Repository navigation
Conversation
…checks Switch the Groth16 proving-key deserialization from UnsafeReadFrom to the safe ReadFrom so the prover enforces the same subgroup membership checks as the verifier, closing security report M-02. Fixes binance#113
naoifelcnc
reviewed
Aug 28, 2026
| buf = bytes.NewBuffer(pkFromFile) | ||
| p.ProvingKey = groth16.NewProvingKey(ecc.BN254) | ||
| n, err = p.ProvingKey.UnsafeReadFrom(buf) | ||
| // Use the safe ReadFrom (which performs subgroup membership checks) to be |
There was a problem hiding this comment.
Level Hash
5,0 b10b869daf4bf055
5,1 64b3993941c4989c
5,2 8044c03e6febd79f
5,3 2d0b235fe7f455ea
5,4 a344071991f8e304
5,5 6dfb1a56a4babe6f
5,6 cc609edbd5a1105f
5,7 d58230484586facd
5,8 1b749d2a915193f8
5,9 535f8cb5e74f6c5e
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The prover loaded its Groth16 proving key with
UnsafeReadFrom, which skips elliptic-curve subgroup membership checks on the deserialized G1/G2 points. The verifier, however, loads the verifying key with the safeReadFrom(which performs the checks). This inconsistency means a tampered or corrupted.pkfile (e.g. via a supply-chain or storage-compromise attack) could be loaded by the prover and used to generate proofs that still verify against an honest verifier — the exact gap described in security report M-02.Root cause
src/prover/prover/prover.go:343usedp.ProvingKey.UnsafeReadFrom(buf)while the R1CS (ReadFrom) and verifying key (ReadFrom) already used the safe variant.Fix
Switch the proving-key load to the safe
ReadFromso prover and verifier enforce the same safety level:This makes the prover reject malformed/tampered proving keys, closing the inconsistency reported in #113.
Verification
go build ./...insrc/proverpasses.Fixes #113