Succinct’s SP1 bug sparks transparency debate in ZK security

This is a segment from the 0xResearch newsletter. To read full editions, subscribe.

Succinct’s SP1 ZKVM has come under scrutiny after LambdaClass disclosed a critical security vulnerability in its proof generation. The exploit in version 3 of SP1, discovered in collaboration with 3Mi Labs and Aligned, stemmed from the interaction of two separate security flaws.

Succinct previously disclosed the potential exploit to its customers via Github and Telegram.

Here’s what happened in simple terms:

1. Missing Verification Step — The system relied on a list to track key proof components but didn’t properly verify that the list was accurate. Consequently, a malicious prover could potentially manipulate it to produce invalid proofs. New checks were added to fix the oversight.
2. Incomplete Proof Flag — A key part of SP1’s proof-checking system included a flag meant to confirm that a proof was fully executed. However, this flag wasn’t always properly enforced, leading to a potential loophole. Succinct tightened up the checks.
3. Polynomial Evaluation Issue — An issue found in Plonky3 (a dependency of SP1), meant that it didn’t fully verify all calculations before confirming a proof was valid. Post-patch, all proof components are properly verified.

While the vulnerability was quickly addressed prior to the disclosure, the process has raised concerns about transparency in security practices for zero-knowledge virtual machines (ZKVMs). SP1’s technology is currently underpinning high profile upgrades in rollup infrastructure under development.

• Mantle Network has integrated SP1 to transition into a zero-knowledge (ZK) validity rollup, aiming to enhance transaction finality times and support institutional-grade asset settlements.
• The AggLayer employs SP1 to generate pessimistic proofs, ensuring the security of its cross-chain interoperability solutions.
• Taiko has adopted SP1 as a ZK prover to secure its layer-2 execution, which uses a multi-prover system
• Soon, a relatively new project, is building an SVM rollup framework that settles to Ethereum with ZK fault proofs powered by SP1, similar to Eclipse, although the latter uses RISC Zero instead.

Transparency and implications

LambdaClass cautioned that the full implications of the flaw required further assessment. Notably, the exploit depended on the interplay between the two issues, meaning that fixing one might not be sufficient to prevent exploitation.

LambdaClass developer known as Fede, highlighted on social media that his team felt compelled to make the disclosure public after perceiving a lack of urgency in Succinct’s communication about the issue.

Succinct’s leadership acted responsibly in fixing the issue, according to Avail’s Anurag Arjun, but he agreed  better public disclosure practices are needed.

“ZKVM systems are very new and are constantly being updated, so you’d expect vulnerabilities,” Arjun told Blockworks. “In an open-source setting, anyone can run the prover, and if vulnerabilities aren’t disclosed properly, that’s definitely a risk.”

The Avail team, which uses SP1 for proof generation in its consensus mechanism, was informed about the issue privately ahead of public disclosure, Arjun confirmed.

Avail’s implementation was not exposed to risk, Arjun said, because they rely on Succinct’s proprietary prover, which remains permissioned. Avail’s rollup clients have also not yet begun using its SP1-powered bridge contract, so there was no practical impact.

Meanwhile, defenders of Succinct point out that responsible disclosure typically involves private reporting before public statements to avoid unnecessary panic and potential exploitation.

Succinct’s updated version 4 of SP1 — dubbed Turbo — resolves the identified vulnerability, and downstream projects have begun integrating these fixes. 

The case illustrates how even well-audited code can and does contain bugs. As Succinct put it, “while auditors provide valuable insights, they are not infallible, and we remain committed to continuously improving and working hard to ensure our systems are safe and secure for everyone.”

The more explicit, if belated transparency from Succinct drew praise. What remains is the question of how to best balance security, transparency, and user protection. And finding the line between due criticism and toxic infighting.

Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.