sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
The Gnark recursion circuit constrains arithmetic over BabyBear when the native field of the ZKP circuit is the BN254 scalar field. Proper implementation of this logic requires range checking Bn254 values to be less than the BabyBear modulus. In versions < 1.2.0, functions like `InvF` and `InvE` used values generated by hints that were not appropriately range checked. These issues are resolved in versions 1.2.0 and higher, by adding range checks in the appropriate places. This code was covered under the original audit scope of the recursion circuit audit by Veridise, and both Veridise and Kalos revisited the code for similar issues and found no additional vulnerabilities. This issue was discovered by the Succinct team on September 3rd. The issue was fixed and resolved within 48 hours, and released with V1.2.0 (note that a later V2.0.0 release has the same contents as V1.2.0 to respect semver), with production SP1 users being notified and upgraded immediately. The V1.1.0 verifier was frozen on September 4th to ensure that no one uses versions of SP1 with this bug.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | sp1-recursion-gnark-ffi (crates.io) | before 1.2.0 | 1.2.0 | Patch available | GHSA-f77q-r5qm-w4m8 |
- sp1-recursion-gnark-ffi (crates.io) Vendor— Affected before 1.2.0 Fixed in 1.2.0 Patch available GHSA-f77q-r5qm-w4m8
Remediation
- Fix · GHSA-f77q-r5qm-w4m8 sp1-recursion-gnark-ffi (crates.io) Fixed in 1.2.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-f77q-r5qm-w4m8
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences