fix: bls bytes verification #1600
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hardhat Unit Tests Coverage SummaryDetailsDiff against masterResults for commit: a70087d Minimum allowed coverage is ♻️ This comment has been updated with latest results |
There was a problem hiding this comment.
Pull request overview
This PR fixes a critical security issue by ensuring that on-chain BLS verification matches the consensus layer (CL) BLS verification. It adds validation of compression flag bits in BLS public keys and signatures against user-provided Y components, preventing potential bypasses where invalid compressed representations could pass on-chain verification but fail CL verification.
Key changes:
- Adds compression flag validation logic to verify that compressed BLS components match their provided Y coordinates
- Introduces new error types for invalid compression flags and sign bits
- Adds comprehensive test coverage for various bit manipulation scenarios
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 19 comments.
| File | Description |
|---|---|
| contracts/common/lib/BLS.sol | Implements compression flag validation functions and integrates them into the deposit signature verification process |
| lib/pdg.ts | Adds test helper utilities to manipulate compression flags in BLS components and verify the validation logic |
| test/0.8.25/vaults/predepositGuarantee/predepositGuarantee.test.ts | Adds comprehensive test cases covering all compression flag manipulation scenarios (100 iterations each) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
test/0.8.25/vaults/predepositGuarantee/predepositGuarantee.test.ts
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
test/0.8.25/vaults/predepositGuarantee/predepositGuarantee.test.ts
Outdated
Show resolved
Hide resolved
tamtamchik
reviewed
Dec 23, 2025
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <[email protected]>
…hardening Fix/bls bytes verification hardening
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
Problem
Restores invariant where on-chain BLS check must be complete to CL BLS check
Solution
Verify compression flag bits in pubkey and signature againts user provided Y components