🤖 AI Summary
In zero-knowledge proofs (ZKPs), under-constrained (false-acceptance) and over-constrained (unsatisfiability) circuits in zk-SNARKs compromise verification security. This work models circuit constraints as polynomial equation systems over finite fields and leverages computer algebra systems (CAS) for symbolic solving and solution-set classification, enabling precise detection of both constraint defects. We introduce a fine-grained verification result classification mechanism that significantly enhances the expressiveness of constraint modeling and improves vulnerability detection accuracy. Our approach supports formal verification and parsing of Circom and Halo2 circuits. Experimental evaluation demonstrates that, within the solvable domain, our method achieves 29% higher constraint coverage than Picus and 10% higher than halo2-analyzer, while reducing analysis time by an order of magnitude.
📝 Abstract
Zero-knowledge proof (ZKP) systems have surged attention and held a fundamental role in contemporary cryptography. Zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) protocols dominate the ZKP usage, implemented through arithmetic circuit programming paradigm. However, underconstrained or overconstrained circuits may lead to bugs. The former refers to circuits that lack the necessary constraints, resulting in unexpected solutions and causing the verifier to accept a bogus witness, and the latter refers to circuits that are constrained excessively, resulting in lacking necessary solutions and causing the verifier to accept no witness. This paper introduces a novel approach for pinpointing two distinct types of bugs in ZKP circuits. The method involves encoding the arithmetic circuit constraints to polynomial equation systems and solving them over finite fields by the computer algebra system. The classification of verification results is refined, greatly enhancing the expressive power of the system. A tool, AC4, is proposed to represent the implementation of the method. Experiments show that AC4 demonstrates a increase in the checked ratio, showing a 29% improvement over Picus, a checker for Circom circuits, and a 10% improvement over halo2-analyzer, a checker for halo2 circuits. Within a solvable range, the checking time has also exhibited noticeable improvement, demonstrating a magnitude increase compared to previous efforts.