AIKIDO-2026-10557

TL;DR

The Ecdsa.verify method compares the signature r value to the x coordinate of the point produced by the verification combination step without first rejecting the point at infinity, so some degenerate results can be handled incorrectly. The curve membership helper contains and public key materialization from coordinates also allowed coordinates outside the field range and did not treat infinity or subgroup membership the same way as the hardened implementation. The update adds an explicit infinity check before comparison, coordinate range checks in contains, and stricter PublicKey import checks so invalid points and the point at infinity are not accepted when verifying or loading keys.