{"answers":{"affected":"2 open source packages ship an affected version, including sp1-stark.","exploited":"There is no known exploitation of GHSA-c873-wfhp-wx5m in the wild and no public exploit code.","fix":"Upgrade sp1-stark to 4.0.0 or later.","what":"GHSA-c873-wfhp-wx5m is a vulnerability in sp1-stark, published on 15 Jan 2025."},"fix_prompt":"Check this codebase for GHSA-c873-wfhp-wx5m and fix it if it is affected.\n\nWhat it is: GHSA-c873-wfhp-wx5m is a vulnerability in sp1-stark, published on 15 Jan 2025. \nExploitation: There is no known exploitation of GHSA-c873-wfhp-wx5m in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- sp1-stark (crates.io): affected all versions; fixed in 4.0.0\n- sp1-stark (crates.io): affected all versions; fixed in 4.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-c873-wfhp-wx5m/ (Markdown: https://insights.sbomify.com/GHSA-c873-wfhp-wx5m/index.md)","id":"GHSA-c873-wfhp-wx5m","markdown":"https://insights.sbomify.com/GHSA-c873-wfhp-wx5m/index.md","name":"GHSA-c873-wfhp-wx5m","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In SP1’s STARK verifier, the prover provided `chip_ordering` is used to fetch the index of the chips that have preprocessed columns. Prior to v4.0.0, the validation that this `chip_ordering` correctly provides these indexes was missing. In v4.0.0, this was fixed by adding a check that the indexed chip’s name is equal to the name stored in the verifying key’s chip information. \n\nIn the recursive verifier, every verifier program is generated beforehand and later checked for correctness by requiring a merkle proof to the precomputed merkle root of valid verifier keys. Therefore, the recursive verifier and the on-chain verifier were not affected by this vulnerability. \n\nThis code was audited twice, once as a part of the audit by KALOS and once by Cantina for v1.0.0. This bug was found by the Succinct team during preparation of v4.0.0. Out of abundance of caution, we will be deprecating all previous versions and freeze the corresponding verifiers.\n\nFurthermore, in the recursive verifier, the `is_complete` boolean flag is used to flag a proof of complete execution. Prior to v4.0.0, this flag was underconstrained in parts of our recursive verifier, such as the first layer of the recursion. In v4.0.0, this bug was fixed by adding appropriate calls to the `assert_complete` function, which constrains the correctness of the `is_complete` flag. This code was a part of the audit for v3.0.0. This bug affects the soundness of the Rust SDK for verifying compressed proofs, and the soundness of on-chain verifier for deferred proofs. \n\nThis issue was found by a combined effort from Aligned, LambdaClass and 3MI Labs, and was also independently found by Succinct during the preparation of v4.0.0. \n\nLastly, SP1’s STARK verifier relied on logic inside Plonky3, one SP1's core dependencies, to check that the polynomial evaluation claims are correct using a FRI-based polynomial commitment scheme. To batch this check, multiple polynomial evaluation claims are combined using a random linear combination. Prior to v4.0.0, the individual evaluation claims were not observed into the challenger before sampling the coefficient for the random linear combination. In v4.0.0, this was fixed by observing all the evaluation claims into the challenger correctly inside of Plonky3.\n\nThis bug was found by Lev Soukhanov and Onur Kilic, and we have worked closely with the Plonky3 team to mitigate this vulnerability. We will be deprecating all previous versions and freezing their verifiers to ensure that versions with the vulnerability will not be used in production.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"SP1 has missing verifier checks and fiat-shamir observations","id":"GHSA-c873-wfhp-wx5m","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":null,"year":"2025"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["4.0.0"],"introduced":["0"],"last_affected":[],"package":"sp1-stark","purl":null,"source":"GHSA-c873-wfhp-wx5m"},{"ecosystem":"crates.io","fixed":["4.0.0"],"introduced":["0"],"last_affected":[],"package":"sp1-stark","purl":"pkg:cargo/sp1-stark","source":"GHSA-c873-wfhp-wx5m"}],"products":null,"published":"2025-01-15","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-c873-wfhp-wx5m/"}