Succinct's mainnet Prover Network was left open to invalid proofs by an SP1 bug

Succinct published a high-severity security advisory on Oct. 11 for a soundness flaw in its SP1 zero-knowledge proving system that let its mainnet Prover Network accept invalid proofs; the company knew of no other affected deployment. Native Rust verifiers—the proof-checking software—in versions 6.0.0 through 6.8.0 could accept a malicious prover’s proof for an invalid execution if sent directly to them, while Groth16, Plonk and Solidity checks were unaffected. Succinct released a fix in version 6.8.1 on Sept. 24 and deployed it to the network. Vitalis Salis reported the flaw through Immunefi’s bug bounty program.