Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Octra is a privacy focused L1 blockchain built around fully homomorphic encryption HFHE (Hypergraph FHE). The idea is that the network can run on encrypted data without ever decrypting it, similar to Zcash's shielded pool functionality.

Every account has a public balance, and an encrypted balance, with value movable between those two states. To encrypt, decrypt, or spend an encrypted balance, an R1CS proof is provided. This proof attests that the transfer is valid using ZK proofs by convincing the verifier than the balance is > 0. A single bug in the ZK verifier for this could lead to a complete compromise of the system.

They decided to review the ZK verifier code for the R1CS proof. The function rist_decode() returns a 32-byte input with Ristretto encoding. Otherwise (if invalid), it returns false. When the code is actually used, the verifier decodes the pointer in a loop without checking the return value. It turns out that an empty point can cause this to fail.

The identity of a Edwards coordinate is {0,1,1,0} while the uninitialized variable is {0,0,0,0}. Because the uninitialized value isn't the identity, this creates some issues in the math downstream.

Every point sum in the verifier uses ext_scalarmul, which is a double, and add formula. It starts on the identity point, and then uses our unchecked value. Because everything is zero, all of the values equal each other without knowing the value s. This zero point, used by the rest of the system, is absorbing in practice! So, it wipes out every honest term. This allowed them say the commitment opens at 0 but use a different commitment entirely to forge a proof.

The author decided to run this proof on mainnet for 100 OCT. This is really irresponsible because A) it messes up the balances, and B) somebody could have seen the vulnerability and reproduced. After this succeed, they contacted a friend who knew people at the company. After working through the night, the vulnerability was fixed on mainnet.

Overall, an interesting and impactful bug find. Personally, I found the exploitation of the bug on mainnet to be bad news, and the article is somewhat tough-and-check with a lot of money-based references.