Skip to content

Add Data Validation Vulnerabilities section to Common Vulnerabilities #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

crStiv
Copy link

@crStiv crStiv commented Jan 8, 2025

Describe your changes

Added a new section on Data Validation Vulnerabilities that covers common input validation issues in ZK circuits, including missing range checks, incomplete parameter validation, and edge case handling. Includes code examples, preventative techniques and references to real-world cases (Aleo, Light Protocol).

Related Issue [if applicable]

N/A

Common Vulnerabilities Addition Checklist [if adding a new common vulnerability]

  • Added example code of the vulnerability (ProcessDeposit template showing vulnerable fee validation)
  • Gave an explanation of how the vulnerability works (detailed explanation of how improper validation can lead to security issues)
  • Added attack scenario section if applicable (example with fee > amount causing underflow)
  • Added preventative techniques section if applicable (range checks, relationship validation, edge case handling with code examples)

Bugs in the Wild Addition Checklist [if adding a new bug found in the wild]

N/A - This PR adds a common vulnerability section, not a bug in the wild.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant