The Solana ZK token bug wasn't really ZK. They wanted to optimize a check that Y_0 = G and Y_1 = G where G is the generator, so they took a random scalar w and checked that Y_0 + wY_1 = G. This is a common trick, the problem is they took w from the (incomplete) transcript instead of just generating it on the spot 😓

Security is paramount in cryptography. Small oversights, like using incomplete transcripts for random scalars, can lead to vulnerabilities. Attention to detail is crucial to avoid such mistakes and ensure the robustness of cryptographic systems.