SP1 V6 Recursion Circuit Row-Count Binding Gap
Date: 2026-04
Affected: rust/sp1_prover, rust/sp1_recursion_circuit, rust/sp1_sdk
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40323
CWE: CWE-345
CWE-354

## Summary A soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. - **Affected versions:** `>= 6.0.0, <= 6.0.2` - **Not affected:** SP1 V5 (all versions) - **Severity:** High ## Details ### Background The recursive shard verifier circuit verifies shard proofs inside a recursive proof. Each shard proof includes a jagged PCS opening, which binds trace-shape metadata into a modified commitment and uses that same shape to evaluate the committed polynomials. These two operations must agree on the committed table heights. ### The Bug In the V6 recursion circuit's jagged verifier, the two checks above are served by separate witnesses: a vector of row counts hashed into the modified commitment (commitment side), and a separate witness of prefix sums derived from row and column counts that drives the jagged polynomial evaluator (evaluation side). The prefix sums are observed within the shard verifier. The consistency check between these two witnesses was missing in the recursion sub-circuit describing the jagged PCS verifier. A malicious prover can therefore supply one trace shape for commitment binding and a different shape for polynomial evaluation. ### Potential Impact The vulnerability applies to both main trace and preprocessed trace metadata. Because preprocessed traces encode circuit structure (selectors, fixed columns, permutation layout), the


Mitigations:

Architectural layers (MAESTRO):