# zkSync Insufficient Proof Verification Bugfix Review

Unconstrained mantissa allocation in zkSync Lite's packed-float parser let a prover forge SNARKs for arbitrary amounts, enabling unauthorized minting, freezing, and token theft.

- Payout: $200,000
- Severity: critical
- Program: zkSync
- Credited: LonelySloth
- Disclosed: 2024-02-09
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/zksync-insufficient-proof-verification-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-zksync-insufficient-proof-verification-bugfix-review
- Tags: domain:web3 impact:funds-loss impact:integrity kind:bounty platform:blog platform:immunefi sev:critical tech:solidity technique:source-review vuln:business-logic vuln:crypto

**Target:** franklin-crypto circuit gadget parse_with_exponent_le (ZK rollup proof system)
**Root cause:** parse_with_exponent_le allocated the mantissa via AllocatedNum::alloc without constraining it to the bit-decomposed mantissa_result, so the witness value was free. The final mul constraint only tied mantissa*exponent to the result, not mantissa to the packed bits.
**Steps:**
1. Read franklin-crypto parse_with_exponent_le; note mantissa = AllocatedNum::alloc(...) with no enforce tying it to mantissa_result.lc().
2. Observe the commented-out constraint block that would have bound result_allocated to mantissa_result.
3. Construct a prover witness with arbitrary mantissa value while keeping packed bits valid.
4. Generate a SNARK over arbitrary (packed_amount, unpacked_amount) pairs that verifies under the circuit's verification keys.
5. Submit the forged block proof to the mainchain verifier to accept altered transaction data.
**How found:** Code review of the packed floating point parsing gadget; noticed mantissa allocated without constraints and the constraint block commented out, hypothesizing arbitrary witness values would still verify.
**Exploitation:** Attacker runs the prover with an unconstrained mantissa witness to produce a valid SNARK for arbitrary amounts, then submits it to the L2 contract; the verifier accepts, allowing unauthorized minting, freezing/transferring of tokens, transaction tampering, and blocking state-tree recovery.
**Escalation:** Single forged proof yields multiple impacts: mint, freeze, transfer, tamper, and DoS state recovery.
**Insight:** In ZK circuits, every AllocatedNum::alloc is a free witness until an enforce ties it to public/derived signals; grep for alloc calls lacking a following constraint, especially where constraint code is commented out.