Commitment Issues: Unverified Evaluations in Dusk's PLONK
Summary
Otter Audits details a critical soundness bug in Dusk Network's dusk-plonk PLONK implementation, where four public selector evaluations were fed into the verifier without corresponding opening proofs, enabling forged proofs that could mint DUSK. The article explains the bug, exploit path, and the fix that adds these evaluations to the KZG batch, plus calls for standardization to prevent similar issues.