Macauley Peterson

This is a segment from the 0xResearch newsletter. To read full editions, <a href="https://blockworks.co/newsletter/research" target="_blank" rel="noreferrer noopener">subscribe</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Succinct’s SP1 ZKVM has come under scrutiny after <a href="https://lambdaclass.com/">LambdaClass</a> disclosed a critical <a href="https://blog.lambdaclass.com/responsible-disclosure-of-an-exploit-in-succincts-sp1-zkvm-found-in-partnership-with-3mi-labs-and-aligned-which-arises-from-the-interaction-of-two-distinct-security-vulnerabilities/">security vulnerability</a> in its proof generation. The exploit in version 3 of SP1, discovered in collaboration with 3Mi Labs and Aligned, stemmed from the interaction of two separate security flaws.



Succinct previously disclosed the potential exploit to its customers <a href="https://github.com/succinctlabs/sp1/security/advisories/GHSA-c873-wfhp-wx5m">via Github</a> and Telegram.



Here’s what happened in simple terms:



<ol class="wp-block-list">
<li>Missing Verification Step — The system relied on a list to track key proof components but didn’t properly verify that the list was accurate. Consequently, a malicious prover could potentially manipulate it to produce invalid proofs. New checks were added to fix the oversight.</li>



<li>Incomplete Proof Flag — A key part of SP1’s proof-checking system included a flag meant to confirm that a proof was fully executed. However, this flag wasn’t always properly enforced, leading to a potential loophole. Succinct tightened up the checks.</li>



<li>Polynomial Evaluation Issue — An issue found in Plonky3 (a dependency of SP1), meant that it didn’t fully verify all calculations before confirming a proof was valid. Post-patch, all proof components are properly verified.</li>
</ol>



While the vulnerability was quickly addressed prior to the disclosure, the process has raised concerns about transparency in security practices for zero-knowledge virtual machines (ZKVMs). SP1’s technology is currently underpinning high profile upgrades in rollup infrastructure under development.



<ul class="wp-block-list">
<li>Mantle Network has integrated SP1 to transition into a zero-knowledge (ZK) validity rollup, aiming to enhance transaction finality times and support institutional-grade asset settlements.</li>



<li>The AggLayer employs SP1 to generate pessimistic proofs, ensuring the security of its cross-chain interoperability solutions.</li>



<li>Taiko has adopted SP1 as a ZK prover to secure its layer-2 execution, which uses a multi-prover system</li>



<li>Soon, a relatively new project, is building an SVM rollup framework that settles to Ethereum with ZK fault proofs powered by SP1, similar to Eclipse, although the latter uses RISC Zero instead.</li>
</ul>



<h2 class="wp-block-heading">Transparency and implications</h2>



LambdaClass cautioned that the full implications of the flaw required further assessment. Notably, the exploit depended on the interplay between the two issues, meaning that fixing one might not be sufficient to prevent exploitation.



LambdaClass developer known as Fede, <a href="https://x.com/fede_intern/status/1883688063936692355">highlighted</a> on social media that his team felt compelled to make the disclosure public after perceiving a lack of urgency in Succinct’s communication about the issue.



Succinct’s leadership acted responsibly in fixing the issue, according to Avail’s Anurag Arjun, but he agreed&nbsp; better public disclosure practices are needed.



“ZKVM systems are very new and are constantly being updated, so you’d expect vulnerabilities,” Arjun told Blockworks. “In an open-source setting, anyone can run the prover, and if vulnerabilities aren’t disclosed properly, that’s definitely a risk.”



The Avail team, which uses SP1 for proof generation in its consensus mechanism, was informed about the issue privately ahead of public disclosure, Arjun confirmed.



Avail’s implementation was not exposed to risk, Arjun said, because they rely on Succinct’s proprietary prover, which remains permissioned. Avail’s rollup clients have also not yet begun using its SP1-powered bridge contract, so there was no practical impact.



Meanwhile, defenders of Succinct point out that responsible disclosure typically involves private reporting before public statements to avoid unnecessary panic and potential exploitation.



Succinct’s updated version 4 of SP1 — dubbed Turbo — resolves the identified vulnerability, and downstream projects have begun integrating these fixes.&nbsp;



The case illustrates how even well-audited code can and does contain bugs. As Succinct <a href="https://x.com/SuccinctLabs/status/1884083149136863656">put it</a>, “while auditors provide valuable insights, they are not infallible, and we remain committed to continuously improving and working hard to ensure our systems are safe and secure for everyone.”



The more explicit, if belated transparency from Succinct drew <a href="https://x.com/arik_g/status/1884084728783069206">praise</a>. What remains is the question of how to best balance security, transparency, and user protection. And finding <a href="https://x.com/dimahledba/status/1884199665035280586">the line between</a> due criticism and toxic infighting.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/daily">Blockworks Daily</a>: Unpacking crypto and the markets.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Succinct’s SP1 bug sparks transparency debate in ZK security

Bessie Liu

Vitalik Buterin, the co-founder of Ethereum, has released a new blog post discussing a new cryptographic proving system that can make zero-knowledge proofs more efficient.



The proving system, called Binius, is designed to operate directly over binary code on computers. Binary code is a language understood by computers, and it is used to store information and represents data using the symbols zero and one, otherwise known as bits. 



Although there are some similarities between STARKs and Binius, Buterin explains that the mathematical tricks that enable these different proving systems are very different.&nbsp;



Generally speaking, STARKs is a technology that has enabled complicated statements to be easily cryptographically verified. It is designed in a way that can easily compute numbers when they are of small value, when there are large values, STARKs generate extra values, which can lead to inefficiency.&nbsp;



Unlike STARKs that “arithmetize” a statement into a polynomial equation — a mathematical expression which model a relationship between variables in a block — Binius treats data as a hypercube and grid, and uses multilinear polynomials to perform cryptographic proofs.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">BInius: highly efficient proofs over binary fields<a href="https://t.co/lHAGXbgI9r">https://t.co/lHAGXbgI9r</a> <a href="https://t.co/3Xx4zIAm1b">pic.twitter.com/3Xx4zIAm1b</a>&mdash; vitalik.eth (@VitalikButerin) <a href="https://twitter.com/VitalikButerin/status/1784912087098999263?ref_src=twsrc%5Etfw">April 29, 2024</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Binius converts individual values into bits and places them in a hypercube and a square. This hypercube is then converted into a grid and computations are performed in order to receive an output matrix.&nbsp;



<figure class="wp-block-image"><img loading="lazy" decoding="async" width="1021" height="637" src="https://blockworks-co.imgix.net/wp-content/uploads/2024/05/image.png" alt="" class="wp-image-85182" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2024/05/image.png?w=1021 1021w, https://blockworks-co.imgix.net/wp-content/uploads/2024/05/image.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2024/05/image.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2024/05/image.png?w=412 412w, https://blockworks-co.imgix.net/wp-content/uploads/2024/05/image.png?w=418 418w, https://blockworks-co.imgix.net/wp-content/uploads/2024/05/image.png?w=351 351w, https://blockworks-co.imgix.net/wp-content/uploads/2024/05/image.png?w=80 80w" sizes="auto, (max-width: 1021px) 100vw, 1021px" /></figure>



A verifier will then perform its own computational calculations to ensure that the information itself matches and ensure that the compute columns returns a value claimed by the prover.



“I highly encourage people to understand and explore! Lots of innovations have been happening in ZK-proving recently. And I expect lots more to come soon,” Buterin wrote in an <a href="https://twitter.com/VitalikButerin/status/1784912152655974533">X post</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/daily">Blockworks Daily</a>: Unpacking crypto and the markets.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Vitalik Buterin talks ways to make zk proofs more efficient

In today’s digital world, the need to decrypt data for computational tasks exposes it to security risks.



This is a significant problem in privacy-sensitive sectors like Web3, where decentralized applications and finance at times rely on both confidentiality and integrity in data processing to maintain trust and security on chain. Fully homomorphic encryption (FHE) offers a potential solution by enabling the processing of encrypted data without needing to decrypt it first, thus preserving confidentiality. This advancement not only enhances data <a href="https://blockworks.co/tag/privacy">security and privacy</a>, but also extends the potential for secure data analysis and decentralized services.



Guy Itzhaki, CEO and co-founder of Fhenix, says that in the context of blockchain, FHE enables developers and users to control which assets they want to maintain privately and confidentially on-chain.



This means that it will enable developers to “create a new set of use cases,” and “unlock the way for true on-chain gaming, voting, and auctions,” Itzahki said.



Read more: <a href="https://blockworks.co/news/fhenix-homomorphic-encryption">Encryption startup Fhenix raises $7M for private computation</a>



Although there are some similarities between FHE and zero-knowledge (zk) technology, the major difference is that FHE technology can perform computation on top of encrypted data without having to reveal or know the data points to obtain the end result.&nbsp;



Liam McDonald, head of growth at blockchain privacy startup Fairblock, explained that with <a href="https://blockworks.co/tag/zero-knowledge-tech">zk technology</a>, a prover turns necessary data into a secure code called a polynomial commitment to show it&#8217;s accurate.



“In order to do this, the data itself is turned into polynomial hashes and is aggregated into a polynomial equation of the hashes that represents the encoded data,” McDonald told Blockworks.&nbsp;



This equation is then sent to a verifier, who determines whether the function is true. If the function is proven, a proof is generated, confirming that the information inside is accurate.&nbsp;



Peyman Momeni, co-founder of Fairblock, mentioned that while zk proofs allow users to validate ownership of data or correct computation, they fall short in supporting computations on encrypted data, especially when it involves merging private information from multiple users.



“Zk is more relevant for scalability with some degree of security and limited privacy applications like shielded transfers, where FHE unlocks wide range of applications coupled with higher levels of data security and privacy,” Momeni said.



<h2 class="wp-block-heading">FHE in practice</h2>



When combined with the benefits of the blockchain, FHE provides enhanced privacy, which is a core component that is missing in the existing blockchain ecosystem, said Kaal Dhairya, a Shiba Inu developer.



“Apart from true end-to-end encryption of data, this opens up a variety of use cases, including supply chain/food chain to blockchain, private voting for DAOs, efficient prediction markets, on-chain casino games, hidden items in on-chain games, and many more,” Dhairya said.



Momeni notes that in most crypto use cases, it is necessary to combine private inputs from multiple users, compute over them and decrypt the results, meaning that there would be a “shared private state.”



“As an example in private governance or sealed-bid auctions, all users encrypt their votes or bids, we perform on-chain computing over encrypted data, then in the end we need to decrypt the actual results,” he said. “In this case we don&#8217;t actually decrypt the individual bids/votes/trades, just the updated state or the result of computation.”



Read more: <a href="https://blockworks.co/news/fhenix-whitepaper-fhe-rollups">Fully homomorphic encryption rollups are one step closer to reality</a>



To ensure no single user has exclusive access, a system of multiple validators should share this decryption key, and decrypt the information collaboratively at the appropriate time.



According to Momeni, current FHE technologies face the technical hurdle of creating a decentralized system for managing these decryption keys. Fairblock, however, is developing a solution with a decentralized network for key generation, aiming to make FHE technology more accessible and practical for developers and various platforms.



<h2 class="wp-block-heading">Different solutions for different privacy needs</h2>



It&#8217;s worth noting that FHE isn&#8217;t the only privacy solution being developed on the blockchain today; there are several other solutions that might be more beneficial for developers building different tools.



“There are different solutions with different trade-offs, so we’re trying to enable developers to use them correctly without passing a cryptography course,” Momeni said.



Read more from our opinion section: <a href="https://blockworks.co/news/privacy-crypto-mainstream-2024">Privacy is going mainstream</a>&nbsp;



In the case of Fairblock, the company sees itself as being similar to Axelar, Eigenlayer, or Celestia, where a network facilitates and accelerates other builders.



“Instead of cross-chain messaging, shared security, and data availability, we&#8217;re abstracting away all of the bandwidth overhead, onboarding and maintenance costs of running the network in a secure and decentralized way,” he said.



The company recently rolled out its <a href="https://medium.com/@Fair_Block/fairblock-public-testnet-is-now-live-a487f97ea3e0">public testnet</a>, which is designed for developers of select layer-2 networks to tailor how they integrate encryption and decryption into applications. It currently enables users to leverage identity-based encryption (IBE), witness encryption (WE) with integration of fully homomorphic encryption still under development.



Updated March 13, 2024 at 9:52 am ET: Clarified example of sealed-bid auctions.



Updated March 13, 2024 at 9:13 am ET: Clarified relevance of zk for scalability.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/daily">Blockworks Daily</a>: Unpacking crypto and the markets.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

What is fully homomorphic encryption and how will it change blockchain?

Jack Kubinec

Much has been made of growing investor interest in integrations between AI and crypto, but it was the less-novel narrative of zero-knowledge (zk) proofs that drew significant VC funding this week. Zk proofs allow statements to be proven true without revealing their contents and are popular in layer-2 rollups that scale blockchains.&nbsp;



Blockworks first reported on Tuesday that the zk startup Ingonyama raised a $21 million seed round led by Geometry, Walen Catalyst Ventures and IOSG Ventures.



Ingonyama offers open-source libraries for zk acceleration. Interestingly, it views itself becoming a chip company down the line and has plans to release intellectual property on zk-optimized hardware in the coming months.



Read more: <a href="https://blockworks.co/news/zk-startup-seed-funding">ZK tech startup Ingonyama secures $21M in seed funding</a>



“It starts with building the [software stack] and then once there is some level of maturity…[and] there is a product that has more demand for compute, then obviously we&#8217;ll need to shift into <a href="https://blockworks.co/tag/asics">ASICs</a>,” Ingonyama founder Omer Shlomovits told Blockworks.



Standard Crypto and Paradigm led a $20 million Series A round in on-chain infrastructure startup Axiom. Axiom <a href="https://blog.axiom.xyz/v2-mainnet/">uses</a> zk to help Ethereum smart contracts parse data at a lower cost. It’s a new application to a popular <a href="https://blockworks.co/tag/zero-knowledge-rollup">concept</a> of using zk to scale Ethereum.&nbsp;



Read more: <a href="https://blockworks.co/news/parallel-evms-vs-arbitrum-stylus">What are the differences between parallel EVMs and Arbitrum Stylus?</a>



Axiom said it would use the funding partly to make new hires.



“We are at an inflection point in taking zk from research to production, and with this funding we are growing our team to make it a reality,” Axiom <a href="https://x.com/axiom_xyz/status/1750534118260297855?s=20">wrote</a> on X.



Delphi Ventures led a $5 million seed round in Zorp, which is building a “personal sovereignty”-focused blockchain using zk proofs.&nbsp;



“We’re building the rails for a parallel world economy,” Zorp CEO Logan Allen wrote in a blog <a href="https://zorp.io/blog/seed">post</a> announcing the raise.&nbsp;



Venture DAO Octu Ventures participated in the round.



“Zorp is answering the question of “How do you verify anything a computer does without simply deferring to a ‘trust us’ authority” and making doing so cheap and reliable enough to replace those authorities as they lose signal and get pwned,” Octu <a href="https://x.com/OctuVentures/status/1750669823695327566?s=20">wrote</a> on X.&nbsp;



<h2 class="wp-block-heading">An inside look at the Beacon Web3 accelerator demo day</h2>



Web3 startup accelerator Beacon held a demo day for its fall 2023 cohort this week. The founder support group <a href="https://www.0xbeacon.com/blog/web3-founders-support-group">provides</a> mentorship to Web3 startups, culminating in a demo day attended by investors and members of the press.



The accelerator just graduated its third batch of startups, and some of its alumni have gone on to draw investor attention, like <a href="https://blockworks.co/news/web3-nft-moma-socialfi">social platform Phaver</a> and <a href="https://blockworks.co/news/sleek-raise-tokenized-knowledge-marketplace">Telegram-enabled business card</a> provider Sleek.



This most recent cohort was heavy on infrastructural apps. Zero Gravity is trying to improve data availability on blockchains, and Inco Network is an <a href="https://blockworks.co/tag/evm">EVM</a> using fully homomorphic encryption.&nbsp;



Read more: <a href="https://blockworks.co/news/fhenix-whitepaper-fhe-rollups">Fully homomorphic encryption rollups are one step closer to reality&nbsp;</a>



There were also, of course, <a href="https://blockworks.co/news/ai-startups-increased-funding">startups integrating AI with crypto</a>. Fraction AI pitched a decentralized platform for data labeling used in training AI models.&nbsp;



“Our model allows us to go planet scale because we open it up for everyone. We get a lot of diverse data because a lot of people participate throughout the globe. And the best of them, our users, are always assured of payments because everything is managed by smart contracts,” founder Shashank Yadav said.



<h2 class="wp-block-heading">Other notable fundraises</h2>



<ul class="wp-block-list">
<li>A subsidiary of the spot bitcoin ETF provider VanEck <a href="https://ccdata.io/press-releases/vaneck-and-marketvector-indexes-complete-strategic-investment-in-ccdata-leading-global-digital-asset-data-firm">led</a> a strategic investment in data firm CCData.&nbsp;</li>



<li>Paper Ventures <a href="https://x.com/Papervc/status/1749441635069411667?s=20">announced</a> a $25 million blockchain fund.</li>



<li>Pantera and Sequoia Capital headlined an undisclosed amount of Series B funding for EDX Markets, Bloomberg <a href="https://www.bnnbloomberg.ca/edx-plans-asia-crypto-exchange-with-funding-from-sequoia-and-pantera-capital-1.2025416">reported</a>. The firm said it is building a crypto exchange in Singapore.</li>



<li>A16z-backed crypto payments firm Eco <a href="https://x.com/andy_bromberg/status/1750525408733540796?s=20">acquired</a> stablecoin shopping app Join. The terms of the deal were undisclosed.&nbsp;</li>



<li>Cash handling company Brink’s, known for its armored trucks, made an undisclosed strategic <a href="https://blog.bitgo.com/brinks-makes-strategic-investment-in-bitgo-977e22d2c625">investment</a> in institutional custody and trading firm BitGo.</li>
</ul>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/daily">Blockworks Daily</a>: Unpacking crypto and the markets.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

zero-knowledge tech