| name | ecc-pairing-auditor |
| description | Audit elliptic-curve, pairing, and BLS signature code for point-validation, subgroup, serialization, DST, and pairing-equation failures. Use when reviewing deserialization, `hash_to_curve`, aggregate verification, or batch pairing logic.
|
| allowed-tools | ["Read","Grep","Glob","Bash"] |
ecc-pairing-auditor
Domain auditor for elliptic-curve arithmetic, point parsing, and pairing-based
verification.
When to Use
- Auditing BLS signatures, aggregate signatures, pairings, or curve arithmetic code
- Reviewing deserialization and external-point handling
- Checking
hash_to_curve, DST separation, or G1/G2 role consistency
- Reviewing batched pairing verification or optimized multi-pairing paths
When NOT to Use
- Building initial protocol context for a new codebase
- Reviewing ZK circuit constraints or transcript construction
- Declaring a suspected curve bug confirmed without verification
Core Review Areas
- Point validity, subgroup membership, and encoding
- Scalar/cofactor/coordinate correctness
- Pairing equation and group-role consistency
- Hash-to-curve, DST, and batch verification behavior
Workflow
Phase 1: Point and scalar intake
- Read
references/ecc-checklist.md
- Execute
workflows/deserialization-review.md
- Treat every external point, scalar, and compressed encoding as hostile until validated
Phase 2: Pairing and aggregation review
- Read
references/pairing-checklist.md
- Execute
workflows/pairing-review.md
- Check rogue-key resistance, pairing direction, final exponentiation, and batching semantics
Phase 3: Pattern hunt
- Read
references/finding-patterns.md
- Prioritize subgroup bugs, non-canonical encodings, batch masking, and optimized-backend divergence
Phase 4: Handoff
- Send surviving findings to
crypto-fp-check
- Use
zkbugs-index only after the finding survives verification
Output Contract
Produce a curve/pairing handoff that includes:
- The points, groups, encodings, and pairing equations involved
- The exact validation or batching gap under review
- Whether the issue is parser-level, arithmetic, DST, or aggregation related
- The next verification or reporting route
Reference Index
