Skip to content

prover: enforce load/store memory alignment in AIR#609

Open
Kuhai9801 wants to merge 3 commits into
nexus-xyz:mainfrom
Kuhai9801:fix/issue-605-load-store-alignment-air
Open

prover: enforce load/store memory alignment in AIR#609
Kuhai9801 wants to merge 3 commits into
nexus-xyz:mainfrom
Kuhai9801:fix/issue-605-load-store-alignment-air

Conversation

@Kuhai9801
Copy link
Copy Markdown

@Kuhai9801 Kuhai9801 commented May 14, 2026

Context

Fixes #605.

The VM rejects unaligned halfword and word memory accesses, but the load/store AIR did not enforce that same rule. That meant a forged trace could describe memory behavior that the VM itself would reject.

This PR makes the load/store AIR enforce the same alignment semantics as the VM for:

  • LH, LHU, SH halfword accesses
  • LW, SW word accesses

What changed

  • Added RamBaseAddrAlignmentQuotient, a small witness for the low byte of RamBaseAddr divided by the required alignment.
  • Filled that witness only for halfword and word load/store rows.
  • Added LoadStoreChip constraints so:
    • halfword rows must satisfy addr_low = 2 * q
    • word rows must satisfy addr_low = 4 * q
  • Reused the existing Range128Chip lookup to prove q is an actual small integer, not an arbitrary field value.
  • Added focused regression tests for unaligned LH, LW, and SH, plus aligned acceptance checks for LH and LW.

Review notes

The range check is the key part of the fix. Without it, the equality constraint alone would still allow a forged trace to use a fractional field value for q. With q constrained to [0, 127], the equations force the low address byte to be correctly aligned.

RamBaseAddr limbs are already byte-ranged elsewhere, so enforcing the low byte is enough for these alignment rules.

Verification

Ran locally with the pinned nightly-2025-05-09-x86_64-pc-windows-gnu toolchain:

  • cargo fmt --all --check
  • cargo test -p nexus-vm-prover aligned -- --nocapture

The focused test run passed with 4 tests passing and 0 failures. The rejection tests intentionally catch AIR constraint failures from malformed traces, so the panic messages printed during those tests are expected.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 14, 2026

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@Kuhai9801 Kuhai9801 marked this pull request as ready for review May 14, 2026 09:22
@Kuhai9801
Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA

1 similar comment
@Kuhai9801
Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA

@Kuhai9801
Copy link
Copy Markdown
Author

recheck

@Kuhai9801
Copy link
Copy Markdown
Author

Hi @sjudson @slumber, could either of you review this when possible? I can’t request reviewers directly on this repo. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Load/Store AIR Does Not Enforce VM Alignment Rules

1 participant