# Overflow possible in bus argument

OpenVM's LogUp bus argument lacks a bound on bus sends, letting a malicious prover send a tuple p times to forge proofs of false statements.

- Payout: Contest reward
- Severity: high
- Program: OpenVM
- Credited: georg
- Disclosed: 2025-03-24
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.1
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:rust technique:incomplete-fix technique:source-review vuln:crypto

**Target:** zkVM prover/verifier bus argument (LogUp) in OpenVM framework
**Root cause:** The LogUp bus argument is only sound if the number of sends of a tuple is less than the field characteristic p; OpenVM does not constrain trace heights or send counts, so sending a tuple p times is equivalent to zero sends.
**Steps:**
1. Identify that bus sends use multiplicity 1 and accumulator term m/(α+t) over BabyBear (p = 2^31 - 2^27 + 1).
2. Patch BaseAluCoreAir::eval to send a wrong XOR tuple (x,x,x) with multiplicity p-1 then again with multiplicity 1, totaling p sends per row.
3. Confirm the modified circuit's proof is accepted by the verifier, demonstrating overflow.
4. To reach p sends without modifying the circuit, supply wrong witnesses to existing bus sends across many rows, or design a malicious OpenVM extension with many controllable sends.
5. Modify should_segment to allow chips of size 2^25 and verify the verifier accepts them.
6. Apply a diff adding 2028 send_xor(zero,zero,zero) and 2048 request_xor(0,0) per row; run Fibonacci on input 0xFFFF300000000000 producing a 2^22-row BaseAluCoreAir with ~2^11 sends/row = 2^32 sends, accepted by verifier.
**How found:** Reading the LogUp paper's Lemma 5 soundness condition (sends < field characteristic) and checking that OpenVM enforces no such bound on trace heights or send counts, then testing with a patched circuit and a verifier diff.
**Exploitation:** A malicious prover constructs a witness/circuit where a chosen tuple is sent exactly p times to the bus (via wrong witnesses across many rows or a custom extension), making the LogUp accumulator treat p sends as zero and allowing a proof of a false computation result to pass verification.
**Escalation:** Once one chip's bus connection is broken, the prover can arbitrarily interfere with inter-chip connections, proving wrong results for any step and thus arbitrary statements; malicious extensions could also break other extensions' results.
**Insight:** For lookup/bus arguments, always check whether the protocol enforces the field-characteristic bound on multiplicities; trace height limits per chip and per-bus send counts are the missing verifier constraint to look for.