Refactor transaction validation checks into separate functions

[jvff]

Motivation

PRs #2302, #2371, and #2419 included some refactorings of the transaction::Verifier, splitting some code into separate methods so that they can be reused. It might be beneficial to further split the methods so that the consensus rules can be properly quoted in the documentation, instead of in the code comments. The split code could be either new methods, or new functions in the transaction::check module, where other consensus rule checks are implemented.

Specifications

The consensus rules that are affected and quoted in the code comments are:

The joinSplitSig MUST represent a valid signature, under joinSplitPubKey, of the sighash.

https://zips.z.cash/protocol/protocol.pdf#sproutnonmalleability

Consensus rule: cv and rk MUST NOT be of small order, i.e. [h_J]cv MUST NOT be 𝒪_J and [h_J]rk MUST NOT be 𝒪_J.

The proof π_ZKSpend MUST be valid given a primary input formed from the other fields except spendAuthSig.

The spend authorization signature MUST be a valid SpendAuthSig signature over SigHash using rk as the validating key.

https://zips.z.cash/protocol/protocol.pdf#spenddesc

cv and wpk MUST NOT be of small order, i.e. [h_J]cv MUST NOT be 𝒪_J and [h_J]wpk MUST NOT be 𝒪_J.

The proof π_ZKOutput MUST be valid given a primary input formed from the other fields except C^enc and C^out.

https://zips.z.cash/protocol/protocol.pdf#outputdesc

The consensus rule affected by the code but not quoted in any nearby comment:

bindingSigSapling MUST represent a valid signature under the transaction binding validating key bvk^Sapling of SigHash

https://zips.z.cash/protocol/protocol.pdf#txnconsensus

The consensus rules that are likely relevant but not yet implemented are:

The spend authorization signature MUST be a valid SpendAuthSigOrchard signature over SigHash using rk as the validating key. [...] validation of the R component of the signature prohibits non-canonical encodings.

Tracking issue: #2317
Open PR: #2442

The proof 𝜋 MUST be valid given a primary input (cv, rt^Orchard, nf, rk, cm_x, enableSpends, enableOutputs)

Tracking issue: #2105

https://zips.z.cash/protocol/protocol.pdf#actiondesc

bindingSigOrchard MUST represent a valid signature under the transaction binding validating key bvk^Orchard of SigHash

Tracking issue: #2103

https://zips.z.cash/protocol/protocol.pdf#txnconsensus

Related Work

#1981 was the issue that tracked part of the refactor when initial support for V5 transactions was implemented.