle when exporting a Groth16 VK from an insecure zkey. Consider wrapping the readBinFile/protocol switch in a try/finally so the descriptor is always closed, even when groth16Vk throws.

Copilot uses AI. Check for mistakes.

const alphaBeta = await curve.pairing(zkey.vk_alpha_1, zkey.vk_beta_2);

let vKey = {
Expand Down
Loading