Description
Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Plonky3 | Plonky3 | < 0.4.3, >= 0.5.0, < 0.5.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | p3-challenger | < 0.4.3 | 0.4.3 | GHSA-vj64-rjf3-w3v7 |
| crates.io | p3-challenger | >= 0.5.0, < 0.5.3 | 0.5.3 | GHSA-vj64-rjf3-w3v7 |