The four opaque-state loaders (participant state1, state2,
coordinator state, inv_data) guarded the t/n/participant_id fields
read from the serialized object with VERIFY_CHECK, which is compiled
out in noverify (release) builds. chilldkg.md explicitly recommends
persisting state1 and the coordinator state between rounds, which
turns the persisted file into an attack surface: a state1 with n
altered to 100000 and the magic bytes left intact crashed
participant_step2 with out-of-bounds array indexing in a noverify
build.
Promote all four guards to ARG_CHECK, consistent with the magic-byte
check right above them: the illegal-argument callback fires, the load
returns 0, and the public entry points (participant_step2,
participant_finalize, coordinator_finalize, participant_investigate)
return SECP256K1_CHILLDKG_INVALID_INPUT before any state-derived size
is used -- verified in both verify and noverify builds.
ceccb50a5a