Proof verification bypass in OpenVM Halo2 Solidity verifier
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
OpenVM before 1.7.0, from 2.0.0-alpha before 2.0.0-rc.3, and from 2.1.0-dev.0 before 2.1.0-preview are affected. The OpenVmHalo2Verifier.verify function (CWE-754) treats a successful staticcall to itself as proof acceptance, so a proof whose leading bytes select another exposed function can make that function succeed instead of the Halo2 verifier. An unauthenticated remote attacker can get applications using the generated Solidity wrapper to accept arbitrary app commitments and public values without a valid proof.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| openvm-org | openvm | before 1.7.0; 2.0.0-alpha to before 2.0.0-rc.3; 2.1.0-dev.0 to before 2.1.0-preview | 1.7.0, 2.0.0-rc.3, 2.1.0-preview | Patch available | CNA |
- openvm Vendoropenvm-org Affected before 1.7.0; 2.0.0-alpha to before 2.0.0-rc.3; 2.1.0-dev.0 to before 2.1.0-preview Fixed in 1.7.0, 2.0.0-rc.3, 2.1.0-preview Patch available CNA
Remediation
Upgrade OpenVM to 1.7.0 in the 1.x line, to 2.0.0-rc.3 in the 2.0 prereleases, or to 2.1.0-preview in the 2.1 prereleases.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
- Fix · CNA openvm (openvm-org) Fixed in 1.7.0, 2.0.0-rc.3, 2.1.0-preview
Timeline
- 2026-10-30 Threatist record created from CVE-2026-62334
- 2026-10-30 CISA SSVC decision points changed
References
Other 9
- https://github.com/openvm-org/openvm/security/advisories/GHSA-j29p-wr24-hp4f
- https://github.com/openvm-org/openvm/pull/151
- https://github.com/openvm-org/openvm/commit/751bdb1725254c3268782ddf8df89f19035666e3
- https://github.com/openvm-org/openvm/blob/v2.0.0-alpha/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol
- https://github.com/openvm-org/openvm/blob/v2.0.0-beta.2/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol
- https://github.com/openvm-org/openvm/blob/v2.1.0-dev.0/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol
- https://github.com/openvm-org/openvm/releases/tag/v1.7.0
- https://github.com/openvm-org/openvm/releases/tag/v2.0.0-rc.3
- https://github.com/openvm-org/openvm/releases/tag/v2.1.0-preview
More openvm-org vulnerabilities
- TI-2026-83374 OpenVM MemoryMerkleAir lets forged rows change the memory root CVSS 4.0HIGH 8.7
- TI-2025-29394 OpenVM byte decomposition of pc in AUIPC chip can overflow CVSS 4.0HIGH 7.8
- TI-2026-83376 OpenVM's Halo2 verifier accepts non-canonical app commitments CVSS 4.0MEDIUM 6.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences