Succinct Patches SP1 Rust Verifier Flaw Affecting Versions Through 6.8.0

Succinct patched a flaw in SP1’s native Rust verifier that could allow invalid execution proofs to pass validation when proof data was inconsistent, affecting releases 6.0.0 through 6.8.0.

The fix is included in SP1 version 6.8.1. Along affected verification paths, the software now checks that a tensor’s stored length equals the product of its declared dimensions and checks the tensor’s shape. These checks address inconsistencies that could cause separate verification steps to process mismatched data.

The issue involved Core and Compressed proofs submitted directly to the vulnerable Rust verifier. When the flaw was discovered, Succinct’s mainnet Prover Network was the only known affected deployment. The network accepted proofs from third-party provers, and Succinct has updated it with the patch.

Groth16 and Plonk verification was unaffected. Operators running their own native Rust verifier with proofs from untrusted provers should upgrade to version 6.8.1.