A malicious prover could exploit tensor metadata that did not match the proof’s stored elements, potentially getting the vulnerable verifier to approve a proof tied to an invalid computation.
The issue applied to releases 6.0.0 through 6.8.0 when Core or Compressed proofs went directly to the native Rust verifier. Succinct’s security advisory says tensor metadata could specify dimensions that did not match the elements stored in the proof. Separate verification stages could then process inconsistent inputs, creating a path to an incorrect approval.
SP1 6.8.1 compares each tensor’s stored element count with the total implied by its declared dimensions and validates its shape before use. The advisory, published Oct. 11, rates the flaw high severity and credits Vitalis Salis with identifying it through the Immunefi bug bounty program.
Succinct also updated its mainnet Prover Network, the only affected deployment it had identified when the issue was found. The network accepted proofs from third-party provers. The advisory recommends that operators who run their own native Rust verifier and accept proofs from untrusted provers upgrade to version 6.8.1.
The advisory says Groth16 and Plonk verification were unaffected. For applications that verify Compressed proofs through verify_sp1_proof, it limits that status to cases where aggregation ends with a Groth16 or Plonk proof.
