Ola Discovers Vulnerability in Privacy Network Aleo Record Validation, Vulnerability Has Been Fixed

Payne, a developer of the Ola team, a programmable privacy and scaling solution, tweeted that he found a logic vulnerability in Aleo and received a bug bounty from Aleo. When Payne studied Aleo's code, he found that there was a logical error in the validity check of the Record spent by the user. When the spent Record is generated during the execution of the previous contract of the same transaction, the commitment of the Record should be used to construct the leaf node of the transition tree, but Aleo uses the serial number of the Record to construct the leaf node, which will cause the transaction to be In-circuit verification failed. After communication and confirmation, the Aleo team has fixed this vulnerability. Ola is a two-layer high-performance ZK-ZKVM project incubated by Sin7y Labs, which focuses on programmable privacy, programmable expansion and multi-language compatibility. Ola is expected to launch an internal testnet in the third quarter of 2023 and a public testnet by the end of the year.