---
title: "Non-deterministic or malleable witness generation"
description: "More than one witness satisfies the constraints for the same logical input, allowing an attacker to produce a distinct valid proof for the same action…"
type: "failure-mode"
url: "https://zkpick.com/audit/failure-modes/non-deterministic-or-malleable-witness-generation/"
section: "03 Auditing a ZK protocol"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/audit/failure-modes/non-deterministic-or-malleable-witness-generation.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Non-deterministic or malleable witness generation

More than one witness satisfies the constraints for the same logical input, allowing an attacker to produce a distinct valid proof for the same action — which breaks any logic that assumed proofs or their derived values are unique.

**Mitigation:** Constrain witness generation to a canonical form. Where uniqueness matters downstream, enforce it in the circuit rather than relying on the honest prover implementation.