# Unconstrained sign bit in Rv32LoadStoreAdapter

Unconstrained imm_sign bit in OpenVM's Rv32LoadStoreAdapter lets a malicious prover flip the immediate's high limb, redirecting load/store to a different memory cell and proving false execution.

- Payout: Contest reward
- Severity: high
- Program: OpenVM
- Credited: georg
- Disclosed: 2025-03-24
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.1.8
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.8
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:high tech:rust technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** zkVM Rv32LoadStoreAdapterChip (loadstore.rs)
**Root cause:** The imm_sign column is only constrained to be boolean and used in the high-limb addition; no constraint ties it to the actual sign of the instruction immediate, so the prover picks either value freely.
**Steps:**
1. Read loadstore.rs: imm_extend_limb = imm_sign * 0xffff, carry constraint only asserts imm_sign is bool.
2. Patch adapter to flip imm_sign when rs1_val==0x20b2f0, imm==0x1c, opcode==531.
3. Run Fibonacci example with input 0x1000000000000000.
4. Observe store routed to 0x1fb30c instead of 0x20b30c.
**How found:** Code review of the load/store adapter constraints: noticed imm_sign appears only in the boolean assertion and the high-limb extension, with nothing binding it to the real immediate sign.
**Exploitation:** Malicious prover flips imm_sign on a store so the write lands on an otherwise-unused address, skipping writes such as an account balance update in a smart contract execution, then submits the false proof.
**Escalation:** Skipping arbitrary writes/branches lets the prover prove a false program statement, potentially catastrophic for most programs.
**Insight:** In zkVM/zk circuits, audit every witness column for whether it is actually pinned to the public/instruction input; a column used only in one arithmetic constraint and a bool check is prover-controlled. Check sign/extension bits of immediates specifically.