Why does a missing constraint in my ZK circuit survive five separate audits?
Opportunity
ZK circuits can contain constraints that are syntactically valid but logically incomplete, leaving the witness underconstrained so an attacker can construct a fake proof the verifier accepts. The Zcash Orchard circuit had exactly this bug, disclosed in June 2026 after sitting undetected for four years through multiple professional audits. Existing static analysis tools catch simple cases but cannot prove completeness over a full production circuit. Fuzzing finds individual bugs but generates no soundness guarantee. No workflow in standard use today can tell you, before deployment, that your circuit has no underconstrained witness.
Why it matters
A single missing constraint is enough to let an attacker mint value from nothing, and no standard pre-deployment workflow gives a completeness guarantee over a full production circuit.
How I score the opportunity
The Opportunity Score is my own read, not a measurement: how much it hurts, how often it bites, and how little exists to solve it today. Higher means I think it is more worth building.
How much pain it causes when it shows up.
How often people actually run into it.
How little good tooling exists for it today.
More problems worth solving
Why can't I prove I am solvent without showing my balance?
BlockchainWhy is moving money between chains still scarier than the early internet?
BlockchainWhy does compliance still mean a PDF and a prayer?
BlockchainWhy is self-custody still a choice between losing your keys and trusting a company?
BlockchainWhy does tokenizing a real asset still need ten middlemen?
BlockchainWhy can't a stablecoin pay someone with no internet?