Read the docs
TI-2024-39068 Aliases GHSA-f77q-r5qm-w4m8

sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

The Gnark recursion circuit constrains arithmetic over BabyBear when the native field of the ZKP circuit is the BN254 scalar field. Proper implementation of this logic requires range checking Bn254 values to be less than the BabyBear modulus. In versions < 1.2.0, functions like `InvF` and `InvE` used values generated by hints that were not appropriately range checked. These issues are resolved in versions 1.2.0 and higher, by adding range checks in the appropriate places. This code was covered under the original audit scope of the recursion circuit audit by Veridise, and both Veridise and Kalos revisited the code for similar issues and found no additional vulnerabilities. This issue was discovered by the Succinct team on September 3rd. The issue was fixed and resolved within 48 hours, and released with V1.2.0 (note that a later V2.0.0 release has the same contents as V1.2.0 to respect semver), with production SP1 users being notified and upgraded immediately. The V1.1.0 verifier was frozen on September 4th to ensure that no one uses versions of SP1 with this bug.

Why it matters now

Fix Fixed sp1-recursion-gnark-ffi (crates.io): 1.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—sp1-recursion-gnark-ffi (crates.io)before 1.2.01.2.0Patch availableGHSA-f77q-r5qm-w4m8
  • sp1-recursion-gnark-ffi (crates.io) Vendor— Affected before 1.2.0 Fixed in 1.2.0 Patch available GHSA-f77q-r5qm-w4m8

Remediation

  • Fix · GHSA-f77q-r5qm-w4m8 sp1-recursion-gnark-ffi (crates.io) Fixed in 1.2.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-f77q-r5qm-w4m8

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences