AIKIDO-2026-283234

TL;DR

The RISC Zero zkVM executes certain RISC-V instructions across multiple proving cycles, using a major mode set during the first cycle to control how the following cycle proceeds. The circuit does not impose a constraint ensuring that the mode of operation was definitively selected by the previous cycle. A malicious prover can leverage this under-constrained behavior to craft invalid proofs that still pass verification, breaking the soundness guarantees of the proof system. The fix adds constraints that require the mode to have been set by the preceding cycle.