When debugging a ZKP verifier, make sure to keep checking not just that the proof verifies on valid inputs, but also that the proof verification returns an error on invalid inputs (or with nonsensical tweaks to the verification mechanism).

I guess this is how you catch unconstrained circuit bugs? I can imagine there's some proof circuit that checks that the square of a number is 9, but doesn’t check if it should be 3 or -3. What you're suggesting here should catch the bug if we only want it to be 3, no?

That's debugging your circuit source, not the verifier. Check out circomspect or (for a more general solution) formal verification

Creative undirector: @2077Collective. Ethernaut. Learning machine. Crazy genius. 

That's debugging your circuit source, not the verifier. Check out circomspect or (for a more general solution) formal verification https://github.com/trailofbits/circomspect