[moodlezoup]

Summary

Fixes a critical soundness bug in ZK mode (zk feature): the evaluation opening point was not bound by the verifier. A ZK proof created for a point P verified at any point P', letting a malicious prover open a committed polynomial to a forged evaluation at an attacker-chosen point. Transparent mode was unaffected.

Special thanks to Veria Labs for finding and reporting this vulnerability!

Root cause

The evaluation point reaches the verifier only through the folded scalars s1_acc/s2_acc (accumulated in DoryVerifierState::process_round). The 0.3.0 ZK final check was a collapsed 1-pairing scalar-product argument over the pre-fold statement (C, D₁, D₂) and never read them — it dropped the point-binding terms (the transparent check's Pairs 2 & 3 and the s1_acc·s2_acc·HT term) with no zero-knowledge replacement.

Fix — restore the original Dory construction

Per the Dory paper (eprint 2020/1274, §4.1 Fold-Scalars → §3.1 Scalar-Product):

• The prover applies the Fold-Scalars reduction to its witness (v₁ += γ·s₁·H₁, v₂ += γ⁻¹·s₂·H₂, r_C += γ·r_E2 + γ⁻¹·r_E1) via the new DoryProverState::apply_fold_scalars, before running the scalar-product Σ-argument. The argument now opens the point-dependent folded statement (C′, D₁′, D₂′).
• The verifier reconstructs (C′, D₁′, D₂′) from its own point-derived s1_acc/s2_acc and the E-accumulators, batched into a 3-pairing check (mirrors Pairs 1–3 of the transparent check). This pins the point coefficient to the committed witness while v₁[0]/v₂[0] stay hidden.
• The Σ-proof responses (E₁, E₂, r₁, r₂, r₃) are absorbed into the Fiat–Shamir transcript before the batching challenge d is drawn, and the unconstrained r_final1/r_final2 blinds are removed — closing the degree of freedom a point-agnostic fix would leave exploitable (advisory §5).

Breaking change

DoryProof::final_message is now Option<ScalarProductMessage> — Some in transparent mode (reveals the folded witness), None in ZK (the Σ-proof replaces it; revealing it would break hiding). ZK proofs generated by 0.3.0 no longer verify and must be regenerated. Documented in CHANGELOG.md under [Unreleased]; the version bump is left as a release decision.

Tests

• examples/zk_wrong_point.rs (advisory PoC): reports wrong_point_accepted=false at every size after the fix (true before).
• test_zk_wrong_point_rejected: an honest ZK proof is rejected at a shifted and at a random point.
• test_zk_crafted_blind_shift_wrong_point_rejected: an adversarial wrong-point proof that shifts the Σ-blinds by the exact public point-deltas (§5's attack) is rejected.
• test_soundness_missing_final_message / test_zk_soundness_unexpected_final_message: the clear final message must be present iff the proof is transparent.
• Full suite green (97 with zk, 67 transparent), clippy/fmt clean across all feature combos, both proof formats round-trip, and zk_statistical (ZK uniformity + witness-independence, 1000 trials) still passes.

Downstream note

The Jolt-side items in the advisory (jolt-verifier stage 8, jolt-dory, and flipping zk_wrong_point_binding_poc to is_err()) live in a separate repo. When Jolt bumps this dependency, that PoC test should be flipped.

🤖 Generated with Claude Code