{
  "type": "failure-mode",
  "name": "Phase 2 never run: shipping the initial zkey",
  "slug": "phase-2-never-run-shipping-the-initial-zkey",
  "section": {
    "id": "ceremony",
    "number": "04",
    "title": "Running or reusing a trusted setup",
    "url": "https://zkpick.com/ceremony/"
  },
  "url": "https://zkpick.com/ceremony/failure-modes/phase-2-never-run-shipping-the-initial-zkey/",
  "markdown": "https://zkpick.com/md/ceremony/failure-modes/phase-2-never-run-shipping-the-initial-zkey.md",
  "detail": "The circuit-specific phase is initialised from a phase-1 file and the resulting key is deployed without a single phase-2 contribution. In that state the verifying key's gamma and delta are both the G2 generator rather than independent secrets, and a prover can cancel the corresponding terms of the verification equation and forge a proof for any statement without a witness. Every other control — a reputable phase 1, a verified transcript, an audited circuit — is satisfied, and the system is still unsound. This is the only setup failure that has produced real losses: in late February 2026 two deployed protocols were drained through exactly this gap, roughly $1.4 million from one and a few thousand dollars from the other, within a week of each other.",
  "mitigation": "Treat phase 2 as mandatory for any circuit-specific setup, even a single contribution by the team. Assert in CI and in the deployment checklist that the contribution count is non-zero and that gamma and delta differ from the generator and from each other. Auditors reviewing a Groth16 verifier should check the deployed key for this condition explicitly.",
  "relatedOptions": [],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/ceremony/failure-modes/phase-2-never-run-shipping-the-initial-zkey/",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "authors": [
    "MarketComp"
  ]
}