@meteora-ag/cp-amm-sdk 1.0.0 → 1.0.1-1.rc-0

package/node_modules/{@solana/web3.js/node_modules/@noble → @noble}/curves/src/abstract/weierstrass.ts

@@ -1,6 +1,19 @@
 /**
  * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
  *
+ * ### Parameters
+ *
+ * To initialize a weierstrass curve, one needs to pass following params:
+ *
+ * * a: formula param
+ * * b: formula param
+ * * Fp: finite field of prime characteristic P; may be complex (Fp2). Arithmetics is done in field
+ * * n: order of prime subgroup a.k.a total amount of valid curve points
+ * * Gx: Base point (x, y) aka generator point. Gx = x coordinate
+ * * Gy: ...y coordinate
+ * * h: cofactor, usually 1. h*n = curve group order (n is only subgroup order)
+ * * lowS: whether to enable (default) or disable "low-s" non-malleable signatures
+ *
  * ### Design rationale for types
  *
  * * Interaction between classes from different curves should fail:
@@ -25,30 +38,53 @@
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// prettier-ignore
 import {
-  type AffinePoint,
-  type BasicCurve,
-  type Group,
-  type GroupConstructor,
-  pippenger,
-  validateBasic,
-  wNAF,
-} from './curve.js';
+  pippenger, validateBasic, wNAF,
+  type AffinePoint, type BasicCurve, type Group, type GroupConstructor
+} from './curve.ts';
+// prettier-ignore
 import {
   Field,
-  type IField,
-  getMinHashLength,
-  invert,
-  mapHashToField,
-  mod,
-  validateField,
-} from './modular.js';
-import * as ut from './utils.js';
-import { type CHash, type Hex, type PrivKey, abool, ensureBytes, memoized } from './utils.js';
+  FpInvertBatch,
+  getMinHashLength, invert, mapHashToField, mod, validateField,
+  type IField
+} from './modular.ts';
+// prettier-ignore
+import {
+  aInRange, abool,
+  bitMask,
+  bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, ensureBytes, hexToBytes,
+  inRange, isBytes, memoized, numberToBytesBE, numberToHexUnpadded, validateObject,
+  type CHash, type Hex, type PrivKey
+} from './utils.ts';
 
 export type { AffinePoint };
 type HmacFnSync = (key: Uint8Array, ...messages: Uint8Array[]) => Uint8Array;
-type EndomorphismOpts = {
+/**
+ * When Weierstrass curve has `a=0`, it becomes Koblitz curve.
+ * Koblitz curves allow using **efficiently-computable GLV endomorphism ψ**.
+ * Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.
+ * For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.
+ *
+ * Endomorphism consists of beta, lambda and splitScalar:
+ *
+ * 1. GLV endomorphism ψ transforms a point: `P = (x, y) ↦ ψ(P) = (β·x mod p, y)`
+ * 2. GLV scalar decomposition transforms a scalar: `k ≡ k₁ + k₂·λ (mod n)`
+ * 3. Then these are combined: `k·P = k₁·P + k₂·ψ(P)`
+ * 4. Two 128-bit point-by-scalar multiplications + one point addition is faster than
+ *    one 256-bit multiplication.
+ *
+ * where
+ * * beta: β ∈ Fₚ with β³ = 1, β ≠ 1
+ * * lambda: λ ∈ Fₙ with λ³ = 1, λ ≠ 1
+ * * splitScalar decomposes k ↦ k₁, k₂, by using reduced basis vectors.
+ *   Gauss lattice reduction calculates them from initial basis vectors `(n, 0), (-λ, 0)`
+ *
+ * Check out `test/misc/endomorphism.js` and
+ * [gist](https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066).
+ */
+export type EndomorphismOpts = {
   beta: bigint;
   splitScalar: (k: bigint) => { k1neg: boolean; k1: bigint; k2neg: boolean; k2: bigint };
 };
@@ -60,7 +96,7 @@ export type BasicWCurve<T> = BasicCurve<T> & {
   // Optional params
   allowedPrivateKeyLengths?: readonly number[]; // for P521
   wrapPrivateKey?: boolean; // bls12-381 requires mod(n) instead of rejecting keys >= n
-  endo?: EndomorphismOpts; // Endomorphism options for Koblitz curves
+  endo?: EndomorphismOpts;
   // When a cofactor != 1, there can be an effective methods to:
   // 1. Determine whether a point is torsion-free
   isTorsionFree?: (c: ProjConstructor<T>, point: ProjPointType<T>) => boolean;
@@ -68,7 +104,7 @@ export type BasicWCurve<T> = BasicCurve<T> & {
   clearCofactor?: (c: ProjConstructor<T>, point: ProjPointType<T>) => ProjPointType<T>;
 };
 
-type Entropy = Hex | boolean;
+export type Entropy = Hex | boolean;
 export type SignOpts = { lowS?: boolean; extraEntropy?: Entropy; prehash?: boolean };
 export type VerOpts = { lowS?: boolean; prehash?: boolean; format?: 'compact' | 'der' | undefined };
 
@@ -84,17 +120,16 @@ export interface ProjPointType<T> extends Group<ProjPointType<T>> {
   readonly pz: T;
   get x(): T;
   get y(): T;
-  multiply(scalar: bigint): ProjPointType<T>;
   toAffine(iz?: T): AffinePoint<T>;
-  isTorsionFree(): boolean;
-  clearCofactor(): ProjPointType<T>;
-  assertValidity(): void;
-  hasEvenY(): boolean;
-  toRawBytes(isCompressed?: boolean): Uint8Array;
   toHex(isCompressed?: boolean): string;
+  toRawBytes(isCompressed?: boolean): Uint8Array;
 
+  assertValidity(): void;
+  hasEvenY(): boolean;
   multiplyUnsafe(scalar: bigint): ProjPointType<T>;
   multiplyAndAddUnsafe(Q: ProjPointType<T>, a: bigint, b: bigint): ProjPointType<T> | undefined;
+  isTorsionFree(): boolean;
+  clearCofactor(): ProjPointType<T>;
   _setWindowSize(windowSize: number): void;
 }
 // Static methods for 3d XYZ points
@@ -119,33 +154,33 @@ export type CurvePointsTypeWithLength<T> = Readonly<
 
 function validatePointOpts<T>(curve: CurvePointsType<T>): CurvePointsTypeWithLength<T> {
   const opts = validateBasic(curve);
-  ut.validateObject(
+  validateObject(
     opts,
     {
       a: 'field',
       b: 'field',
     },
     {
+      allowInfinityPoint: 'boolean',
       allowedPrivateKeyLengths: 'array',
-      wrapPrivateKey: 'boolean',
-      isTorsionFree: 'function',
       clearCofactor: 'function',
-      allowInfinityPoint: 'boolean',
       fromBytes: 'function',
+      isTorsionFree: 'function',
       toBytes: 'function',
+      wrapPrivateKey: 'boolean',
     }
   );
   const { endo, Fp, a } = opts;
   if (endo) {
     if (!Fp.eql(a, Fp.ZERO)) {
-      throw new Error('invalid endomorphism, can only be defined for Koblitz curves that have a=0');
+      throw new Error('invalid endo: CURVE.a must be 0');
     }
     if (
       typeof endo !== 'object' ||
       typeof endo.beta !== 'bigint' ||
       typeof endo.splitScalar !== 'function'
     ) {
-      throw new Error('invalid endomorphism, expected beta: bigint and splitScalar: function');
+      throw new Error('invalid endo: expected "beta": bigint and "splitScalar": function');
     }
   }
   return Object.freeze({ ...opts } as const);
@@ -159,8 +194,6 @@ export type CurvePointsRes<T> = {
   isWithinCurveOrder: (num: bigint) => boolean;
 };
 
-const { bytesToNumberBE: b2n, hexToBytes: h2b } = ut;
-
 export class DERErr extends Error {
   constructor(m = '') {
     super(m);
@@ -203,11 +236,11 @@ export const DER: IDER = {
       if (tag < 0 || tag > 256) throw new E('tlv.encode: wrong tag');
       if (data.length & 1) throw new E('tlv.encode: unpadded data');
       const dataLen = data.length / 2;
-      const len = ut.numberToHexUnpadded(dataLen);
+      const len = numberToHexUnpadded(dataLen);
       if ((len.length / 2) & 0b1000_0000) throw new E('tlv.encode: long form length too big');
       // length of length with long form flag
-      const lenLen = dataLen > 127 ? ut.numberToHexUnpadded((len.length / 2) | 0b1000_0000) : '';
-      const t = ut.numberToHexUnpadded(tag);
+      const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 0b1000_0000) : '';
+      const t = numberToHexUnpadded(tag);
       return t + lenLen + len + data;
     },
     // v - value, l - left bytes (unparsed)
@@ -245,7 +278,7 @@ export const DER: IDER = {
     encode(num: bigint): string {
       const { Err: E } = DER;
       if (num < _0n) throw new E('integer: negative integers are not allowed');
-      let hex = ut.numberToHexUnpadded(num);
+      let hex = numberToHexUnpadded(num);
       // Pad with zero byte if negative flag is present
       if (Number.parseInt(hex[0], 16) & 0b1000) hex = '00' + hex;
       if (hex.length & 1) throw new E('unexpected DER parsing assertion: unpadded hex');
@@ -256,14 +289,13 @@ export const DER: IDER = {
       if (data[0] & 0b1000_0000) throw new E('invalid signature integer: negative');
       if (data[0] === 0x00 && !(data[1] & 0b1000_0000))
         throw new E('invalid signature integer: unnecessary leading zero');
-      return b2n(data);
+      return bytesToNumberBE(data);
     },
   },
   toSig(hex: string | Uint8Array): { r: bigint; s: bigint } {
     // parse DER signature
     const { Err: E, _int: int, _tlv: tlv } = DER;
-    const data = typeof hex === 'string' ? h2b(hex) : hex;
-    ut.abytes(data);
+    const data = ensureBytes('signature', hex);
     const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);
     if (seqLeftBytes.length) throw new E('invalid signature: left bytes after parsing');
     const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);
@@ -280,6 +312,10 @@ export const DER: IDER = {
   },
 };
 
+function numToSizedHex(num: bigint, size: number): string {
+  return bytesToHex(numberToBytesBE(num, size));
+}
+
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
 const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
@@ -293,7 +329,7 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
     CURVE.toBytes ||
     ((_c: ProjConstructor<T>, point: ProjPointType<T>, _isCompressed: boolean) => {
       const a = point.toAffine();
-      return ut.concatBytes(Uint8Array.from([0x04]), Fp.toBytes(a.x), Fp.toBytes(a.y));
+      return concatBytes(Uint8Array.from([0x04]), Fp.toBytes(a.x), Fp.toBytes(a.y));
     });
   const fromBytes =
     CURVE.fromBytes ||
@@ -307,32 +343,42 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
     });
 
   /**
-   * y² = x³ + ax + b: Short weierstrass curve formula
+   * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².
    * @returns y²
    */
   function weierstrassEquation(x: T): T {
     const { a, b } = CURVE;
     const x2 = Fp.sqr(x); // x * x
-    const x3 = Fp.mul(x2, x); // x2 * x
-    return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x3 + a * x + b
+    const x3 = Fp.mul(x2, x); // x² * x
+    return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b
   }
+
+  function isValidXY(x: T, y: T): boolean {
+    const left = Fp.sqr(y); // y²
+    const right = weierstrassEquation(x); // x³ + ax + b
+    return Fp.eql(left, right);
+  }
+
   // Validate whether the passed curve params are valid.
-  // We check if curve equation works for generator point.
-  // `assertValidity()` won't work: `isTorsionFree()` is not available at this point in bls12-381.
-  // ProjectivePoint class has not been initialized yet.
-  if (!Fp.eql(Fp.sqr(CURVE.Gy), weierstrassEquation(CURVE.Gx)))
-    throw new Error('bad generator point: equation left != right');
+  // Test 1: equation y² = x³ + ax + b should work for generator point.
+  if (!isValidXY(CURVE.Gx, CURVE.Gy)) throw new Error('bad curve params: generator point');
+
+  // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.
+  // Guarantees curve is genus-1, smooth (non-singular).
+  const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);
+  const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
+  if (Fp.is0(Fp.add(_4a3, _27b2))) throw new Error('bad curve params: a or b');
 
   // Valid group elements reside in range 1..n-1
   function isWithinCurveOrder(num: bigint): boolean {
-    return ut.inRange(num, _1n, CURVE.n);
+    return inRange(num, _1n, CURVE.n);
   }
   // Validates if priv key is valid and converts it to bigint.
   // Supports options allowedPrivateKeyLengths and wrapPrivateKey.
   function normPrivateKeyToScalar(key: PrivKey): bigint {
     const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n: N } = CURVE;
     if (lengths && typeof key !== 'bigint') {
-      if (ut.isBytes(key)) key = ut.bytesToHex(key);
+      if (isBytes(key)) key = bytesToHex(key);
       // Normalize to hex string, pad. E.g. P521 would norm 130-132 char hex to 132-char bytes
       if (typeof key !== 'string' || !lengths.includes(key.length))
         throw new Error('invalid private key');
@@ -343,18 +389,18 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
       num =
         typeof key === 'bigint'
           ? key
-          : ut.bytesToNumberBE(ensureBytes('private key', key, nByteLength));
+          : bytesToNumberBE(ensureBytes('private key', key, nByteLength));
     } catch (error) {
       throw new Error(
         'invalid private key, expected hex or ' + nByteLength + ' bytes, got ' + typeof key
       );
     }
     if (wrapPrivateKey) num = mod(num, N); // disabled by default, enabled for BLS
-    ut.aInRange('private key', num, _1n, N); // num in range [1..N-1]
+    aInRange('private key', num, _1n, N); // num in range [1..N-1]
     return num;
   }
 
-  function assertPrjPoint(other: unknown) {
+  function aprjpoint(other: unknown) {
     if (!(other instanceof Point)) throw new Error('ProjectivePoint expected');
   }
 
@@ -362,7 +408,7 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
 
   // Converts Projective point to affine (x, y) coordinates.
   // Can accept precomputed Z^-1 - for example, from invertBatch.
-  // (x, y, z) ∋ (x=x/z, y=y/z)
+  // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)
   const toAffineMemo = memoized((p: Point, iz?: T): AffinePoint<T> => {
     const { px: x, py: y, pz: z } = p;
     // Fast-path for normalized points
@@ -392,30 +438,32 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
     const { x, y } = p.toAffine();
     // Check if x, y are valid field elements
     if (!Fp.isValid(x) || !Fp.isValid(y)) throw new Error('bad point: x or y not FE');
-    const left = Fp.sqr(y); // y²
-    const right = weierstrassEquation(x); // x³ + ax + b
-    if (!Fp.eql(left, right)) throw new Error('bad point: equation left != right');
+    if (!isValidXY(x, y)) throw new Error('bad point: equation left != right');
     if (!p.isTorsionFree()) throw new Error('bad point: not in prime-order subgroup');
     return true;
   });
 
   /**
-   * Projective Point works in 3d / projective (homogeneous) coordinates: (x, y, z) ∋ (x=x/z, y=y/z)
+   * Projective Point works in 3d / projective (homogeneous) coordinates: (X, Y, Z) ∋ (x=X/Z, y=Y/Z)
    * Default Point works in 2d / affine coordinates: (x, y)
    * We're doing calculations in projective, because its operations don't require costly inversion.
    */
   class Point implements ProjPointType<T> {
+    // base / generator point
     static readonly BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
-    static readonly ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);
+    // zero / infinity / identity point
+    static readonly ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0
+    readonly px: T;
+    readonly py: T;
+    readonly pz: T;
 
-    constructor(
-      readonly px: T,
-      readonly py: T,
-      readonly pz: T
-    ) {
+    constructor(px: T, py: T, pz: T) {
       if (px == null || !Fp.isValid(px)) throw new Error('x required');
-      if (py == null || !Fp.isValid(py)) throw new Error('y required');
+      if (py == null || !Fp.isValid(py) || Fp.is0(py)) throw new Error('y required');
       if (pz == null || !Fp.isValid(pz)) throw new Error('z required');
+      this.px = px;
+      this.py = py;
+      this.pz = pz;
       Object.freeze(this);
     }
 
@@ -445,7 +493,10 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
      * Optimization: converts a list of projective points to a list of identical points with Z=1.
      */
     static normalizeZ(points: Point[]): Point[] {
-      const toInv = Fp.invertBatch(points.map((p) => p.pz));
+      const toInv = FpInvertBatch(
+        Fp,
+        points.map((p) => p.pz)
+      );
       return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);
     }
 
@@ -489,7 +540,7 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
      * Compare one point to another.
      */
     equals(other: Point): boolean {
-      assertPrjPoint(other);
+      aprjpoint(other);
       const { px: X1, py: Y1, pz: Z1 } = this;
       const { px: X2, py: Y2, pz: Z2 } = other;
       const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
@@ -552,7 +603,7 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
     // https://eprint.iacr.org/2015/1060, algorithm 1
     // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
     add(other: Point): Point {
-      assertPrjPoint(other);
+      aprjpoint(other);
       const { px: X1, py: Y1, pz: Z1 } = this;
       const { px: X2, py: Y2, pz: Z2 } = other;
       let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
@@ -608,6 +659,7 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
     is0() {
       return this.equals(Point.ZERO);
     }
+
     private wNAF(n: bigint): { p: Point; f: Point } {
       return wnaf.wNAFCached(this, n, Point.normalizeZ);
     }
@@ -619,7 +671,7 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
      */
     multiplyUnsafe(sc: bigint): Point {
       const { endo, n: N } = CURVE;
-      ut.aInRange('scalar', sc, _0n, N);
+      aInRange('scalar', sc, _0n, N);
       const I = Point.ZERO;
       if (sc === _0n) return I;
       if (this.is0() || sc === _1n) return this;
@@ -629,6 +681,7 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
         return wnaf.wNAFCachedUnsafe(this, sc, Point.normalizeZ);
 
       // Case c: endomorphism
+      /** See docs for {@link EndomorphismOpts} */
       let { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);
       let k1p = I;
       let k2p = I;
@@ -657,8 +710,9 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
      */
     multiply(scalar: bigint): Point {
       const { endo, n: N } = CURVE;
-      ut.aInRange('scalar', scalar, _1n, N);
+      aInRange('scalar', scalar, _1n, N);
       let point: Point, fake: Point; // Fake point is used to const-time mult
+      /** See docs for {@link EndomorphismOpts} */
       if (endo) {
         const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);
         let { p: k1p, f: f1p } = this.wNAF(k1);
@@ -720,12 +774,11 @@ export function weierstrassPoints<T>(opts: CurvePointsType<T>): CurvePointsRes<T
 
     toHex(isCompressed = true): string {
       abool('isCompressed', isCompressed);
-      return ut.bytesToHex(this.toRawBytes(isCompressed));
+      return bytesToHex(this.toRawBytes(isCompressed));
     }
   }
-  const _bits = CURVE.nBitLength;
-  const wnaf = wNAF(Point, CURVE.endo ? Math.ceil(_bits / 2) : _bits);
-  // Validate if generator point is on curve
+  const { endo, nBitLength } = CURVE;
+  const wnaf = wNAF(Point, endo ? Math.ceil(nBitLength / 2) : nBitLength);
   return {
     CURVE,
     ProjectivePoint: Point as ProjConstructor<T>,
@@ -747,7 +800,6 @@ export interface SignatureType {
   recoverPublicKey(msgHash: Hex): ProjPointType<bigint>;
   toCompactRawBytes(): Uint8Array;
   toCompactHex(): string;
-  // DER-encoded
   toDERRawBytes(isCompressed?: boolean): Uint8Array;
   toDERHex(isCompressed?: boolean): string;
 }
@@ -777,7 +829,7 @@ function validateOpts(
   curve: CurveType
 ): Readonly<CurveType & { nByteLength: number; nBitLength: number }> {
   const opts = validateBasic(curve);
-  ut.validateObject(
+  validateObject(
     opts,
     {
       hash: 'hash',
@@ -818,7 +870,7 @@ export type CurveFn = {
  */
 export function weierstrass(curveDef: CurveType): CurveFn {
   const CURVE = validateOpts(curveDef) as ReturnType<typeof validateOpts>;
-  const { Fp, n: CURVE_ORDER } = CURVE;
+  const { Fp, n: CURVE_ORDER, nByteLength, nBitLength } = CURVE;
   const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32
   const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32
 
@@ -839,7 +891,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     toBytes(_c, point, isCompressed: boolean): Uint8Array {
       const a = point.toAffine();
       const x = Fp.toBytes(a.x);
-      const cat = ut.concatBytes;
+      const cat = concatBytes;
       abool('isCompressed', isCompressed);
       if (isCompressed) {
         return cat(Uint8Array.from([point.hasEvenY() ? 0x02 : 0x03]), x);
@@ -853,8 +905,8 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       const tail = bytes.subarray(1);
       // this.assertValidity() is done inside of fromHex
       if (len === compressedLen && (head === 0x02 || head === 0x03)) {
-        const x = ut.bytesToNumberBE(tail);
-        if (!ut.inRange(x, _1n, Fp.ORDER)) throw new Error('Point is not on curve');
+        const x = bytesToNumberBE(tail);
+        if (!inRange(x, _1n, Fp.ORDER)) throw new Error('Point is not on curve');
         const y2 = weierstrassEquation(x); // y² = x³ + ax + b
         let y: bigint;
         try {
@@ -881,8 +933,6 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       }
     },
   });
-  const numToNByteStr = (num: bigint): string =>
-    ut.bytesToHex(ut.numberToBytesBE(num, CURVE.nByteLength));
 
   function isBiggerThanHalfOrder(number: bigint) {
     const HALF = CURVE_ORDER >> _1n;
@@ -893,23 +943,27 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     return isBiggerThanHalfOrder(s) ? modN(-s) : s;
   }
   // slice bytes num
-  const slcNum = (b: Uint8Array, from: number, to: number) => ut.bytesToNumberBE(b.slice(from, to));
+  const slcNum = (b: Uint8Array, from: number, to: number) => bytesToNumberBE(b.slice(from, to));
 
   /**
    * ECDSA signature with its (r, s) properties. Supports DER & compact representations.
    */
   class Signature implements SignatureType {
-    constructor(
-      readonly r: bigint,
-      readonly s: bigint,
-      readonly recovery?: number
-    ) {
-      this.assertValidity();
+    readonly r: bigint;
+    readonly s: bigint;
+    readonly recovery?: number;
+    constructor(r: bigint, s: bigint, recovery?: number) {
+      aInRange('r', r, _1n, CURVE_ORDER); // r in [1..N]
+      aInRange('s', s, _1n, CURVE_ORDER); // s in [1..N]
+      this.r = r;
+      this.s = s;
+      if (recovery != null) this.recovery = recovery;
+      Object.freeze(this);
     }
 
     // pair (bytes of r, bytes of s)
     static fromCompact(hex: Hex) {
-      const l = CURVE.nByteLength;
+      const l = nByteLength;
       hex = ensureBytes('compactSignature', hex, l * 2);
       return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));
     }
@@ -921,10 +975,11 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       return new Signature(r, s);
     }
 
-    assertValidity(): void {
-      ut.aInRange('r', this.r, _1n, CURVE_ORDER); // r in [1..N]
-      ut.aInRange('s', this.s, _1n, CURVE_ORDER); // s in [1..N]
-    }
+    /**
+     * @todo remove
+     * @deprecated
+     */
+    assertValidity(): void {}
 
     addRecoveryBit(recovery: number): RecoveredSignature {
       return new Signature(this.r, this.s, recovery) as RecoveredSignature;
@@ -937,7 +992,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       const radj = rec === 2 || rec === 3 ? r + CURVE.n : r;
       if (radj >= Fp.ORDER) throw new Error('recovery id 2 or 3 invalid');
       const prefix = (rec & 1) === 0 ? '02' : '03';
-      const R = Point.fromHex(prefix + numToNByteStr(radj));
+      const R = Point.fromHex(prefix + numToSizedHex(radj, Fp.BYTES));
       const ir = invN(radj); // r^-1
       const u1 = modN(-h * ir); // -hr^-1
       const u2 = modN(s * ir); // sr^-1
@@ -958,18 +1013,19 @@ export function weierstrass(curveDef: CurveType): CurveFn {
 
     // DER-encoded
     toDERRawBytes() {
-      return ut.hexToBytes(this.toDERHex());
+      return hexToBytes(this.toDERHex());
     }
     toDERHex() {
-      return DER.hexFromSig({ r: this.r, s: this.s });
+      return DER.hexFromSig(this);
     }
 
     // padded bytes of r, then padded bytes of s
     toCompactRawBytes() {
-      return ut.hexToBytes(this.toCompactHex());
+      return hexToBytes(this.toCompactHex());
     }
     toCompactHex() {
-      return numToNByteStr(this.r) + numToNByteStr(this.s);
+      const l = nByteLength;
+      return numToSizedHex(this.r, l) + numToSizedHex(this.s, l);
     }
   }
   type RecoveredSignature = Signature & { recovery: number };
@@ -1022,14 +1078,19 @@ export function weierstrass(curveDef: CurveType): CurveFn {
   /**
    * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
    */
-  function isProbPub(item: PrivKey | PubKey): boolean {
-    const arr = ut.isBytes(item);
-    const str = typeof item === 'string';
-    const len = (arr || str) && (item as Hex).length;
-    if (arr) return len === compressedLen || len === uncompressedLen;
-    if (str) return len === 2 * compressedLen || len === 2 * uncompressedLen;
+  function isProbPub(item: PrivKey | PubKey): boolean | undefined {
+    if (typeof item === 'bigint') return false;
     if (item instanceof Point) return true;
-    return false;
+    const arr = ensureBytes('key', item);
+    const len = arr.length;
+    const fpl = Fp.BYTES;
+    const compLen = fpl + 1; // e.g. 33 for 32
+    const uncompLen = 2 * fpl + 1; // e.g. 65 for 32
+    if (CURVE.allowedPrivateKeyLengths || nByteLength === compLen) {
+      return undefined;
+    } else {
+      return len === compLen || len === uncompLen;
+    }
   }
 
   /**
@@ -1043,8 +1104,8 @@ export function weierstrass(curveDef: CurveType): CurveFn {
    * @returns shared public key
    */
   function getSharedSecret(privateA: PrivKey, publicB: Hex, isCompressed = true): Uint8Array {
-    if (isProbPub(privateA)) throw new Error('first arg must be private key');
-    if (!isProbPub(publicB)) throw new Error('second arg must be public key');
+    if (isProbPub(privateA) === true) throw new Error('first arg must be private key');
+    if (isProbPub(publicB) === false) throw new Error('second arg must be public key');
     const b = Point.fromHex(publicB); // check for being on-curve
     return b.multiply(normPrivateKeyToScalar(privateA)).toRawBytes(isCompressed);
   }
@@ -1056,12 +1117,12 @@ export function weierstrass(curveDef: CurveType): CurveFn {
   const bits2int =
     CURVE.bits2int ||
     function (bytes: Uint8Array): bigint {
-      // Our custom check "just in case"
+      // Our custom check "just in case", for protection against DoS
       if (bytes.length > 8192) throw new Error('input is too large');
       // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)
       // for some cases, since bytes.length * 8 is not actual bitLength.
-      const num = ut.bytesToNumberBE(bytes); // check for == u8 done here
-      const delta = bytes.length * 8 - CURVE.nBitLength; // truncate to nBitLength leftmost bits
+      const num = bytesToNumberBE(bytes); // check for == u8 done here
+      const delta = bytes.length * 8 - nBitLength; // truncate to nBitLength leftmost bits
       return delta > 0 ? num >> BigInt(delta) : num;
     };
   const bits2int_modN =
@@ -1070,14 +1131,14 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       return modN(bits2int(bytes)); // can't use bytesToNumberBE here
     };
   // NOTE: pads output with zero as per spec
-  const ORDER_MASK = ut.bitMask(CURVE.nBitLength);
+  const ORDER_MASK = bitMask(nBitLength);
   /**
    * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.
    */
   function int2octets(num: bigint): Uint8Array {
-    ut.aInRange('num < 2^' + CURVE.nBitLength, num, _0n, ORDER_MASK);
+    aInRange('num < 2^' + nBitLength, num, _0n, ORDER_MASK);
     // works with order, can have different size than numToField!
-    return ut.numberToBytesBE(num, CURVE.nByteLength);
+    return numberToBytesBE(num, nByteLength);
   }
 
   // Steps A, D of RFC6979 3.2
@@ -1107,7 +1168,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       const e = ent === true ? randomBytes(Fp.BYTES) : ent; // generate random bytes OR pass as-is
       seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes
     }
-    const seed = ut.concatBytes(...seedArgs); // Step D of RFC6979 3.2
+    const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2
     const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!
     // Converts signature params into point w r/s, checks result for validity.
     function k2sig(kBytes: Uint8Array): RecoveredSignature | undefined {
@@ -1152,7 +1213,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
   function sign(msgHash: Hex, privKey: PrivKey, opts = defaultSigOpts): RecoveredSignature {
     const { seed, k2sig } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.
     const C = CURVE;
-    const drbg = ut.createHmacDrbg<RecoveredSignature>(C.hash.outputLen, C.nByteLength, C.hmac);
+    const drbg = createHmacDrbg<RecoveredSignature>(C.hash.outputLen, C.nByteLength, C.hmac);
     return drbg(seed, k2sig); // Steps B, C, D, E, F, G
   }
 
@@ -1189,7 +1250,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     if ('strict' in opts) throw new Error('options.strict was renamed to lowS');
     if (format !== undefined && format !== 'compact' && format !== 'der')
       throw new Error('format must be compact or der');
-    const isHex = typeof sg === 'string' || ut.isBytes(sg);
+    const isHex = typeof sg === 'string' || isBytes(sg);
     const isObj =
       !isHex &&
       !format &&
@@ -1369,7 +1430,8 @@ export function mapToCurveSimpleSWU<T>(
     y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)
     const e1 = Fp.isOdd!(u) === Fp.isOdd!(y); // 23.  e1 = sgn0(u) == sgn0(y)
     y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)
-    x = Fp.div(x, tv4); // 25.   x = x / tv4
+    const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];
+    x = Fp.mul(x, tv4_inv); // 25.   x = x / tv4
     return { x, y };
   };
 }