Succinct's SP1 exposed a serious vulnerability, the mainnet may accept invalid proofs

Succinct's zero-knowledge proof system SP1 has revealed a high-severity reliability vulnerability. This vulnerability was disclosed through the GitHub announcement GHSA-p7v2-jjv3-8p8f, affecting SP1's native Rust verifier versions 6.0 to 6.8.0, allowing the mainnet Prover Network to potentially accept invalid proofs: malicious provers could submit proofs of invalid executions, which the network verifiers would still accept.

The cause of the vulnerability is that the verifier only reads the labels of the data (declaration dimensions) without verifying whether the actual number of stored elements equals the product of the dimensions, allowing attackers to forge labels to pass invalid proofs. The Groth16 and Plonk checks using fixed-shape wrap proofs are unaffected, and the on-chain Solidity checker is also safe. Succinct released the fixed version 6.8.1 on September 24, which has been deployed to the mainnet; this version adds deserialization length checks.

The vulnerability was discovered by Vitalis Salis and reported through the Immunefi bug bounty program. Users running the native Rust verifier and accepting untrusted provers need to upgrade to 6.8.1.