AIKIDO-2025-10669

TL;DR

Affected versions of this package are vulnerable to a Weak Fiat-Shamir implementation due to an incorrect commitment processing bug where the deduplicated commitment count (num_commitments) was used with the original, potentially duplicate-containing array (commitments_bytes) for challenge computation, instead of the deduplicated array (unique_commitments). This mismatch could cause the system to generate a cryptographic challenge based on an incorrect subset of data, for example, using [commitment_a, commitment_a] instead of the intended unique set [commitment_a, commitment_b]. An attacker could potentially exploit this by strategically submitting duplicate commitments to manipulate the challenge value, which would allow them to influence the protocol's outcome or compromise its security guarantees, although exploitation is considered difficult.