mirror of
https://github.com/luxfi/precompile.git
synced 2026-09-24 00:26:21 +00:00
zeekay
0ba85e6aaf
The package documented ECVRF-EDWARDS25519-SHA512-ELL2 and sent suite byte 0x04, while the code ran try-and-increment — which is TAI, suite 0x03. The suite byte is hashed into both the encode-to-curve and challenge digests, so the combination matched no conforming prover and could not verify a proof from one. Aligned on TAI throughout, with the RFC's front/back domain separators. Verification also now runs with validate_key = TRUE (Section 5.4.5). The public key arrives in calldata, so it is attacker-chosen, and that check is what buys the collision resistance and unpredictability-under-malicious-key-generation an on-chain lottery is paying for (Sections 7.1.1, 7.1.3). Point decoding refuses non-canonical encodings. Gas follows the work: encode_to_curve hashes the whole alpha string once per counter, so the fee carries a per-word term, and a call that does no work is charged rather than free.