@zksecurityXYZ discussed common anti-patterns in Circom programming in blog, focusing on non-constraint operator assert and <--, and alias attacks caused by finite field arithmetic. @zksecurityXYZ 在博客中讨论了Circom编程中的常见反模式,重点介绍了断言(assert)不添加约束、提示(<--)不受约束以及有限域算术导致的别名攻击等问题。
Notes
assert would not generate constraints, only used for template parameter security checks.
Manual constraints must be added when using the <-- operator to prevent security vulnerabilities.
Finite field arithmetic may cause alias attacks, especially when encoding numbers.
Bits2Num_strict and Num2Bits_strict can be used to prevent alias attacks.
Developers should avoid using assert for signals and should only use it for template parameters.
Separating computation and constraints can improve performance, but all calculations must be appropriately constrained.