The Frozen Heart vulnerability in Bulletproofs
Summary: Trail of Bits disclosed a class of vulnerability it calls Frozen Heart, caused by insecure Fiat-Shamir implementations that let malicious users forge proofs for random statements, and in this post demonstrates an exploit against Bulletproofs. The flaw traces to an error in the original Bulletproofs paper, whose recommended Fiat-Shamir computation sets y = Hash(A,S), z = Hash(A,S,y), and x = Hash(A,S,y,z,T1,T2) without including the public statement value V, affecting ING Bank's zkrp, SECBIT Labs' ckb-zkp, and Adjoint, Inc.'s bulletproofs.
What's compelling: An attacker can forge a Bulletproofs range proof for a value outside the intended range, such as [0, 2^32), with overwhelming probability, and the proof still passes verification. In most applications where the range is much smaller than the group order, this is severe.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026