TransactionBuilder: Check that all anchors in a transaction are identical

This reduces the amount of information that is leaked by the choice of anchor.
In future we will make a protocol change to enforce that all inputs use the
same anchor.

src/gtest/test_transaction_builder.cpp

@@ -58,7 +58,10 @@ TEST(TransactionBuilder, Invoke) {
 
     // Create a Sapling-only transaction
     auto builder2 = TransactionBuilder(consensusParams, 2);
-    builder2.AddSaplingSpend(xsk, note, anchor, witness);
+    ASSERT_TRUE(builder2.AddSaplingSpend(xsk, note, anchor, witness));
+    // Check that trying to add a different anchor fails
+    ASSERT_FALSE(builder2.AddSaplingSpend(xsk, note, uint256(), witness));
+
     builder2.AddSaplingOutput(fvk, pk, 25, {});
     auto maybe_tx2 = builder2.Build();
     ASSERT_EQ(static_cast<bool>(maybe_tx2), true);

src/transaction_builder.cpp

@@ -27,14 +27,22 @@ TransactionBuilder::TransactionBuilder(
     mtx = CreateNewContextualCMutableTransaction(consensusParams, nHeight);
 }
 
-void TransactionBuilder::AddSaplingSpend(
+bool TransactionBuilder::AddSaplingSpend(
     libzcash::SaplingExpandedSpendingKey xsk,
     libzcash::SaplingNote note,
     uint256 anchor,
-    ZCSaplingIncrementalWitness witness
-) {
+    ZCSaplingIncrementalWitness witness)
+{
+    // Consistency check: all anchors must equal the first one
+    if (!spends.empty()) {
+        if (spends[0].anchor != anchor) {
+            return false;
+        }
+    }
+
     spends.emplace_back(xsk, note, anchor, witness);
     mtx.valueBalance += note.value();
+    return true;
 }
 
 void TransactionBuilder::AddSaplingOutput(

src/transaction_builder.h

@@ -55,7 +55,9 @@ private:
 public:
     TransactionBuilder(const Consensus::Params& consensusParams, int nHeight);
 
-    void AddSaplingSpend(
+    // Returns false if the anchor does not match the anchor used by
+    // previously-added Sapling spends.
+    bool AddSaplingSpend(
         libzcash::SaplingExpandedSpendingKey xsk,
         libzcash::SaplingNote note,
         uint256 anchor,