Batch verifiers reject proofs/results length mismatch

w3f-ring-proof/src/lib.rs

@@ -125,6 +125,20 @@ mod tests {
         _test_ring_proof::<pcs::IdentityCommitment>(2usize.pow(10), 1);
     }
 
+    // `zip` would silently drop unmatched elements, reporting success for
+    // inputs that received no verification at all (srlabs_findings#713).
+    #[test]
+    fn test_batch_length_mismatch_rejected() {
+        let (verifier, mut claims) = _test_ring_proof::<KZG<Bls12_381>>(2usize.pow(9), 1);
+        let (result, proof) = claims.pop().unwrap();
+        assert!(verifier.verify(proof.clone(), result));
+
+        assert!(!verifier.verify_batch(Vec::new(), vec![result]));
+        assert!(!verifier.verify_batch(vec![proof.clone()], Vec::new()));
+        assert!(!verifier.verify_batch_kzg(Vec::new(), vec![result]));
+        assert!(!verifier.verify_batch_kzg(vec![proof], Vec::new()));
+    }
+
     #[test]
     fn test_lagrangian_commitment() {
         let rng = &mut test_rng();

w3f-ring-proof/src/ring_verifier.rs

@@ -74,11 +74,16 @@ where
         &self.plonk_verifier.pcs_vk
     }
 
+    /// Verifies the proofs sequentially, pairing them with the results
+    /// positionally. Fails if the two vectors differ in length.
     pub fn verify_batch(
         &self,
         proofs: Vec<RingProof<F, CS>>,
         results: Vec<Affine<Jubjub>>,
     ) -> bool {
+        if proofs.len() != results.len() {
+            return false;
+        }
         for (proof, result) in proofs.into_iter().zip(results) {
             let res = self.verify(proof, result);
             if !res {
@@ -97,11 +102,16 @@ where
 {
     /// Verifies a batch of proofs against this ring in a single batched
     /// pairing check, using a [`BatchVerifier`] under the hood.
+    /// Proofs are paired with the results positionally. Fails if the two
+    /// vectors differ in length.
     pub fn verify_batch_kzg(
         &self,
         proofs: Vec<RingProof<E::ScalarField, KZG<E>>>,
         results: Vec<Affine<J>>,
     ) -> bool {
+        if proofs.len() != results.len() {
+            return false;
+        }
         let mut batch = BatchVerifier::new(
             self.plonk_verifier.pcs_vk.clone(),
             self.plonk_verifier.transcript_prelude.clone(),