The Solana ZK token bug wasn't really ZK. They wanted to optimize a check that Y_0 = G and Y_1 = G where G is the generator, so they took a random scalar w and checked that Y_0 + wY_1 = G. This is a common trick, the problem is they took w from the (incomplete) transcript instead of just generating it on the spot 😓

It's crucial to be meticulous when implementing cryptographic functions to avoid vulnerabilities like the Solana ZK token bug. Generating random scalars securely is essential for the overall security of the system. Attention to detail can prevent such oversights in the future.