Skip to content

Conversation

chfast
Copy link
Member

@chfast chfast commented Aug 7, 2025

🗒️ Description

This adds test cases for BLS precompiles where one of the point (G1/G2) coordinates is "slightly" above the value of the field prime P. The "slightly above" means that a valid point is modified by adding P to one of its field elements. Such test case has a chance of detecting an invalid implementation where the field element is loaded as 384-bit integer and converted to the Montgomery form. The Montgomery form round-trip has the effect of computing a value mod P, i.e. (x + P) % P gives x and the invalid point becomes valid.

In the similar way test cases may be extended to other BLS precompiles. However, I assume BLS precompiles implementations share the input validation code.

🔗 Related Issues or PRs

N/A.

✅ Checklist

  • All: Ran fast tox checks to avoid unnecessary CI fails, see also Code Standards and Enabling Pre-commit Checks:
    uvx --with=tox-uv tox -e lint,typecheck,spellcheck,markdownlint
  • All: PR title adheres to the repo standard - it will be used as the squash commit message and should start type(scope):.
  • All: Considered adding an entry to CHANGELOG.md.
  • All: Considered updating the online docs in the ./docs/ directory.
  • All: Set appropriate labels for the changes (only maintainers can apply labels).
  • Tests: Ran mkdocs serve locally and verified the auto-generated docs for new tests in the Test Case Reference are correctly formatted.
  • Tests: For PRs implementing a missed test case, update the post-mortem document to add an entry the list.
  • Ported Tests: All converted JSON/YML tests from ethereum/tests or tests/static have been assigned @ported_from marker.

This adds test cases for BLS precompiles where one of the point (G1/G2)
coordinates is "slightly" above the value of the field prime P.
The "slightly above" means that a valid point is modified by adding P
to one of its field elements. Such test case has a chance of detecting
an invalid implementation where the field element is loaded as 384-bit
integer and converted to the Montgomery form. The Montgomery form
round-trip has the effect of computing a value mod P,
i.e. `(x + P) % P` gives `x` and the invalid point becomes valid.

In the similar way test cases may be extended to other BLS precompiles.
However, I assume BLS precompiles implementations share the input
validation code.
@chfast
Copy link
Member Author

chfast commented Aug 7, 2025

Similar tests are critically missing for BN254.

Copy link
Contributor

@spencer-tb spencer-tb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks so much for catching this. How did you discover the gap?

Tested against all clients. LGTM!

@spencer-tb spencer-tb merged commit 846d5cc into ethereum:main Aug 7, 2025
16 checks passed
@chfast
Copy link
Member Author

chfast commented Aug 7, 2025

I noticed that evmone is missing the check for BN254. I manually checked some implementations there and it looks good. I didn't submit tests for BN254 because they hadn't been ported.

@chfast chfast deleted the feat/tests/bls_invalid_fp branch September 10, 2025 12:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants