Advisories for Cargo/Risc0-Ethereum-Contracts package

2025

RISC Zero Ethereum invalid commitment with digest value of zero accepted by Steel.validateCommitment

Prior to 2.1.1 and 2.2.0, the Steel.validateCommitment Solidity library function will return true for a crafted commitment with a digest value of zero. This violates the semantics of validateCommitment, as this does not commitment to a block that is in the current chain. Because the digest is zero, it does not correspond to any block and there exist no known openings. As a result, this commitment will never be produced …