argumentcomputer / argumentcomputer/sphinx
Large start_pc leads to guest programs early exit
- Dominant language
- Rust
- Stars
- 80
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
Since the tables are defined over a finite field, if the initial program counter is too large, the next program counter in the final row may wrap around to zero before the halt syscall is reached.
https://github.com/argumentcomputer/sphinx/blob/8a39b951e3ea520e295b693ad38bff6b43a2630c/prover/src/verify.rs#L93
As a result, a malicious prover can generate a proof that appears to show successful program termination, even though the halt syscall was never actually executed.
> This issue is disclosed with the permission of @johnchandlerburnham.
Contributor guide
Research direction
Start at prover/src/verify.rs:93 and trace how the verifier handles the initial program counter and the final row of the execution table. Reproduce the large-start_pc case, then verify that an execution cannot be accepted as successful termination when the halt syscall was not reached.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 38/100