A $1M zk-rollup audit bounty pays for finding 'a soundness bug — a constraint flaw allowing the prover to convince the verifier of a false statement.' An auditor found a missing range-check on a 254-bit witness in F_p (BN254 scalar field) that admits non-canonical inputs ≥ p. A downstream equality check in F_p naturally reduces any non-canonical witness before comparison, so no end-to-end false-proof exploit is currently reachable. Does the auditor earn the bounty?

Rule YES (PAY) if a missing constraint is a soundness bug under the bounty's plain text — a flaw in the constraint system regardless of current reachability. Rule NO (NO PAY) if the bounty requires a demonstrable end-to-end exploit producing a verifier-accepted false proof.

The circuit at sources/main.circom line 142 omits a `Num2Bits_strict(126)` decomposition for the high half of a 254-bit witness, leaving input_x_high unconstrained beyond field reduction. A malicious prover can witness input_x_high = p + k for any k ∈ F_p. The proof's final step computes z = (a · b) mod p == expected; the modular reduction silently canonicalizes any non-canonical witness, so the verifier rejects k ≠ 0 regardless. The auditor produced a witness-generation PoC demonstrating the missing constraint but could not produce a falsified proof end-to-end. Bounty rules cite 'Halo2 and Plonk standards' without specifying which auditor convention controls — Halo2 audits historically pay for unreachable constraint flaws; Plonk-style audits historically require exploit demonstration.