---
title: "Unsound Fiat–Shamir transcripts"
description: "Challenges are derived from a hash that omits values it must bind — public inputs, commitments, or protocol parameters."
type: "failure-mode"
url: "https://zkpick.com/audit/failure-modes/unsound-fiat-shamir-transcripts/"
section: "03 Auditing a ZK protocol"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/audit/failure-modes/unsound-fiat-shamir-transcripts.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Unsound Fiat–Shamir transcripts

Challenges are derived from a hash that omits values it must bind — public inputs, commitments, or protocol parameters. A prover can then choose those values after seeing the challenge and forge proofs for false statements. Publicly known as the 'Frozen Heart' class, found across multiple independent implementations.

**Mitigation:** Hash the complete transcript, in a fixed order, including all public inputs and every commitment, with domain separation. Compare the implementation against the paper's transcript definition line by line rather than assuming the library handles it.