Root + Impact

Description

The ALLOWED_TREASURE_HASHES array in circuits/src/main.nr lines 55-66
is supposed to contain 10 UNIQUE treasure hashes, but index 8 and index 9
are identical:

Confirmed in test file circuits/src/tests.nr line 30:

Treasures[8] and Treasures[9] have identical secret values, meaning
the circuit only has 9 unique treasures despite being designed for 10.

Risk

Likelihood:

• This is a deployment-time configuration error, present from launch

• Any participant can generate a valid proof for the duplicate secret

Impact:

• Only 9 unique treasures exist in the circuit instead of 10

• 100 ETH is allocated for 10 treasures but only 9 unique ones exist

• One treasure secret can be used to claim twice, breaking hunt fairness

• Hunt integrity is compromised — participants cannot trust the design

Proof of Concept

The duplicate is confirmed in two separate files:

• ALLOWED_TREASURE_HASHES[8] and ALLOWED_TREASURE_HASHES[9] in main.nr are byte-for-byte identical

• treasures[8] = 10 and treasures[9] = 10 in tests.nr confirm both use the same secret value

Both point to the same secret, creating only 9 unique treasures instead of 10.

Recommended Mitigation

A new unique 10th treasure secret must be generated and the duplicate
replaced. The circuit must then be recompiled to update the verifier.

1. Generate a new unique 10th treasure secret

2. Compute its Pedersen hash

3. Replace duplicate at line 65: ALLOWED_TREASURE_HASHES[9] = NEW_UNIQUE_HASH

4. Recompile: ./circuits/scripts/build.sh

5. Regenerate Verifier.sol

6. Verify all 10 hashes are now unique