GHSA-RJR4-V43M-PXQ6

The Lie in the Sponge: Breaking Triton VM's STARKs

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 22, 2026·6 min read·3 visits

Executive Summary (TL;DR)

Triton VM, a Rust-based Zero-Knowledge Virtual Machine, failed to hash the `FriPolynomial` and `Log2PaddedHeight` into its Fiat-Shamir transcript. This broke the causality of the proof system, allowing an attacker to choose proof parameters *after* seeing the verifier's challenges, effectively allowing them to forge proofs for false statements. Additionally, a missing bounds check allowed for a trivial Denial of Service.

A critical soundness vulnerability in Triton VM's STARK proof system allowed malicious provers to forge proofs by exploiting a flaw in the Fiat-Shamir heuristic implementation. By failing to commit specific protocol elements to the transcript, the verifier could be tricked into accepting invalid state transitions.

Fix Analysis (1)

Technical Appendix

CVSS Score
1.7/ 10
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

triton-vm < 2.0.0

Affected Versions Detail

Product
Affected Versions
Fixed Version
triton-vm
TritonVM
< 2.0.02.0.0
AttributeDetail
CWE-358Improperly Implemented Security Check (Fiat-Shamir)
CWE-400Uncontrolled Resource Consumption (DoS)
CVSS v4.0AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
LanguageRust
ComponentFRI Protocol / Fiat-Shamir Sponge
ImpactSoundness Break (Proof Forgery)
CWE-358
Improperly Implemented Security Check for Standard

Improperly Implemented Security Check for Standard

Vulnerability Timeline

Patch Released in v2.0.0
2026-01-01
Advisory Published
2026-01-02

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.