# Proof nonce clobbered when packing deferred page protection events into last shard

Packing deferred page-protection events into the last CPU shard overwrites its proof_nonce with the deferred accumulator's default [0;4], breaking verification of valid proofs.

- Payout: Contest reward
- Severity: medium
- Program: Succinct
- Credited: mohamedfahmy
- Disclosed: 2026-02-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-09-succinct#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:accounting-error vuln:misconfiguration

**Target:** zkVM executor/prover shard record packing and verifier
**Root cause:** ExecutionRecord::split assigns the deferred accumulator's proof_nonce (never populated, stays default [0;4]) onto the already-produced last shard, while the verifier requires all shards to share an identical proof_nonce.
**Steps:**
1. Run execution to completion (done == true) with no precompile shards emitted and deferred sets below packing thresholds.
2. Deferred accumulator is created via `ExecutionRecord::new(program.clone())` without setting `public_values.proof_nonce`, so it remains `[0;4]`.
3. In `ExecutionRecord::split` (~record.rs:289) the code executes `last_record_ref.public_values.proof_nonce = self.public_values.proof_nonce;`, overwriting the last shard's real nonce with `[0;4]`.
4. Verifier in `crates/prover/src/verify.rs` requires identical proof_nonce across shards; the mismatch causes verification failure.
**How found:** Code review of the shard-splitting path: noticed the deferred accumulator is constructed with default public values and never assigned the real proving nonce, then traced the overwrite in split and the verifier's cross-shard nonce equality check.
**Insight:** When a struct is initialized with defaults and later merged into an existing record, audit every field assignment at the merge site against the verifier's cross-shard invariants; default-initialized accumulators silently clobber real values.