Root + Impact

Description

• The circuit defines 10 allowed treasure hashes baked into ALLOWED_TREASURE_HASHES, matching MAX_TREASURES = 10 in the contract. However, indices 8 and 9 contain identical values. Since each treasure hash corresponds to a unique physical secret, only 9 distinct secrets exist. The 10th reward slot can never be claimed by a unique finder — it is a duplicate of treasure 8.

Risk

Likelihood:

• Hardcoded in the circuit — present from deployment, affects every hunt instance

• Trivially verifiable by inspection

Impact:

• Only 9 unique physical treasures exist despite the contract promising 10 rewards

• The finder of treasure 8 can claim twice using the same secret (same hash, same proof)

• One 10 ETH reward slot is either permanently unclaimable or double-claimable by a single finder

• Participants are misled — MAX_TREASURES = 10 and getRemainingTreasures() both suggest 10 prizes

Proof of Concept

No on-chain PoC needed — the duplicate is directly visible by comparing ALLOWED_TREASURE_HASHES[8] and ALLOWED_TREASURE_HASHES[9] in circuits/src/main.nr:

Recommended Mitigation