RISC Zero Disclosed Report

https://github.com/risc0/risc0/tree/main/risc0

Overview

Using fault injection, it is currently possible to prove and verify an execution trace that is not a correct execution of the RISC0 VM. As of now, I identified remu and divu as infected instructions.

I provided a proof of concept with which I was able to verify a proof that claimed: 7 % 5 = 0.

Inside the provided supplementary.zip you can find my_project, a very simple risc0 project, and malicious-prover.patch, a git patch file for the risc0 repository. The Cargo.toml files inside of the my_project repository expect the manipulated risc0 repository on the same directory level.

The source files manipulated are:

• risc0/circuit/rv32im/src/execute/rv32im.rs
• risc0/circuit/rv32im-sys/kernels/cxx/ffi.cpp

Furthermore, I used the local prover setting to generate the proof.

The main idea for the attack is to use the 2nd register also as 3rd register. This seems to work for remu and divu, resulting in a certain 0 or 1 respectively. Usually the verifier is able to catch this, but it seems that some constraints are not (enough) enforced, leading to an underconstrainedness of the RISC0 system in this regard.

Versions

toolchain installed with: rzup 0.4.0 risc0 commit hash: 1385e049dffb98bb4ee237709e69a9dee3b40625

Please let me know if you need more information.

1. setup an environment with the risc0 toolchain installed
2. unzip the provided supplementary material
3. download the risc0 repository in the same directory and apply the provided git patch
4. build and run the my_project project
5. the printed message should say: verified that 7 % 5 = 0