# Immediate limbs not range-checked

OpenVM Rv32BaseAluAdapterAir never range-checks immediate byte limbs, letting a malicious prover supply out-of-range decompositions that alter ALU immediate operands and change program results.

- Payout: Contest reward
- Severity: high
- Program: OpenVM
- Credited: georg
- Disclosed: 2025-03-24
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.1.5
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.5
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:rust technique:incomplete-fix technique:source-review vuln:misconfiguration

**Target:** zkVM Rv32BaseAluAdapterAir (alu.rs)
**Root cause:** The adapter constrains rs2 to equal limb[0]+2^8*limb[1]+2^16*limb[2]+2^24*limb[3] but never range-checks each limb to 8 bits, so non-canonical decompositions satisfy the equality.
**Steps:**
1. Patch Rv32BaseAluAdapterChip to add a manipulate_limbs flag and decompose immediate c as [c&0xff, (c>>8)&0xff, (c>>16)&0xff, (c>>16)&0xff].
2. When flag set, replace limb[0] with p-256+limb[0] (p=(1<<31)-(1<<27)+1) and increment limb[1] by 1, preserving the weighted sum.
3. Enable the flag only for the LessThan chip in extension.rs.
4. Run the Fibonacci example with input 0x1000000000000000; observe printed manipulated limbs e.g. [0x77ffff02,0x1,0x0,0x0] for immediate 0x1.
5. Verifier accepts the proof despite out-of-range limbs, confirming the missing constraint.
**How found:** Code review of the adapter AIR: noticed the byte-decomposition equality constraint on rs2 lacked accompanying range checks on the limbs, then built a PoC that shifts value between limbs while preserving the weighted sum.
**Exploitation:** A malicious prover crafts a witness where immediate limbs are out-of-range but sum to the correct rs2, then generates a proof; the verifier accepts it, so ALU-with-immediate instructions (e.g. less-than) evaluate with attacker-chosen operand bytes, changing program control flow and results.
**Insight:** In zkVM/AIR circuits, an equality constraint tying limbs to a value is insufficient without per-limb bit-width range checks; audit every decomposition for missing range constraints, since a prover can redistribute value across limbs freely.