OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 1.7.0, 2.0.0-rc.3, 2.1.0-preview
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
OpenVM's generated Solidity Halo2 verifier wrapper (OpenVmHalo2Verifier), used in the 1.x line before 1.7.0 and in the 2.0 and 2.1 prereleases, can be tricked into accepting forged proofs, allowing arbitrary app commitments and public values to be accepted without real verification. Applications that deploy this wrapper to verify zero-knowledge proofs on-chain are affected.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- openvm-org openvm
fixed in 1.7.0; From 2.0.0-alpha · fixed in 2.0.0-rc.3; From 2.1.0-dev.0 · fixed in 2.1.0-preview