gnark vulnerable to unsoundness in variable comparison/non-unique binary decomposition

CVE-2023-44378

What is CVE-2023-44378?

The gnark zk-SNARK library, developed by Consensys, has a vulnerability prior to version 0.9.0 that allows the construction of two valid decompositions for certain small in-circuit values. This occurs due to an overflow condition in the field where the values are calculated, enabling the validation of both the standard decomposition and an alternative for the value 'a+r', challenging the integrity of cryptographic operations. Users are advised to upgrade to version 0.9.0 to resolve this issue without altering existing code that uses the value comparison methods.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References