OpenVM vulnerabilities

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254 scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.

OpenVM before 1.7.0 (and affected 2.0 and 2.1 prereleases) has a vulnerability in OpenVmHalo2Verifier.verify where raw calldata from proofData can invoke another external function instead of the verifier, accepting arbitrary app commitments and public values without proof validation.

OpenVM before 1.7.0 (and affected 2.0 and 2.1 prereleases) has a vulnerability in MemoryMerkleAir that does not forbid Merkle expansion rows at parent_height = 0 or below when expand_direction != 0. A malicious prover can fabricate a subtree and change the committed memory root without a corresponding memory operation, undermining OpenVM proof soundness.

OpenVM prior to version 1.6.0 contains a vulnerability in the openvm-pairing guest library where the try_honest_pairing_check function does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check.