v2.1.0

OpenVM v2.1.0 adds optional certified STARK verification and includes security and correctness fixes across the verifier, cryptographic guest libraries, transpiler, and toolchain. Prebuilt binaries for various machines are attached.

Security Fixes

This release addresses the following security advisories:

• GHSA-5f24-43wm-7gr2: Rust std main failures are ignored by guest startup.
• GHSA-6p9w-9j7q-867r: RV32IM transpilation can allow execution to continue past abort instructions.
• GHSA-3c6x-fcmq-fm7v: OpenVM k256/p256 point and scalar helpers observe noncanonical representations.
• GHSA-hf63-jcf3-9wm8: Public-key construction does not enforce canonical y coordinates.
• GHSA-3fv9-jqjf-qp93: Noncanonical selected roots can change elliptic-curve decompression results.

Highlights

• (Verifier/SDK/CLI) Added optional STARK proof verification with the certified Swirl verifier extracted from its Lean formalization to the SDK and CLI.
• (Recursion/Continuations) Updated recursion and continuation circuit interactions and constraints for formal verification.
• (Verifier) Marked all verifier circuit AIRs as required during key generation.
• (Guest Library/Algebra) Assert reduction before modular and point byte access and Serde serialization. Native checks panic on noncanonical values.
• (Guest Library/Algebra) Require IntMod and WeierstrassPoint implementers to provide *_unchecked byte accessors, and point coordinates to implement CanonicalRepr.
• (Guest Library/ECC) Assert reduction of the selected root before testing parity during point decompression.
• (Guest Library/ECC) Assert reduction of both coordinates in PublicKey::from_affine before checking identity.
• (Guest Library/Algebra) Compare zkVM field and scalar values modulo their modulus in ct_eq for ff_derive, k256, and p256.
• (Guest Library/ff_derive) Fix encoding and decoding for differing representation and storage sizes in both byte orders. Invalid encodings return None instead of panicking.
• (Transpiler) Reject unsupported SYSTEM/CSR instructions, including LLVM's UNIMP trap.
• (Toolchain) Treat nonzero return statuses from Rust's std main wrapper as failures, including Err and nonzero ExitCode returns.
• (Prover) Fix program-trace padding PC collisions in sparse programs on CPU and CUDA by placing padding after the original program slots.

Contributors

• @Aalanli
• @jonathanpwang
• @shuklaayush
• @stephenh-axiom-xyz
• @yi-sun

New Contributors

• @crazywriter1 made their first contribution in #3152
• @zakazaka95 made their first contribution in #3145
• @kriss39 made their first contribution in #3174

Full Changelog: v2.0.1...v2.1.0