Executive brief
Plonky3 is a software toolkit used to build cryptographic proofs for blockchain and privacy applications. A vulnerability in its proof-generation component allows an attacker to manipulate the data used to create these proofs without changing the resulting security "challenges." In practice, this could allow a malicious actor to forge valid-looking proofs, potentially leading to the acceptance of fraudulent transactions or data in systems relying on this library.
Technical details
A vulnerability in the MultiField32Challenger component of Plonky3 breaks the binding property of the Fiat-Shamir transformation. The flaw stems from three primary issues: partial-chunk aliasing during absorption due to a lack of length markers, non-injective squeezing where distinct values produce identical challenge sequences after modular reduction, and high-bit truncation when observing hashes (e.g., BN254) where bits are silently discarded. These issues allow a prover to craft distinct transcripts that result in identical challenges. An attacker can exploit this to perform selective forgery or break the soundness of the proof system. The issue is fixed in versions 0.4.3 and 0.5.3.
Affected products
- Plonky3 Plonky3 (p3-challenger) < 0.4.3, < 0.5.3
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE-2026-46654 published to NVD