This an interesting Fiat-Shamir bug: the verifier fails to absorb a “challenge” value from the pvoer. So why does the prover send a “challenge” value and why must the verifier absorb it? Read the details about the bug here: https://blog.zksecurity.xyz/posts/solana-phantom-challenge-bug/
Uncovering the Phantom Challenge Soundness Bug in Solana's ZK ElGamal Proof Program
I found a critical soundness zk bug in Solana