Executive brief
Lean 4 is a theorem prover used to formally verify critical software including compilers, cryptographic libraries, and smart contracts. A vulnerability in its kernel allows an attacker to inject unsound declarations that prove false propositions (e.g., 0 = 1) without triggering any safety checks or axiom warnings. This undermines the entire correctness guarantee of systems built on Lean proofs, potentially invalidating safety cases for avionics, automotive, and other critical systems.
Technical details
The vulnerability is an inference cache poisoning attack (CWE-488) in the Lean 4 kernel's type checker. The root cause is that the environment::add_opaque function omits the check_no_metavar_no_fvar closure check that definition and theorem paths perform. An attacker creates a crafted type expression that equals False, causing the kernel to cache a temporary local variable's type. After restoring the local context (leaving the cache stale), the opaque declaration body references the now-unbound variable. Because cache lookup precedes local-context membership tests, the kernel accepts an opaque constant of type False without detecting the free variable violation. The exploit works through the standard checked addDecl path with --trust=0 (maximum verification), produces no axiom warnings, and contains no sorry, unsafeCast, or FFI calls. Fixed in Lean 4.32.2 by adding the missing closure check.
Affected products
- Lean Lean 4 ≤4.31.0 (all prior versions)
Timeline
- 2026-08-24: disclosed
- 2026-07-23: patched: Fixed in nightly 2026-07-23+, backported to v4.32.1 and v4.32.2