Proof of Exploit

Proof of Exploit

Generate zero-knowledge proofs of smart contract bugs

Proof of Exploit

Proof of Exploit

Generate zero-knowledge proofs of smart contract bugs

The problem Proof of Exploit solves

Although there are bug bounty programs, we still see smart contract hacks. This causes innocent people to lose their hard-earned money.

If we try to understand why this happens, then one of the reasons is that the security researcher has to disclose the bug to the project team. If the project decides to not reward the security researcher, then the security researcher cannot do much, since they have already provided their part of the deal. Because such incidents take place, the security researcher might think that instead of responsibly disclosing the bug, they should exploit the project.

This project aims to solve two problems:

  1. Enable the security researcher to keep their bug secret until the negotiation.
  2. Help project teams to filter the spam by making it easy to verify reports.

Next, I want to work on a front-end to verify the proofs so that it is easier for the project teams to verify bug reports.

Challenges I ran into

  • zkEVM proof verification was failing and after days of debugging, I found out there was a bug in the rust codebase which caused non-deterministic verification key generation.
  • Debug trace generated using Anvil had some errors, i.e. it did not contain storage values for some SLOAD value which I am not sure why.
  • It was so difficult to find a geth node since I needed it to generate steps tracing.
  • Also, I have faced more issues related to Rust programming.

Tracks Applied (3)

User Security Tools

Currently, the smart contract teams receive a lot of bug reports and have to go though the tedious task of reviewing eac...Read More

QuillAudits - Web3 Security 🛡️

Blockchain Forensics and Investigations Tools

The Proof of Exploit simulates the exploit transaction locally and generates a zk proof of the computation trace, it red...Read More

BlockSec

Web3 Insurance & Risk Management

Currently, the insurance fund is thought to be just for post-exploit situations where the users would be paid with the i...Read More

Polygon

Discussion