Restrict the verification key accepted by a Mina DynamicProof
A dynamic proof supplies its verification key at runtime. Verifying under that key establishes the proved program only if the application also constrains which key it accepts.
Try a proof from a different program
Consider a settlement zkApp expecting a proof that a payout total stayed below a limit. A second program with the same public input shape could accept any total. Keep the authorized program's verification-key hash in trusted state or a circuit constant, assert the hash match, then verify the submitted proof with that key.
vk.hash.assertEquals(approvedProgramHash);
proof.verify(vk);
Constrain the public statement
A proof under the right key might still concern another invoice or epoch. Compare its public fields with the contract operation being authorized. When upgrading the approved program, explicitly change the allowed hash through the contract's defined authority and test old proofs against the new policy.