{
  "type": "failure-mode",
  "name": "Missing nullifier or replay protection",
  "slug": "missing-nullifier-or-replay-protection",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/failure-modes/missing-nullifier-or-replay-protection/",
  "markdown": "https://zkpick.com/md/audit/failure-modes/missing-nullifier-or-replay-protection.md",
  "detail": "A valid proof can be submitted more than once, or across chains, contracts or epochs, because nothing binds it to a single use. Nullifier derivation may also be malleable, allowing distinct nullifiers for the same underlying secret.",
  "mitigation": "Bind proofs to a domain, a chain identifier and a spending context; constrain nullifier derivation to be deterministic and collision-resistant in the circuit; check the nullifier set atomically with the state change.",
  "relatedOptions": [],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/failure-modes/missing-nullifier-or-replay-protection/",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "authors": [
    "MarketComp"
  ]
}