Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
semaphore-protocol/semaphore
main @ 341475c
3
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Cryptographic Logic Error: 1 prior fix. Scrutinize any change in this area.
Semaphore.sol: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cryptographic Logic Error: Missing scalar range validation on the secret input inside the circom circuit allows values outside the safe field modulus (r), potentially leading to proof forgeability. Developers must strictly enforce constraints (0 < secret < r) using proper range checks.
Cryptographic Weakness: Passing raw, un-hashed public inputs (like message and scope) that exceed the SNARK scalar modulus to the Groth16 verifier can result in input truncation or aliasing. The contract must pre-hash these arguments with keccak256 mod r to ensure integrity.
Cryptographic Vulnerability: Using non-standard or mismatched hashing algorithms (like sha256 instead of keccak256) for on-chain signal verification creates compatibility issues and verification mismatches. Alignment with EVM standards is necessary for secure and predictable signal validation.