Hi Witnet team / @mariocao — you're among the best-matched eyes for this, since it lives right in elliptic-curve-solidity's domain.
We built a small on-chain BIP-340 (secp256k1 Schnorr) verifier for a verifiable agent-recovery escrow (part of the trustless-ai agent-standards work). It verifies an agent-signed receipt on-chain via the ecrecover trick + a modexp even-Y lift (lifting R from its x-coordinate, p ≡ 3 mod 4) — no oracle, ~7.5k gas, native precompiles only. It's live end-to-end on Sepolia and passes all 15 official BIP-340 vectors, including every invalid case (pubkey-off-curve, odd-Y R, negated msg/s, infinite point, rx≥p, s≥n, x≥p).
The curve arithmetic — the even-Y lift, the on-curve / field-range checks — is exactly what elliptic-curve-solidity does carefully, and we benchmarked our approach against it. Would you (or someone in your orbit) be open to a clean, well-scoped public-good review? ~120 lines, single link with everything to start in ~5 min — the file, a reviewer brief (the ecrecover algebra + full domain-check checklist), the official vectors wired as on-chain assertions, the live deploy + a real tx, one-command repro, and the 6 things we're asking a reviewer to confirm:
https://github.com/TMerlini/hack-ens-recovery/blob/wyriwe-receipt/contracts/audit/REVIEW-PACKAGE.md
No pressure, no rush — it's pre-mainnet by design, so a cred-based pass strengthens confidence rather than underwriting funds (a formal/grant-funded audit is the later mainnet gate). We'd credit you publicly. Totally fine to close this or point me to someone better-placed.
Either way — elliptic-curve-solidity is one of the references we held our implementation up against. 🙏
Hi Witnet team / @mariocao — you're among the best-matched eyes for this, since it lives right in
elliptic-curve-solidity's domain.We built a small on-chain BIP-340 (secp256k1 Schnorr) verifier for a verifiable agent-recovery escrow (part of the trustless-ai agent-standards work). It verifies an agent-signed receipt on-chain via the ecrecover trick + a modexp even-Y lift (lifting R from its x-coordinate, p ≡ 3 mod 4) — no oracle, ~7.5k gas, native precompiles only. It's live end-to-end on Sepolia and passes all 15 official BIP-340 vectors, including every invalid case (pubkey-off-curve, odd-Y R, negated msg/s, infinite point, rx≥p, s≥n, x≥p).
The curve arithmetic — the even-Y lift, the on-curve / field-range checks — is exactly what
elliptic-curve-soliditydoes carefully, and we benchmarked our approach against it. Would you (or someone in your orbit) be open to a clean, well-scoped public-good review? ~120 lines, single link with everything to start in ~5 min — the file, a reviewer brief (the ecrecover algebra + full domain-check checklist), the official vectors wired as on-chain assertions, the live deploy + a real tx, one-command repro, and the 6 things we're asking a reviewer to confirm:https://github.com/TMerlini/hack-ens-recovery/blob/wyriwe-receipt/contracts/audit/REVIEW-PACKAGE.md
No pressure, no rush — it's pre-mainnet by design, so a cred-based pass strengthens confidence rather than underwriting funds (a formal/grant-funded audit is the later mainnet gate). We'd credit you publicly. Totally fine to close this or point me to someone better-placed.
Either way —
elliptic-curve-solidityis one of the references we held our implementation up against. 🙏