Vulnerable File: circuits/utils.circom
commit: 4984d68467b87ddf14c2e725dcfb753be3c92528
WordSelector: condition is not boolean-constrained. out[i] = condition*(bytes1[i] - bytes2[i]) + bytes2[I] only behaves as a selector if condition ∈ {0,1}.
Several templates treat signals as bytes but do not restrict them to 0..255 (e.g., BytesToWords, Rotate, SubstituteWord, WordSelector, MulByte). Some templates (XorWord, XorByte) do enforce 8-bit ranges via Num2Bits, but others rely on upstream constraints. If not enforced elsewhere, inputs can be out of range and still satisfy constraints. Add Num2Bits(8) or AssertLessThan(256) where byte semantics are required.
Vulnerable File:
circuits/utils.circomcommit:
4984d68467b87ddf14c2e725dcfb753be3c92528WordSelector: condition is not boolean-constrained.out[i] = condition*(bytes1[i] - bytes2[i]) + bytes2[I]only behaves as a selector if condition ∈ {0,1}.Several templates treat signals as bytes but do not restrict them to 0..255 (e.g.,
BytesToWords,Rotate,SubstituteWord,WordSelector,MulByte). Some templates (XorWord,XorByte) do enforce 8-bit ranges via Num2Bits, but others rely on upstream constraints. If not enforced elsewhere, inputs can be out of range and still satisfy constraints. AddNum2Bits(8)orAssertLessThan(256)where byte semantics are required.