[H16] DKG Round-1 rejects all honest packages unless exactly threshold(N)+1 registered Round-0 — deterministic bridge halt for N≥7

Bug Bounty Resolved
10

Hey VoidDragon — confirmed resolved on my end. I pulled commit 653bf0848 and verified both vectors:

  1. Trailing-byte (Round-1): the dead Option<Option<()>> check is now ensure!(estimated == byzantium_threshold(full authority set), Round1PackageInvalidLength). Importantly it’s not the R-1 invariant we discussed avoiding — padded packages now fail at registration, and honest packages (which always carry exactly threshold(N) coefficients) can never be rejected by it.
  2. Malformed slots (Round-2): gather_incoming_offchain_packages is gone; ecdh_decrypt_round2_packages now iterates round1_packages and marks decode failures in accused_indexes, so a malformed sender lands on the complaint path instead of being silently dropped.

I also compiled ghost-exodus at that commit and ran the pallet suite: the new test_dkg_robustness_against_malformed_scale_slots passes and the full suite is 28/28 green — no regression on the honest paths.

Thanks for the quick turnaround on the fix. Happy to re-run my standalone reproducers against this commit too if you’d like an extra confirmation.

One more thing while I have you: could you explain how the payout side of this program works? Is there a fixed scale per severity (e.g. what a Medium pays), who makes the severity/payout call, and roughly what the timeline looks like from fix-confirmation to payout?