RISC Zero Security Disclosure A missing constraint was recently discovered in the rv32im circuit. This issue affects any 3-register RISC-V instruction (including remu and divu) in risc0-zkvm 2.0.0, 2.0.1, and 2.0.2. This vulnerability was reported by Christoph Hochrainer via our @HackenProof bug bounty program. We have evaluated the severity of the vulnerability as “Critical,” and paid a $50K bounty. The issue has been patched and all partners have been migrated over to 2.1.0. RISC Zero remains committed to providing the highest level of transparency, proactive security, and integrity.