# Incorrect opcode offset used for Branch Less instruction

OpenVM's Rv32BranchLessThan256Chip passed the wrong opcode CLASS_OFFSET to its core chip, mis-decoding BLT/BGE/BLTU/BGEU and corrupting branch condition evaluation and PC updates.

- Payout: Contest reward
- Severity: high
- Program: OpenVM
- Credited: Rhaydden
- Disclosed: 2025-03-24
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.1.19
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.19
- Tags: domain:oss impact:integrity kind:contest platform:cantina sev:high tech:rust technique:regression technique:source-review vuln:memory-corruption

**Target:** zkVM RV32 branch-less-than circuit chip (BranchLessThanCoreChip)
**Root cause:** Rv32BranchLessThan256Chip constructs BranchLessThanCoreChip with Rv32LessThan256Opcode::CLASS_OFFSET instead of Rv32BranchLessThan256Opcode::CLASS_OFFSET, so local_opcode_idx maps branch opcodes against the wrong range.
**Steps:**
1. Read Int256::build in extension.rs#L184-L196 and note the offset passed to BranchLessThanCoreChip::new.
2. Compare with BaseAluCoreChip and BranchEqualCoreChip which use their own opcode CLASS_OFFSET.
3. Add openvm-bigint-transpiler dependency and import Rv32LessThan256Opcode in tests.rs.
4. Build Rv32BranchLessThanChip with BranchLessThanCoreChip::new(bitwise_chip, Rv32LessThan256Opcode::CLASS_OFFSET).
5. Execute a BLT instruction via `Instruction::from_isize(BranchLessThanOpcode::BLT.global_opcode(), rs1, rs2, imm, 1, 1)` with from_pc in range.
6. Observe panic `attempt to subtract with overflow` at instructions/src/lib.rs:38 from local_opcode_idx subtraction.
**How found:** Code review of chip construction patterns: noticed the branch chip used the non-branch LessThan opcode offset, inconsistent with sibling chips, then confirmed via a unit test that opcode indexing overflows.
**Insight:** In zkVM/opcode-dispatch circuits, audit the CLASS_OFFSET passed into each core chip against its own opcode enum; a copy-paste offset from a sibling instruction silently mis-indexes local opcodes and breaks control flow.