test(msm): add negative/adversarial tests for MSM constraint satisfaction by PranavPipariya · Pull Request #392 · worldfnd/provekit

PranavPipariya · 2026-03-31T10:05:25Z

Summary

Adds the negative/adversarial MSM constraint-satisfaction tests proposed in #348.

This PR is test-only and does not change MSM implementation behavior.

Closes #348.

Included tests

wrong output coordinate
off-curve input point
wrong scalar/output pairing
s2 = 0 forgery attempt
flipped neg1 sign bit

Validation

cargo +nightly-2026-03-04 fmt --all --check
cargo +nightly-2026-03-04 clippy --all-targets --all-features --verbose
cargo +nightly-2026-03-04 test -p provekit-bench --test msm_witness_solving
cargo +nightly-2026-03-04 test --no-fail-fast --all-features --verbose --lib --tests --bins

ocdbytes

@PranavPipariya

Can you also add two more test cases here :

out_y limb corruption (same as written for out_x).
scalar corruption (replace the scalar but keep output computed from the original scalar). this is to check end to end scalar output binding.

After this will give one more review for the code.

PranavPipariya · 2026-04-07T22:57:10Z

@ocdbytes

Have added both the cases and re-ran the validation commands.

New tests:

out_y limb corruption
scalar corruption while keeping the original output

ocdbytes

Also add a test for

out_inf corruption
neg2 flip
multi point MSM (this will catch any error in the process multi point path)

NIT : for tests which dont require much changes and are mostly duplicated logic like out_x and out_y or neg_1 and neg_2. We can have a single test and add it as a case rather than having two different tests with mostly same logic.

ocdbytes · 2026-04-08T21:28:36Z

+    let curve = Secp256r1;
+    let gx = curve.generator().0;
+    let gy = curve.generator().1;
+    let scalar: [u64; 4] = [7, 0, 0, 0];
+    let (ex, ey) = ec_scalar_mul(
+        &gx,
+        &gy,
+        &scalar,
+        &curve.curve_a(),
+        &curve.field_modulus_p(),
+    );


Ig we can de duplicate this among the tests

Consolidated the duplicated out_x/out_y and neg1/neg2 cases into case-driven tests that share the setup. Please take a look at 73f41e68.

This logic :

let curve = Secp256r1; let gx = curve.generator().0; let gy = curve.generator().1; let scalar: [u64; 4] = [7, 0, 0, 0]; let (ex, ey) = ec_scalar_mul( &gx, &gy, &scalar, &curve.curve_a(), &curve.field_modulus_p(), );

appears too many times which is just a repeating code. Ig this can be delegated to a single function

Yeah, you're totally right. should've been more DRY in the first place. have extracted the repeated single-point generator setup into a shared helper and updated the affected tests to use it. please take a look.

ocdbytes · 2026-04-08T21:29:25Z

+fn different_field_element(value: FieldElement) -> FieldElement {
+    if value == FieldElement::zero() {
+        FieldElement::from(1u64)
+    } else {
+        FieldElement::zero()
+    }
+}


we can use a better approach here rather than toggling between 0 and 1

Replaced different_field_element; the general corruption path now uses corrupt_field_element, and the neg1/neg2 case uses an actual boolean flip. Please take a look.

PranavPipariya · 2026-04-09T19:19:15Z

Made the updates:

consolidated the duplicated out_x/out_y and neg1/neg2 cases into case-driven tests
added coverage for out_inf, neg2, and the multi-point MSM negative path
updated the neg1/neg2 case to use an actual boolean flip

Also re-ran the validation commands locally.

ocdbytes · 2026-04-09T19:27:59Z

@PranavPipariya Please address the above comments regarding the code and then will give a final review.

ocdbytes

Some NITS.
Other than this things look good to me !!

ocdbytes · 2026-04-09T22:03:39Z

+/// Two-point MSM: corrupting the output must be rejected, exercising the
+/// multi-point accumulation and output-constraining path.
+#[test]
+fn test_two_point_msm_rejects_wrong_output() {


this new test it just copy of the test build_single_point_msm_fixture. We can de duplicate this.

done. have extracted the shared setup into build_default_two_point_msm_fixture. Both test_two_point_msm and test_two_point_msm_rejects_wrong_output use it now. please take a look.

ocdbytes · 2026-04-09T22:06:46Z

Pre existing test should also be using the the function for params

done. the pre-existing positive tests now use secp256r1_generator_params (or secp256r1_generator where curve params aren't needed).

ocdbytes · 2026-04-09T22:10:27Z

remove these print statements these were left in previous review

removed the print statements

ocdbytes · 2026-04-09T22:17:03Z

+    let case = secp256r1_generator_case([7, 0, 0, 0]);
+    let fixture = build_generator_single_point_fixture(case);


NIT :

The pattern here of calling secp256r1_generator_case and build_generator_single_point_fixture looks redundant use something like this :

fn generator_fixture(scalar: [u64; 4]) -> SinglePointMsmFixture { build_generator_single_point_fixture(secp256r1_generator_case(scalar)) }

so the tests which require their own case internally can call otherwise

fn test_single_point_rejects_wrong_output_inf() { let fixture = generator_fixture([7, 0, 0, 0]); // ← one call ...... }

Added generator_fixture as mentioned. simple tests now use the one-liner. test_single_point_rejects_off_curve_input and test_single_point_rejects_wrong_scalar_output_pairing keep the two-step form because they read case fields before building the fixture.

Co-authored-by: Arun Jangra <arunjangra1001@gmail.com>

ocdbytes · 2026-04-16T06:29:44Z

@PranavPipariya fix the lint and then we can merge the PR

Bisht13 · 2026-04-20T12:37:02Z

Thanks for the contribution @PranavPipariya!

test(msm): add negative witness satisfaction tests

021b30c

ocdbytes self-requested a review April 1, 2026 00:39

ocdbytes requested changes Apr 6, 2026

View reviewed changes

test(msm): add output and scalar corruption cases

e6c9ff8

ocdbytes requested changes Apr 8, 2026

View reviewed changes

test(msm): flip neg bits as booleans

73f41e6

test(msm): extract repeated generator setup

5f81aff

ocdbytes requested changes Apr 9, 2026

View reviewed changes

PranavPipariya and others added 2 commits April 11, 2026 03:10

test(msm): deduplicate generator and two-point test fixtures

9098796

test(msm): using iter to locate single FakeGLV hint

4f13ece

Co-authored-by: Arun Jangra <arunjangra1001@gmail.com>

ocdbytes approved these changes Apr 16, 2026

View reviewed changes

ocdbytes requested a review from Bisht13 April 16, 2026 07:00

test(msm): fix rustfmt lint

944fcef

Bisht13 approved these changes Apr 20, 2026

View reviewed changes

Bisht13 merged commit 5749786 into worldfnd:main Apr 20, 2026
7 of 8 checks passed

		let case = secp256r1_generator_case([7, 0, 0, 0]);
		let fixture = build_generator_single_point_fixture(case);

Conversation

PranavPipariya commented Mar 31, 2026

Summary

Included tests

Validation

Uh oh!

ocdbytes left a comment

Choose a reason for hiding this comment

Uh oh!

PranavPipariya commented Apr 7, 2026

Uh oh!

ocdbytes left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PranavPipariya commented Apr 9, 2026

Uh oh!

ocdbytes commented Apr 9, 2026

Uh oh!

ocdbytes left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ocdbytes commented Apr 16, 2026

Uh oh!

Uh oh!

Bisht13 commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants