One support cell short
Hekate 0.37.0 postmortem: in 0.35.0 and 0.36.0, a zero-knowledge proof could confirm a guess of its own witness. The fix costs one field element per proof.
Postmortem
What broke in a Hekate release, how it was found and what changed.
6 articles
Columns only the bus read
Hekate 0.36.0 postmortem: five soundness gaps, three with forgeries that 0.35.0 accepted, and the ordered service buses that close them.
The estimate that chose its own geometry
Hekate 0.35.0 postmortem: the security level was overstated, and 0.35.0 restates it at 100 bits that follow from published theorems. No forgery is known.
Liveness was a witness
Hekate 0.34.0 postmortem: the prover decided whether a block existed, and the same decision switched off the constraints that policed it.
Shapes the honest prover never builds
Hekate 0.33.0 postmortem: seven soundness gaps across the Keccak and AES chiplets. Both computed their round functions correctly; neither proved its cipher.
Three unbound values
Hekate 0.32.0 postmortem: three soundness failures found in our own prover, two of them total breaks confirmed with a proof-of-concept prover.