mediumLogic errorOther
Brevis Pico ZKVM: wrong sign handling when x == 0 produces non-canonical / out-of-range x = p
- Payout
- $0
- Protocol
- Brevis Pico ZKVM
- Disclosed
- Sep 29, 2025
- Source
- sherlock
Brevis Pico's Ed25519 point-decompression gadget in its ZKVM applies an unconditional field flip (x = p − x) whenever the compressed sign bit is set, with no guard for x == 0 and no canonical reduction. For an input decompressing to x == 0 with sign bit 1, thi …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.