Add zkVM bugs

[StefanosChaliasos]

UI changes:

• Add ZKVM field to both reports and bugs. It should be a boolean flag.
• Update the UI to filter bugs and reports with the ZKVM flag.
• Update the past reports to include the flag and to contain the zkbugs_get_sources.sh file. This file should do nothing if the code is already in the bug report.
• Add script to run all the zkbugs_get_sources.sh commands in all issues.

For audit reports, also add them in the reports/ directory.
We only include medium, high, and critical severity bugs from audits.
For each bug, we need to do the following:

1. Create a directory dataset/dsl/project/bug-id where dsl is the DSL used by the project (e.g., plonky3), project is the project name (e.g., SP1), bug-id is the ID that should be source-bug, where source could be the security company (e.g., zksecurity) or a competition or the handle of a security researcher, and bug is the bug name with underscores instead of spaces.
2. Copy the contents of the template into the new directory: cp template/* dataset/dsl/project/bug-id
3. Fill all the details in the zkbugs_config.json file. Note that id is source-report-id where report-i is the id for the bug in the report (e.g., 1)
4. If it is possible to reproduce the bug with a test case, then fill the rest of the files (look at circom-template for an example). In any case, in zkbugs_get_sources.sh add the code to clone the code in the specific commit where the code was vulnerable.

SP1:

• GH advisories: https://github.com/succinctlabs/sp1/security
• Audit reports: https://github.com/succinctlabs/sp1/tree/dev/audits

risc0:

• GH advisories: https://github.com/risc0/risc0/security
• https://github.com/risc0/rz-security/tree/main/audits (some of them might not be relevant)
• risc0/zirgen@4514a39

Zisk:

• Critical soundness bug in SignFp template 0xPolygonHermez/zisk#477

openvm:

• GH advisories: https://github.com/openvm-org/openvm/security
• Audits: https://github.com/openvm-org/openvm/tree/main/audits

zksync-airbender:

• Are any of those audits for airbender? https://docs.zksync.io/zksync-protocol/security/audits

jolt:

• https://blog.zksecurity.xyz/posts/jolt-findings/

Pico and Ziren: Nothing yet

[this-vishalsingh]

@StefanosChaliasos Pico completed their public audit, report here - https://github.com/brevis-network/pico/blob/main/audits/Security%20Review%20for%20Pico%20-%20Sherlock.pdf

[StefanosChaliasos]

Thanks @this-vishalsingh! Would be amazing if you can help with a list of public audit reports

[this-vishalsingh]

Thanks @this-vishalsingh! Would be amazing if you can help with a list of public audit reports

Absolutely, here we go - https://github.com/ZippelLabs/zkVMs-Security/tree/main/reports

[this-vishalsingh]

@StefanosChaliasos Is this relevant ?

[StefanosChaliasos]

yeah, thanks!