CVE-2026-62337CWE-20

SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements

Medium · published October 30, 2026

CVSS v4.0
6.9
EPSS
—
In the wild
Unconfirmed
What it is

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. `EcPointLoader::multi_scalar_multiplication` places a `Value::Assigned(_)` base paired with `Value::Constant(ONE)` into its unscaled variable-base list and passes it directly to `sum_with_const`. The default shim delegates to halo2-lib `EccChip::sum`, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as `(0, 0)` can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
Not scored
Weakness
CWE-20 · Improper Input Validation
Published
2026-10-30T20:00Z
Timeline
  • 30 OCT 20:00Z
    SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements
    cvelistv5
  • 30 OCT 20:00Z
    SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements
    cvelistv5