Search results

Soundness bug: under-constrained usage of find_dot in assert_payloads_match

Status: Open.

#21 In shield-labs/zklogin;

· anon-researchers-123 opened on Jun 20, 2026

Soundness bug: Account impersonation: extracted JWT fields aren't bound to the signed token

Status: Open.

#20 In shield-labs/zklogin;

· anon-researchers-123 opened on May 25, 2026

Unconstrained dot_index Enables Full JWT Spoofing

Status: Open.

#19 In shield-labs/zklogin;

· imxm opened on May 13, 2026

Use poseidon2 instead of pedersen

Status: Open.

#15 In shield-labs/zklogin;

· olehmisar opened on Jan 13, 2025

set salt to non-0 to avoid privacy leaks

Status: Open.

#14 In shield-labs/zklogin;

· olehmisar opened on Dec 31, 2024

better public key oracle

Status: Open.

#13 In shield-labs/zklogin;

· olehmisar opened on Dec 21, 2024

·  

MVP

OpenID account is leaked because salt is 0

bugSomething isn't workingSomething isn't working

Status: Open.

#12 In shield-labs/zklogin;

· olehmisar opened on Dec 21, 2024

·  

MVP

Investigate forking/using authjs

good first issueGood for newcomersGood for newcomers

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#11 In shield-labs/zklogin;

· olehmisar opened on Dec 20, 2024

·  

MVP

Stop committing artifacts

good first issueGood for newcomersGood for newcomers

Status: Open.

#10 In shield-labs/zklogin;

· olehmisar opened on Dec 20, 2024

·  

MVP

Migrate to noir-jwt

Status: Open.

#9 In shield-labs/zklogin;

· olehmisar opened on Dec 20, 2024

Support Apple authentication

Status: Open.

#8 In shield-labs/zklogin;

· olehmisar opened on Dec 20, 2024

·  

MVP