{
  "type": "failure-mode",
  "name": "Cross-table lookup and multiplicity bugs",
  "slug": "cross-table-lookup-and-multiplicity-bugs",
  "section": {
    "id": "audit",
    "number": "03",
    "title": "Auditing a ZK protocol",
    "url": "https://zkpick.com/audit/"
  },
  "url": "https://zkpick.com/audit/failure-modes/cross-table-lookup-and-multiplicity-bugs/",
  "markdown": "https://zkpick.com/md/audit/failure-modes/cross-table-lookup-and-multiplicity-bugs.md",
  "detail": "In multi-table designs — zkVM chips, bus architectures — soundness depends on sends and receives balancing across tables and on multiplicity columns being correctly constrained. An unbalanced bus, an unconstrained multiplicity, or a permutation argument over the wrong tuple silently admits executions that never happened. This is a dominant recurring class in zkVM codebases and has no analogue in single-circuit review.",
  "mitigation": "Review the bus or cross-table argument as its own artefact: enumerate every send and receive, check they balance, and confirm multiplicity columns are range-constrained and cannot be chosen freely by the prover.",
  "relatedOptions": [
    {
      "name": "Bug bounties",
      "url": "https://zkpick.com/audit/bug-bounties/"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/audit/failure-modes/cross-table-lookup-and-multiplicity-bugs/",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "authors": [
    "MarketComp"
  ]
}