Small-field hash-based SNARGs are less sound than conjectured

Hash-based succinct non-interactive arguments (SNARGs) are a widely studied and deployed class of proof systems. Practical hash-based SNARGs rely on linear codes, and their security relies on two combinatorial parameters of its underlying linear code: a distance-preservation error and the list size (both parametrized by a proximity parameter). Optimistically, one might hope that these parameters are bounded all the way to the capacity regime. Several deployed hash-based SNARGs operate in this regime, and initiatives such as the Ethereum Proximity Prize investigate to which extent soundness is preserved in this setting. We present a minimal toy protocol whose analysis captures most of the complexity of state-of-the-art hash-based SNARGs, and present a generic attack whose success probability depends on the list size. Further, we investigate the common settings when the code is an extension code over a field of a base code over a small base field. In this setting, classical combinatorial lower bounds on the list size of the base code, combined with our generic attack, show that the soundness error of the toy protocol exceeds the value predicted by capacity-style conjectures. We quantify the resulting loss for the code parameters of several deployed systems, whose security estimates rely on the same list-size conjecture.