Security Audit Report for Atoshi's atoshi-privacy-circuits

The target of this audit is the private code repository of atoshi-privacy-circuits of Atoshi. The atoshi-privacy-circuits project is a Circom/Groth16 zero-knowledge circuit system for shielded transactions. It contains three core circuits. Shield creates private note commitments for deposits. Unshield proves note ownership and enables withdrawals with nullifierbased double-spend protection. Transfer spends an existing note and creates a new note while preserving asset consistency.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we have found that the codebase contains 4 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as recommendations and notes that should be considered. The atoshi-privacy-circuits team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.