03 — Auditing · Failure mode

Unsound Fiat–Shamir transcripts

Challenges are derived from a hash that omits values it must bind — public inputs, commitments, or protocol parameters. A prover can then choose those values after seeing the challenge and forge proofs for false statements. Publicly known as the 'Frozen Heart' class, found across multiple independent implementations.

By MarketComp Updated 2026-09-12 v1.3 About the authors Changelog

Mitigation

Hash the complete transcript, in a fixed order, including all public inputs and every commitment, with domain separation. Compare the implementation against the paper's transcript definition line by line rather than assuming the library handles it.

Cite this page

MarketComp (2026). Unsound Fiat–Shamir transcripts. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/audit/failure-modes/unsound-fiat-shamir-transcripts/

@misc{zkfieldmanual-unsound-fiat-shamir-transcripts,
  title        = {Unsound Fiat–Shamir transcripts — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/audit/failure-modes/unsound-fiat-shamir-transcripts/}},
  note         = {Accessed: YYYY-MM-DD}
}