fix(precompile): BLS G2 MSM

crates/precompile/src/bls12_381/g1.rs

@@ -1,5 +1,5 @@
 use super::utils::{fp_to_bytes, remove_padding, PADDED_FP_LENGTH};
-use blst::{blst_fp_from_bendian, blst_p1_affine, blst_p1_affine_in_g1};
+use blst::{blst_fp_from_bendian, blst_p1_affine, blst_p1_affine_in_g1, blst_p1_affine_on_curve};
 use revm_primitives::{Bytes, PrecompileError};
 
 /// Length of each of the elements in a g1 operation input.
@@ -19,7 +19,12 @@ pub(super) fn encode_g1_point(input: *const blst_p1_affine) -> Bytes {
 }
 
 /// Extracts a G1 point in Affine format from a 128 byte slice representation.
-pub(super) fn extract_g1_input(input: &[u8]) -> Result<blst_p1_affine, PrecompileError> {
+///
+/// NOTE: This function will perform a G1 subgroup check if `subgroup_check` is set to `true`.
+pub(super) fn extract_g1_input(
+    input: &[u8],
+    subgroup_check: bool,
+) -> Result<blst_p1_affine, PrecompileError> {
     if input.len() != G1_INPUT_ITEM_LENGTH {
         return Err(PrecompileError::Other(format!(
             "Input should be {G1_INPUT_ITEM_LENGTH} bytes, was {}",
@@ -37,9 +42,41 @@ pub(super) fn extract_g1_input(input: &[u8]) -> Result<blst_p1_affine, Precompil
         blst_fp_from_bendian(&mut out.y, input_p0_y.as_ptr());
     }
 
-    // SAFETY: out is a blst value.
-    if unsafe { !blst_p1_affine_in_g1(&out) } {
-        return Err(PrecompileError::Other("Element not in G1".to_string()));
+    if subgroup_check {
+        // NB: Subgroup checks
+        //
+        // Scalar multiplications, MSMs and pairings MUST perform a subgroup check.
+        //
+        // Implementations SHOULD use the optimized subgroup check method:
+        //
+        // https://eips.ethereum.org/assets/eip-2537/fast_subgroup_checks
+        //
+        // On any input that fail the subgroup check, the precompile MUST return an error.
+        //
+        // As endomorphism acceleration requires input on the correct subgroup, implementers MAY
+        // use endomorphism acceleration.
+        if unsafe { !blst_p1_affine_in_g1(&out) } {
+            return Err(PrecompileError::Other("Element not in G2".to_string()));
+        }
+    } else {
+        // From EIP-2537:
+        //
+        // Error cases:
+        //
+        // * An input is neither a point on the G1 elliptic curve nor the infinity point
+        //
+        // NB: There is no subgroup check for the G1 addition precompile.
+        //
+        // We use blst_p1_affine_on_curve instead of blst_p1_affine_in_g2 because the latter performs
+        // the subgroup check.
+        //
+        // SAFETY: out is a blst value.
+        if unsafe { !blst_p1_affine_on_curve(&out) } {
+            return Err(PrecompileError::Other(
+                "Element not on G2 curve".to_string(),
+            ));
+        }
     }
+
     Ok(out)
 }

crates/precompile/src/bls12_381/g1_add.rs

@@ -33,8 +33,11 @@ pub(super) fn g1_add(input: &Bytes, gas_limit: u64) -> PrecompileResult {
         )));
     }
 
-    let a_aff = &extract_g1_input(&input[..G1_INPUT_ITEM_LENGTH])?;
-    let b_aff = &extract_g1_input(&input[G1_INPUT_ITEM_LENGTH..])?;
+    // NB: There is no subgroup check for the G2 addition precompile.
+    //
+    // So we set the subgroup checks here to `false`
+    let a_aff = &extract_g1_input(&input[..G1_INPUT_ITEM_LENGTH], false)?;
+    let b_aff = &extract_g1_input(&input[G1_INPUT_ITEM_LENGTH..], false)?;
 
     let mut b = blst_p1::default();
     // SAFETY: b and b_aff are blst values.

crates/precompile/src/bls12_381/g1_msm.rs

@@ -41,8 +41,12 @@ pub(super) fn g1_msm(input: &Bytes, gas_limit: u64) -> PrecompileResult {
     let mut g1_points: Vec<blst_p1> = Vec::with_capacity(k);
     let mut scalars: Vec<u8> = Vec::with_capacity(k * SCALAR_LENGTH);
     for i in 0..k {
+        // NB: Scalar multiplications, MSMs and pairings MUST perform a subgroup check.
+        //
+        // So we set the subgroup_check flag to `true`
         let p0_aff = &extract_g1_input(
             &input[i * g1_mul::INPUT_LENGTH..i * g1_mul::INPUT_LENGTH + G1_INPUT_ITEM_LENGTH],
+            true,
         )?;
         let mut p0 = blst_p1::default();
         // SAFETY: p0 and p0_aff are blst values.

crates/precompile/src/bls12_381/g1_mul.rs

@@ -34,7 +34,10 @@ pub(super) fn g1_mul(input: &Bytes, gas_limit: u64) -> PrecompileResult {
         )));
     }
 
-    let p0_aff = &extract_g1_input(&input[..G1_INPUT_ITEM_LENGTH])?;
+    // NB: Scalar multiplications, MSMs and pairings MUST perform a subgroup check.
+    //
+    // So we set the subgroup_check flag to `true`
+    let p0_aff = &extract_g1_input(&input[..G1_INPUT_ITEM_LENGTH], true)?;
     let mut p0 = blst_p1::default();
     // SAFETY: p0 and p0_aff are blst values.
     unsafe { blst_p1_from_affine(&mut p0, p0_aff) };

crates/precompile/src/bls12_381/g2.rs

@@ -1,5 +1,5 @@
 use super::utils::{fp_to_bytes, remove_padding, FP_LENGTH, PADDED_FP_LENGTH};
-use blst::{blst_fp_from_bendian, blst_p2_affine, blst_p2_affine_in_g2};
+use blst::{blst_fp_from_bendian, blst_p2_affine, blst_p2_affine_in_g2, blst_p2_affine_on_curve};
 use revm_primitives::{Bytes, PrecompileError};
 
 /// Length of each of the elements in a g2 operation input.
@@ -27,7 +27,12 @@ pub(super) fn encode_g2_point(input: &blst_p2_affine) -> Bytes {
 }
 
 /// Extracts a G2 point in Affine format from a 256 byte slice representation.
-pub(super) fn extract_g2_input(input: &[u8]) -> Result<blst_p2_affine, PrecompileError> {
+///
+/// NOTE: This function will perform a G2 subgroup check if `subgroup_check` is set to `true`.
+pub(super) fn extract_g2_input(
+    input: &[u8],
+    subgroup_check: bool,
+) -> Result<blst_p2_affine, PrecompileError> {
     if input.len() != G2_INPUT_ITEM_LENGTH {
         return Err(PrecompileError::Other(format!(
             "Input should be {G2_INPUT_ITEM_LENGTH} bytes, was {}",
@@ -49,9 +54,40 @@ pub(super) fn extract_g2_input(input: &[u8]) -> Result<blst_p2_affine, Precompil
         blst_fp_from_bendian(&mut out.y.fp[1], input_fps[3].as_ptr());
     }
 
-    // SAFETY: out is a blst value.
-    if unsafe { !blst_p2_affine_in_g2(&out) } {
-        return Err(PrecompileError::Other("Element not in G2".to_string()));
+    if subgroup_check {
+        // NB: Subgroup checks
+        //
+        // Scalar multiplications, MSMs and pairings MUST perform a subgroup check.
+        //
+        // Implementations SHOULD use the optimized subgroup check method:
+        //
+        // https://eips.ethereum.org/assets/eip-2537/fast_subgroup_checks
+        //
+        // On any input that fail the subgroup check, the precompile MUST return an error.
+        //
+        // As endomorphism acceleration requires input on the correct subgroup, implementers MAY
+        // use endomorphism acceleration.
+        if unsafe { !blst_p2_affine_in_g2(&out) } {
+            return Err(PrecompileError::Other("Element not in G2".to_string()));
+        }
+    } else {
+        // From EIP-2537:
+        //
+        // Error cases:
+        //
+        // * An input is neither a point on the G2 elliptic curve nor the infinity point
+        //
+        // NB: There is no subgroup check for the G2 addition precompile.
+        //
+        // We use blst_p2_affine_on_curve instead of blst_p2_affine_in_g2 because the latter performs
+        // the subgroup check.
+        //
+        // SAFETY: out is a blst value.
+        if unsafe { !blst_p2_affine_on_curve(&out) } {
+            return Err(PrecompileError::Other(
+                "Element not on G2 curve".to_string(),
+            ));
+        }
     }
 
     Ok(out)

crates/precompile/src/bls12_381/g2_add.rs

@@ -34,8 +34,11 @@ pub(super) fn g2_add(input: &Bytes, gas_limit: u64) -> PrecompileResult {
         )));
     }
 
-    let a_aff = &extract_g2_input(&input[..G2_INPUT_ITEM_LENGTH])?;
-    let b_aff = &extract_g2_input(&input[G2_INPUT_ITEM_LENGTH..])?;
+    // NB: There is no subgroup check for the G2 addition precompile.
+    //
+    // So we set the subgroup checks here to `false`
+    let a_aff = &extract_g2_input(&input[..G2_INPUT_ITEM_LENGTH], false)?;
+    let b_aff = &extract_g2_input(&input[G2_INPUT_ITEM_LENGTH..], false)?;
 
     let mut b = blst_p2::default();
     // SAFETY: b and b_aff are blst values.

crates/precompile/src/bls12_381/g2_msm.rs

@@ -49,7 +49,10 @@ pub(super) fn g2_msm(input: &Bytes, gas_limit: u64) -> PrecompileResult {
             continue;
         }
 
-        let p0_aff = &extract_g2_input(slice)?;
+        // NB: Scalar multiplications, MSMs and pairings MUST perform a subgroup check.
+        //
+        // So we set the subgroup_check flag to `true`
+        let p0_aff = &extract_g2_input(slice, true)?;
 
         let mut p0 = blst_p2::default();
         // SAFETY: p0 and p0_aff are blst values.

crates/precompile/src/bls12_381/g2_mul.rs

@@ -34,7 +34,10 @@ pub(super) fn g2_mul(input: &Bytes, gas_limit: u64) -> PrecompileResult {
         )));
     }
 
-    let p0_aff = &extract_g2_input(&input[..G2_INPUT_ITEM_LENGTH])?;
+    // NB: Scalar multiplications, MSMs and pairings MUST perform a subgroup check.
+    //
+    // So we set the subgroup_check flag to `true`
+    let p0_aff = &extract_g2_input(&input[..G2_INPUT_ITEM_LENGTH], true)?;
     let mut p0 = blst_p2::default();
     // SAFETY: p0 and p0_aff are blst values.
     unsafe { blst_p2_from_affine(&mut p0, p0_aff) };

crates/precompile/src/bls12_381/pairing.rs

@@ -46,12 +46,21 @@ pub(super) fn pairing(input: &Bytes, gas_limit: u64) -> PrecompileResult {
     // accumulator for the fp12 multiplications of the miller loops.
     let mut acc = blst_fp12::default();
     for i in 0..k {
-        let p1_aff =
-            &extract_g1_input(&input[i * INPUT_LENGTH..i * INPUT_LENGTH + G1_INPUT_ITEM_LENGTH])?;
+        // NB: Scalar multiplications, MSMs and pairings MUST perform a subgroup check.
+        //
+        // So we set the subgroup_check flag to `true`
+        let p1_aff = &extract_g1_input(
+            &input[i * INPUT_LENGTH..i * INPUT_LENGTH + G1_INPUT_ITEM_LENGTH],
+            true,
+        )?;
 
+        // NB: Scalar multiplications, MSMs and pairings MUST perform a subgroup check.
+        //
+        // So we set the subgroup_check flag to `true`
         let p2_aff = &extract_g2_input(
             &input[i * INPUT_LENGTH + G1_INPUT_ITEM_LENGTH
                 ..i * INPUT_LENGTH + G1_INPUT_ITEM_LENGTH + G2_INPUT_ITEM_LENGTH],
+            true,
         )?;
 
         if i > 0 {