Describe your changes

The mitigation described in the section on arithmetic overflows is insufficient as it currently stands. Since LessThan only restricts the size of the difference |in[0] - in[1]| between the two inputs, a malicious user try to withdraw p - 1. As long as the current balance is non-negative this would satisfy the circuit, even though p - 1 is huge when viewed as an unsigned value.

The correct mitigation is to use LessThan, together with constraints restricting the size of the inputs to ensure that they are non-negative. This can be done using the Num2Bits template from Circomlib.

Common Vulnerabilities Addition Checklist

• Added example code of the vulnerability
• Gave an explanation of how the vulnerability works
• Added attack scenario section if applicable
• Added preventative techniques section if applicable