The trick that turns a back-and-forth proof into a single file by replacing the verifier's random questions with hashes. It's proven safe only for an imaginary, perfectly random hash.
The idea: In an interactive proof, the verifier keeps the prover honest with unpredictable questions: a cheater can't prepare answers in advance. Fiat-Shamir lets the prover generate those questions by hashing the conversation so far, so changing anything changes the questions. That works as long as the prover can't steer the hash, which is guaranteed for a perfectly random one. The 2025 attack found a way to steer a real one: make the statement being proven compute the hash itself, so the prover can see its own questions coming.
Why it matters: STARK and PLONK verifiers on Ethereum, and the planned zkVM proofs, all depend on it.
On the map: for multi-round proofs, proven only for an idealized hash. A 2025 attack forged GKR-based proofs for any hash, using a crafted circuit
STARK verifiers, PLONK verifiers and the planned leanVM all turn an interactive proof into a single file with Fiat-Shamir: the verifier's random challenges are replaced by hashes of the transcript[1]. Groth16 doesn't need it. It is non-interactive by design.
The transform is proven secure only if the hash behaves like a random oracle. In January 2025 Dmitry Khovratovich and Lev Soukhanov (Ethereum Foundation) and Ron Rothblum (Succinct) showed a practical attack on a standard GKR-based proof system: for any hash, a specially built circuit that evaluates the hash itself admits a convincing proof of a false statement[2]. The attack needs a crafted circuit rather than breaking an existing one, but it showed the gap is not just theoretical, which matters as Ethereum moves toward proving whole blocks.
The common practical failure is simpler: leaving some public inputs out of the hash ("weak Fiat-Shamir"), which broke several PlonK implementations in 2022[3]. Blob KZG proofs also use a one-step Fiat-Shamir challenge (a hash of the blob and its commitment)[4], the simple, well-understood case.
If any of these breaks, this breaks too.
If this breaks, these break with it.