[A1kmm]

The problem is that you can construct a proof that there exists a circuit c with hash h = H(c), such that c(x) = y, where h & y are public, and c and x is private. That is a bad thing if you can construct such a proof when it isn't actually true, for certain specially crafted c.

[charcircuit]

What value is such a proof of you don't know what the circuit is?

[A1kmm]

It depends what the proof system is being used for. There are applications of ZKC that this would absolutely break.

It isn't on the exact same proving scheme broken in this research, but consider https://risczero.com/blog/zkpoex, which is about proving that you have an exploit (a program) that puts a protocol into into an unexpected state, without revealing the exploit. Imagine you had a specially crafted program that allows you to prove you have an exploit, but actually none exists, and it is just that you're computing the same hash in your program that is used in the Fiat-Shamir heuristic, and violating the assumptions of the random oracle model.

[charcircuit]

And why should people trust the program is not computing the hash? If people don't have a way to trust it then of course it can be gamed. This article doesn't sound like a new result, it's just people not verifying that programs aren't gaming the system.