# JIT bounds check elision on length underflow

Optimized length or index arithmetic that can underflow before the bounds check runs

_Area: Memory corruption and native code. Seen in 2 disclosed reports; one confirmed bounty: $100,000; latest 2024-02-29. Updated 2026-10-25._

## How it works
An optimizer reasons about a length or index and concludes a bounds check is unnecessary, or a builtin reduction does arithmetic on a length the typer believes is a known constant. The assumption that breaks is that the value feeding the check is what the check assumes: a length the engine believes is zero gets decremented to -1, or a skipped access path leaves an output unconstrained. Once the arithmetic underflows, the unsigned comparison that would have caught an out-of-range index passes, and the access proceeds out of bounds [E2](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2021-12-15-exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce.md). The same shape appears when an optimization skips work: if a memory read is skipped, the output must still be constrained to a safe value, and if it is not, the skipped path forges data [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-03.md).

## Where it shows up
- JIT reductions of builtins (shift, pop) that subtract from a length the typer treats as constant [E2](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2021-12-15-exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce.md)
- Bounds-check elimination passes whose proof depends on a length or index computed earlier
- "Skip" fast paths for out-of-range or special-case pointers that bypass the normal read and masking [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-03.md)
- Optimizations that dematerialize an object but keep a sub-allocation alive, then materialize the same activation more than once [E1](https://bugbountylibrary.com/r/p0%3ACVE-2022-1364.md)
- Any place a length can reach zero and then be decremented again

## How to review
For each elided check, identify the exact value the check would have tested and prove it cannot underflow or change between the proof and the use. The invariant: every optimized access is either preceded by a check on the same value, or the value is provably in range on all paths, including paths where a length is zero. For skip optimizations, verify the output is still constrained (masked to zero or the operation aborted) when the access is skipped [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-03.md). For materialization, confirm repeated materialization of one activation cannot yield two objects sharing one backing store [E1](https://bugbountylibrary.com/r/p0%3ACVE-2022-1364.md).

## Variants seen
- Builtin reduction subtracting 1 from a zero length, underflowing to -1 and passing unsigned bounds checks [E2](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2021-12-15-exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce.md)
- Skipped out-of-bounds read with cleanup mask zeroed, forging the read value [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-03.md)
- Escape analysis dematerializing an object while keeping its backing store, producing aliased objects on repeated materialization [E1](https://bugbountylibrary.com/r/p0%3ACVE-2022-1364.md)

## Impact and severity
Led to out-of-bounds access and RCE in a browser renderer [E2](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2021-12-15-exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce.md), forged memory values in a zkVM circuit [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-03.md), and an in-the-wild exploited type confusion leaking the hole value [E1](https://bugbountylibrary.com/r/p0%3ACVE-2022-1364.md). Severity is high because the flaw sits in optimized code trusted to be safe; it worsens when the bad value crosses a sandbox or trust boundary.

## Evidence
- E1: https://bugbountylibrary.com/r/p0%3ACVE-2022-1364.md
- E2: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2021-12-15-exploitation-of-cve-2021-21220-from-incorrect-jit-behavior-to-rce.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-03.md