2026-08-31

This week

Zero-knowledge proving system vulnerabilities disclosed in the last 24 hours

- 2024-09-05 — Zellic disclosed two critical vulnerabilities in gnark's Groth16 variant with commitments, affecting gnark versions up to 0.10.0 on the BN254 curve. Both were reported to the gnark team…

RESEARCH: Zero-knowledge proving system vulnerabilities disclosed in the last 24 hours

Publication Date: 2024-09-06 Review Cutoff: This document covers developments disclosed between 2024-09-05 and 2024-09-06 (24-hour window).

Summary

Action Required: Two CVEs (CVE-2024-45039, CVE-2024-45040) affect gnark (zktecnologies/gnark) Groth16 with ≥2 commitments on BN254. Upgrade to v0.11.0 immediately. Users of standard Groth16 (fewer than 2 commitments) or other gnark proving systems are not affected. These vulnerabilities constitute a soundness and privacy break—not merely a denial-of-service—allowing malicious provers to prove false statements and potentially recover private witnesses. For regulated entities, a soundness break means proofs cannot be trusted for audit or settlement, potentially violating record-keeping requirements under MiCA or similar frameworks. No governmental or industry enforcement actions (e.g., fines, cease-and-desist) were reported in this 24-hour window.

Development

  • 2024-09-05 — Zellic disclosed two critical vulnerabilities in gnark's Groth16 variant with commitments, affecting gnark versions up to 0.10.0 on the BN254 curve. Both were reported to the gnark team and fixed in version 0.11.0:
    • CVE-2024-45039 (Soundness break): Malicious prover can prove incorrect statements when at least two commitments are used. Affects versions up to and including 0.10.0.
    • CVE-2024-45040 (Zero-knowledge break): An attacker can recover private witnesses from proofs when at least two commitments are used. Affects versions up to and including 0.10.0.

The patched release v0.11.0 is confirmed via the official gnark GitHub releases page and the GitHub security advisory (GHSA-). Both vulnerabilities were fixed in this release. Two Vulnerabilities in gnark's Groth16 Proofs | Zellic — Research

No other CVEs, patches, or advisories were identified in this 24-hour window.

Sources