Rocq Prover 9.1 Guard Checker Bypass Proof of Concept

Rocq Prover versions 8.20 through 9.1 contain a kernel soundness vulnerability in the termination guard checker. The finduniformparameters function fails to examine cross-calls between nested mutually recursive fixpoints, incorrectly treating changing parameters as uniform and accepting recursive...

Rocq Prover 9.1.0 Higher Order Fixpoint Guard Checker Bypass

Rocq Prover version 9.1.0 and earlier contain a kernel soundness vulnerability in the termination guard checker. The checker incorrectly accepts recursive functions passed as higher order arguments to other fixpoints, allowing recursive calls on values that are not structurally decreasing. This...