{"id":76929,"url":"https://github.com/extropyio/awesome-mina-security","name":"awesome-mina-security","description":"A curated list of Mina resources with a focus on security from Extropy.io","projects_count":58,"last_synced_at":"2026-08-15T04:00:25.641Z","repository":{"id":212636688,"uuid":"731961403","full_name":"ExtropyIO/awesome-mina-security","owner":"ExtropyIO","description":"A curated list of Mina resources with a focus on security from Extropy.io","archived":false,"fork":false,"pushed_at":"2024-10-11T09:11:51.000Z","size":113,"stargazers_count":8,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-07-26T18:07:18.127Z","etag":null,"topics":["blockchain","blockchain-security","mina","mina-protocol","zk-snarks"],"latest_commit_sha":null,"homepage":"https://www.extropy.io","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ExtropyIO.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"contributing.md","funding":null,"license":"LICENSE","code_of_conduct":"code-of-conduct.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-12-15T09:46:11.000Z","updated_at":"2025-06-13T12:35:21.000Z","dependencies_parsed_at":"2024-07-08T21:34:26.309Z","dependency_job_id":"7429d77b-a82f-4a71-9105-320521d3bcaf","html_url":"https://github.com/ExtropyIO/awesome-mina-security","commit_stats":null,"previous_names":["extropyio/awesomemina","extropyio/awesome-mina-security"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ExtropyIO/awesome-mina-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExtropyIO%2Fawesome-mina-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExtropyIO%2Fawesome-mina-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExtropyIO%2Fawesome-mina-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExtropyIO%2Fawesome-mina-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ExtropyIO","download_url":"https://codeload.github.com/ExtropyIO/awesome-mina-security/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ExtropyIO%2Fawesome-mina-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36672384,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-06T04:43:03.162Z","status":"online","status_checked_at":"2026-08-15T02:00:05.847Z","response_time":94,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-11-10T08:05:23.849Z","updated_at":"2026-08-15T04:00:25.641Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["Resources:","Security aspects of zkApps"],"sub_categories":[],"readme":"# awesome-mina-security\n\nA curated list of Mina resources with a focus on security from [Extropy.io](https://www.extropy.io/) .\n\n## Getting started\n👉🏻 [Mina and zkApp essentials](./GettingStarted/MinaAndZkAppEssentials.md)\\\n👉🏻 [Basics of o1js](./GettingStarted/o1jsBasics.md)\\\n👉🏻 [Deploy and interact with your first zkAPP under 10 minutes](./GettingStarted/deployIn10min.md) \n\n## Security aspects of zkApps\nA list of security considerations to keep in mind when writing zkApps:\n\u003eNOTE: links should open the related page of the docs at the correct point where the issue is being mentioned. However for unknown reason after a page is opened it quickly goes at the top. At the moment please search for the mentioned words in the page, we will try to find a solution asap to this problem\n\nGeneric issues:\\\n🔒 [Underconstrained Proofs: unproved logic can be manipulated by a malicious prover](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#:~:text=exploit%20your%20application.-,Underconstrained,-proofs%3A%20Successfully%20%22calling)\\\n🔒 [Overriding `init()` is unnecessary if only `super.init()` is called inside without no other state initialization](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/smart-contracts#initializing-state)\\\n🔒 [Conversion between an o1js `Bool` and javascript `boolean` is always truthy](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#rolling-your-own-provable-methods:~:text=boolean%2C%20is%20always-,truthy,-%2C%20so%20this%20always)\\\n🔒 [Using `Provable.asProver()` on inputs moves them out from the zk proof: anyone can remove the Provable block, execute the off-chain code and send a valid proof passing constraints](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#fix-adding-the-missing-constraints:~:text=as%20well.%20Progress!%20%F0%9F%9A%80-,However,-%2C%20the%20statement%20about)\\\n🔒 [Writing custom low-level provable methods may add underconstrained logic](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#rolling-your-own-provable-methods)\\\n🔒 [Never trust methods callers](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#second-problem-we-trusted-the-caller)\\\n🔒 [Foreign Field Arithmetic should be used with caution](https://docs.minaprotocol.com/zkapps/o1js/foreign-fields#three-kinds-of-foreign-fields)\\\n🔒 [Usage of `requireNothing()` when retrieving On-chain Values may be dangerous](https://docs.minaprotocol.com/zkapps/o1js/foreign-fields#three-kinds-of-foreign-fields)\\\n🔒 [if condition is used instead of `const x = Circuit.if(new Bool(foo), a, b);`](https://docs.minaprotocol.com/zkapps/o1js/basic-concepts#conditionals)\\\n🔒 [Onchain merkle tree root not synced with offchain merkle root](https://docs.minaprotocol.com/zkapps/o1js/merkle-tree#:~:text=is%20always%20in-,sync,-with%20the%20actual)\\\n🔒 [Use on-chain values without checking them both at verification and proving time](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/smart-contracts#:~:text=off%2Dchain%20execution.-,When,-you%20use%20an)\\\n🔒 [Circumventing 01js security features should be avoided](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#fix-adding-the-missing-constraints:~:text=flag%20in%20general.-,Security,-advice%20%232%3A%20Don%27t)\\\n🔒 [Possible race conditions when many users read/write the state concurrently](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/smart-contracts#:~:text=and%20update%20state-,concurrently,-.%20It%20is%20applicable)\\\n🔒 [Always extend the official `TokenContract` standard instead of building a custom token from scratch](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#when-developing-a-token-extend-a-standard-token-contract) + [mina-fungible-token repo (built on top of `TokenContract`)](https://github.com/MinaFoundation/mina-le-token)\n\nActions \u0026 reducers issues:\\\n🔒 [The `reduce()` method breaks if more than the hard-coded number (default: 32) of actions are pending](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/feature-overview/actions-and-reducer)\\\n🔒 [Be careful when creating Account Updates from a reducer](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#be-careful-with-creating-account-updates-from-a-reducer)\\\n\nPermissions related issues:\\\n🔒 [Explicitly setting Permissions to default is unnecessary if no other permissions are modified in the `init()` function](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/feature-overview/permissions#default-permissions:~:text=send%3A%20Permissions.proof()%2C-,Alternatively,-%2C%20you%20can%20just)\\\n🔒 [Permissions not locked down enough + advices for setting permissions](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#lock-down-permissions-as-much-as-possible)\\\n🔒 [Calling external contracts with permissions not locked down enough](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#only-call-external-contracts-with-locked-down-permissions)\\\n🔒 [`editState` permission set to none](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/feature-overview/permissions#types-of-permissions:~:text=the%20smart%20contract.-,However,-%2C%20imagine%20if%20a)\\\n🔒 [`send` permission set to none](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/feature-overview/permissions#default-permissions)\\\n🔒 [if `access` and `receive` permissions are not set to `none` a deadlock may occur while doing concurrent state updates + safe way of doing an airdrop](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#dont-deadlock-your-zkapp-by-interacting-with-unknown-accounts)\\\n🔒 [smart contract interactions are limited to `signature` instead of `proof`](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/feature-overview/permissions#example-unsecurecontract:~:text=the%20transaction%20succeeds.-,However,-%2C%20this%20way%20of)\\\n🔒 [restrictive permissions can be circumvented if `setPermissions` is not set to impossible](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/feature-overview/permissions#example-impossible-to-upgrade:~:text=For%20the-,sake,-of%20security%2C%20it)\\\n🔒 [lack of access controls](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/feature-overview/permissions#example-unsecurecontract:~:text=not%20very%20secure%3A-,Anyone,-can%20call%20the)\\\n🔒 [Minting unlimited tokens to himself is possile for an attacker if a custom token contract does not change `access` permission from `none` to at least `proof`](https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#dont-deadlock-your-zkapp-by-interacting-with-unknown-accounts:~:text=can%20mint%20an-,arbitrary,-number%20of%20tokens)\\\n🔒 Setting `access` to `impossible` makes your account inaccessible: no one will ever be able to call their contract againt. It's like deleting.\n\n## Development best practices\n- Do not assume that the fact that someone has to pay transaction fees doesn't have incentives to attack your zkApp\n- Work with the compiler, don't try to get round the way that 01js works\n- Be very aware of what is part of the proof and what is not\n- Make sure that your code is not under constrained - all the necessary checks are\npart of the proof.\n- Don't make assumptions about the caller\n- Be aware of pre conditions for the update\n- Restrict the permissions as much as you can.\n- Be careful when calling external contracts and accounts, you need to be sure your\ncall will succeed.\n- Make sure the access control is accurate and enforced\n- Have a test suite, don't just test the 'happy path'\n- Put yourself in an adversarial mindset and try to break your code\n- Get your code audited\n- Have a plan to react to attacks\n- Keep up to date, we are at a very early stage.\n\n## Resources:\nDocumentation:\n- [Official Docs](https://docs.minaprotocol.com/) \n- [Mina tutorials](https://docs.minaprotocol.com/zkapps/tutorials)\n\nTools \u0026 Frameworks:\n- [Awesome mina tools](https://github.com/nerdvibe/awesome-mina) \n- [zkApp Cli](https://github.com/o1-labs/zkapp-cli)\n- [OpenMina: setting up a node from the smartphone](https://openmina.com/)\n- [zkApps official examples](https://github.com/o1-labs/o1js/tree/main/src/examples/zkapps) \n- [Mina Playground](https://www.minaplayground.com/)\n- [Protokit](https://protokit.dev/)\n- [GraphQL queries](https://graphql.minaexplorer.com/)\n\nNews:\n- [zkok MinaBlog](https://minablog.zkok.io/) \n- [Mina June 4 2024 hard fork announcement](https://minaprotocol.com/blog/mina-protocols-upcoming-major-upgrade-everything-you-need-to-know) \n\nProjects on Mina:\n- [Awesome Mina ZKApps](https://github.com/iam-dev/awesome-zkApps) \n- [zkApp list from zkok](https://zkok.io/)\n- [list from Mina Foundation](https://github.com/MinaFoundation/list-of-projects?tab=readme-ov-file) \n- [Anomix](https://github.com/anomix-zk/anomix-network/tree/main)\n- [Zeko](https://github.com/zeko-labs)\n- [PunkPoll](https://www.punkpoll.io/)\n- [ID-Mask](https://idmask.xyz/)\n- [Hakata](https://hakata.io/) \n- [ZkNoid](https://www.zknoid.io/)\n- [ZKPassport](https://github.com/MinaFoundation/Core-Grants/issues/18)\n- [Snarky.bio](https://snarky.bio/) \n- [PaimaStudios](https://paimastudios.com/) \n- [Mina Email](https://github.com/0xStruct/moolah/tree/main)\n- [Clor.io](https://clor.io/)\n- [zk-invoices](https://github.com/kriss1897/zk-invoices/tree/main)\n- [zkPass](https://zkpass.org/)\n- [ZKON](https://www.zkon.xyz/)\n- [zeko](https://zeko.io/)\n- [Hazook](https://github.com/ycryptx/Hazook-Fast-Zk-Rollup)\n- [Lumina DEX](https://luminadex.com/)\n- [SocialCap](https://socialcap.app/)\n\n  \n\n---\n## Old Links\n\u003e This section is a WIP\n\n- https://www.di.ens.fr/~nitulesc/files/Survey-SNARKs.pdf\n- https://arxiv.org/pdf/1906.07221.pdf \n- https://medium.com/magicofc/interactive-proofs-and-zero-knowledge-b32f6c8d66c3 \n- https://blog.zkga.me/intro-to-zksnarks \n- https://media.consensys.net/introduction-to-zksnarks-with-examples-3283b554fc3b \n- https://z.cash/technology/zksnarks/\n- https://masked.medium.com/the-coda-protocol-bbcb4b212b13 \n- https://docs.minaprotocol.com/en/zkapps/how-to-write-a-zkapp \n- https://a16z.com/2022/04/15/zero-knowledge-proofs-hardware-decentralization-innovation/\n- https://www.youtube.com/watch?v=bjSAf41PWWI\n- https://www.youtube.com/watch?v=Zls_QlI8fn8\n- https://www.youtube.com/watch?v=ByrymOorggc\n- https://minaprotocol.com/blog/22kb-sized-blockchain-a-technical-reference\n- https://minaprotocol.com/blog/kimchi-the-latest-update-to-minas-proof-system\n- https://medium.com/minaprotocol/meet-pickles-snark-enabling-smart-contract-on-coda-protocol-7ede3b54c250\n- https://minaprotocol.com/blog/what-are-zk-snarks\n- https://medium.com/minaprotocol/https-and-snapps-bridging-cryptocurrency-and-the-real-world-962beb21cf2b \n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/extropyio%2Fawesome-mina-security/projects"}