fix: honour proof_out capacity and validate required pointers (Zellic DEFI-1108/1109/1110)

[tesseract-ripple]

Summary

Resolves the three findings from the Zellic scan of mpt-crypto@3baaaac (current main): DEFI-1108, DEFI-1109, DEFI-1110 on the DEFI board. Each was verified against the source at that commit before anything was changed.

DEFI-1110 (memory safety, the one that matters)

secp256k1_bulletproof_prove_agg documents *proof_len as the caller's buffer capacity on input, but overwrites it with proof_size immediately after validating m. The only capacity check, in the serialization block, then compares that value against a locally recomputed expected equal to it, so *proof_len < expected is dead for every supported m, and an undersized proof_out is serialized past its end.

Reproduced under AddressSanitizer on unpatched main: a 600-byte heap buffer with declared capacity 600 takes a heap-buffer-overflow WRITE 0 bytes after the region, in the trailing-scalar memcpy block, for an m=1 proof requiring 688 bytes (88-byte overrun). The same repro against this branch returns 0 and reports 688.

Fix: capture the capacity in a local before *proof_len is written, and resolve the size-query (proof_out == NULL), NULL-proof_len and insufficient-capacity paths at the top of the function, before any proving work rather than after it.

Compatibility: both in-repo callers (mpt_get_bulletproof_agg, reached from the Send and ConvertBack builders) already pass kMPT_{SINGLE,DOUBLE}_BULLETPROOF_SIZE, which equal the computed sizes for m=1 and m=2, so existing callers are unaffected. Two behaviour differences worth knowing: a size query now returns immediately without running the prover (previously it returned 1 only if proving succeeded), and on an internal proving failure *proof_len is left at the caller's capacity rather than set to the required size. Neither is relied on in-repo. Separately, note that mpt_get_bulletproof_agg only checks the written length after the call returns, so the utility layer was never itself enforcing the capacity it passes down; correct today because every caller hands it a matching constant.

DEFI-1108 (robustness)

secp256k1_bulletproof_create_commitment dereferenced h_generator and commitment_C without validating them, so a NULL required pointer crashed the process instead of returning the documented 0 (confirmed: SIGSEGV on unpatched main). Added MPT_ARG_CHECK entry-point checks, the idiom already used across elgamal.c and the proof modules. The same checks are added to prove_agg, which had the identical gap the scan did not flag. context_id is deliberately excluded: it is documented optional and NULL-guarded at every transcript absorption.

DEFI-1109 (documented, deliberately not changed)

secp256k1_elgamal_add / _subtract cannot represent an identity result, because a secp256k1_pubkey has no encoding for the point at infinity; subtracting a ciphertext from itself, or any pair sharing a component, returns 0 indistinguishably from a genuine failure. Giving the ciphertext an identity-capable representation changes the exported representation downstream consumers build on, so this PR documents the limitation in the API contract and pins it with tests instead. Whether to change the representation is a protocol decision, not a library one, and it is the same underlying mechanism as AXRT-4218 at the transactor layer, so the two are worth deciding together. Both functions are WASM-exported specifically for client-side chained-balance prediction (CB_S' = CB_S -/+ the encrypted amount), which is the path that can actually reach a cancellation, so the header now points callers at generate_canonical_encrypted_zero() for a zero balance.

Testing

New tests/test_api_hardening.c. Verified to be genuine regression tests by building the same file against unpatched main: the DEFI-1108 case exits 139 (SIGSEGV) and the DEFI-1110 case exits 134 (assertion), while the DEFI-1109 case passes both before and after, since it pins existing behaviour rather than changing it.

On this branch: Debug build on macOS with MPT_CRYPTO_WERROR=ON, 13/13 ctest pass. pre-commit run clean on all changed files. The _shared test variant is exercised only in CI.