Brave Researchers Detail Structural Risks in zkLogin Zero-Knowledge Authorization on Sui

In a newly published paper and blog post, Brave security researcher Sofía Celi and colleagues analyze the zkLogin authorization system used in the Sui blockchain ecosystem, warning that its security, privacy, and trust properties rely on assumptions not enforced by the protocol. They describe three main vulnerability classes involving JWT parsing, weak bindings between authentication and authorization, and dependence on centralized identity and proving services. The team says these issues arise from architectural design choices and recommends stricter token validation, stronger issuer and user bindings, and improved consent when forwarding tokens to external services.