Firo — Audit — AnticsDecoded

/audits / FIRO.cpp

cat /audits/FIRO.cpp

NODE: PRIVATE

Privacy L1 (Spark)

// engagement

protocolFiro

categoryPrivacy L1 (Spark)

kindprivate · Private

date2026-06

duration1 week

languageC++

chainsFiro

nSLOC920

reportview report ↗

// findingsNODE: 1 FND

critical0

high0

medium1

low0

info0

gas0

// summary

Private disclosure to the Firo team for the Spark shielded-payment protocol in the Firo C++ node, covering a Spark proof/vector-dimension validation gap reachable through spend processing. Validated by the team but classified as a prior-fixed duplicate.

// methodology

Manual review
PoC development
Differential analysis

// scope

pathnsloc

src/libspark/chaum.cpp320

src/libspark/*600

total920

// findings

M-01mediummitigated

Malformed Spark proof/vector dimensions could crash node-side validation

Malformed Spark proof/vector dimensions with zero-sized input vectors passed the basic dimension check, letting verifier-side processing proceed into an invalid state and crash node-side validation (node availability). Reported privately and validated, but classified as a valid prior-fixed duplicate — the `n == 0` guard was added in PR #1805 (`89456e21`) and shipped in v0.14.16.1 before disclosure.