chore(deps): bump github.com/consensys/gnark from 0.16.3 to 0.16.4

[dependabot]

Bumps github.com/consensys/gnark from 0.16.3 to 0.16.4.

Release notes

Sourced from github.com/consensys/gnark's releases.

v0.16.4

gnark v0.16.4

This release contains a security fix for a high-severity soundness issue in emulated elliptic-curve scalar multiplication, which made ECDSA signature forgery possible. It also has another soundness fix in the BW6-761 pairing gadget, several correctness fixes in pairing and recursion gadgets, new in-circuit performance work, a public GKR prover/verifier API and an experimental WebGPU+WASM proving backend.

We strongly recommend that all users upgrade to v0.16.4. Many circuits have new constraint systems in this release. Read Breaking changes below before upgrading. You will probably need to recompile circuits, run a new setup and redeploy verifiers.

---

⚠️ Security

GHSA-7fx8-hmgc-82jp — ECDSA / P256Verify signature forgery in emulated fake-GLV scalar multiplication (High)

Advisory: GHSA-7fx8-hmgc-82jp Affected: < v0.16.4 · Patched: v0.16.4

sw_emulated scalar multiplication with fake-GLV (scalarMulFakeGLV, scalarMulGLVAndFakeGLV) gets the result point from a prover-supplied hint and then checks a relation, without computing the point in-circuit. Nothing checked that the hinted point is on the curve. The final accumulator identity is a group-law argument, so it holds trivially for an off-curve operand. A malicious prover could therefore make the gadget return any point they chose.

• P-256, P-384, STARK curve: full ECDSA signature forgery. With s = -1 and a degenerate decomposition, the accumulator collapses to the point at infinity at every step, so the check passes for any R.x. This affects std/signature/ecdsa and any circuit using ScalarMul, JointScalarMulBase or MultiScalarMul on these curves, including the EIP-7951 P256Verify precompile gadget.
• secp256k1, BN254 (emulated): same missing check. These curves have cofactor 1, so the subgroup check is a no-op and nothing else constrained the hint. This affects the ECRECOVER (0x01) and BN254 ECMUL (0x07) precompile gadgets.
• BLS12-381, BW6-761 (emulated): not affected. They use classic GLV, which computes the result in-circuit.

The fix adds an on-curve check on the hinted output, at about 325 R1CS constraints per hinted scalar multiplication (~0.2%).

The same fix also corrects AddUnified on curves with a ≠ 0 (j ≠ 0, e.g. P-256, P-384, STARK curve). When y1 + y2 = 0 but x1 ≠ x2, the old code returned the point at infinity instead of the correct sum. This could happen with two valid on-curve points and an honest witness. AddUnified now uses the same chord/tangent selection as the j = 0 path. It costs about 6.3k R1CS constraints on P-256 ECDSA (~4.4%); j = 0 curves are not affected. emulated.Field.IsZero is also hardened for inputs that reduce to canonical zero.

The ScalarMul, JointScalarMulBase and MultiScalarMul docs now state the guarantee: the returned point is on the curve and in the prime-order subgroup on every supported curve. Callers do not need to check this again.

BW6-761 AssertFinalExponentiationIsOne accepted a zero accumulator (#1871)

The emulated BW6-761 Pairing.AssertFinalExponentiationIsOne did not require the hinted residue witness to be non-zero. With a zero Miller-loop accumulator, an all-zero witness made the check reduce to 0 == 0, so the gadget accepted a value outside the target group. This is the same class of bug as GHSA-3mvx-pp85-pm65, which was fixed in v0.16.0 for BN254, BLS12-381 and BLS12-377 but missed for BW6-761. PairingCheck is not affected.

Documented caller obligations

These are documentation-only changes, but they describe assumptions that callers must meet:

• EIP-4844 KZG point evaluation (std/evmprecompiles.KzgPointEvaluation*): the caller must range-check every input limb to 128 bits (16 bits for the *16 variants). The gadget does not check this, so unchecked limbs let several public inputs map to the same precompile input (#1863).
• Precomputed G2 line evaluations (G2Affine.Lines, NewG2AffineFixed*): when lines are supplied, Pair and MillerLoop use them as given and do not check that Q is in the subgroup. Only the in-circuit line-computation path (Lines == nil) performs that check (#1858).

Hardening via gnark-crypto

• field/extensions: the vector length read by AsyncReadFromConsensys/gnark-crypto#878

---

💥 Breaking changes

Circuits: constraint systems change, so a new setup is needed

Several gadgets now produce different constraint systems. If your circuit uses any of the gadgets below, recompile it. For Groth16, run a new circuit-specific setup and redeploy on-chain verifiers, because proving and verifying keys from v0.16.3 will not work. Constraint systems serialized with an older version must also be recompiled.

... (truncated)

Changelog

Sourced from github.com/consensys/gnark's changelog.

[v0.16.4] - 2026-10-07

Build

• deps-dev: bump the npm_and_yarn group across 1 directory with 2 updates (#1819)

CI

• update notif channel (#1825)

Chore

• move to Go 1.26 (#1866)
• remove stale UnmarshalSolidity (#1839)
• regenerate tinyfield (#1824)
• remove failing tests (#1815)

Docs

• specify limb range assumptions for KZG point evaluation precompile (#1863)
• clarify security assumptions of precomputed G2 line evaluations (#1858)
• reporting addresses (#1829)

Feat

• allow modifying the upper bound in bits.ToBinary (#1809)
• init codeowners (#1830)
• add WebGPU+WASM backend (#1789)
• GKR: Scheduler sum-check batching (#1828)
• eddsa: Bandersnatch in Assign helpers, re-enable the Bandersnat… (#1818)

Fix

• rule out zero residue witness in BW6-761 AssertFinalExponentiationIsOne (#1871)
• make profile Top report constraints again (#1835)
• multiround commits with shared vals (#1814)
• recursion: use complete addition for K[0] in the groth16 verifier (#1843)
• sw_bls12377: accept the G1 point at infinity in the pairing (#1851)
• sw_bw6761: handle a G1 point at infinity in the Miller loop (#1850)
• webgpu: reject non-Uint8Array byte arguments (#1832)
• witness: avoid mutating schema in FromJSON (#1821)

Perf

• emulated-curve scalar multiplication (#1826)
• fold constant byte operations in std/math/uints (#1796)
• optimize keccack permutation (#1802)

Refactor

• GKR: Re-surface Prover and Verifier (#1852)
• GKR: Decouple I/O Claims from GKR Core (#1844)

Commits

• e974abb release: v0.16.4 (#1876)
• 4d47639 Merge commit from fork
• 436d5ac fix: rule out zero residue witness in BW6-761 AssertFinalExponentiationIsOne ...
• c50918c chore: move to Go 1.26 (#1866)
• 8df228f perf: emulated-curve scalar multiplication (#1826)
• d0ca295 docs: specify limb range assumptions for KZG point evaluation precompile (#1863)
• ff4f4c9 docs: clarify security assumptions of precomputed G2 line evaluations (#1858)
• 89720c2 refactor(GKR): Re-surface Prover and Verifier (#1852)
• 63e4502 refactor(GKR): Decouple I/O Claims from GKR Core (#1844)
• d089cef perf: fold constant byte operations in std/math/uints (#1796)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)