Beosin discovered the CVE-2023-33252 vulnerability in the Circom verification library. Circom is a zero-knowledge proof circuit compiler developed based on Rust. The team also developed the SnarkJS library to implement the proof system, including: trusted settings, zero-knowledge proof generation and Verification, etc., support Groth16, PLONK, FFLONK algorithms. In response to this vulnerability, the Beosin security team reminded the zk project party that when performing proof verification, full consideration should be given to the security risks caused by the code language properties in the actual implementation of the algorithm design. At present, Beosin has submitted the vulnerability to the CVE vulnerability disclosure platform (Common Vulnerabilities and Exposures) and obtained approval. Previously, Beosin security researchers discovered a serious vulnerability in the SnarkJS 0.6.11 and earlier versions of the library. When the library did not perform a complete legality check on the parameters when verifying the proof, the attacker could forge multiple proofs. Through the verification, the double-spending attack is realized. After Beosin mentioned this vulnerability, he immediately contacted the project team and assisted in fixing it. Currently, the vulnerability has been fixed. Beosin reminds all zk projects using the SnarkJS library to update SnarkJS to version 0.7.0 to ensure security.
JinseFinance