fix(avm): preserve coordinates in embedded curve point

[IlyasRidhuan]

Preamble

The representation of the point at infinity differs between BB and noir, with the latter using {x: 0, y: 0, inf: 1}. To ensure we match with noir's expectations we wrap the bb AffinePoint in a struct StandardAffinePoint that outputs the noir representation if you ask for the coordinates of a point at infinity.

The bug

The ECADD opcode loads points from addresses in memory (i.e. x-coord, y-coord, inf-flag). It is possible that some bytecode loads a point such that x != 0, y != 0, inf = 1. When this happens during simulation, the execution trace will load the original coordinate values but when the EC gadget is called, it utilises StandardAffinePoint which incorrectly outputs {x: 0, y:0, inf = 1 when building the EC events.

This causes a Lookup PERM_EXECUTION_DISPATCH_TO_ECC_ADD failed. because the value loaded in the registers in the execution trace no longer match the values in the ECC subtrace.

Solution

The subtlety in StandardAffinePoint is that we only want the point at infinity to be {x: 0, y: 0, inf: 1}, when the result of an operation results in infinity. Otherwise we want to use the original coordinates of the point. This means we need to track the original coordinate values as well in the StandardAffinePoint.

[IlyasRidhuan]

• feat(avm): change to_radix backfill #19277
• fix(avm): precomp trace for get_p_limbs #19266
• fix(avm): preserve coordinates in embedded curve point #19263 👈 (View in Graphite)
• fix(avm): sha256 modulo add bug #19262
• merge-train/avm

This stack of pull requests is managed by Graphite. Learn more about stacking.

[sirasistant]

nice catch!