Phase 2 never run: shipping the initial zkey
The circuit-specific phase is initialised from a phase-1 file and the resulting key is deployed without a single phase-2 contribution. In that state the verifying key's gamma and delta are both the G2 generator rather than independent secrets, and a prover can cancel the corresponding terms of the verification equation and forge a proof for any statement without a witness. Every other control — a reputable phase 1, a verified transcript, an audited circuit — is satisfied, and the system is still unsound. This is the only setup failure that has produced real losses: in late February 2026 two deployed protocols were drained through exactly this gap, roughly $1.4 million from one and a few thousand dollars from the other, within a week of each other.
Treat phase 2 as mandatory for any circuit-specific setup, even a single contribution by the team. Assert in CI and in the deployment checklist that the contribution count is non-zero and that gamma and delta differ from the generator and from each other. Auditors reviewing a Groth16 verifier should check the deployed key for this condition explicitly.
Related pages
Cite this page
MarketComp (2026). Phase 2 never run: shipping the initial zkey. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/ceremony/failure-modes/phase-2-never-run-shipping-the-initial-zkey/
@misc{zkfieldmanual-phase-2-never-run-shipping-the-initial-z,
title = {Phase 2 never run: shipping the initial zkey — The ZK Field Manual},
author = {MarketComp},
year = {2026},
version = {1.3},
howpublished = {\url{https://zkpick.com/ceremony/failure-modes/phase-2-never-run-shipping-the-initial-zkey/}},
note = {Accessed: YYYY-MM-DD}
}