Proofs of Nothing: Zero-Witness Forgeries and the Side Conditions That Prevent Them

Abstract

A lattice proof verifier is sound only if it binds the proof to a fixed statement the prover cannot choose. We report a post-quantum consensus verifier that does not, and accepts a proof of nothing. In a confidential-transaction opcode, an all-zero proof whose only nonzero field is a public, recomputable Fiat-Shamir seed is accepted through the real script entry point, authorising a spend with no valid signature. Every algebraic check on the accept path is homogeneous in the prover-supplied values, so the zero witness satisfies all of them, and the statement itself is read from the same untrusted blob, so there is nothing external to contradict it. The natural hardening of such a verifier rebinds its transcript to the transaction, which stops replay but leaves the witness unanchored, and a whole-blob rejection test is blind to the attack because it also zeros the one field the attacker must set. We then show this is not a one-off but the sharp end of a class: soundness failures where a verifier's checks are met because a required side condition was not imposed. We give a second, fully worked instance in the same system, a corrector-chain encoding that silently weakens value conservation to conservation modulo 2^d + 1 and admits a norm-minimal inflation forgery; a bound documented in three places and enforced twice as loose in two verifiers; a survey finding two of 102 bound gates in two independent lattice-proof codebases state the predicate they enforce, both wrongly; and a validity predicate that disagrees between mempool policy and consensus. Against these we set the positive cases that prove the obligation is understood but unstated: ML-DSA designs the degenerate witness away, and the reference LatticeFold implementation anchors its statement to a fixed relation, so an all-zero witness is rejected there, which we confirm empirically by running its own prover and verifier. The danger is the integration boundary, where the anchoring obligation is real, undocumented, and easy to miss, and we close with the discipline that makes it visible. An artifact accompanying this record, corrector_wrap.py, is dependency-free and reproduces the corrector-chain results.