# Weak Fiat-Shamir Implementation for the LogUp Phase allows crafting Backdoored Circuits

LogUp Fiat-Shamir challenges omitted Interaction field expressions, letting a malicious circuit author craft backdoored circuits that prove false Interactions.

- Payout: Contest reward
- Severity: medium
- Program: OpenVM
- Credited: techiepriyansh
- Disclosed: 2025-03-24
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_openvm_january2025.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.2.4
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:rust technique:chained technique:source-review vuln:crypto

**Target:** openvm-stark-backend LogUp interaction/Fiat-Shamir transcript
**Root cause:** LogUp alpha/beta challenges are sampled only from main-trace, preprocessed and public-input commitments, not from the Interaction field expressions, so the challenges are independent of those expressions.
**Steps:**
1. Clone openvm-org/stark-backend at commit 81b25d79 and apply the PoC patch from gist b0f250e4.
2. Build two chips over a bus: DummyInteractionChip sending fields `[1,1,1,1,1]` mult 1, and VulnInteractionChip sending the same fields referenced from main trace.
3. Run prover/verifier, record sampled alphas/betas.
4. Change VulnInteractionChip to send `[1*coeffs[i] for i in range(5)]` with coeffs hardcoded in the Interaction expression; note alphas/betas unchanged.
5. Solve `sum((coeffs[i]-1)*betas[i]) == 0` over the base field (linear dependence among five 4-dim extension-field betas) for coeffs != [1,1,1,1,1].
6. Plug coeffs in; Interaction holds for unsound witness and proving/verification passes.
**How found:** Observed that Interaction fields can be arbitrary expressions over main trace/preprocessed columns, then checked the transcript: challenges are sampled before field expressions are evaluated, so challenges cannot depend on them. Hypothesized that changing only the expressions (not witnesses) leaves challenges identical, then solved the resulting linear relation to confirm a backdoor.
**Exploitation:** A malicious circuit author hardcodes field-expression coefficients in the Interaction so that, for their chosen public input and main trace, the LogUp sum vanishes despite unsound witnesses, yielding a backdoored circuit that proves false statements. Only the author benefits; third parties still face the original hardness.
**Insight:** When auditing Fiat-Shamir transcripts, verify that every value defining the statement—including expressions/coefficients inside constraints, not just commitments—is absorbed before challenge sampling; if a challenge is invariant to a constraint parameter, that parameter is attacker-free to solve against the challenge.