# Invalid Divrem chip row can send arbitrary bitwise range check with multiplicity -1 (equiv- alent to receive)

Divrem chip failed to constrain special_case implies is_valid, letting a malicious prover send bitwise range checks with multiplicity -1 and forge out-of-range 16-bit limbs.

- Payout: Contest reward
- Severity: high
- Program: OpenVM
- Credited: cergyk
- Disclosed: 2025-03-24
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.1.15
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.15
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:rust technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** zkVM Divrem chip / bitwise lookup bus constraint
**Root cause:** The send_range multiplicity is is_valid - special_case, but special_case is not constrained to require is_valid, so a row with special_case=1 and is_valid=0 emits multiplicity -1 (a receive) on the bitwise bus.
**Steps:**
1. Read divrem/core.rs#L280-L282: send_range(lt_diff - 1, 0).eval(is_valid - special_case).
2. Note no constraint ties special_case to is_valid.
3. Insert a Divrem row with is_valid=0, special_case=1, producing multiplicity -1 on the bitwise bus.
4. This acts as a receive, letting the prover assert any (F, 0) pair is valid 16-bit limbs.
5. Forge results of other chips relying on send_range limb checks.
6. Compare with modular_chip/is_eq.rs where is_setup is constrained to imply is_valid.
**How found:** Code review of the Divrem chip's send_range multiplicity expression, noticing special_case was unconstrained relative to is_valid, then comparing against the correctly constrained modular_chip is_setup/is_valid pattern.
**Exploitation:** A malicious prover crafts a Divrem chip row with special_case=1 and is_valid=0, emitting a bitwise range check with multiplicity -1 (a receive). This lets them claim arbitrary (F, 0) pairs are valid 16-bit limbs, bypassing range checks used by other chips and forging their results. Second argument must be zero.
**Escalation:** Forged limb validity propagates to any chip relying on send_range over the bitwise bus, undermining soundness of the proof system.
**Insight:** In lookup-bus multiplicity expressions of the form valid - flag, always check the flag is constrained to imply valid; a negative multiplicity silently turns a send into a receive, letting the prover assert arbitrary range checks.