⚠️ Disclaimer ⚠️
This version serves as the foundation for the production release and is currently undergoing security and correctness audits.
Although extensive testing and validation have been performed, additional bugs or vulnerabilities may still be discovered. Users should evaluate the software according to their own requirements and use it at their own discretion and responsibility.
Feedback and bug reports are highly appreciated and help improve the reliability of the project.
Summary
- Soundness fix in recursive proof aggregation
- Airgroup values bound to the Fiat-Shamir transcript
Recursive Proving Soundness Fix
Fixed a soundness bug in recursive aggregation, reported by @LeonPaulSchneider throught a security advisor GHSA-3j5v-j2rm-9c5f, fixed in (pil2-proofman#618). A prover could mark every child proof as null, which disables its STARK checks, and then supply stage1Hash and airgroupvalues by hand. The final proof would be accepted for an execution that was never proven.
Every proof must now aggregate at least one real proof, and null children contribute fixed canonical values instead of prover-chosen ones. Single-air setups are unaffected.
Airgroup Values Bound to the Transcript
Airgroup values are now absorbed into the Fiat-Shamir transcript, so they are fixed before challenges are drawn (pil2-proofman#619).