[zk-token-sdk] Fix transfer with fee edge case error

[samkim-crypto]

Problem

In the way the transfer with fee proof is currently calculated, it is possible for transfer fee to be greater than the transfer amount. This stems from some edge cases that were missed in the way range proof is used.

1. We call the difference of transfer_fee * 10_000 - transfer_amount * fee_basis_point the delta_fee. If the fee is calculated correctly, then the delta_fee must be in the range 0 <= delta_fee < 10_000. We use range proof to check this. However, since range proof only works for ranges of power-of-two, we require the prover to generate two range proofs: (i) 0 <= delta_fee < 16_384 (16384 = 2^14) and (ii) 0 <= 10_000 - delta_fee < 16_384. However, if delta_fee = 10_000, then both conditions (i) and (ii) are satisfied. What we really want for condition (ii) is 0 <= 9_999 - delta_fee < 16_384.
2. If the calculated fee is less than the max fee parameter, then the fee sigma proof enforces the transfer fee to be less than or equal to the transfer amount. However, if the max fee parameter is greater than the transfer amount, then the fee sigma proof is insufficient to certify that the fee is at most the transfer amount.

#33526

Summary of Changes

1. Fixed the off-by-one error
2. Added an additional range proof to certify that the transfer fee is at most the transfer amount. Specifically, in the batched range proof condition, I added the condition transfer_amount - transfer_fee is a positive 64-bit number. Since the range proofs are batched, this additional condition does not increase the cost or size of the range proof itself.
3. Removed unchecked arithmetic.

Fixes #

[codecov]

Codecov Report

Merging #34314 (94e0ca9) into master (d451675) will decrease coverage by 0.1%.
Report is 15 commits behind head on master.
The diff coverage is 100.0%.

Additional details and impacted files

@@            Coverage Diff            @@
##           master   #34314     +/-   ##
=========================================
- Coverage    81.9%    81.9%   -0.1%     
=========================================
  Files         819      819             
  Lines      220228   220234      +6     
=========================================
- Hits       180535   180510     -25     
- Misses      39693    39724     +31     

[joncinque]

Looks great, and thanks for all the explanation!