AIKIDO-2026-10494

TL;DR

Affected versions of this package are vulnerable to timing side-channel attacks due to non-constant-time comparison in DLEQ proof verification. The affected verifyDLEQProof logic compares byte arrays using standard equality checks that may return early on mismatch, causing observable timing differences based on the input. An attacker able to measure these timing variations can gradually infer valid proof values or secret-dependent data, potentially compromising the integrity of the verification process.