feat(crypto): add strict ECDSA validation

[Federico2014]

What does this PR do?

• Add governance-controlled strict ECDSA validation through proposal 99 and block version 38, including scalar and recovery checks and rejection of point-at-infinity public keys.
• Require exactly 65 bytes per signature at admission and auxiliary-query entry points. Queries reject malformed lengths before hashing or recovery and omit the transaction from length-error responses.
• Trim unused witness-signature trailing bytes during block sanitization, including historical synchronization.
• Invalidate queued transaction verification caches on activation and require verified pending transactions before reusing their results.
• Handle failed address recovery explicitly in ValidateMultiSign and add regression coverage for auxiliary queries and signature precompiles.

Why are these changes required?

Malformed signatures and unused trailing bytes can produce inconsistent validation or unnecessary storage and response costs. These changes harden signature handling while retaining legacy consensus recovery before governance activation.

Related TIP: tronprotocol/tips#935

This PR has been tested by:

• Focused signature-query and Wallet/TransactionUtil tests: 33 passed.
• ValidateMultiSign and BatchValidateSign test classes: 13 passed; all 6 ValidateMultiSign tests passed again after adding the null check.
• Framework main/test and plugin main Checkstyle checks passed.
• Full-suite and multi-node rollout validation have not been performed.

Follow up

Add maintenance-boundary integration coverage for activation and pending-transaction revalidation. Complete affected-client measurements and migration notices before rollout.

Extra details

Targets v4.8.3. Admission and auxiliary-query length checks take effect upon upgrade; strict consensus recovery is governance-controlled. Clients producing padded signatures, including 68-byte signatures, must migrate to 65-byte encoding.

---

Summary by cubic

Adds governance-controlled strict ECDSA signature validation (proposal 99, block version 38) that rejects malformed signatures and padding across admission, query, and consensus paths.

Previously, padded signatures up to 68 bytes were accepted at admission and truncated during query recovery. Now signatures must be exactly 65 bytes at admission and auxiliary-query entry points, which return SIGNATURE_FORMAT_ERROR without hashing or recovery. When the proposal activates, consensus recovery also enforces scalar bounds, recovery-id limits, and rejects point-at-infinity public keys; witness-signature trailing bytes are trimmed during block sanitization and the transaction verification cache is invalidated at activation.

Migration

• Clients producing padded signatures, including 68-byte signatures, must switch to 65-byte encoding.
• Verified pending transactions are re-verified once the proposal activates.

Related TIP: tronprotocol/tips#935

^{Written for commit 4bca8c9. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 2eb9ebc1-a313-447b-bdde-e2f9f9dd9647

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

All reported issues were addressed across 34 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>