Z012.md

Z012: Zero-Knowledge Property Leak via Public-Output Over-Exposure

Severity

MEDIUM - Privacy degradation (heuristic, advisory)

Description

Detects circuits/contracts exposing more public outputs than strictly necessary for verification, potentially leaking information the ZK scheme was meant to keep private.

Vulnerable Pattern

// ❌ BAD: Over-broad public outputs leak private data
pub fn verify_credit_score(
    env: Env,
    proof: Proof,
    public_inputs: Vec<u64>
) {
    // Public: [ssn, income, debt, score, is_above_700]
    // ❌ Only need is_above_700, rest should be private!
    
    verify_zk_proof(&env, proof, &public_inputs);
    
    let is_qualified = public_inputs[4];
    if is_qualified != 1 {
        panic!("Credit check failed");
    }
}

Privacy leak: Exposes SSN, income, debt - defeats ZK purpose.

Secure Pattern

// ✅ GOOD: Minimal public outputs preserve privacy
pub fn verify_credit_score(
    env: Env,
    proof: Proof,
    is_above_700: u64
) {
    // Public: [is_above_700] only
    // ✅ Private in circuit: SSN, income, debt, actual score
    
    verify_zk_proof(&env, proof, &[is_above_700]);
    
    if is_above_700 != 1 {
        panic!("Credit check failed");
    }
}

Why This Matters

• Privacy failure: ZK provides no protection if data public
• Compliance risk: Expose PII unnecessarily
• Security degradation: More attack surface

Detection Method (Heuristic)

1. Count public inputs to verification
2. Compare against minimal expected set
3. Flag if substantially more (advisory)
4. Requires manual review to confirm

Note: This is a heuristic/advisory rule, not a hard proof of leakage.

Best Practices

1. Only expose final boolean/commitment results
2. Keep intermediate values private
3. Document why each public input is necessary
4. Use circuit design reviews

Dependencies

• #1192, #1194: ZK infrastructure

Examples

See contracts/fixtures/finding-codes/z012_public_output_overexposure.rs