-
Notifications
You must be signed in to change notification settings - Fork 581
chore(avm): ECC pre-audit - normalise infinity points #19462
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1eaa743 to
b1bf24c
Compare
b1bf24c to
ab98e11
Compare
ab98e11 to
e749a4f
Compare
Collaborator
Flakey Tests🤖 says: This CI run detected 4 tests that failed, but were tolerated due to a .test_patterns.yml entry. |
e749a4f to
c41f653
Compare
This reverts commit 6da1494.
IlyasRidhuan
approved these changes
Jan 14, 2026
Contributor
IlyasRidhuan
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice!
Merged
github-merge-queue bot
pushed a commit
that referenced
this pull request
Jan 14, 2026
BEGIN_COMMIT_OVERRIDE fix(avm): Fix relative addressing in fuzzer (#19550) feat(avm): avm fuzzer bytecode mutation (#19378) chore(avm): there is automatic conversion from uint128_t to FF chore(avm): ECC pre-audit - normalise infinity points (#19462) feat(bb-pilcom): single-component graph check (#19578) feat(avm): contract class mutation (#19498) chore: support uint128_t in uint256_t construction (#19581) fix!: remove unused column in update_check.pil (#19557) fix(avm)!: pre-audit review of context.pil (#19549) fix(avm): Relax fuzzer memory manager asserts (#19591) fix!: sha256.pil missing input propagation constraints (#19590) END_COMMIT_OVERRIDE
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
ECC Pre-Audit - Normalise infinities
Closes AVM-193
NOTE: The issue of no operation being set is now addressed in #19471 => this PR only normalises
infs so they always have(0, 0)coordinates inecc.pil. Though the circuit no longer fails, it does incorrectly set the predicates (i.e.double = 0when doublinginf), which could be a footgun.In pre-audit it was found that our C++ elliptic curve point class
StandardAffinePointaccepts different representations of the infinity (O) point - this makes sense as in noir we use(0, 0)and in BB we use((P+1)/2, 0). This would be fine if any ECC calculations in the AVM first checkedis_infand overrided any subsequent coordinate-based operations. But theecc.piltrace sets whether we have adoubleoraddoperation based on coordinates without gating by anyis_infchecks:Assuming (understandably!) that two infinity points would share the same coordinates, the above works fine, but we can input a BB-standard
Oaspand a Noir-standardOasqfrom as early as the simulation call without any errors/checks.This results in!x_match && y_matchwhich means none ofdouble_predicate,add_predicate, orinfinity_predicateare true and the circuit falls over. See c9da1ea for repro of this.Though there is no current flow that throws here, I think it's worth addressing as we can make the circuit fail with what should be valid inputs.Fix
The current approach is to normalise any input infinity points (we already normalise resulting infinity points in
eccandscalar_mul) at the simulation stage, so events with any infs always have(0, 0)coordinates. This means:ecc.pilor theexecution.pildispatchx = 0, y = 0if the pointis_inffor standard add and scalar mul eventsecc_mem.pilnow constrains thatecc.pilhasx = 0, y = 0if the pointis_infvia the existing lookup (requires 4 more columns)We could alternatively normalise the points in tracegen, but this means we don't use the values emitted in the events, which feels a bit gross. We could also add many gating constraints to
ecc.pilto handleinfedge cases, but this would be expensive and defeats the point a bit of the trace assuming that the input points are on the curve and validated. So this approach felt the smoothest!