🔒 Verify given compressed pubKey is on curve

[byeongsu-hong]

No description provided.

[codecov]

Codecov Report

Attention: Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/lib/LibSecp256k1.sol	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[taeguk]

uncompressPubkey already has some verification logic itself. Isn't it not enough?

[byeongsu-hong]

@taeguk no it does check only for the format, not the public key itself. we need to check whether the pubKey is on curve

[byeongsu-hong]

According to the context. Probably it is safe to not to apply this fix.

1. ValidatorManager -> verifying pubKey with msg.sender. we can assume that the pubKey is on curve if the derived address is the same.
2. ConsensusValidatorEntrypoint -> Only called by ValidatorManager, so we don't need to think about it.

[taeguk]

@byeongsu-hong oh right. we should check.

[taeguk]

ValidatorManager -> verifying pubKey with msg.sender. we can assume that the pubKey is on curve if the derived address is the same.

check ValidatorManager's Initialize(). It only has pubkey.

[byeongsu-hong]

@taeguk given our security assumption, we don't need to verify the pubKey. Please check
Oh actually, i added isOnCurve inside of uncompressPubkey, so it verifies it every time

[taeguk]

How about keeping existing codes for potential usage in future?
And actually it was already included in audit scope.

[byeongsu-hong]

Hmm okay, i will keep it