An experimental, highly optimized BIP-340-compatible library for Schnorr signature verification using sha256
and ecrecover precompile.
Gas usage: 6567.
The verifier checks the BIP-340 equation [s]G - [e]P = R with the standard
tagged challenge hash. It agrees with BIP-340 exactly, up to the following:
- Messages are exactly 32 bytes. Variable-length messages, allowed by the
current spec, are not representable in the
bytes32ABI. - Pass
publicKeyYParity = 0. BIP-340 keys implicitly select the even-Y point; parity1verifies against the odd-Y point, outside BIP-340. publicKeyXmust be less thann. It is routed through the ECDSArslot, so valid BIP-340 keys with x-coordinate in[n, p)— a~2^-128fraction — are rejected.- Point comparison is by address. Points are compared via their 160-bit
keccak256address rather than exact coordinates, so the accepting direction rests on collision resistance. - Negligible edge cases are rejected:
s = 0, challengee = 0, and a nonce point whose address is zero.
Note regarding the EIP-2 low-s rule: it constrains transaction signatures,
not the ecrecover precompile, so no low-s nonce grinding is required.
Hardhat: official BIP-340 vectors #1 and #3, range, parity, and zero-message
checks. Foundry: 10,000-run fuzz and differential tests against secp256k1-zkp
signatures. The upstream
test-vector CSV
is not imported wholesale; its variable-length-message vectors cannot be
expressed in this ABI.
Certora proves the optimized assembly equivalent to an assembly-free reference implementation, covering input domains and plumbing — not the cryptographic soundness of the construction, which is the subject of the paper. See certora/README.md for the property list, assumptions, and scope notes.
This project is licensed under the MIT License.