Executive brief
OpenVM is a framework used to build customizable zero-knowledge virtual machines (zkVMs), which are used to prove the correctness of computations without revealing underlying data. A flaw in its cryptographic pairing library allows a malicious user to provide a "bad hint" that makes any mathematical pairing check appear valid. This could allow an attacker to generate fraudulent proofs, potentially leading to the acceptance of invalid transactions or data in systems relying on OpenVM for security.
Technical details
The `try_honest_pairing_check` function in the `openvm-pairing` guest library (specifically for BN254 and BLS12-381 curves) implements an optimization based on Theorem 3 of ePrint 2024/640. However, it fails to verify that the scaling factor 's' (or 'u') resides within a proper subfield (Fp6) of Fp12. An attacker acting as a dishonest prover can exploit this by providing a malicious hint (e.g., setting the scaling factor to the inverse of the Miller loop result), causing the pairing check to return a successful result for invalid inputs. This vulnerability effectively breaks the soundness of the zero-knowledge proof system for any circuit utilizing these pairing checks. The issue is fixed in version 1.6.0 by adding explicit Fp6 subfield checks.
Affected products
- OpenVM openvm-pairing < 1.6.0
Timeline
- 2026-05-15: patched: Version 1.6.0 released
- 2026-05-15: advisory: GitHub Security Advisory GHSA-76mq-v757-53gr published
- 2026-06-10: disclosed: CVE-2026-46669 published to NVD