zk-bug-tracker icon indicating copy to clipboard operation
zk-bug-tracker copied to clipboard

Add Data Validation Vulnerabilities section to Common Vulnerabilities

Open crStiv opened this issue 11 months ago • 0 comments

Describe your changes

Added a new section on Data Validation Vulnerabilities that covers common input validation issues in ZK circuits, including missing range checks, incomplete parameter validation, and edge case handling. Includes code examples, preventative techniques and references to real-world cases (Aleo, Light Protocol).

Related Issue [if applicable]

N/A

Common Vulnerabilities Addition Checklist [if adding a new common vulnerability]

  • [x] Added example code of the vulnerability (ProcessDeposit template showing vulnerable fee validation)
  • [x] Gave an explanation of how the vulnerability works (detailed explanation of how improper validation can lead to security issues)
  • [x] Added attack scenario section if applicable (example with fee > amount causing underflow)
  • [x] Added preventative techniques section if applicable (range checks, relationship validation, edge case handling with code examples)

Bugs in the Wild Addition Checklist [if adding a new bug found in the wild]

N/A - This PR adds a common vulnerability section, not a bug in the wild.

crStiv avatar Jan 08 '25 11:01 crStiv