# Bus ID collision between "Variable Range Checker" and "Memory Merkle" bus

Duplicate bus ID in OpenVM's extensions.rs lets a malicious prover misroute range-check tuples onto the Memory Merkle bus, breaking zkVM soundness.

- Payout: Contest reward
- Severity: medium
- Program: OpenVM
- Credited: georg
- Disclosed: 2025-03-24
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.2.1
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:rust technique:source-review vuln:business-logic

**Target:** zkVM bus/chip routing (extensions.rs)
**Root cause:** VariableRangeCheckerBus and MemoryMerkleBus were assigned the same bus index due to a typo in bus_idx_max initialization, so tuples fingerprinted as Pi fieldi*beta^i collide across buses.
**Steps:**
1. Read extensions.rs#L591-L601 and note VariableRangeCheckerBus and MemoryMerkleBus share the same bus ID.
2. Observe fingerprints are Pi fieldi*beta^i, so tuple `(1, 16)` equals `(1, 16, 0, 0, 0, 0, ...)`.
3. Send the range-check tuple `(value, num_bits)` to the MemoryMerkleBus, mapping expand_direction=value, height=num_bits, address_space_label=0, address_label=0, hash=0.
4. Attempt to have MemoryMerkleBus absorb a range check that does not hold, or alter Merkle hash computation.
**How found:** Code review of bus index assignments in extensions.rs; noticed two buses sharing an ID, then reasoned about fingerprint collision via zero-padding of shorter tuples.
**Exploitation:** Not demonstrated; author could not construct an effective exploit. Constraints: only first two fields can be non-zero, hash forced to zero (pre-image unknown), and MemoryMerkleBus interaction also constrains the memory bus.
**Insight:** In zkVM/STARK-style systems, audit bus index allocation tables for duplicate IDs and check whether variable-length tuple fingerprints (Pi fieldi*beta^i) collide via zero-padding, letting a prover route a check to a chip that never validates it.