triwidodo99/veilo-bounty-report

This repository is a security audit report, not a piece of software you install or run. It documents a review of VeiloLayer's privacy_pool smart contract, a program built with the Anchor framework that runs on the Solana blockchain. The audit was written by an independent security researcher as part of a paid bug bounty program hosted on Superteam Earn, where the researcher was rewarded $2,000 in USDC for finding a critical severity issue. The report explains that a low level security review was done on the contract's code, focused on ways an attacker could steal funds directly, spend the same private note twice, drain a shared pool of funds without permission, or bypass the zero knowledge proof checks the system relies on to keep transactions private and valid. Zero knowledge proofs, often shortened to ZK-SNARKs, are a cryptographic method that lets someone prove a transaction is valid without revealing its private details. The review found two critical severity problems and one medium severity problem. One critical issue involves a way to replay a proof and mint duplicate private notes, draining the fund pool. The other critical issue describes a code path that lets certain trades skip debiting the vault, which could inflate the pool's reported balance and eventually let someone steal real funds. The medium severity issue is a subtle math bug in how the code checks equality against a cryptographic modulus, which could let an attacker sneak an invalid value past the system's checks. Each finding has its own detailed writeup file linked from the main report, describing the specific code involved and the impact. The audit covers the main smart contract files, including transaction handling, cross pool swaps, integrations with other Solana trading protocols, and the Merkle tree and proof verification logic, but does not cover the frontend, third party protocols, or the correctness of the underlying ZK circuit design itself.