# timestamp can overflow

OpenVM's memory timestamp was unconstrained and could overflow BabyBear's modulus, letting a malicious prover reorder bus interactions to execute and prove wrong program paths.

- Payout: Contest reward
- Severity: high
- Program: OpenVM
- Credited: Leo Alt
- Disclosed: 2025-03-24
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.2
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:rust technique:incomplete-fix technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** zkVM Offline Memory / LogUp bus argument (BabyBear field)
**Root cause:** The constraint only bounds the timestamp difference (time2-time1+1 fits in 29 bits) but never range-constrains the absolute timestamp, so it can wrap the BabyBear modulus.
**Steps:**
1. Note each memory access carries a monotonically increasing timestamp; only the delta is constrained to 29 bits.
2. Choose chip height 2^25 per segment and use complex instructions (Keccak delta 46, Bls12_381 delta 864) over many iterations to accumulate p timestamp units.
3. Minimize memory accesses between iterations to reach overflow before a new segment is forced.
4. Craft witness reordering the LogUp bus sends/receives so all constraints still hold but final memory values differ.
5. Submit the proof; verifier accepts it and the wrong program path executes.
**How found:** Code-reading of the Offline Memory LogUp argument: noticed the delta constraint (time2-time1+1 in 29 bits) but no range check on the timestamp itself, implying field overflow.
**Exploitation:** A malicious prover engineers a program whose timestamp wraps the field modulus, then reorders the memory bus interactions in the witness; the verifier accepts all constraints while the resulting memory state and program output are attacker-chosen.
**Escalation:** Affects all address spaces, so any memory-dependent computation can be redirected to an advantageous path.
**Insight:** In zkVM/LogUp memory arguments, constraining the delta between consecutive accesses is not enough—check whether the absolute counter is range-constrained, since a wrapping counter preserves ordering constraints while corrupting final state.