ZK-proofs introduce security challenges for developers

Zero-Knowledge Proofs (ZK-Proofs) are an emerging success story for cryptography and blockchain with many use cases, including improved transaction privacy and scalability. ZK technology allows two parties to agree that a claim is true, without the claim being revealed or explained – hence the use of the term “zero knowledge”.

There are potential drawbacks to ZK-proofs, however. In the year In November 2023, cyber security company ChainLight announced the discovery of voice amplification in the zkSync Era mainnet implementation. Exploiting that error could result in the loss of $1.9 billion in funds.

Cointelegraph spoke with Chainlight researcher Tim Baker to better understand the security risks of implementing ZK-proofs.

Baker says a major part of the problem with ZK's technology is simply how new it is.

“I think everyone knows that ZK technology is relatively new, but many don't really understand how new it is,” Baker said. “Even a few years ago, many people thought of something like ZK EVM. [Ethereum Virtual Machine] At least ten years away. But we only got it in two or three years.

The huge advances in ZK-proof technology are a big part of what makes it so dangerous. As Becker explained, the development of ZK-proofs was highly decentralized, which greatly accelerated the process but created some additional problems that the industry is currently struggling with.

“So, it's very new, and the developer tools are still in their infancy, and all the projects have their own technology stacks that each one builds independently. There is a lack of community developer-friendly tools for ZK, and this increases the likelihood of introducing vulnerabilities.

How to fix problems like ZK-proofs

While issues related to ZK-tokens have been identified in the past by the projects themselves or by security firms such as ChainLite, actual examples of exploitation are very low.

For this reason, we are going to make a decision. Baker understands this tendency well.

“Some people object to the idea that ZK is particularly dangerous. They point out that no major ZK protocols have been used yet, but I think that's fundamentally misunderstood,” he said.

The main reason for this is that all of these ZK-rollups are so-called training wheels, which are additional layers of security beyond the ZK-proof system, so using the protocol is not helpful to an attacker and instead encourages it. Attackers to report.

According to Baker, these training wheels violate protocol and otherwise are not reliable in the long run.

While the technology is being protected and hidden, these layers of security are necessarily short-term temporary solutions. Because these networks fundamentally sacrifice some of the most valuable assets they want to have in the long run, such as decentralization and other technological capabilities.

Latest: Visa and MasterCard: Benefits for wallets, risk for crypto exchanges?

One point of contention, Baker pointed out, is the execution delays built into ZK-proof transactions. These delays allow time before the networks complete orders, giving them time to identify erroneous transactions. Of course, this negates any speed or scalability benefits from using ZK-proofs.

Eventually, the limitations caused by training tires will necessarily be thrown aside. The trick is to do this only when ZK-proofers are mature enough to do so without exposing themselves to protocols.

Looking ahead

One of the biggest tasks of researching blockchain technology is predicting where the industry is headed next. But regardless, Becker sees a bright future for ZK technology once out of the wrinkle iron.

“It's just a matter of time before the technology matures and the security around it becomes a little more stable,” Baker said.

As for the timeline, Becker said the rapid growth of ZK-evidence is difficult to predict as it has been previously anticipated.

“It's hard to say because the technology is still evolving. Even though we have ZK-rollups and EVMs today, the underlying evidence systems are still changing and iterating and evolving. As a result, networks are improving. It's hard to say exactly when everything will settle down and allow all these tools to mature,” he said.

Ultimately, it may be the better part of a decade before the technology is considered mature. This means that security professionals and developers will have to remain on heightened alert for some time.

A view from the development side

Aleph Zero, a layer-1 solution for decentralized applications, incorporates ZK-proof technology into its tech stack. As such, the company is aware of the challenges that ZK-proofs introduce.

Matthew Niemerg, founder and president of Aleph Zero, told Cointelegraph: “Proofs of zero knowledge show great promise, but the technology is still in its infancy. As with any new innovation, there are challenges in identifying vulnerabilities, such as circuit design, random number generation, and encryption implementation.

The co-founder added that even the smallest mistakes often lead to bigger problems.

“Even small oversights can compromise key properties of integrity, sanity, and privacy. Real-world examples have shown flaws that allow token spoofing, smart contract attacks, and broken anonymity,” Nimerg added. By people who can.Especially in an open source paradigm, your problem can quickly become everyone's problem.

Nimmerg said one of the earliest known ZK-proof vulnerabilities came from the well-known privacy coin Zcash (ZEC). In the year In March 2018, Zcash discovered a bug in its code that allowed a hacker to spoof generation tokens.

In the year In October 2018, Zcash patched the vulnerability with an update to the Sapling network. Overall, the fake vulnerability has been part of the Zcash network for two years. It was never exploited.

Latest: CBCCs: User Privacy Problem or Future Currency?

In a February 2019 statement, Zcash said, “We believe that no one is aware of the risk.”

The reason the blockchain industry is scared is what other vulnerabilities are, still undiscovered. Sometimes, as the knowledge and understanding of ZK-proof technology improves, more of these cases will be discovered.

The question is who will find them first – the developers themselves or the hackers?