Some out-of-range proof values pass the verification

[khovratovich]

Here one could submit a _pA[1] value that is out of range

snarkjs/templates/verifier_groth16.sol.ejs

Line 56 in 53ef3ea

function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[<%=IC.length-1%>] calldata _pubSignals) public view returns (bool) {

and it will silently be taken modulo q before point negation.

snarkjs/templates/verifier_groth16.sol.ejs

Line 105 in 53ef3ea

mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q))

Consider range-checking the coordinate before processing.