[Zellic Audit] fix fp254impl issues #328
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
eigmax
approved these changes
Aug 18, 2025
eigmax
reviewed
Aug 18, 2025
| for i in 0..Self::N_LIMBS-1 { | ||
| { Self::MODULUS_LIMBS[i as usize] } OP_SWAP | ||
| if i == 0 { | ||
| { 2_usize.pow(U254::LIMB_SIZE) } |
Contributor
There was a problem hiding this comment.
One question here: we can use 0x20000000 here for whatever N_LIMBS, yes?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes findings (Malte 1), (Malte 15), (Mohit 12) in the list.
Malte 1
Optimization:
ROT, SWAP, ROTinFp254Impl::addIn Fp254Impl::add in bitvm/src/bn254/fp254impl.rs, there is the following passage:
rust
OP_ROT
OP_SWAP
OP_ROT
this is equivalent to a single OP_SWAP.
Malte 15
Observation: Functions specific for
Fqimplemented in theFp254ImpltraitVarious functions are implemented for the Fp254Impl trait that however operate specifically on Fq, which is only one specific type that implements Fp254Impl. The type Fr is another one implementing Fp254Impl, so counterintuitively, Fr::hinted_mul is a function operating on Fq rather than Fr.
Note also that some of these functions utilize Self, which might refer to an uninted type, for example Fr, instead of the intended Fq. At the moment, the usages of Self are only related to accessing the number of limbs and similar, which are the same in all implementations of Fp254Impl present in the current code base.
These issues appear in the functions in bitvm/src/bn254/fp254impl.rs from hinted_mul to hinted_inv.
While we have not observed an issue in the current state of the codebase connected to this (so far at least), unintuitive behavior like this can cause developer mistakes in the future.
We recommend to move these functions to an implementation for Fq specifically.
Mohit 12
Fp254Impl::neg has a manually unrolled loop and will fail if N_LIMBS is not 9.