Improve accuracy of constraint system violation diagnostics.

src/zcash/IncrementalMerkleTree.cpp

@@ -70,6 +70,17 @@ void IncrementalMerkleTree<Depth, Hash>::wfcheck() const {
     }
 }
 
+template<size_t Depth, typename Hash>
+Hash IncrementalMerkleTree<Depth, Hash>::last() const {
+    if (right) {
+        return *right;
+    } else if (left) {
+        return *left;
+    } else {
+        throw std::runtime_error("tree has no cursor");
+    }
+}
+
 template<size_t Depth, typename Hash>
 void IncrementalMerkleTree<Depth, Hash>::append(Hash obj) {
     if (is_complete(Depth)) {

src/zcash/IncrementalMerkleTree.hpp

@@ -79,6 +79,7 @@ public:
     Hash root() const {
         return root(Depth, std::deque<Hash>());
     }
+    Hash last() const;
 
     IncrementalWitness<Depth, Hash> witness() const {
         return IncrementalWitness<Depth, Hash>(*this);
@@ -138,6 +139,12 @@ public:
         return tree.path(partial_path());
     }
 
+    // Return the element being witnessed (should be a note
+    // commitment!)
+    Hash element() const {
+        return tree.last();
+    }
+
     Hash root() const {
         return tree.root(Depth, partial_path());
     }

src/zcash/JoinSplit.cpp

@@ -205,10 +205,17 @@ public:
         for (size_t i = 0; i < NumInputs; i++) {
             // Sanity checks of input
             {
-                // If note has nonzero value, its witness's root must be equal to the
-                // input.
-                if ((inputs[i].note.value != 0) && (inputs[i].witness.root() != rt)) {
-                    throw std::invalid_argument("joinsplit not anchored to the correct root");
+                // If note has nonzero value
+                if (inputs[i].note.value != 0) {
+                    // The witness root must equal the input root.
+                    if (inputs[i].witness.root() != rt) {
+                        throw std::invalid_argument("joinsplit not anchored to the correct root");
+                    }
+
+                    // The tree must witness the correct element
+                    if (inputs[i].note.cm() != inputs[i].witness.element()) {
+                        throw std::invalid_argument("witness of wrong element for joinsplit input");
+                    }
                 }
 
                 // Ensure we have the key to this note.