03 — Auditing · Failure mode

Unchecked curve point and subgroup membership

Proof elements are accepted without verifying that they lie on the curve and in the correct prime-order subgroup, enabling small-subgroup and invalid-curve attacks against the verifier.

By MarketComp Updated 2026-09-12 v1.3 About the authors Changelog

Mitigation

Validate every deserialised group element for curve membership and subgroup order before use, including in hand-written or gas-optimised verifiers where such checks are the first thing removed.

Cite this page

MarketComp (2026). Unchecked curve point and subgroup membership. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/audit/failure-modes/unchecked-curve-point-and-subgroup-membership/

@misc{zkfieldmanual-unchecked-curve-point-and-subgroup-membe,
  title        = {Unchecked curve point and subgroup membership — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/audit/failure-modes/unchecked-curve-point-and-subgroup-membership/}},
  note         = {Accessed: YYYY-MM-DD}
}