[Bug] Constants exceeding field prime silently wrap without warning

[chamitro]

Summary

Integer constants larger than the field prime are silently reduced modulo p without any compiler warning.

Environment

• Circom: 2.2.3
• OS: Ubuntu

Reproducer

pragma circom 2.0.0;

template Test() {
    signal input a;
    signal output c;
    
    // p+1 where p = 21888242871839275222246405745257275088548364400416034343698204186575808495617
    c <== a + 21888242871839275222246405745257275088548364400416034343698204186575808495618;
}

component main = Test();

circom test.circom --r1cs --wasm --output .
echo '{"a": "5"}' > input.json
node test_js/generate_witness.js test_js/test.wasm input.json w.wtns
snarkjs wtns export json w.wtns w.json
cat w.json  # Returns 6 instead of expected large number!

Results

Constant	Expected	Actual
p	Warning or 0	Silent 0
p+1	Warning or error	Silent 1
p+2	Warning or error	Silent 2
2p	Warning or error	Silent 0
100p+42	Warning or error	Silent 42

Expected Behavior

Compiler should emit a warning like:

warning: constant exceeds field prime, will be reduced modulo p

Comparison

Noir correctly rejects with:

error: Integer literal is too large
  value exceeds limit of 21888242871839275222246405745257275088548364400416034343698204186575808495616

[chamitro]

Hi, friendly bump on this security issue (3 weeks, no response).

Summary: OOB array access returns garbage memory values instead of error.

Is this repo actively maintained? Should I report security issues elsewhere?

cc @jbaylina @clararod9