Add 0.50.9 pentest report

Author: eldryoth

security/pentest/v0.50.9.md

@@ -0,0 +1,107 @@
+Status: PASS
+Reviewed-Commit: a79db380f848eccb1edf62f1d712b74685910d5d
+Tester: External pentest and maintainer retest
+Scope: eth v0.50.9 BN254 projective post-loop line carrier, optimal-ate Miller-loop scalar table, Q1/-Q2 post-loop line multiplication, fail-closed EIP-197 pairing boundary, fuzz reachability, documentation, and package metadata.
+Date: 2026-07-09
+
+# eth v0.50.9 Pentest Report
+
+## Summary
+
+The v0.50.9 release was reviewed after adding the first-party BN254 projective
+post-loop line carrier required before non-empty EIP-197 pairing results can be
+admitted. The review covered the projective line-function path, sparse Fp12
+line multiplication, Q1 and -Q2 post-loop line additions, the fail-closed
+pairing boundary, regression coverage, documentation, release metadata, and
+package boundaries.
+
+The initial review found one Critical correctness issue: the hard-coded BN254
+`6u+2` non-adjacent-form table encoded the wrong scalar. This did not affect
+public execution in v0.50.9 because non-empty pairing inputs still return
+`PrecompileBackendUnavailable`, but it would have made the planned
+result-admission release unsafe. The review also identified the related test
+design gap: the new Miller-loop tests were self-consistency checks and could
+not catch a wrong scalar table.
+
+Both issues were fixed before this report was committed. Retest passed.
+
+Non-empty BN254 pairing execution remains fail-closed with
+`PrecompileBackendUnavailable`; this release does not claim public non-empty
+EIP-197 pairing success or failure words.
+
+## Findings
+
+### F-01 - Wrong BN254 loop constant breaks pairing bilinearity
+
+Severity: Critical
+
+Result: Fixed.
+
+`BN254_SIX_U_PLUS_2_NAF` was intended to encode `6u+2` for the BN254
+optimal-ate parameter `u = 4965661367192848881`, but the table reconstructed to
+a different scalar. The pentest demonstrated the failure with the bilinearity
+identity `e([2]P, Q) == e(P, Q)^2`, using the existing BN254 add precompile
+path to construct `[2]P`.
+
+The remediation replaced the table with an independently derived NAF for:
+
+```text
+6 * 4965661367192848881 + 2 = 29793968203157093288
+```
+
+Two permanent regressions now cover this failure class:
+
+- `miller_loop_naf_reconstructs_six_u_plus_two` reconstructs the scalar from
+  the hard-coded NAF table.
+- `miller_loop_is_bilinear_over_g1_double` checks
+  `e([2]P, Q) == e(P, Q)^2` after final exponentiation.
+
+### F-02 - Regression suite relied on self-consistency only
+
+Severity: Process
+
+Result: Fixed.
+
+The original v0.50.9 tests checked determinism, repeated tuple multiplication,
+and generator-plus-negated-generator neutrality. Those properties can hold even
+when a Miller loop uses the wrong scalar, so they were insufficient for
+admitting more pairing algebra.
+
+The bilinearity regression now checks the accumulator against an independently
+constructed group element. The release notes and BN254 economics document also
+record that future result-admission work must include official EIP-197
+positive/negative vectors and independent differential vectors before any
+non-empty public result is admitted.
+
+## Verified Clean
+
+- The corrected NAF table reconstructs exactly to `6u+2`.
+- The G1-doubling bilinearity regression passes.
+- The generator tuple still does not map to one after final exponentiation.
+- The generator plus negated-generator batch still maps to one after final
+  exponentiation.
+- The projective line carrier, Q1/-Q2 post-loop additions, and sparse Fp12
+  multiplication remain internal behind the fail-closed EIP-197 boundary.
+- Non-empty pairing execution still returns `PrecompileBackendUnavailable`.
+- No default crypto, allocator, bigint, or pairing backend dependency was
+  added.
+- README files, release notes, crate version matrix, release plan, release
+  gate, and package metadata are aligned for v0.50.9.
+- The temporary root `PENTEST.md` file was removed before release
+  finalization.
+
+## Verification
+
+- `cargo test -p eth-valkyoth-evm-core bn254`
+- `cargo clippy -p eth-valkyoth-evm-core --all-targets --all-features -- -D warnings`
+- `cargo clippy --manifest-path fuzz/Cargo.toml --bin bn254_pairing_frame -- -D warnings`
+- `cargo fmt --all --check`
+- `scripts/validate-release-metadata.sh`
+- `python3 scripts/test-release-metadata.py`
+- `scripts/release_crates.py --check`
+- `scripts/checks.sh`
+
+## Decision
+
+The v0.50.9 release candidate is accepted. Tagging must wait for GitHub CI and
+CodeQL to pass on the final report commit.