{
  "type": "failure-mode",
  "name": "Underconstrained signals",
  "slug": "underconstrained-signals",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/failure-modes/underconstrained-signals/",
  "markdown": "https://zkpick.com/md/audit/failure-modes/underconstrained-signals.md",
  "detail": "The circuit admits witnesses that do not correspond to any correct execution: an intermediate value is computed in the witness but never constrained, or a constraint is weaker than the property intended. The proof verifies; it just proves less than everyone believed. This is the single most common exploitable ZK defect class.",
  "mitigation": "Run automated underconstrained-signal detection; review that every witness-assigned value is also constrained; fuzz for accepted-but-invalid witnesses rather than only checking valid ones are accepted.",
  "relatedOptions": [
    {
      "name": "Automated underconstraint detection",
      "url": "https://zkpick.com/audit/automated-underconstraint-detection/"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/failure-modes/underconstrained-signals/",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "authors": [
    "MarketComp"
  ]
}