specification: clarify swap claim integrity checks

[TalDerei]

Describe your changes

Specifies components of the integrity checks in the swap claim.

This references component B in the ECC audit log.

Issue ticket number and link

References #4483

Checklist before requesting a review

• If this code contains consensus-breaking changes, I have added the "consensus-breaking" label. Otherwise, I declare my belief that there are not consensus-breaking changes, for the following reason:

[TalDerei]

there are a few things to note here:

1. The swap claim specification references that the body of a SwapClaim has "a balance commitment, which commits to the value balance of the spent note". This is inconsistent with the protobuf definition for a SwapClaimBody.

2. Regarding the fee consistency check: in constructing the swapClaim plan, it uses the claimFee from the SwapPlaintext as the claimFee field inside SwapClaimProofPublic. Then, in the fee consistency check during circuit constraint generation, it uses the same SwapPlaintext inside SwapClaimProofPrivate. It’s comparing the swap claim fee from the same source, meaning the fee consistency check isn’t actually doing anything useful here from what I can tell?

[redshiftzero]

The swap claim specification references that the body of a SwapClaim has "a balance commitment, which commits to the value balance of the spent note". This is inconsistent with the protobuf definition for a SwapClaimBody.

correctly pointed out, this is done in #4485 so leaving out here

Regarding the fee consistency check: in constructing the swapClaim plan, it uses the claimFee from the SwapPlaintext as the claimFee field inside SwapClaimProofPublic. Then, in the fee consistency check during circuit constraint generation, it uses the same SwapPlaintext inside SwapClaimProofPrivate. It’s comparing the swap claim fee from the same source, meaning the fee consistency check isn’t actually doing anything useful here from what I can tell?

This is true for an honest prover, but a malicious prover can construct a SwapClaim with an arbitrary public claim fee, however the ZKP demonstrates that it must match the claim fee from the SwapPlaintext

[TalDerei]

This is true for an honest prover, but a malicious prover can construct a SwapClaim with an arbitrary public claim fee, however the ZKP demonstrates that it must match the claim fee from the SwapPlaintext

Good point, I should've been strictly thinking about this from the vantage point of a malicious prover.