SNARKeling Treasure Hunt

Description

The Noir circuit defines ALLOWED_TREASURE_HASHES as an array of 10 elements, but the final two entries are identical. As a result, the circuit contains only 9 unique allowed treasure hashes.

This weakens the clarity of the intended treasure inventory and creates ambiguity between “10 slots” and “10 unique treasures.”

Risk

This issue does not by itself demonstrate a direct exploit, but it creates correctness and maintenance risk:

• reviewers may incorrectly assume there are 10 unique treasure hashes

• operators may misunderstand the actual treasure inventory

• future changes become riskier because the source does not clearly express the intended unique set

Proof of Concept

The duplicated entries are visible directly in the circuit:

Because is_allowed() only checks whether a hash appears anywhere in the list, the duplicate final entry does not add a new claimable treasure. It only repeats an already-allowed value.

Recommended Mitigation

Replace the duplicate entry with the intended unique treasure hash and regenerate any dependent artifacts.