{
  "type": "failure-mode",
  "name": "Unsound Fiat–Shamir transcripts",
  "slug": "unsound-fiat-shamir-transcripts",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/failure-modes/unsound-fiat-shamir-transcripts/",
  "markdown": "https://zkpick.com/md/audit/failure-modes/unsound-fiat-shamir-transcripts.md",
  "detail": "Challenges are derived from a hash that omits values it must bind — public inputs, commitments, or protocol parameters. A prover can then choose those values after seeing the challenge and forge proofs for false statements. Publicly known as the 'Frozen Heart' class, found across multiple independent implementations.",
  "mitigation": "Hash the complete transcript, in a fixed order, including all public inputs and every commitment, with domain separation. Compare the implementation against the paper's transcript definition line by line rather than assuming the library handles it.",
  "relatedOptions": [],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/failure-modes/unsound-fiat-shamir-transcripts/",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "authors": [
    "MarketComp"
  ]
}