Zellic - Audit Reports

Assessment reports Public findings

Back to Zellic site

Assessment reports>Barretenberg Bigfield

GeneralOverview

Findings

Informational (2)

DiscussionMaturity of the codebase and lack of specifications Concrete examples for assumptions for bounds and how to document them Undocumented assumption regarding meaning of bigfield fields Functioning of evaluate_non_native_field_multiplication Assumptions regarding bit width of the modulus Behavior in simulator mode Handling of too large ranges in uint256_t::slice Missing maximum-bit number checks in constructor Fix for decompose_into_bits Overflow checks for unreduced elements Prime limb witness indexes equality check in operator- and operator+Inefficient loops Possible shaper bounds Unnecessary assert in mul_product_overflows_crt_modulus Unnecessary reductons in operator+Unreachable code Misleading names of functions or variables Improvements for comments/documentation

Audit ResultsAssessment Results

Aztec

July 23, 2024

Barretenberg Bigfield

Findings Impact LevelCount

Critical7

High0

Medium2

Low6

Informational2

Prepared by

Mohit SharmaEngineer[email protected]

Malte LeipEngineer[email protected]

Sylvain PelissierEngineer[email protected]

About

Aztec contributed the following description of Barretenberg Bigfield:

Aztec is a privacy-first L2 on Ethereum.

Executive Summary

Zellic conducted a security assessment for Aztec from June 20th to July 9th, 2024. During this engagement, Zellic reviewed Barretenberg Bigfield's code for security vulnerabilities, design issues, and general weaknesses in security posture.

Zellic © 2025Back to top ↑