argumentcomputer / argumentcomputer/sphinx

Large start_pc leads to guest programs early exit

Open
#206 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
80
Forks
8
PR merge metrics
No merged PRs in 30d

Description

Since the tables are defined over a finite field, if the initial program counter is too large, the next program counter in the final row may wrap around to zero before the halt syscall is reached.

https://github.com/argumentcomputer/sphinx/blob/8a39b951e3ea520e295b693ad38bff6b43a2630c/prover/src/verify.rs#L93

As a result, a malicious prover can generate a proof that appears to show successful program termination, even though the halt syscall was never actually executed.

> This issue is disclosed with the permission of @johnchandlerburnham.

Contributor guide

Open the contributing guide

Research direction

Start at prover/src/verify.rs:93 and trace how the verifier handles the initial program counter and the final row of the execution table. Reproduce the large-start_pc case, then verify that an execution cannot be accepted as successful termination when the halt syscall was not reached.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.