Notes

• Output constraints are common vulnerabilities, such as IsEqual output not forced to 1 can be exploited by malicious users
• Input assumptions can cause AND gate output errors, need to add boolean constraints like flag*(flag-1)=0
• Circom comparison operators are based on signed integers, val function maps elements to (-p/2, p/2] interval
• Large integer templates like BigLessThan output without constraints can allow out-of-bound inputs, need to explicitly check outputs
• Security best practices: always explicitly constrain component outputs and inputs, avoid relying on implicit assumptions
• Comparison operators' signed semantics may cause p/2 > p/2+1 etc. counterintuitive results, need to pay attention to witness generation

• 输出约束缺失是常见漏洞源，如IsEqual输出未强制为1可被恶意利用
• 输入假设未验证可导致AND门输出错误，需添加布尔约束如flag*(flag-1)=0
• Circom比较运算符基于有符号整数，val函数映射元素到(-p/2, p/2]区间
• 大整数模板如BigLessThan输出未约束可允许越界输入，需显式检查输出
• 安全最佳实践：始终显式约束组件输出和输入，避免依赖隐式假设
• 比较运算符的有符号语义可能导致p/2 > p/2+1等反直觉结果，需在见证生成时注意