# Zero Config Values Can Crash or Stall the Prover Indefinitely

Zero syscall/page_prot/memory thresholds in SplitOpts cause chunks_exact(0) panic or infinite loop in ExecutionRecord::split, stalling the SP1 prover.

- Payout: Contest reward
- Severity: medium
- Program: Succinct
- Credited: johnyfwesh
- Disclosed: 2026-02-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-09-succinct#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:dos vuln:misconfiguration

**Target:** SP1 prover executor shard-splitting (ExecutionRecord::split)
**Root cause:** SplitOpts::new truncates trace-area quotients to multiples of 32 via trunc_32, collapsing thresholds to zero when slack is small; ExecutionRecord::split never guards against zero divisors/capacities.
**Steps:**
1. Set HEIGHT_THRESHOLD=1 or supply config where available_trace_area minus fixed_trace_area is below one chunk cost.
2. SplitOpts::new computes threshold = trunc_32(remaining/cost) = 0.
3. PrecompileEvents::default seeds an entry per should_send() syscall even with empty event list.
4. ExecutionRecord::split calls events.chunks_exact(0) at record.rs:201 -> panic.
5. Alternatively zero page_prot/memory makes capacity=0, init_to_take=finalize_to_take=0, slices never advance -> infinite loop at record.rs:250/314.
6. Use a ~23.6M-instruction ELF under default settings to reach zero thresholds without config override.
**How found:** Code review of record.rs split logic and opts.rs trunc_32 arithmetic; noticed chunks_exact panics on zero and that truncation to multiples of 32 can yield zero when slack is small, then traced reachability via default precompile seeding and env-driven config.
**Exploitation:** Attacker submits a large valid ELF or crafted config/env (HEIGHT_THRESHOLD=1) to a public prover API; shard generation panics or livelocks holding the deferred-record mutex, aborting/stalling proof generation.
**Insight:** When a divisor is derived by truncating a quotient to a block size, check the sub-block-size boundary: trunc_32(x) is zero for x<32, and chunks_exact(0) panics while zero-capacity slice loops livelock. Also check default-seeded maps that iterate even with empty payloads.