Skip to content

[M-3] Jump condition assertion can crash VM #175

@this-vishalsingh

Description

@this-vishalsingh

Context: crates/lean_vm/src/isa/instruction.rs

Description

The Jump execution enforces the boolean constraint with assert! rather than returning a recoverable error. If untrusted bytecode/memory sets condition to any field element other than 0 or 1, the process panics and aborts, allowing a denial-of-service(DoS) against any service that executes attacker-influenced programs.

let condition_value = condition.read_value(ctx.memory, *ctx.fp)?;
assert!([F::ZERO, F::ONE].contains(&condition_value),);
if condition_value == F::ZERO {
    *ctx.pc += 1;
} else {
    *ctx.pc = dest.read_value(ctx.memory, *ctx.fp)?.to_usize();
    *ctx.fp = updated_fp.read_value(ctx.memory, *ctx.fp)?.to_usize();
}

Recommendation

  • Replace the assert! with a checked branch that returns a RunnerError (e.g., InvalidJumpCondition) when the value is not 0/1.

  • Consider validating jump conditions during bytecode loading as well.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions