Skip to main content
Every unlock verifies one aggregated BLS12-381 signature — the maker’s and bridger’s co-signatures combined — natively on-chain. This page specifies exactly what each chain runs. For why the native path was chosen over in-circuit verification, see the BLS auth circuit.

​
The scheme

Min-pubkey mode: public keys live in G1, signatures in G2 (the IETF BLS signature variant that keeps registered keys small). Hash-to-curve follows RFC 9380 (BLS12381G2_XMD:SHA-256_SSWU_RO), with two domain-separation tags:
  • BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_ — settlement signatures
  • BLS_POP_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_ — proofs of possession at key registration
The verification equation on both chains is identical:
For settlement, pk is the aggregated public key (the two registered keys added in G1) and m is the fixed settlement preimage — the domain tag, both chain ids, the order hash, and both chains’ Merkle roots. One pairing check authorizes both traders at once.

​
Ethereum: EIP-2537 precompiles

The BLS library (contracts/evm/src/libraries/BLS.sol) composes the check from the EIP-2537 precompiles, live on Sepolia since Pectra: Notes:
  • The pairing precompile subgroup-checks every input, so malformed or wrong-subgroup points revert rather than verify.
  • The same library verifies registration proofs of possession (BLSKeyRegistry.register) and the settlement aggregate (CounterpartyVerifier).
  • Measured baseline: the full unlock — aggregated-signature check plus deposit-proof verification — runs at roughly 2.6M gas on Sepolia, with a CI gas gate guarding the number.

​
Soroban: BLS12-381 host functions

Soroban exposes BLS12-381 natively through env.crypto().bls12_381(); the contracts call two host functions:
  • hash_to_g2 performs the entire RFC 9380 pipeline in one host call — no in-contract field arithmetic.
  • pairing_check evaluates the multi-pairing product; inputs are G1Affine / G2Affine (raw uncompressed encodings).
  • The same two calls back both the registry’s proof-of-possession check and the CounterpartyVerifier’s settlement check.
  • The pairing check completes in under two seconds wall-clock inside a single Soroban transaction — Tranche 1’s success criterion 4.

​
One signature, two encodings

Clients sign once and submit compressed points; each chain’s native encoding is derived deterministically from the same bytes (@proofbridge/bls-encodings is the single source for every encoding and digest, with cross-chain test vectors asserting byte-for-byte agreement between the TypeScript, Solidity, and Soroban implementations).