03 — Auditing · Failure mode

Non-deterministic or malleable witness generation

More than one witness satisfies the constraints for the same logical input, allowing an attacker to produce a distinct valid proof for the same action — which breaks any logic that assumed proofs or their derived values are unique.

By MarketComp Updated 2026-09-12 v1.3 About the authors Changelog

Mitigation

Constrain witness generation to a canonical form. Where uniqueness matters downstream, enforce it in the circuit rather than relying on the honest prover implementation.

Cite this page

MarketComp (2026). Non-deterministic or malleable witness generation. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/audit/failure-modes/non-deterministic-or-malleable-witness-generation/

@misc{zkfieldmanual-non-deterministic-or-malleable-witness-g,
  title        = {Non-deterministic or malleable witness generation — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/audit/failure-modes/non-deterministic-or-malleable-witness-generation/}},
  note         = {Accessed: YYYY-MM-DD}
}