# Besu doesn't verify whether G1 points lie on the curve in the G1MSM and PAIRING_CHECK precom- piles

Besu's BLS12-381 G1MSM/PAIRING_CHECK precompiles skip the on-curve check when the subgroup endomorphism test passes, so a crafted off-curve point is accepted and causes a chain split.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Pectra Besu
- Credited: alexfilippov314
- Disclosed: 2025-07-21
- Write-up quality: 8/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_ethereum_pectra_besu.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aethereum_pectra_besu%3A3.1.2
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:go technique:source-review vuln:crypto vuln:misconfiguration

**Target:** EIP-2537 BLS12-381 G1MSM and PAIRING_CHECK precompiles (address 0x0c)
**Root cause:** g1AffineDecodeInSubGroupVal only runs IsOnCurve inside the IsInSubGroup failure branch, so a point that passes the endomorphism subgroup test but is not on the curve is accepted; the endomorphism test alone does not imply curve membership.
**Steps:**
1. Read g1AffineDecodeInSubGroupVal: on-curve check is nested under the subgroup-check failure, unlike g2AffineDecodeInSubGroupVal.
2. Find a point on a different curve y^2 = x^3 + 24 that still satisfies g1.IsInSubGroup (endomorphism test phi(P)+x^2*P=0).
3. Encode it as G1MSM input with scalar 0: `0000...0a2833e497b38ee3ca5c62828bf4887a9f940c9e426c7890a759c20f248c23a7210d2432f4c98a514e524b5184a0ddac` + `0000...150772d56bf9509469f9ebcd6e47570429fd31b0e262b66d512e245c38ec37255529f2271fd70066473e393a8bead0c3` + zero scalar.
4. Call precompile 0x0c with this data via `cast call ... --rpc-url`; Besu returns point at infinity while other clients return an error.
5. Deploy POC contract calling msm.call(data) and keccak the result to observe divergent state across clients.
**How found:** Compared Besu's g1AffineDecodeInSubGroupVal against g2AffineDecodeInSubGroupVal and EIP-2537's stated requirement, noticing the on-curve check was only reached on subgroup-check failure; then searched for a point on a different curve satisfying the endomorphism test.
**Exploitation:** Submit a transaction (or contract call) to the G1MSM precompile with an off-curve G1 point that passes the subgroup test; Besu computes a result (point at infinity) while other clients revert, so Besu nodes diverge from the network consensus.
**Escalation:** Same flaw applies to PAIRING_CHECK precompile, widening the set of divergent inputs; any user can trigger a consensus split permissionlessly.
**Insight:** When a client delegates subgroup validation to a library, check whether the on-curve check is a precondition or a fallback branch — endomorphism/subgroup tests can pass for points off the actual curve, and asymmetric G1 vs G2 handling is a strong smell.