In the previous article, we explained the inherent malleability vulnerability in the Groth16 proof system theoretically.<a href="https://glacier-screen-c36.notion.site/Beosin-s-Research-Transaction-Malleability-Attack-of-Groth16-Proof-c090649950804af686e276baa3ba8182" rel="noopener noreferrer nofollow">https://glacier-screen-c36.notion.site/Beosin-s-Research-Transaction-Malleability-Attack-of-Groth16-Proof-c090649950804af686e276baa3ba8182</a>In this article, we take the Tornado.Cash project as an example, modifying parts of its circuit and code to demonstrate malleability attack flows and the corresponding mitigations in the project, hoping to raise awareness for other zkp projects. Tornado.Cash uses the snarkjs library with the following development flow, so we&#39;ll dive right in - please refer to the first article in the series if you are unfamiliar with the library.<h2 id="header-0">1 Tornado.Cash Structure</h2>There are 4 main entities in the interaction flow of Tornado.Cash:<ul><li>User: Uses this DApp to conduct private coin mixing transactions, including deposits and withdrawals.</li></ul><img src="https://academy-public.coinmarketcap.com/optimized-uploads/d00bef325c7f4d31be93fbfaf92dc03f.png" />Source: <a href="https://docs.circom.io/" rel="noopener noreferrer nofollow">https://docs.circom.io/</a><ul><li>Web page: The frontend web page of the DApp, contains some user buttons.</li><li>Relayer: To prevent on-chain nodes from recording privacy-related info like IP addresses, this server replays transactions on behalf of users to further enhance privacy.</li><li>Contract: Contains a proxy contract Tornado.Cash Proxy, which selects the specified Tornado pool based on deposit/withdrawal amounts. Currently there are 4 pools for amounts: 0.1, 1, 10, 100.</li></ul>First the user initiates deposit or withdrawal on Tornado.Cash frontend. Then the Relayer forwards the transaction request to the Tornado.Cash Proxy contract on-chain, which further forwards it to the corresponding Pool based on amount, and finally performs the deposit/withdrawal processing. The architecture is as follows:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/d06a870fae3e4c99afddc386875fbf58.png" />As a coin mixer, Tornado.Cash has two main business functions:<ul><li>deposit: When a user makes a deposit, they first select the token (BNB, ETH etc) and amount on the frontend. To better ensure privacy, only 4 preset amounts can be deposited.</li></ul><img src="https://academy-public.coinmarketcap.com/optimized-uploads/7660bb1368874bf78f8eb08281ca34a7.png" />Source: <a href="https://ipfs.io/ipns/tornadocash.eth/" rel="noopener noreferrer nofollow">https://ipfs.io/ipns/tornadocash.eth/</a>The server then generates two 31-byte random numbers - nullifier and secret. Concatenating and hashing them generates the commitment. The nullifier &#43; secret is returned to the user as a note, like below:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/2a178c35f70f49d69bddc7e8688ac7cd.png" />Then a deposit transaction is initiated, sending the commitment to the on-chain Tornado.Cash Proxy contract. The proxy forwards the data to the corresponding Pool based on deposit amount. Finally the Pool contract inserts the commitment as a leaf node into the merkle tree, and stores the computed root in the Pool contract.<ul><li>withdraw: When a user makes a withdrawal, they first enter the note data returned during deposit, and recipient address on the frontend;</li></ul><img src="https://academy-public.coinmarketcap.com/optimized-uploads/fbeec70cb6ae4453b2d2cd0c9638d575.png" />The server then retrieves all Tornado.Cash deposit events off-chain, withdraws the commitments to build a local merkle tree, and uses the user provided note (nullifier &#43; secret) to generate the commitment and corresponding merkle path and root. This is input into a circuit to obtain a zero-knowledge SNARK proof. Finally, a withdraw transaction is initiated to the on-chain Tornado.Cash Proxy contract, which forwards it to the corresponding Pool to verify the proof, and sends the money to the user&#39;s specified receiving address.The core of Tornado.Cash&#39;s withdraw is to prove that a certain commitment exists in the Merkle tree without revealing the user&#39;s nullifier and secret.The Merkle tree structure is as follows:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/b109e9a109384bffb2fe87224b48b3a8.png" /><h2 id="header-1">2 Tornado.Cash Vulnerable Version After Modification</h2><h3 id="2-1-tornado-cash-strong-modification-strong">2.1 Tornado.Cash Modification</h3>Based on the previous article about Groth16 malleability attack principles, we know attackers can generate multiple different Proofs using the same nullifier and secret, so if developers don&#39;t consider replay attacks leading to double-spending, it can threaten project funds. Before modifying Tornado.Cash, this article will first introduce the Pool contract code that handles withdraws in Tornado.Cash:<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/846ad6e76a5c47a790d2e063c93e191d.png" />As shown in the image above, to prevent attackers from double spending using the same Proof, while not revealing the nullifier and secret, Tornado.Cash added a public signal called nullifierHash in the circuit, which is the Pedersen hash of the nullifier, and can be passed as a parameter on-chain. The Pool contract then uses this variable to check if a valid Proof has been used before. However, what if instead of modifying the circuit, the project simply records Proofs to prevent double spending attacks? This would reduce circuit constraints and save costs, but would it work?To test this hypothesis, this article will remove the added nullifierHash public signal from the circuit, and change the contract verification to just check the Proof. Since Tornado.Cash retrieves all deposit events to build the merkle tree on each withdraw, then verifies if the root values are within the last 30 generated, which is cumbersome, this article will also remove the merkleTree circuit, leaving just the core withdraw logic, as follows:<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/e625d2a0e4b549a1a4251bf94c8a8044.png" /><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/38cde1aa61e648268f4a34da7ed6fe4d.png" />Note: We discovered during the experiments that the latest TornadoCash code on GitHub lacks output signals in the withdraw circuit, requiring manual fixes to run properly. &#xff08;<a href="https://github.com/tornadocash/tornado-core**%EF%BC%89**" rel="noopener noreferrer nofollow">https://github.com/tornadocash/tornado-core**&#xff09;**</a>Based on the modified circuit above, following the development process outlined earlier using snarkjs etc, a normal Proof is generated, denoted as proof1:<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/fcb44ffc5da14d3585d033ccf2a66951.png" /><h3 id="2-2-strong-experimental-verification-strong">2.2 Experimental Verification</h3>2.2.1 Verification with Default circom ContractFirst we use the default contract generated by circom. Since it does not record any used Proof info, attackers can replay proof1 multiple times to achieve double-spending attacks. In the following experiment, the same input&#39;s proof can be replayed unlimited times and still pass verification.<img src="https://academy-public.coinmarketcap.com/optimized-uploads/9945d9b89e5e403ab493bb7ab4a95727.png" />The image below shows proof1 passing verification in the default contract, including the Proof parameters A, B, C from the previous article, and the final result:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/4ad7d95863034061bbdee6a116a5e450.png" />The next image shows the results of calling the verifyProof function multiple times with the same proof1. The experiment finds that for the same input, no matter how many times proof1 is used by the attacker, it always passes:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/27a4be1c6fa141d597463ac2fd49b7b2.png" />Testing in the native snarkjs js library also does not defend against reused Proofs, with results as follows:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/7b348a04f67b4b81a008e361d842a6f2.png" />2.2.2 Verification with Basic Anti-Replay ContractTo fix the replay vulnerability in the default circom contract, this article records a value from the valid Proof(proof1) to prevent replaying already verified proofs for double-spending attacks, as shown below:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/3cbd7e515c6540bf914289fcd216342a.png" />Continuing to verify with proof1, the experiment finds the transaction reverts with &#34;The note has been already spent&#34; when reusing the same proof, as shown:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/8152f8f3de6c40e29133dfe58620cff4.png" />However, although this achieves the goal of preventing basic proof replay attacks, as covered earlier Groth16 has malleability vulnerabilities that can bypass this. The following PoC constructs a forged SNARK proof for the same input based on the algorithm from previous article, and it still passes verification. The PoC code to generate forged proof2 is:<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/9f1e1c110c344be6b767d7e4a3b310b2.png" /><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/9fbbc5e1f03d48af82fdc3a7b936cb8f.png" />The generated forgery PROOF2 is shown below:<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/27388f64237a42058d878ddffbd6137d.png" />Again using this parameter to call verifyProof function for proof verification, the experiment found that the same input in the case of using proof2 verification has passed again, as shown below:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/e6e0627b8fe44b16a41c34ca184c01ff.png" />Although the forged proof2 can only be used once more, since there are nearly unlimited forged proofs for the same input, this could lead to contract funds being withdrawn unlimited times.Testing in the circom js library also shows proof1 and the forged proof2 passing verification:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/0dc82b9eb8884eb0afb845b2c73712ff.png" />2.2.3 Verification with Tornado.Cash Anti-Replay ContractAfter so many failed attempts, is there no way to solve this once and for all? Here, following Tornado.Cash&#39;s method of checking if the original input has been used, this article further modifies the contract code as:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/0c5069c673ff4641ac0cbabd2500c576.png" />It should be noted that to demonstrate simple mitigations against Groth16 malleability attacks, this article takes the approach of directly recording original circuit inputs, which does not conform to zero knowledge principles of keeping inputs private. For example in Tornado.Cash the inputs are private, so a new public input is added to identify a proof. Since this article&#39;s circuit does not add an identifier, the privacy is poorer compared to Tornado.Cash - this is just an experimental demo. The results are as follows:<img src="https://academy-public.coinmarketcap.com/optimized-uploads/5827214ef68e4a11ab83f8c54c12cb83.png" />It can be seen that with the same input, only the first proof1 passes verification. After that, both proof1 and the forged proof2 cannot pass verification.<h2 id="header-2">3 Summary and Recommendations</h2>Through modifying TornadoCash&#39;s circuit and using the default contract verification generated by the commonly used Circom, this article has verified the existence and risks of replay vulnerabilities. It further proves that using common measures at the contract level can defend against replay attacks, but cannot prevent Groth16 malleability attacks. Based on this, we suggest Zero Knowledge Proof projects note the following during development:<ul><li>Unlike traditional DApps that use unique addresses to generate node data, zkp projects typically use combined random numbers to generate Merkle tree nodes. Pay attention if business logic allows inserting duplicate node values, as the same leaf node data can lead to some user funds being locked in contracts, or the same leaf data having multiple Merkle Proofs confusing business logic.</li><li>zkp projects typically record used Proofs in a mapping to prevent double-spending attacks. When using Groth16, malleability attacks exist, so recording should use original node data rather than just Proof data.</li><li>Complex circuits can have circuit uncertainty, lack of constraints etc, leading to incomplete validation conditions and logical vulnerabilities in contracts. We strongly recommend projects seek comprehensive audits from security audit firms well-versed in circuits and contracts before launch, to ensure security.</li></ul>Beosin is a leading global blockchain security company co-founded by several professors from world-renowned universities and there are 40&#43; PhDs in the team, and set up offices in 10&#43; cities including Hong Kong, Singapore, Tokyo and Miami. With the mission of &#34;Securing Blockchain Ecosystem&#34;, Beosin provides &#34;All-in-one&#34; blockchain security solution covering Smart Contract Audit, Risk Monitoring &amp; Alert, KYT/AML, and Crypto Tracing. Beosin has already audited more than 3000 smart contracts including famous Web3 projects PancakeSwap, Uniswap, DAI, OKSwap and all of them are monitored by Beosin EagleEye. The KYT AML are serving 100&#43; institutions including Binance.<h2 id="header-3">Contact</h2>If you need any blockchain security services, welcome to contact us:<a href="https://beosin.com/" rel="noopener noreferrer nofollow">Official Website</a> <a href="https://eagleeye.beosin.com/ProjectSearch" rel="noopener noreferrer nofollow">Beosin EagleEye</a> <a href="https://twitter.com/Beosin_com" rel="noopener noreferrer nofollow">Twitter</a> <a href="https://t.me/beosin" rel="noopener noreferrer nofollow">Telegram</a> <a href="https://www.linkedin.com/company/beosin" rel="noopener noreferrer nofollow">Linkedin</a>

Exploring Tornado Cash In-Depth to Reveal Malleability Attacks in ZKP Projects

Table of Contents

Beosin

Other articles published on Aug 7, 2023

Outpost Season 15 - Sky Shield & Terminator 07/08/23 @ 00:00 UTC FOR 24HRS

Kava Price Prediction: Can KAVA Coin Make A Comeback Again?

Ethereum Price Prediction: Will ETH Crypto Skip Consolidation?

XRP and Litecoin (LTC) See Epic $1 Million Inflows Amid Bitcoin Exodus

Riding the Bull: Borroe ($ROE) Raises $250,000, Shaking Up Uniswap (UNI) and Arbitrum (ARB) Markets

US Congressman: Stablecoins have Promise if Regulated Properly!

Join our free newsletter for daily crypto updates!