audit: deserialize proof with validation checks

[manishbista28]

Verify that point decompression actually does point-on-curve check as well.

[manishbista28]

Point Decompression right now doesn't check if compressed point is a valid point on curve:

Comparing Arkworks-rs decompress implementation to g16ckt:

https://github.com/arkworks-rs/algebra/blob/v0.5.0/ec/src/models/short_weierstrass/affine.rs#L130

Not all field elements have square roots. If it doesn't exist, arkworks returns None. This is used to verify that the compressed point is a valid point.

g16ckt directly returns sqrt and doesn't validate as is done here because it assumes input is a quadratic residue i.e. square root always exists.
/// Square root in Montgomery form (assuming input is quadratic residue)
https://github.com/arkworks-rs/algebra/blob/v0.5.0/ff/src/fields/sqrt.rs#L145

[manishbista28]

    impl<M: CircuitMode<WireValue = bool>> EncodeInput<M> for OnlyCompressedG1Input {
        fn encode(&self, repr: &CompressedG1Wires, cache: &mut M) {
            let p = self.0;
            let x_m = Fq::as_montgomery(p.x);
            let s = (p.y.square()).sqrt().expect("y^2 must be QR");

First I am very doubtful if the rust function that feeds data to wires should itself validate what a "proper" input is and panic as is done in the last line. Doing it like this won't allow for circuit code to debate on the validity of correct inputs and as such no way to disprove for incorrect inputs onchain.

Secondly the last check should be sqrt() followed by square(). The way it's done right now never determines a QR.

 let s = p.y.sqrt().expect("y^2 must be QR").square();  // corrected form

[AaronFeickert]

What is even the functionality of having such an assert?

[manishbista28]

We should not use assertion the way it's been used above. Instead this should have been a validation check to identify whether the input supplied was correct. Doing this validation in rust is like an additional way to confirm or ascertain what the circuit value should be at some point.

[manishbista28]

Message from Zenith:

Target

groth16.rs
Severity:

Impact: High
Likelihood: High
Description:

In groth16_verify and groth16_verify_compressed, there's no validations on whether the input points are in the correct prime-order subgroup. Coupling with https://github.com/zenith-security/2025-11-alpen-labs/issues/1 that is used in groth16_verify_compressed , invalid points can be used in the Groth16 verification that may break the paring computation and allow attackers to forge a Groth16 proof.

Recommendations:

Similar to https://github.com/zenith-security/2025-11-alpen-labs/issues/1, adds subgroup check for the input G1 and G2 points.

Client:

Zenith: