GHSA-x26x-7f4v-cqx7: SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multiscalarmultiplication places a Value::Assigned() base paired with Value::Constant(ONE) into its unscaled variable-base list and passes it directly to sumwithconst. The default shim delegates to halo2-lib EccChip::sum, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as (0, 0) can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SNARK Verifierto a version that resolves this vulnerability.Fixed in 0.2.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using SNARK Verifier versions earlier than 0.2.5 that use the Halo 2 aggregation circuit may be exposed. Exposure specifically depends on whether prover-controlled proof points can reach the aggregation path and on the surrounding aggregation and final-decider checks.
What does an attacker need to supply?
An attacker needs to provide a proof containing a point encoded as the point at infinity, represented as `(0, 0)`. The affected path is reached when that point is handled through the scalar-one shortcut in multi-scalar multiplication.
Is an invalid proof known to be accepted in every affected deployment?
No. The advisory states that practical exploitability depends on the surrounding aggregation and final-decider checks and does not establish universal acceptance of invalid proofs.
What is the available remediation?
Upgrade SNARK Verifier to version 0.2.5, which fixes this issue.