What are the actual risks of vulnerabilities caused by deviations?

[Subway2023]

Component

sp1-zkvm

Describe the feature you would like

What are the actual risks of vulnerabilities caused by deviations (such as execution results being inconsistent with expectations, shown in bug)?
What impact could this have on zk-rollups or blockchain?

Additional context

No response

[themighty1]

The risks are a complete loss of soundness. But to exploit it, the attacker has to use unsafe {} iiuc.
To mitigate, we can pin the dependencies to prevent supply-chain attacks + audit the guest program code.

[nhtyy]

Thank you @themighty1 I agree those are good practices to ensure security! Closing for now but feel free to follow up with any questions or if you think its should be reopened.