EIP-2537 (BLS12 precompile) discussion thread

There is a flaw in the spec in the context of the BLST library.
In the inputs to multiplication (both MUL and MSM) the spec allows scalars bigger than the main subgroup order q, e.g. 2^256-1. In the BLST implementation this case is handled by slower non-GLV multiplication implementation “added for formal completeness”. In other words, users can bypass GLV multiplication by sending nonsensical inputs.

        if (check_mod_256(val.s, BLS12_381_r))  /* z^4 is the formal limit */
            POINTonE1_mult_glv(out, a, val.s);
        else    /* should never be the case, added for formal completeness */
            POINTonE1_mult_w5(out, a, scalar, nbits);

Found by @rodiazet.