fix(results): constrain accumulators to the bjj order

Range-constrain the results accumulators to the BabyJub subgroup order
before they are used as scalar inputs. This prevents wrapped field
values from being interpreted as valid tally deltas under a weaker
mod-field relation than the host-side arithmetic expects.

Tweaked testutil NewVoteForTest to cover the edge case of a zero Result

Author: altergui

circuits/results/results.go

@@ -2,11 +2,14 @@ package results
 
 import (
 	"errors"
+	"math/big"
 
 	"github.com/consensys/gnark/frontend"
 	"github.com/consensys/gnark/std/algebra/native/twistededwards"
 	"github.com/vocdoni/davinci-node/circuits"
 	"github.com/vocdoni/davinci-node/circuits/merkleproof"
+	bjj "github.com/vocdoni/davinci-node/crypto/ecc/bjj_gnark"
+	"github.com/vocdoni/davinci-node/crypto/ecc/curves"
 	"github.com/vocdoni/davinci-node/spec/params"
 	"github.com/vocdoni/davinci-node/state"
 	"github.com/vocdoni/gnark-crypto-primitives/elgamal"
@@ -110,8 +113,12 @@ func (c *ResultsVerifierCircuit) VerifyDecryptionProofs(api frontend.API) {
 }
 
 func (c *ResultsVerifierCircuit) VerifyResults(api frontend.API) {
+	bjjOrderMinusOne := new(big.Int).Sub(curves.New(bjj.CurveType).Order(), big.NewInt(1))
+
 	// Verify that the results add minus results sub equals results
 	for i := range params.FieldsPerBallot {
+		api.AssertIsLessOrEqual(c.AddAccumulators[i], bjjOrderMinusOne)
+		api.AssertIsLessOrEqual(c.SubAccumulators[i], bjjOrderMinusOne)
 		api.AssertIsLessOrEqual(c.SubAccumulators[i], c.AddAccumulators[i])
 		api.AssertIsEqual(
 			api.Sub(c.AddAccumulators[i], c.SubAccumulators[i]),

circuits/results/results_test.go

@@ -151,12 +151,33 @@ func TestResultsVerifierCircuit(t *testing.T) {
 	invalid := *assignment
 	invalid.DecryptionAddProofs[0].A1.Y = big.NewInt(0)
 
-	// Start the proving process
+	// subgroup order used by the ElGamal scalar arithmetic
+	q := new(big.Int).Set(curves.New(bjj.CurveType).Order())
+
+	shiftedAssignment := func(slot int) *ResultsVerifierCircuit {
+		honestAdd := new(big.Int).Set(addAccumulator[slot])
+		honestSub := new(big.Int).Set(subAccumulator[slot])
+		honestRes := new(big.Int).Sub(honestAdd, honestSub)
+
+		// Malicious witness: same ciphertext and same proof, but plaintext shifted by q.
+		shifted := *assignment
+		shifted.AddAccumulators[slot] = new(big.Int).Add(honestAdd, q)
+		shifted.Results[slot] = new(big.Int).Add(honestRes, q)
+
+		c.Assert(shifted.Results[slot].(*big.Int).Cmp(assignment.Results[slot].(*big.Int)), qt.Not(qt.Equals), 0)
+
+		// Human-readable explanation of the bug
+		c.Logf("[BUG DEMO] slot=%d\n  honest result:  %s\n  shifted result: %s (= honest + subgroup order)",
+			slot, honestRes.String(), shifted.Results[slot].(*big.Int).String())
+		return &shifted
+	}
 	startTime = time.Now()
 	assert.CheckCircuit(
 		&ResultsVerifierCircuit{},
 		test.WithValidAssignment(assignment),
 		test.WithInvalidAssignment(&invalid),
+		test.WithInvalidAssignment(shiftedAssignment(0)),
+		test.WithInvalidAssignment(shiftedAssignment(1)),
 		test.WithCurves(params.ResultsVerifierCurve),
 		test.WithBackends(backend.GROTH16),
 	)

state/testutil/state.go

@@ -48,7 +48,7 @@ func NewRandomState(t *testing.T, origin types.CensusOrigin) *state.State {
 func NewVoteForTest(publicKey ecc.Point, voterIndex uint64, value int) *state.Vote {
 	fields := [params.FieldsPerBallot]*big.Int{}
 	for i := range fields {
-		fields[i] = big.NewInt(int64(value + i))
+		fields[i] = big.NewInt(int64(value * i))
 	}
 	ballot, err := elgamal.NewBallot(publicKey).Encrypt(fields, publicKey, nil)
 	if err != nil {