GHSA-f77q-r5qm-w4m8
sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic
GHSA-f77q-r5qm-w4m8 is a medium vulnerability (CVSS 6.9) in sp1-recursion-gnark-ffi, published October 29, 2024. No source lists public exploit code. Fixed in sp1-recursion-gnark-ffi 1.2.0.
- Severity
- 6.9 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2.0sp1-recursion-gnark-ffi
Description
The Gnark recursion circuit constrains arithmetic over BabyBear when the native field of the ZKP circuit is the BN254 scalar field. Proper implementation of this logic requires range checking Bn254 values to be less than the BabyBear modulus.
In versions < 1.2.0, functions like InvF and InvE used values generated by hints that were not appropriately range checked. These issues are resolved in versions 1.2.0 and higher, by adding range checks in the appropriate places. This code was covered under the original audit scope of the recursion circuit audit by Veridise, and both Veridise and Kalos revisited the code for similar issues and found no additional vulnerabilities.
This issue was discovered by the Succinct team on September 3rd. The issue was fixed and resolved within 48 hours, and released with V1.2.0 (note that a later V2.0.0 release has the same contents as V1.2.0 to respect semver), with production SP1 users being notified and upgraded immediately. The V1.1.0 verifier was frozen on September 4th to ensure that no one uses versions of SP1 with this bug.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sp1-recursion-gnark-fficrates.io | before 1.2.0 | 1.2.0 |
What each source reports
GitHub Advisories Score used
sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic
The Gnark recursion circuit constrains arithmetic over BabyBear when the native field of the ZKP circuit is the BN254 scalar field. Proper implementation of this logic requires range checking Bn254 values to be less than the BabyBear modulus.
In versions < 1.2.0, functions like InvF and InvE used values generated by hints that were not appropriately range checked. These issues are resolved in versions 1.2.0 and higher, by adding range checks in the appropriate places. This code was covered under the original audit scope of the recursion circuit audit by Veridise, and both Veridise and Kalos revisited the code for similar issues and found no additional vulnerabilities.
This issue was discovered by the Succinct team on September 3rd. The issue was fixed and resolved within 48 hours, and released with V1.2.0 (note that a later V2.0.0 release has the same contents as V1.2.0 to respect semver), with production SP1 users being notified and upgraded immediately. The V1.1.0 verifier was frozen on September 4th to ensure that no one uses versions of SP1 with this bug.
- Record
GHSA-f77q-r5qm-w4m8- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic
The Gnark recursion circuit constrains arithmetic over BabyBear when the native field of the ZKP circuit is the BN254 scalar field. Proper implementation of this logic requires range checking Bn254 values to be less than the BabyBear modulus.
In versions < 1.2.0, functions like InvF and InvE used values generated by hints that were not appropriately range checked. These issues are resolved in versions 1.2.0 and higher, by adding range checks in the appropriate places. This code was covered under the original audit scope of the recursion circuit audit by Veridise, and both Veridise and Kalos revisited the code for similar issues and found no additional vulnerabilities.
This issue was discovered by the Succinct team on September 3rd. The issue was fixed and resolved within 48 hours, and released with V1.2.0 (note that a later V2.0.0 release has the same contents as V1.2.0 to respect semver), with production SP1 users being notified and upgraded immediately. The V1.1.0 verifier was frozen on September 4th to ensure that no one uses versions of SP1 with this bug.
- Record
GHSA-f77q-r5qm-w4m8- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.