The Solana ZK token bug wasn't really ZK. They wanted to optimize a check that Y_0 = G and Y_1 = G where G is the generator, so they took a random scalar w and checked that Y_0 + wY_1 = G. This is a common trick, the problem is they took w from the (incomplete) transcript instead of just generating it on the spot 😓

I know I'm one of the few people who know this and aren't under embargo so you bet I'm going to clout farm as much as humanly possible 😜

Auditoooor at ChainSecurity
—
Engineer at Randa.mu
—
EPFL Cybersec MSc.
—
CTF player w/ 0rganizers
—
Hacker & Cypherpunk
—
🌸

A doodler and computerer. I like permissive/permissionless open source, smart contracts, p2p systems, room-scale VR, and NixOS.

shazow.net

Currently: WhatsABI

The bug is in a native program (what we call a precompile) and affected both implementations

Wild.

Do you have any insight on why this had to be a consensus-breaking feature rather than a userland contract that could be battletested before being enshrined?

On paper at least. I wanted to talk with a guy from AR last friday and he answered that he couldn't comment. The patches are public though