zkBob Private Wallet

**zkBob has published a detailed post-mortem** following a security vulnerability discovery in their privacy protocol. **Key Details:** - Full vulnerability analysis now available in [zkBob documentation](https://docs.zkbob.com/zkbob-overview/vulnerability-post-mortem) - All pools operating in **withdraw-only mode** with fixes deployed - Users strongly advised to withdraw funds immediately - Withdrawals are safe but **will not process instantly** **What Users Should Do:** - Review the post-mortem for specific actions required - Proceed with withdrawals from all pools via [zkBob app](https://app.zkbob.com/) - Expect processing delays for submitted withdrawals The post-mortem covers the vulnerability's cause, implemented remediations, and necessary user actions for anyone holding funds in zkBob pools.

**zkBob** has announced that a comprehensive post-mortem report on a recently discovered vulnerability will be released later this week. - The report will provide detailed information about the security issue - No specific details about the vulnerability's nature or impact have been disclosed yet - This follows a pattern of transparency, similar to previous incidents like the CoW Swap vulnerability disclosure in April zkBob is a privacy-focused protocol that enables anonymous token transfers using zero-knowledge proofs. The platform supports WETH, ETH, USDC, and BOB tokens, allowing users to make private transactions without exposing amounts or recipients. The upcoming post-mortem is expected to include root cause analysis and any implemented security measures. Users should monitor official zkBob channels for the full report.

zkBob is transitioning to a new withdrawal mechanism for its privacy pools. **Key Changes:** - Users exiting USDC or ETH pools will receive **on-chain claims** instead of immediate transfers - Claims will be processed on a **regular schedule** - Expected redemption rate: **1:1** for the underlying assets This withdrawal phase represents a shift in how users access their funds from the privacy-focused protocol. The claim-based system introduces a processing delay compared to instant withdrawals, though the protocol maintains that full redemption value will be preserved. zkBob continues to offer private token transfers using zero-knowledge proofs, supporting WETH, ETH, USDC, and BOB tokens.

**zkBob**, a privacy-focused token transfer protocol, has announced plans to roll out a fix and enable **withdrawal-only mode within approximately one week**. **Key Details:** - A detailed technical report will be published before withdrawals resume, explaining the issue and remediation process in full - Clear instructions will be provided to users on how to withdraw funds safely - All user funds remain safe, with losses fully covered by protocol insurance - Withdrawals are anticipated to be re-enabled before April 19th zkBob specializes in secure, anonymous token transfers for WETH, ETH, USDC, and BOB. The protocol uses zero-knowledge proofs to keep transaction amounts and recipients private, routing transfers through relayers to abstract gas fees. Users should watch for the upcoming technical report and withdrawal instructions before attempting to access their funds.

**zkBob has temporarily paused all pools** as a precautionary measure while deploying a fix to its circuits and verifier contracts. **Key Updates:** - Circuit and verifier contract updates are being deployed on Polygon and Optimism - All pools will reopen in **withdrawal-only mode** once the upgrade is complete - Deposits and internal transfers will remain disabled - Existing pools will be gradually wound down The privacy-focused protocol is taking these steps to ensure users can safely withdraw their funds. No timeline has been provided for when withdrawals will resume.

**Security Vulnerability Identified** zkBob's internal security review uncovered a double-spend vulnerability in their zero knowledge circuits. The flaw affects the privacy-focused token transfer protocol that handles WETH, ETH, USDC, and BOB. **Key Details:** - No evidence of past exploitation on live pools - Vulnerability found in zkBob's zero knowledge proof implementation - Similar to a previous snarkjs library issue discovered during a Galxe Identity audit **Technical Context:** The vulnerability relates to input aliasing in zero knowledge proofs, where different values could be treated as identical. This type of flaw can potentially allow attackers to forge proofs and bypass verification systems. zkBob uses zkproofs to enable private token transfers between users without disclosing transaction amounts or recipients. The protocol routes transactions through relayers to abstract gas fees while maintaining privacy. **Current Status:** The team has identified the issue through their security review process. Users should await further updates on remediation steps and any necessary actions.

**Critical Action Required** - All users must withdraw funds from zkBob Polygon pool by January 31, 2025 - Funds left after deadline will become inaccessible - Direct Deposits are no longer being processed - 24-hour timeout in effect for any attempted deposits zkBob continues operations on Optimism with both USDC and ETH pools available. **Immediate Action Required:** Withdraw your USDC from Polygon pool immediately to maintain access to your funds. Visit blog.zkbob.com/polygon-sunsets-january-31-2025 for complete details.

**Critical Alert**: The zkBob Tron pool is shutting down within hours. Users must withdraw all USDT immediately to avoid losing access to their funds. Key Information: - Final withdrawal deadline: October 29, 2024 - Affected: All funds in zkBob Tron pool - Action required: Immediate withdrawal *Any funds remaining in the pool after shutdown will become inaccessible.* For detailed instructions, visit: https://blog.zkbob.com/tron-pool-closes-october-29-2024/