A note on the security of the BitVM3 garbling scheme

We provide minimal counterexamples for the security of the BitVM3 garbling scheme presented in the BitVM3 🔗whitepaper.

Our attack allows the evaluator to forge input and output wires. Then we use the same idea to exhibit an attack on the forward label propagation garbling scheme proposed in the Instantiating BitVM3 from Label Forward Propagation 🔗whitepaper. In both cases, the authenticity property of the garbling scheme is broken.

Read our findings 🔗here: A note on the security of the BitVM3 garbling scheme