arkrpc: validate ancestry tree_depth at indexer trust boundary (#370)

[ellemouton]

Closes #370.

Summary

ancestryFromRPC (in both darepod/incoming_metadata.go and oor/incoming_metadata_query.go) copied the indexer-supplied AncestryPath.tree_depth into vtxo.Ancestry without validation. A malicious indexer could return:

• tree_depth = 0 → descriptor persists; later unroll trips the frag.TreeDepth == 0 guard → stranded VTXO.
• an under-reported non-zero depth → vtxo/expiry.go uses MaxTreeDepth() * TreeDepthMultiplier to size the safe-exit buffer → late refresh, missed CSV.

Fix

New arkrpc.ValidateAncestryPathDepth(claimed, reconstructed) at the trust boundary:

• rejects claimed == 0
• rejects claimed > MaxAncestryTreeWalkDepth (32 — reused existing documented constant)
• rejects claimed != reconstructed.Depth() (mismatch with the actual TreePath)

Both ancestryFromRPC copies call it before materializing vtxo.Ancestry. oor.validateIncomingAncestry also calls it as defense-in-depth so in-process descriptor construction is gated too.

Test plan

• new TestValidateAncestryPathDepth — table-driven: 0, 1 (leaf), at-cap, over-cap, mismatch, nil-tree
• new TestBuildIncomingVTXODescriptorRejectsInvalidAncestry subcases
• 4 new regression tests + 2 subcases fail when the production fix is reverted
• 3 pre-existing test fixtures (testIncomingVTXO, testIncomingMetadataVTXO, three cases in incoming_metadata_query_test.go) updated — they previously built bogus zero-depth paths; now use a shared testValidAncestryPath helper
• make lint-native — 0 issues
• go test ./arkrpc/... ./oor/... ./darepod/... ./unroll/... ./vtxo/... — pass

Relationship to #372

Complementary, not conflicting. #370 (this PR) closes the indexer→client ingress: zero/under-reported TreeDepth never reaches persistence. #372 keeps the unroll boundary liberal about TreeDepth (the scalar is expiry-timing metadata, not proof material — the proof assembler walks TreePath.Root directly), so legacy/pre-fix poisoned data can still recover. The two fixes are mutually consistent.

[gemini-code-assist]

Code Review

This pull request introduces validation for the tree_depth field in ancestry paths to ensure consistency between indexer-supplied metadata and reconstructed tree paths. This change acts as a trust boundary to prevent malicious indexers from providing zero or mismatched depths that could result in fund-availability issues. A security concern was identified in the ValidateAncestryPathDepth function, where calling reconstructed.Depth() on untrusted data could potentially cause a stack overflow; it is recommended to use a bounded depth-checking helper instead.

[gemini-code-assist]

The use of reconstructed.Depth() here may be unsafe if it performs an unbounded recursive walk on the tree structure. Since the tree is reconstructed from untrusted indexer data, an arbitrarily deep tree could cause a stack overflow.

You should use the treeMaxDepth helper defined later in this file (line 141), which explicitly bounds the walk depth to MaxAncestryTreeWalkDepth to prevent this risk. This is consistent with how depth is calculated in AncestryPathFromTree (line 41).

	actual, err := treeMaxDepth(reconstructed)
	if err != nil {
		return err
	}

	if uint32(actual) != claimed {
		return fmt.Errorf("ancestry tree_depth %d does not match "+
			"reconstructed path depth %d", claimed, actual)
	}

[ellemouton]

Good catch, you are correct. tree.Tree.Depth() walks the recursive Node.Depth() without any bound, and TreePathToTree only enforces parent_idx < child_idx < len(nodes) per child entry; the overall chain length is uncapped at the proto layer, so an indexer can supply a linear chain of N nodes that crashes the goroutine on reconstructed.Depth() even when the claimed scalar is in range.

Fixed in 2f18d9d: ValidateAncestryPathDepth now uses the locally-bounded treeMaxDepth (capped at MaxAncestryTreeWalkDepth = 32) instead of reconstructed.Depth(). The bounded walker returns an error when traversal exceeds the cap, so a hostile path fails closed before the comparison. Added TestValidateAncestryPathDepthBoundsReconstructedWalk to lock the behaviour in. Lint clean (0 issues), ./arkrpc/... and ./oor/... pass.

[ellemouton]

Superseded by consolidated PR #459. Closing to reduce CI load.