Grootle verification hardening

src/libspark/grootle.cpp

@@ -281,6 +281,11 @@ void Grootle::prove(
     for (std::size_t k = 0; k < S_offset.size(); k++) {
         S_offset[k] += S1_inverse;
         V_offset[k] += V1_inverse;
+
+        // Neither should be zero
+        if (S_offset[k].isInfinity() || V_offset[k].isInfinity()) {
+            throw std::invalid_argument("Commitment offset should not be zero");
+        }
     }
 
     // Generate masks
@@ -405,6 +410,16 @@ bool Grootle::verify(
         return false;
     }
 
+    // Check for zero inputs
+    for (std::size_t t = 0; t < S1.size(); t++) {
+        for (std::size_t i = 0; i < S.size(); i++) {
+            if (S[i] == S1[t] || V[i] == V1[t]) {
+                LogPrintf("Invalid offset commitment");
+                return false;
+            }
+        }
+    }
+
     // Check proof semantics
     for (std::size_t t = 0; t < M; t++) {
         GrootleProof proof = proofs[t];
@@ -545,6 +560,10 @@ bool Grootle::verify(
             points.emplace_back(proof.X[j] + proof.X1[j] * bind_weight);
             scalars.emplace_back(x_powers.negate() * w2);
             x_powers *= x;
+            if (x_powers.isZero()) {
+                LogPrintf("Challenge power is zero");
+                return false;
+            }
         }
     }