TYPED_TEST(ByteArraySoundnessExploit, DISABLED_SizeConstructorBypassesRangeConstraints){    using Builder = TypeParam;    using field_ct = typename TestFixture::field_ct;    using witness_ct = typename TestFixture::witness_ct;    using byte_array_ct = typename TestFixture::byte_array_ct;
    Builder builder;
    // Create byte_array with size constructor - NO constraints applied    byte_array_ct arr(&builder, 4);
    // EXPLOIT: Assign values > 255 without any range constraints    arr[0] = witness_ct(&builder, 256);  // Should be invalid for a "byte"    arr[1] = witness_ct(&builder, 512);  // Way larger than a byte    arr[2] = witness_ct(&builder, 1024); // ditto    arr[3] = witness_ct(&builder, 100);  // Valid byte
    // These "bytes" are NOT constrained to 8 bits!    // No create_range_constraint(8) was ever called on them
    // Convert to field - uses these invalid "bytes" in computation    field_ct result = static_cast<field_ct>(arr);
    // Expected if bytes were valid: (256*256^3 + 512*256^2 + 1024*256 + 100)    // But these aren't valid bytes at all!    uint256_t expected = uint256_t(256) * (uint256_t(1) << 24) +                        uint256_t(512) * (uint256_t(1) << 16) +                        uint256_t(1024) * (uint256_t(1) << 8) +                        uint256_t(100);
    EXPECT_EQ(result.get_value(), fr(expected));
    // THE EXPLOIT: Circuit passes verification even with invalid "bytes"!    // This should FAIL but it PASSES because no constraints were added    bool verified = CircuitChecker::check(builder);    EXPECT_TRUE(verified);  // ❌ VULNERABILITY: Should reject but accepts!}

byte_array(Builder* parent_context, const size_t n)    : context(parent_context)    , values(n){    for (auto& value : values) {        // Default field_t() is constant 0, which is valid        // But require explicit constraint to prevent misuse        value.create_range_constraint(8, "byte_array: size constructor byte");    }}

field_t<Builder>& operator[](const size_t index) {    BB_ASSERT_LT(index, values.size());    // On assignment, ensure constraint exists    values[index].create_range_constraint(8);    return values[index];}

byte_array(Builder* parent_context, std::vector<uint8_t> const& input) {    for (size_t i = 0; i < input.size(); ++i) {        field_t<Builder> value(witness_t(context, input[i]));        value.create_range_constraint(8, "...");  // CONSTRAINT APPLIED        values[i] = value;    }}

byte_array(Builder* parent_context, bytes_t const& input)    : values(input)  // NO VALIDATION OR CONSTRAINTS{}

TYPED_TEST(ByteArraySoundnessExploit, DISABLED_BytesConstructorBypassesConstraints){    using Builder = TypeParam;    using field_ct = typename TestFixture::field_ct;    using witness_ct = typename TestFixture::witness_ct;    using byte_array_ct = typename TestFixture::byte_array_ct;
    Builder builder;
    // Create unconstrained field elements (values > 255)    std::vector<field_ct> unconstrained_fields;    unconstrained_fields.push_back(witness_ct(&builder, 1000));  // NOT a byte!    unconstrained_fields.push_back(witness_ct(&builder, 2000));  // NOT a byte!    unconstrained_fields.push_back(witness_ct(&builder, 3000));  // NOT a byte!
    // EXPLOIT: Create byte_array from unconstrained fields    byte_array_ct arr(&builder, unconstrained_fields);
    EXPECT_EQ(arr.size(), 3UL);
    // These "bytes" have NO range constraints!    EXPECT_EQ(arr[0].get_value(), fr(1000));  // Not a valid byte    EXPECT_EQ(arr[1].get_value(), fr(2000));  // Not a valid byte    EXPECT_EQ(arr[2].get_value(), fr(3000));  // Not a valid byte
    // THE EXPLOIT: Circuit accepts invalid "bytes"    bool verified = CircuitChecker::check(builder);    EXPECT_TRUE(verified);  // VULNERABILITY: Accepts unconstrained values!
    // PROOF OF VULNERABILITY:    // The bytes_t constructor does not apply create_range_constraint(8) to input fields.    // Callers must manually ensure fields are constrained, which is error-prone.}

TYPED_TEST(ByteArraySoundnessExploit, DISABLED_WriteAtOverwritesWithUnconstrained){    using Builder = TypeParam;    using field_ct = typename TestFixture::field_ct;    using witness_ct = typename TestFixture::witness_ct;    using byte_array_ct = typename TestFixture::byte_array_ct;
    Builder builder;
    // Step 1: Create properly constrained byte array    std::vector<uint8_t> valid_bytes = { 0x01, 0x02, 0x03, 0x04 };    byte_array_ct valid_arr(&builder, valid_bytes);
    // These bytes ARE properly constrained (via vector<uint8_t> constructor)    // Each has create_range_constraint(8) applied
    // Step 2: Create malicious byte array with unconstrained fields    std::vector<field_ct> malicious_fields;    malicious_fields.push_back(witness_ct(&builder, 500));  // NOT a byte!    malicious_fields.push_back(witness_ct(&builder, 600));  // NOT a byte!
    byte_array_ct malicious_arr(&builder, malicious_fields);
    // Step 3: EXPLOIT - Overwrite constrained bytes with unconstrained ones    valid_arr.write_at(malicious_arr, 1);  // Overwrite at index 1
    // Now valid_arr contains:    // [0] = 0x01 (still constrained)     // [1] = 500  (UNCONSTRAINED!)       // [2] = 600  (UNCONSTRAINED!)       // [3] = 0x04 (still constrained)
    EXPECT_EQ(valid_arr[0].get_value(), fr(0x01));    EXPECT_EQ(valid_arr[1].get_value(), fr(500));  // Invalid "byte"    EXPECT_EQ(valid_arr[2].get_value(), fr(600));  // Invalid "byte"    EXPECT_EQ(valid_arr[3].get_value(), fr(0x04));
    // THE EXPLOIT: Circuit accepts corrupted array    bool verified = CircuitChecker::check(builder);    EXPECT_TRUE(verified);  // VULNERABILITY: Should reject but accepts!
    // PROOF OF VULNERABILITY:    // write_at() preserves field element references, including their (lack of) constraints.    // A properly constrained byte_array can be corrupted by writing unconstrained fields.}

template <typename Builder>byte_array<Builder>::byte_array(Builder* parent_context, bytes_t const& input)    : context(parent_context)    , values(input){    // Validate that all input fields are properly constrained    for (auto& value : values) {        value.create_range_constraint(8, "byte_array: bytes_t constructor - unconstrained input");    }}
template <typename Builder>byte_array<Builder>::byte_array(Builder* parent_context, bytes_t&& input)    : context(parent_context)    , values(std::move(input)){    // Validate that all input fields are properly constrained    for (auto& value : values) {        value.create_range_constraint(8, "byte_array: bytes_t constructor - unconstrained input");    }}

field_t<Builder>& operator[](const size_t index) {    BB_ASSERT_LT(index, values.size());    // On assignment, ensure constraint exists    values[index].create_range_constraint(8);    return values[index];}

TYPED_TEST(ByteArraySoundnessExploit, DISABLED_ThirtyTwoByteConversionBlocked){    using Builder = TypeParam;    using field_ct = typename TestFixture::field_ct;    using witness_ct = typename TestFixture::witness_ct;    using byte_array_ct = typename TestFixture::byte_array_ct;
    Builder builder;
    // Create a valid field value at modulus boundary    uint256_t valid_value = fr::modulus - 1;  // Largest valid field element
    field_ct field_val = witness_ct(&builder, valid_value);
    // STEP 1: Create 32-byte array from field - THIS WORKS     // This triggers the complex modulus boundary check (lines 157-189)    byte_array_ct arr_32_bytes(field_val, 32);
    EXPECT_EQ(arr_32_bytes.size(), 32UL);
    // All bytes are properly constrained to 8 bits    // Modulus boundary was validated with borrow bit technique    // This is the MOST security-critical code in the entire implementation
    // STEP 2: Try to convert back to field - THIS FAILS     field_ct result = static_cast<field_ct>(arr_32_bytes);    // ASSERTION FAILURE: ASSERT(bytes < 32) on line 242
    // PROOF OF CORRECTNESS ISSUE:    // 1. The assertion blocks valid 32-byte to field conversion    // 2. This creates asymmetry: field->32bytes works, 32bytes->field doesn't    // 3. The most critical security code (modulus check) is untestable via fuzzer    // 4. Fuzzer's to_field_t() cannot test 32-byte case (see byte_array.fuzzer.hpp:391)    //    // SECURITY IMPACT:    // - Zero continuous fuzzer coverage for most critical constraint logic    // - Regression bugs in modulus boundary check would not be caught    // - Lines 157-189 are mathematically correct but have NO ongoing validation}

// Start with SAFE constructorbyte_array_ct arr(&builder, {0x01, 0x02, 0x03, 0x04});  // All constrained
// Get unconstrained witnessfield_ct bad_input = witness_ct(&builder, 500);  // No constraint!
// Corrupt via operator[] assignmentarr[1] = bad_input;  // Overwrites constrained byte!
// Now arr[1] is unconstrained, even though we used safe constructor!
// write_at() propagates this corruptionbyte_array_ct target(&builder, {0xAA, 0xBB});target.write_at(arr, 0);  // Copies the unconstrained field!

template <typename Builder> byte_array<Builder>::operator field_t<Builder>() const{    const size_t bytes = values.size();    // Commented out: ASSERT(bytes < 32);
    std::vector<field_t<Builder>> scaled_values;    for (size_t i = 0; i < bytes; ++i) {        const field_t<Builder> scaling_factor(one << (8 * (bytes - i - 1)));        scaled_values.push_back(values[i] * scaling_factor);  // No constraint check here    }    return field_t<Builder>::accumulate(scaled_values);}

Builder builder;
// BUG: Create byte_array with size constructor - NO constraintsbyte_array_ct arr(&builder, 4);
// Assign invalid "bytes" (values > 255)arr[0] = witness_ct(&builder, 1000);  // NOT a byte!arr[1] = witness_ct(&builder, 2000);  // NOT a byte!arr[2] = witness_ct(&builder, 3000);  // NOT a byte!arr[3] = witness_ct(&builder, 4000);  // NOT a byte!
// Convert to field_t - this SHOULD fail but doesn't.// The conversion blindly multiplies by scaling factors:// result = 1000*(256^3) + 2000*(256^2) + 3000*256 + 4000field_ct malicious_field = static_cast<field_ct>(arr);
// Calculate what the value WOULD be if these were valid bytesuint256_t expected_if_unchecked = uint256_t(1000) * (uint256_t(1) << 24) +                                  uint256_t(2000) * (uint256_t(1) << 16) +                                  uint256_t(3000) * (uint256_t(1) << 8) +                                  uint256_t(4000);
EXPECT_EQ(malicious_field.get_value(), fr(expected_if_unchecked));
// THE EXPLOIT: Circuit accepts this invalid conversion!bool verified = CircuitChecker::check(builder);EXPECT_TRUE(verified);  // VULNERABILITY: Should reject but accepts!
// PROOF OF VULNERABILITY:// operator field_t() at line 251-253 multiplies values[i] by scaling factors// WITHOUT verifying that values[i] is constrained to [0, 255].//// The conversion assumes byte constraints exist but doesn't enforce them.// A malicious prover can inject arbitrary field values disguised as "bytes".

```cppTYPED_TEST(ByteArraySoundnessExploit, DISABLED_ConversionToFieldDoesntVerifyConstraints_ForeignFieldAssignment){    using Builder = TypeParam;    using field_ct = typename TestFixture::field_ct;    using witness_ct = typename TestFixture::witness_ct;    using byte_array_ct = typename TestFixture::byte_array_ct;
    Builder builder;
    // Step 1: Create a properly constrained byte_array    std::vector<uint8_t> valid_bytes = { 0x01, 0x02, 0x03, 0x04 };    byte_array_ct arr(&builder, valid_bytes);
    // Verify initial array is properly constrained    for (size_t i = 0; i < 4; ++i) {        EXPECT_LT(arr[i].get_value(), fr(256));    }
    // Step 2: Create "foreign" field_t elements (unconstrained, different context)    // Simulate unconstrained field elements that represent invalid "bytes"    field_ct foreign_byte1 = witness_ct(&builder, 5000);  // NOT a byte!    field_ct foreign_byte2 = witness_ct(&builder, 6000);  // NOT a byte!
    // These are NOT constrained to be bytes - they're just raw witnesses    // In a real attack, these could come from a different part of the circuit
    // Step 3: BUG - Assign foreign fields to byte_array positions    arr[1] = foreign_byte1;  // Overwrite constrained byte with unconstrained field    arr[2] = foreign_byte2;  // Overwrite constrained byte with unconstrained field
    // Now arr contains:    // [0] = 0x01 (constrained)       // [1] = 5000 (UNCONSTRAINED)     // [2] = 6000 (UNCONSTRAINED)     // [3] = 0x04 (constrained)  
    // Step 4: Convert to field_t - uses unconstrained values in computation!    field_ct malicious_field = static_cast<field_ct>(arr);
    // Expected value if these were treated as valid inputs:    // result = 1*(256^3) + 5000*(256^2) + 6000*256 + 4    uint256_t expected_malicious = uint256_t(1) * (uint256_t(1) << 24) +                                   uint256_t(5000) * (uint256_t(1) << 16) +                                   uint256_t(6000) * (uint256_t(1) << 8) +                                   uint256_t(4);
    EXPECT_EQ(malicious_field.get_value(), fr(expected_malicious));
    bool verified = CircuitChecker::check(builder);    EXPECT_TRUE(verified);  // BUG: Should reject but accepts!    // NO VERIFICATION that values[i] has create_range_constraint(8) applied!}

TYPED_TEST(ByteArraySoundnessExploit, DISABLED_ConstOperatorIndexOutOfBounds){    using Builder = TypeParam;    using byte_array_ct = typename TestFixture::byte_array_ct;
    Builder builder;
    // Create 1-element array    std::vector<uint8_t> single_byte = { 0x42 };    const byte_array_ct arr(&builder, single_byte);  // const reference
    EXPECT_EQ(arr.size(), 1UL);
    // Valid access    auto byte0 = arr[0];  // This works    EXPECT_EQ(byte0.get_value(), fr(0x42));
    // EXPLOIT: Out of bounds access via const operator[]    // The assertion only checks `assert(values.size() > 0)`    // It does NOT check `assert(index < values.size())`
    auto byte5 = arr[5];  // UNDEFINED BEHAVIOR!    // Assertion passes: size() > 0 is true (size = 1)    // But index 5 is out of bounds for size 1 array    // Result: Reads garbage memory or crashes
    // Const operator[] has weaker bounds checking than non-const version.    // This is a code quality issue, not a circuit soundness issue.
    // What SHOULD happen:    // assert(5 < 1) → false → assertion failure → program terminates
    // What ACTUALLY happens:    // assert(1 > 0) → true → assertion passes → UB!}

TYPED_TEST(ByteArraySoundnessExploit, DISABLED_EmptySliceTriggersAssertion){    using Builder = TypeParam;    using byte_array_ct = typename TestFixture::byte_array_ct;
    Builder builder;
    // Create empty byte array    std::vector<uint8_t> empty_vec;    byte_array_ct empty_arr(&builder, empty_vec);
    EXPECT_EQ(empty_arr.size(), 0UL);
    // ========================================    // BUG: Attempt to slice at offset 0    // ========================================    // This is a semantically VALID operation:    // - Slicing empty array from start → should return empty array    // - Equivalent to: empty_array[0..0] → []
    // But it triggers: BB_ASSERT_LT(0, 0) which evaluates to FALSE    auto sliced = empty_arr.slice(0);  // ASSERTION FAILURE!
    // What SHOULD happen:    // - Returns empty byte_array (size 0)    // - No assertion failure
    // This is a CORRECTNESS bug (blocks valid operations), not a soundness    // issue (no circuit impact).}

template <typename Builder>byte_array<Builder> byte_array<Builder>::slice(size_t offset) const{    BB_ASSERT_LTE(offset, values.size());  // Allow offset == size    return byte_array(context, bytes_t(values.begin() + static_cast<ptrdiff_t>(offset), values.end()));}
template <typename Builder>byte_array<Builder> byte_array<Builder>::slice(size_t offset, size_t length) const{    BB_ASSERT_LTE(offset, values.size());  // Allow offset == size    BB_ASSERT_LTE(length, values.size() - offset);    auto start = values.begin() + static_cast<ptrdiff_t>(offset);    auto end = values.begin() + static_cast<ptrdiff_t>((offset + length));    return byte_array(context, bytes_t(start, end));}

/** * @brief Slice `length` bytes from the byte array, starting at `offset`. * Does not add any constraints **/

TEST(byte_array, slice_propagates_unconstrained_from_size_constructor){    auto builder = Builder();
    // Step 1: Create unconstrained array via size constructor (vulnerability #1)    byte_array_ct arr(&builder, 32);
    // Step 2: Assign out-of-range value via operator[] (vulnerability #3)    arr[0] = witness_ct(&builder, 500);   // 500 > 255, but no constraint prevents this    arr[1] = witness_ct(&builder, 1000);  // 1000 > 255
    // Step 3: Slice extracts the corrupted bytes (vulnerability #4)    byte_array_ct sliced = arr.slice(0, 2);
    // Step 4: Verify the corruption persists    auto value0 = uint256_t(sliced[0].get_value());    auto value1 = uint256_t(sliced[1].get_value());
    EXPECT_EQ(value0, 500);   // Unconstrained value preserved    EXPECT_EQ(value1, 1000);  // Unconstrained value preserved
    // Step 5: Proof verifies despite invalid byte values    EXPECT_TRUE(CircuitChecker::check(builder));  // Should fail but passes}

if (!is_constant() && !other.is_constant()) {ASSERT(context == other.context);}

std::vector<field_t> accumulator_hi;for (size_t i = 0; i < num_bytes; ++i) {    size_t bit_start = (num_bytes - i - 1) * 8;    const field_t scaling_factor = one << bit_start;
    if (i < midpoint) {  // midpoint = 16 for num_bytes = 32        accumulator_hi.push_back(scaling_factor * byte);    }}const field_t reconstructed_hi = field_t::accumulate(accumulator_hi);

reconstructed_hi = Σ(i=0 to 15) byte[i] * 2^(248 - 8i)                 = 2^128 * Σ(i=0 to 15) byte[i] * 2^(120 - 8i)                 = 2^128 * [high_value]

// SAFETY: reconstructed_hi is always a multiple of 2^128 by construction// (bytes 0-15 all have scaling factors ≥ 2^128)const field_t diff_hi = (-reconstructed_hi / shift).add_two(s_hi, -overlap);

byte_array_ct arr(&builder, {0x00, 0x7F, 0x80, 0xFF});std::string s = arr.get_string();
s[0] = 0x00 (char)  // OKs[1] = 0x7F (char)   // OKs[2] = -128 (char)   // Negative!s[3] = -1 (char)       // Negative!