fix: validate Plonk proof structure according to verifying key

[ivokub]

Description

Check ClaimedValues length according to verifing key.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How has this been tested?

• TestPlonkVerifyClaimedValuesLenMismatch

Checklist:

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I did not modify files generated from templates
• golangci-lint does not output errors locally
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

---

Note

Medium Risk
Touches the PLONK verifier entry path on all curves; changes are defensive length checks only, but incorrect bounds could reject valid proofs or miss invalid ones.

Overview
Hardens PLONK Verify across curves by checking proof and verifying-key shape against len(vk.Qcp) before the verifier indexes batched openings.

Early checks now reject mismatched CommitmentConstraintIndexes vs Qcp (errInvalidVerifyingKey), Bsb22Commitments count (replacing the ad-hoc BSB22 error with errInvalidProof), and BatchedProof.ClaimedValues length must be 6 + len(vk.Qcp) (errInvalidProof) so malformed proofs fail with an error instead of panicking when reading ClaimedValues[6:].

The same logic is wired through plonk.verify.go.tmpl; regression test issue1787 covers too-short, too-long, and commitment-missing ClaimedValues cases (in-memory and after encode/decode).

^{Reviewed by Cursor Bugbot for commit 2a0afd8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

This PR hardens Plonk verification by validating proof structure (and a related verifying key invariant) up front, preventing panics when malformed proofs are provided. It also adds a regression test reproducing the claimed-values length mismatch scenario described in the PR.

Changes:

• Add verifying-time structural checks for Bsb22Commitments and BatchedProof.ClaimedValues lengths against vk.Qcp.
• Add a verifying key consistency check for CommitmentConstraintIndexes vs Qcp.
• Add a regression test ensuring malformed claimed-values lengths never panic and always return an error.

Reviewed changes

Copilot reviewed 2 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
internal/regression_tests/issue1787/issue1787_test.go	Adds regression coverage for malformed Plonk proof claimed-values lengths (including roundtrip encode/decode).
internal/generator/backend/template/zkpschemes/plonk/plonk.verify.go.tmpl	Updates the Plonk verifier template to validate proof/VK structure before indexing into slices.
backend/plonk/bw6-761/verify.go	Generated verifier updated to include new proof/VK length checks.
backend/plonk/bn254/verify.go	Generated verifier updated to include new proof/VK length checks.
backend/plonk/bls12-381/verify.go	Generated verifier updated to include new proof/VK length checks.
backend/plonk/bls12-377/verify.go	Generated verifier updated to include new proof/VK length checks.

Files not reviewed (4)

• backend/plonk/bls12-377/verify.go: Generated file
• backend/plonk/bls12-381/verify.go: Generated file
• backend/plonk/bn254/verify.go: Generated file
• backend/plonk/bw6-761/verify.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.