Home > Resources > papers > CPV24-Last-Challenge

The Last Challenge Attack: Exploiting a Vulnerable Implementation of the Fiat-Shamir Transform in a KZG-based SNARK (Ciobotaru, Peter, Velichkov 2024)

Last modified: 2026-10-27

URL: https://eprint.iacr.org/2024/398

Summary

Shows how an implementation of a KZG-based PLONK variant that does not bind the last Fiat-Shamir challenge to all previous prover messages lets a malicious prover forge proofs for false statements. A concrete example of "weak Fiat-Shamir" bugs, cited in BL26-SoK-AnonCreds among the attacks that make implementation correctness essential for general-purpose ZKP credentials.

Related resources

• How to Prove Yourself: Practical Solutions to Identification and Signature Problems (Fiat-Shamir) (paper, 1986)
• PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge (paper, 2019)
• SoK: What Don't We Know? Understanding Security Vulnerabilities in SNARKs (Chaliasos, Ernstberger, Theodore, Wong, Jahanara, Livshits 2024) (paper, 2024)