SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

Unverified Verifier Deployment Allows Complete Protocol Compromise

Author Revealed upon completion

Root + Impact

Description

  • The HonkVerifier contract is the core trust anchor of the protocol:

    • It validates ZK proofs generated off-chain

    • Only valid proofs should unlock rewards

    • An invalid verifier breaks the entire security model

    Users assume the deployed verifier exactly matches the audited circuit.

  • The deployment script deploys whatever Verifier.sol exists locally with:

    • No bytecode hash verification

    • No circuit commitment validation

    • No protection against modified or malicious build artifacts

// @> The verifier is implicitly trusted without verification
​
verifier = new HonkVerifier();
hunt = new TreasureHunt(address(verifier));

Risk

Likelihood:

  • Occurs in multi-developer environments

  • Occurs when build artifacts are regenerated

  • Occurs when CI pipelines cache incorrect outputs

  • Occurs via supply-chain compromise

Impact:

  • Fake proofs can drain all ETH

Legitimate proofs can be permanently rejected

  • Trustless ZK security collapses entirely

  • Loss is total and irreversible

Proof of Concept

contract MaliciousVerifier {
function verify(bytes calldata) external pure returns (bool) {
return true;
}
}

Recommended Mitigation

- remove this code
+ add this code
​
+bytes32 expectedCodeHash = 0xabc...;
​
+require(
+ address(verifier).codehash == expectedCodeHash,
+ "UNEXPECTED_VERIFIER_BYTECODE"
+);

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!