Content
@
0 reply
0 recast
0 reaction
Julie B.
@bbjubjub.eth
The Solana ZK token bug wasn't really ZK. They wanted to optimize a check that Y_0 = G and Y_1 = G where G is the generator, so they took a random scalar w and checked that Y_0 + wY_1 = G. This is a common trick, the problem is they took w from the (incomplete) transcript instead of just generating it on the spot đ
3 replies
0 recast
14 reactions
Julie B.
@bbjubjub.eth
erratum I should have said the point at infinity aka G times zero instead of G
1 reply
0 recast
1 reaction
Julie B.
@bbjubjub.eth
erratum checking Y_1 = 0 would be trivial. These are the actual equations they are combining by multiplying with 1, w and w²
1 reply
0 recast
0 reaction
