[Audit L-02] Verifier constructors accept zero/invalid trust anchors

[hmzakhalid]

Finding

Severity: Low

Confirmed against baseline commit d4277510d. BFV verifier wrappers accepted zero or invalid recursive verifier/VK trust anchors, allowing unusable or incorrectly anchored deployments.

Full audit report

Required remediation

Validate nonzero deployed verifier dependencies and nonzero expected VK anchors at construction.

The dedicated fixing commit and remediation PR will be linked in a follow-up comment.

[hmzakhalid]

Fixed by commit bcb6dd99373dd46e99f9e19558a30ea44ad616cb in PR #1727.

[hmzakhalid]

Supersedes the earlier remediation reference after the cleanup of PR #1727. Fixed by commit 4d209f1 (L-02): the hand-written BFV wrappers reject zero hashes and non-contract verifier anchors. The autogenerated Honk verifier sources are unchanged.

[hmzakhalid]

Confirmed fixed in final commit a9a337e. BFV verifier constructors reject zero addresses, EOAs, and invalid/zero trust-anchor hashes.

[hmzakhalid]

Final remediation in PR #1727: a9a337e validates BFV verifier trust anchors.