---
title: "Unchecked curve point and subgroup membership"
description: "Proof elements are accepted without verifying that they lie on the curve and in the correct prime-order subgroup, enabling small-subgroup and invalid-curve…"
type: "failure-mode"
url: "https://zkpick.com/audit/failure-modes/unchecked-curve-point-and-subgroup-membership/"
section: "03 Auditing a ZK protocol"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/audit/failure-modes/unchecked-curve-point-and-subgroup-membership.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Unchecked curve point and subgroup membership

Proof elements are accepted without verifying that they lie on the curve and in the correct prime-order subgroup, enabling small-subgroup and invalid-curve attacks against the verifier.

**Mitigation:** Validate every deserialised group element for curve membership and subgroup order before use, including in hand-written or gas-optimised verifiers where such checks are the first thing removed.