Penetration Test Report (NCCGroup): NCC Group ZenBlockchainFoundation E001741 Report 2021 11 29 v1.2

Zendoo Proof Verifier Cryptography Review
Zen Blockchain Foundation
November 29, 2021 – Version 1.2
Preparedfor
LucaCermelli
DanieleDiBenedetto
AlbertoGaroffolo
RosarioPabst
Preparedby
PaulBottinelli
AvaHowell
EliSohl
©2021–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc.forZenBlockchainFoundation.Portionsofthisdocument
andthetemplatesusedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullor
inpart)withoutNCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis • Polynomialcommitmentimplementation: https://gith
During the summer of 2021, Horizen Labs engaged ub.com/HorizenLabs/poly-commit on branch dev at
NCC Group to conduct a cryptography review of Zen- commit
doo protocol’s proof verifier. This system generates
7d8a0f38c218229288c8885fb416b4005f9f7d59,in-
and verifies modified Marlin proofs with a polynomial cludingpullrequest28: Proofsizeoptimization;
commitment scheme based on the hardness of the • zendoo-cctp-lib to support cross chain transfers
discretelogarithmprobleminprime-ordergroups. The fortheZendooprotocol: https://github.com/Horizen
system also provides optimized batch verification of
Official/zendoo-cctp-libonbranchdevatcommit
accumulated proofs. The review included a large
f7aeeba5266a2a6d82e2186958d11ead165191ab;
number of supporting elements for the proof system, • zendoo-mc-cryptolib, an FFI library crate that
such as the underlying field arithmetic, instantiations exposes the ginger-lib Rust components needed to
of specific elliptic curves, a custom hash function, and support Zendoo in mainchain: https://github.com/H
optimized Merkle Tree implementations. NCC Group
orizenOfficial/zendoo-mc-cryptolibonbranchsync_w
assignedthreeconsultantsforatotalof42person-days
ith_cctp_libatcommit
overthecourseoffivecalendarweeksonthisreview.
ac1a8d59330953d9bfabf8c65b11b21bde6669f9.
Followingthisreview,NCCGroupperformedaretestof Limitations
thefindingsuncoveredduringtheinitialengagementa Duetothelargesizeofthedifferentcodebasesunder
fewweekslater. review,theNCCGroupteamfocusedtheireffortsonthe
scope described above and did not venture outside of
Scope
the specific repositories listed. Overall, good coverage
NCCGroup’sevaluationincluded: wasachievedontheitemsinscope.
• Selected portions of the ginger-lib repository: At the time of the review, some portions of the code
github.com/HorizenOfficial/ginger-lib on branch werestillunderdevelopment,asevidencedbyanumber
development_tmpatcommit
of “TODO”s throughout the repositories and some
b8b3a9feb8f1c4dde5ce3a3f2e951d597ec9d696.
commented code portions. The NCC Group team
Morespecifically: also performed the review on dedicated development
– Field and BigInteger arithmetic and their cor- branches, which eventually will have to be completed
responding serialization and deserialization func- andintegratedwithinthelargerZendooecosystem.
tions,
– Assembly optimizations of the underlying arith- Additionally, side-channel attacks leveraging timing
metic, leakswerenotanareaofconcernfortheHorizenLabs
– TweedleCurvesandtheircorrespondingfields, team and as such non constant-time operations were
– Multi Scalar Multiplication (MSM) and Fast Fourier notinvestigatedindetail.
Transforms(FFT),
Finally, the changes introduced in the different pull
– Implementationofthesnark-friendlyhashfunction
requests prior to the retest sometimes contained
Poseidon,
modificationsto filesthat wereout of theinitial scope.
– Concrete parameter instantiation of the Poseidon
Theseupdateswerenotreviewedingreatdepth.
hashfortheTweedlecurves,
– Merkletreesandpathsimplementations, KeyFindings
– Coboundary Marlin and Final Darlin batch verifica-
The NCC Group team reported a total of 22 findings
tionandaccumulationusingDiscreteLogAccumu-
duringthecourseoftheengagement.Themostnotable
lators;
findingswere:
• Marlin implementation: https://github.com/Horizen
Labs/marlinonbranchdevatcommit • MissingPolynomialNormalizationafterArithmetic
eaf2a6a4ebfbb8034f158583f29179765a2f5297; Operations: Incorrect polynomial representation
resulting from arithmetic operations may break as-
sumptions and lead to erroneous computations or
mayresultindenialofserviceattacksviaRustpanics.
2 | ZendooProofVerifierCryptographyReview ZenBlockchainFoundation/NCCGroup
• Batch Proof Verification Bypass: A maliciously StrategicRecommendations
crafted set of proofs or tampered verification keys Consider cleaning up the different repositories by
may pass the batch (and aggregated) verification deleting all unused code. The current code bases
procedure. Thismightallowattackerstotamperwith are large, and contain a lot of unused, outdated, or
proofs without legitimate users noticing, potentially otherwise unnecessary implementations. This makes
impacting the trust in the zero-knowledge proof thecodebasesmoredifficulttomaintainandeventually
system. increasestheattacksurface.
• Incorrect Random Polynomial Generation: The
generation of masking polynomials with inadequate Inordertoprovidemoreassuranceregardingthelackof
randomcoefficientsmayinvalidatethesecurityproofs exploitablevulnerabilities(forexample,inthepresence
andbreachthezero-knowledgeproperty. ofadverseinputparameters),morecomprehensiveunit
• MissingLengthCheckinCanonicalDeserialization: testscouldbewritten, particularlyaroundsomeofthe
Differentserializedfieldelementsmaybedeserialized higher-level primitives such as proof aggregation and
to the same value, resulting in potentially adverse verification. Randomizedinputtestingviafuzzingmight
and unexpected consequences, including breach of beavaluableapproachtouncoverpotentialadditional
consensus. edge cases. The Rust cargo fuzz subcommand is an
• NoDomainSeparationinMerkleTreeImplementa- easy-to-usewrapperaroundlibFuzzer.
tion: Anattackermaybeabletoproduceaseriesof
Due to the deep function hierarchy, it might not
leaveswhichallowsthemtoforgeaninclusionproof
always be evident if and where parameter validation
intheMerkletree.
is performed. As such, consider revisiting some of
• MerkleLeafNodesNotZeroedonReset: Incorrect
the existing functions to assess whether stricter input
values may be computed for root nodes, subtree
validation is necessary. Avoid the use of unsafe Rust
nodes,andtreepaths. Computedvaluesmaynotbe
code that can cause panics, and catch possible errors
reproducible between users or between consecutive
withinformativeerrormessageswherepossible.
programexecutions.
Thecodebasecouldalsobenefitfrommorespecificand
The NCC Group team also collected a number of
detailed comments, given the complex nature of the
informational engagement notes which are provided
performed operations. Additionally, ensuring that the
inAppendixBonpage50.
referencepapersandtheimplementationusetheexact
Afterretesting,NCCGroupfoundthatalargemajority same terminology for variable and function naming
of the findings had been addressed. Out of a would greatly help readers follow the flow of complex
total of twenty-two (22) original findings, fourteen (14) cryptographicoperations.
were marked as Fixed and one (1) as Partially Fixed.
Additionally, three (3) findings were marked as False
Positiveandfour(4)weremarkedasRiskAccepted,after
discussionswiththeHorizenLabsteam.
3 | ZendooProofVerifierCryptographyReview ZenBlockchainFoundation/NCCGroup
Dashboard
TargetMetadata EngagementData
Name ZendooProofVerifier Type CryptographyImplementationReview
Type CryptographicLibraries Method Code-assisted
Platforms RustwithCFFI Dates 2021-06-07to2021-07-09
Environment Local Consultants 3
LevelofEffort 42person-days
Targets
ginger-lib Ageneralpurposezk-SNARKlibrarysupportingrecursiveproofcomposition: https://github
.com/HorizenOfficial/ginger-lib
poly-commit ARustlibrarythatimplements(univa