Why does a missing constraint in my ZK circuit survive five separate audits?
机会
ZK circuits can contain constraints that are syntactically valid but logically incomplete, leaving the witness underconstrained so an attacker can construct a fake proof the verifier accepts. The Zcash Orchard circuit had exactly this bug, disclosed in June 2026 after sitting undetected for four years through multiple professional audits. Existing static analysis tools catch simple cases but cannot prove completeness over a full production circuit. Fuzzing finds individual bugs but generates no soundness guarantee. No workflow in standard use today can tell you, before deployment, that your circuit has no underconstrained witness.
为什么重要
A single missing constraint is enough to let an attacker mint value from nothing, and no standard pre-deployment workflow gives a completeness guarantee over a full production circuit.
我如何评估机会
机会评分是我的个人判断，而非量化指标：痛苦程度、发生频率，以及当前解决方案的匮乏程度。分数越高，意味着我认为越值得去构建。
出现时造成的痛苦程度。
人们实际遇到它的频率。
当前针对它的优质工具有多匮乏。