03 — Auditing · Failure mode

Missing nullifier or replay protection

A valid proof can be submitted more than once, or across chains, contracts or epochs, because nothing binds it to a single use. Nullifier derivation may also be malleable, allowing distinct nullifiers for the same underlying secret.

By MarketComp Updated 2026-09-12 v1.3 About the authors Changelog

Mitigation

Bind proofs to a domain, a chain identifier and a spending context; constrain nullifier derivation to be deterministic and collision-resistant in the circuit; check the nullifier set atomically with the state change.

Cite this page

MarketComp (2026). Missing nullifier or replay protection. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/audit/failure-modes/missing-nullifier-or-replay-protection/

@misc{zkfieldmanual-missing-nullifier-or-replay-protection,
  title        = {Missing nullifier or replay protection — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/audit/failure-modes/missing-nullifier-or-replay-protection/}},
  note         = {Accessed: YYYY-MM-DD}
}