AI Meets Cryptography 2: What AI Found in OpenVM's ZkVM

TL;DR Highlight

Running zkao on OpenVM found a critical bug letting provers forge any pairing equality

Who Should Read

A security or backend developer who works with zkVM or ZK verification code, or wants to automate code audits with AI

Core Mechanics

openvm-pairing let provers fake pairing checks
- In the openvm-pairing guest library, a malicious prover could forge any pairing equality.
- This is not a bug in the zkVM proving system itself, only in code using this library.
- It was assigned CVE-2026-46669 and fixed in OpenVM 1.6.0.
The scaling factor never got a subfield check
- The optimized check is f·u = c^λ, but nothing verified that u lies in the F_p^6 subfield.
- The code only checked that c was non-zero (u for BN254, s for BLS12-381).
- The subfield test is just three equality checks: the odd coefficients c1, c3, c5 must be zero.
c=1, u=f⁻¹ passes the check for any f
- With c=1, c^λ=1, and with u=f⁻¹, f·u=1, so the check passes for any Miller output f.
- f⁻¹ is normally a full F_p^12 element, so a subfield check would have rejected it.
- Because the optimized routine returned success, the slower fallback doing the full final exponentiation never ran.
The blast radius is wide

Community Reactions

Having an LLM write a PoC is a weak triage signal, per the authors
- The model was good at producing passing PoCs even for issues that were not real.
- Validating those PoCs took longer than triaging the original report.
A commenter gave an easy analogy
- They compared it to a signature library that checks the signature matches a given hash but not that the signed data hashes to it.
- They said the precomputed value needed for verification wasn't checked against the situation, so trivial parameters always yield 1.
A commenter asked whether exploitation would force L2 resets
- They asked whether most L2 ecosystems or the components connecting them would need a hard reset.
- The article says all partners building on OpenVM have upgraded to 1.6.0.
A commenter said the dense math explains the sparse discussion
- They guessed few people commented because the post is very dense math without context.

How to Apply

Audit your verification functions for missing hint checks
- Today, paste a ZK, signature or proof verification function into a coding agent and have it list the constraints on every prover-supplied hint.
- For values with only weak checks like non-zero, add explicit membership checks (subfield, range, degree).
Check where a fast path skips the full verification
- Find code where a successful fast path bypasses a slower full check.
- Add tests that cover every precondition of the fast path.
Design multi-agent audits around module knowledge summaries
- Instead of per-folder bug hunting, have each subagent output assumptions, delegated duties and implicit invariants in a fixed format.
- Have the main agent combine them to spot composition bugs across modules.
Don't trust LLM-written PoCs that merely pass
- Check them for mocks, disabled checks, patched helpers and odd run flags.
- Have a human reproduce the exploit against unmodified code.

Try It

copy & run

# Paste into Claude or ChatGPT (simplified version of the article's approach: audit verification code via module-knowledge summaries)

You are a cryptography and verification-code security auditor. Analyze the verification function below as 'module knowledge', not as a bug list.

[Code]
{{verification function code}}

Answer in this format.
1. What this function assumes
2. What it delegates to callers or the prover (hints, witnesses, other external input)
3. Invariants it silently relies on
4. For each external input, which constraints the code actually checks and which it doesn't
5. Whether a fast path on success skips a full verification
6. Whether the checks pass if the input is chosen maliciously (e.g. values like c=1, u=f^-1 that always make the equation hold)

Quote the supporting code lines for each item. If unsure, say you don't know instead of guessing.

Next step: run the same analysis on other modules, merge the results, and ask whether module A's delegated duties line up with module B's assumptions.

Terminology

pairingA special multiplication that takes two elliptic-curve points and returns one value. It lets you check 'a×b=c' without knowing the values, which is the core of SNARK, KZG and BLS verification.

zkVMA virtual machine that proves program execution with zero-knowledge proofs. You write provable programs in familiar languages like Rust instead of hand-writing circuits.

soundness bugA bug that lets you prove a false statement. The verifier accepts a fake proof.

scaling factorA correction value (u or s) the prover supplies so the optimized pairing check balances. It must lie in a subfield, and that condition was missing.

final exponentiationThe pairing step that raises the Miller loop output to a fixed power to remove ambiguity. It is too expensive inside a circuit, so a hint is used instead.

zkaozkSecurity's AI security auditor. It encodes expert audit methods as reusable flows and runs them continuously.