Veil Cash (Veil Protocol) — Groth16 Verifier Misconfiguration (delta2 == gamma2)

Timeline: On approximately 20 February 2026, an attacker drained the legacy Veil_01_ETH privacy pool on Base (a 0.1 ETH-denomination Tornado Cash fork) by exploiting a fatal misconfiguration in its Groth16 zk-SNARK verifier. The verification key's delta parameter had been left identical to gamma (both pinned to the BN254 G2 generator, the snarkjs Phase 2 default placeholder that should be replaced during a trusted setup ceremony). This collapses the soundness of the pairing check: because gamma2 == delta2, any change to the public inputs can be compensated by a linear change to the proof's C component, so a single valid proof can be 're-bound' to arbitrary public inputs without knowing any witness or having ever deposited. In one transaction (0x5ff6dbc3...4a17d), the attacker deployed a helper contract (0x5f68ad46...b3354) which called the pool's withdraw() function 29 times, each time with a fabricated nullifierHash incrementing from 0xdead0000 to 0xdead001c and a freshly computed C point, withdrawing 0.1 ETH per call for a total of 2.9 ETH to recipient 0x49a7ca88...5f903. The same delta2==gamma2 bug class was reused days later in the larger FoomCash exploit (~$2.26M, late February 2026), which BlockSec Phalcon flagged as a copycat of Veil Cash. Pashov Audit Group (which had audited Veil Cash, though the Verifier was out of scope) publicly acknowledged the incident as 'a small, but real hack.' Detailed root-cause analyses were published by independent researchers (CoinsBench / Evgenii, the DK27ss PoC repo) and by Rekt. Recovery status is not confirmed in available sources.