Polygon Zero, the zero-knowledge arm of Polygon, alleged that a newly released proving system from zkSync contains a substantial amount of code that has been copy-pasted from performance-critical components of one of its libraries.
In a blog post on Thursday, titled “Protect the Open Source Ethos,” Polygon Zero claims that zkSync’s proving system Boojum contains copy-pasted source code that was published in Polygon’s Plonky2 code repository more than a year ago.
Crypto runs on the open source ethos. When projects don’t follow it, the ecosystem suffers.
— Polygon Zero 💜 (@0xPolygonZero) August 3, 2023
It is worth noting that Polygon Zero released its code under an open-source license, meaning external developers are free to use, modify and distribute it. Polygon’s issue, is rather, the fact that the code was not appropriately attributed to its supposed original authors.
Matter Labs, the development team behind zkSync, introduced Boojum last month, introducing it as a new high-performance proof system that utilizes PLONK-style arithmetization.
“To add insult to injury, the founder of Matter Labs claimed that Boojum is more than 10x faster than Plonky2. Wondering how this is possible, given that the performance-critical field arithmetic code is directly copied from Plonky2? You should be,” wrote Polyon Zero in its blog post.
Matter Labs’ co-founder and CEO Alex Gluchowski said he was “disappointed by these untrue accusations” and would publish a more detailed reply shortly. He directed users to the first line of Boojum’s code module, which notes the use of a Plonky2 implementation of non-vectorized fields as the baseline.
When asked why the code had no mention of Polygon’s license at the bottom of the file, Gluchowski said that Matter Labs used the same MIT/Apache 2.0 license. Still, many in the crypto community were not convinced by the response and called for the developers to respect the ethos of open-source.
Fwiw @0xPolygonZero should have sent you a PR to try to easily rectify this before writing a slam piece about the faux pas. Obviously a cheap shot in bad faith, but you should still fix it.
— Q (@quentinc137) August 3, 2023