Description

The add function of BN256G1 is calling the precompiled contract performing an elliptic curve point addition. It uses a staticcall opcode directly in assembly. The opcode expects an input length as a parameter. In this function, it is set to 0xc0 but the input array is only 4 * 32 bytes, so it should be 0x80 instead.

The mul function has a similar mismatch with the input length set to 0x80, whereas there are only three elements in the input array.

Impact

According to EIP-196↗, the input is shorter than expected; the input is padded with zero, which in this case would not change the result.

Recommendations

To avoid unexpected behaviors, the correct length should be set correctly. Some unitary tests with test vectors coming from a source other than the library would improve the confidence in the implementation.

Remediation

This issue has been acknowledged by Session team, and a fix was implemented in commit 9f3d379b↗.