ZK Circuit Security Checklist

Every public input must be used in constraints. Unconstrained inputs let provers choose arbitrary values.

Private inputs must affect the proven statement. Otherwise provers can use any private input.

All intermediate values should be fully determined by inputs. Check for degrees of freedom.

Field elements wrap around. Ensure values stay in expected ranges.

x * (x - 1) === 0 enforces boolean. Just saying 'is boolean' is not enough.

Array indices must be constrained to valid ranges.

Arithmetic wraps at field modulus. Large numbers can wrap to small ones.

Division by zero is undefined. Ensure denominators are non-zero.

Field elements have two square roots. Constrain which one is expected.

Less-than comparisons are expensive and tricky in circuits. Verify implementation.

When decomposing to bits, ensure reconstruction equals original.

All inputs to hash functions must be constrained. Unconstrained inputs allow hash manipulation.

All signature components verified. Partial verification allows forgery.

The message being signed must be part of the signature verification constraints.

Verify public keys are valid curve points. Invalid keys can cause issues.

Nullifiers must be uniquely derived. Multiple nullifiers for same input allow double-spending.

Each Merkle path direction must be constrained boolean.

Final hash must equal claimed root. Check hash ordering at each level.

The leaf value must include all relevant data, not just identifiers.

Circuit tree depth must match actual tree depth.

Define what empty leaves hash to. Ensure consistency.

Use parameters from a multi-party ceremony. Single-party setups are trusted.

Circuit must fit within the powers of tau size used in setup.

Verification key must match the deployed circuit exactly.

Each circuit needs its own setup. Never reuse keys across circuits.

Verifier must be generated from same circuit used by prover.

Public input ordering must match between prover and verifier.

Include nonce or timestamp in public inputs to prevent replay.

Verifier must reject malformed proofs, not revert or panic.

On-chain verification must fit within block gas limits.

Proofs should include action-specific data to prevent misuse.

Proofs should have time bounds to prevent indefinite validity.

Spent nullifiers must be recorded. Missing check allows double-spend.

Data from oracles or other sources must be validated before use in proofs.