# Rv32HintStoreChip allows insertion of arbitrary memory content at any time

Rv32HintStoreChip omitted a constraint forcing is_buffer_start, letting a malicious prover write arbitrary memory at any timestamp, breaking zkVM soundness.

- Payout: Contest reward
- Severity: high
- Program: OpenVM
- Credited: georg
- Disclosed: 2025-03-24
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.1.12
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.12
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:rust technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** zkVM Rv32HintStoreChip circuit constraints
**Root cause:** The prover is not forced to set is_buffer_start on the first row of a buffer write, so the execution-bridge connection that constrains timestamp and memory address is never activated.
**Steps:**
1. Set is_buffer=1 and is_single=0 on a hint-store row.
2. Omit is_buffer_start on the first row, skipping the execution-bridge lookup that binds timestamp and address.
3. Emit buffer-write rows writing chosen data to an arbitrary mem_ptr at an arbitrary timestamp.
4. Generate witness with the malicious record inserted (PoC diff adds malicious_execute and a trace-gen branch for marker opcode 12345).
5. Run on Fibonacci example with input 0x1000000000000000; observe challenge-phase error rather than out-of-domain mismatch, confirming constraint gap.
**How found:** Code review of Rv32HintStoreChip: noticed is_buffer_start gates the execution-bridge connection but is prover-set and unconstrained, so omitting it detaches the write from timestamp/address constraints.
**Exploitation:** A malicious prover crafts a witness containing a fake hint-store buffer block with is_buffer_start=0, writing attacker-chosen words to any memory address at any timestamp, then submits the proof to a verifier that accepts it as a valid execution.
**Escalation:** Breaks soundness for any program, even those not using the hint-store instruction, since memory consistency is no longer guaranteed.
**Insight:** In zkVM/STARK circuits, audit every prover-supplied flag that gates a lookup or permutation argument: if a flag can be zeroed to skip a connection, the constraint it enforces vanishes. Check first-row/start flags especially.