fix(crypto): bind g1 identity to g2 in bls verification - #481
Merged
Conversation
Validators are identified by their on-chain g1 key, but verification ran against the g2 supplied in the incoming message with nothing tying the two together. Fold the keypair check into the pairing so a substituted g2 is rejected, matching SigBlsBn254.verify in the contracts. Applies to both bn254 and bls12381.
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
|
Failed to generate code suggestions for PR |
alrxy
self-requested a review
July 31, 2026 06:54
alrxy
approved these changes
Jul 31, 2026
Committer indices serialize as a bitmap, so ordering is not representable and the deriver sorts them for that reason. Assert the set round-trips intact in ascending order instead of an insertion order the codec never promised.
Generated bindings differ between abigen releases and CI fails if `make generate` leaves a diff, so an unpinned @latest breaks every PR whenever upstream changes its output. v1.17.5 is the current latest and matches the committed bindings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BLS verification checked the signature against the g2 supplied in the incoming message, with nothing tying it to the g1 key a validator is identified by. This folds the keypair check into the existing pairing so both halves have to belong together, matching SigBlsBn254.verify in relay-contracts. It stays a two term pairing check, so there is no extra pairing on the gossip path.
Applies to both bn254 and bls12381. Verify in bn254 was a byte for byte duplicate of VerifyWithHash and now delegates to it. Adds regression tests at the crypto and entity-processor layers.