✨ implement isOnCurve function

src/ECDSA256r1.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
 pragma solidity >=0.8.19 <0.9.0;
 
-import { ECDSA, Curve, p, gx, gy, n, MINUS_2, MINUS_1, MODEXP_PRECOMPILE } from "./utils/ECDSA.sol";
+import { ECDSA, Curve, p, gx, gy, n, MINUS_2, MINUS_1, MODEXP_PRECOMPILE, a, b } from "./utils/ECDSA.sol";
 
 /// @title ECDSA256r1
 /// @notice A library to verify ECDSA signatures made on the secp256r1 curve
@@ -14,6 +14,27 @@
 library ECDSA256r1 {
     using { Curve.nModInv } for uint256;
 
+    /// @notice Verifies that a point is on the secp256r1 curve
+    /// @param x The x-coordinate of the point
+    /// @param y The y-coordinate of the point
+    /// @return bool True if the point is on the curve, false otherwise
+    function isPointValid(uint256 x, uint256 y) internal pure returns (bool) {
+        if (((0 == x) && (0 == y)) || x == p || y == p) {
+            return false;
+        }
+
+        unchecked {
+            // y^2
+            uint256 lhs = mulmod(y, y, p);
+            // x^3+ax
+            uint256 rhs = addmod(mulmod(mulmod(x, x, p), x, p), mulmod(x, a, p), p);
+            // x^3 + a*x + b
+            rhs = addmod(rhs, b, p);
+
+            return lhs == rhs;
+        }
+    }
+
     //// @notice Computes uG + vQ using Strauss-Shamir's trick on the secp256r1 elliptic curve, where G is the basepoint
     ///           and Q is the public key.
     /// @param Q0 x-coordinate of the input point Q
@@ -21,14 +42,14 @@
     /// @param scalar_u Multiplier for basepoint G
     /// @param scalar_v Multiplier for input point Q
     /// @return X Resulting x-coordinate of the computed point
     function mulmuladd(uint256 Q0, uint256 Q1, uint256 scalar_u, uint256 scalar_v) internal returns (uint256 X) {
         uint256 zz;
         uint256 zzz;
         uint256 Y;
         uint256 index = 255;
         uint256[6] memory T;
         uint256 H0;
         uint256 H1;
 
         unchecked {
             if (scalar_u == 0 && scalar_v == 0) return 0;
@@ -36,7 +57,7 @@
             // will not work if Q=P, obvious forbidden private key
             (H0, H1) = ECDSA.affAdd(gx, gy, Q0, Q1);
 
             assembly {
                 for { let T4 := add(shl(1, and(shr(index, scalar_v), 1)), and(shr(index, scalar_u), 1)) } eq(T4, 0) {
                     index := sub(index, 1)
                     T4 := add(shl(1, and(shr(index, scalar_v), 1)), and(shr(index, scalar_u), 1))