---
title: "Over-constrained circuits and completeness failures"
description: "The circuit rejects witnesses that correspond to correct executions: a range check tighter than the specification, an edge case such as zero or the field's…"
type: "failure-mode"
url: "https://zkpick.com/audit/failure-modes/over-constrained-circuits-and-completeness-failures/"
section: "03 Auditing a ZK protocol"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/audit/failure-modes/over-constrained-circuits-and-completeness-failures.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Over-constrained circuits and completeness failures

The circuit rejects witnesses that correspond to correct executions: a range check tighter than the specification, an edge case such as zero or the field's maximum value, or a constraint that assumes an invariant the honest prover does not always satisfy. No forged proof results, so the bug is invisible to soundness tooling, but a user with a legitimate claim cannot produce a proof — funds are stuck, a withdrawal path is dead, or a rollup cannot progress until the circuit is redeployed.

**Mitigation:** Test completeness deliberately: generate valid witnesses across boundary values and assert the proof is produced, fuzz against a reference implementation for rejected-but-valid inputs, and include completeness in the bug-bounty scope. Tools that vet completeness as well as soundness exist for zkVMs and some circuit pipelines.