The Solana ZK token bug wasn't really ZK: they wanted to optimize a check that Y_0 = G and Y_1 = 0 (on an elliptic curve), so they took a random scalar w and checked that Y_0 + wY_1 = G. This is ok, the problem is they took w from the (incomplete) transcript instead of generating it on the spot 😓
7 months ago