Enforce checkpoints at their specific block height

This ensures checkpoints can't be bypassed even prior to getting the main chain's headers.

This partially reverts dce8360.

Author: luke-jr

src/kernel/chainparams.h

@@ -33,6 +33,12 @@ struct CCheckpointData {
         const auto& final_checkpoint = mapCheckpoints.rbegin();
         return final_checkpoint->first /* height */;
     }
+
+    bool CheckBlock(int height, const uint256& hash) const {
+        const auto i = mapCheckpoints.find(height);
+        if (i == mapCheckpoints.end()) return true;
+        return hash == i->second;
+    }
 };
 
 struct AssumeutxoHash : public BaseHash<uint256> {

src/test/util/setup_common.cpp

@@ -250,6 +250,7 @@ ChainTestingSetup::ChainTestingSetup(const ChainType chainType, TestOpts opts)
             .chainparams = chainparams,
             .datadir = m_args.GetDataDirNet(),
             .check_block_index = 1,
+            .checkpoints_enabled = false,
             .notifications = *m_node.notifications,
             .signals = m_node.validation_signals.get(),
             .worker_threads_num = 2,

src/validation.cpp

@@ -4171,11 +4171,18 @@ static bool ContextualCheckBlockHeader(const CBlockHeader& block, BlockValidatio
         // Don't accept any forks from the main chain prior to last checkpoint.
         // GetLastCheckpoint finds the last checkpoint in MapCheckpoints that's in our
         // BlockIndex().
-        const CBlockIndex* pcheckpoint = blockman.GetLastCheckpoint(chainman.GetParams().Checkpoints());
+        const auto& checkpoint_data = chainman.GetParams().Checkpoints();
+        const CBlockIndex* pcheckpoint = blockman.GetLastCheckpoint(checkpoint_data);
         if (pcheckpoint && nHeight < pcheckpoint->nHeight) {
             LogPrintf("ERROR: %s: forked chain older than last checkpoint (height %d)\n", __func__, nHeight);
             return state.Invalid(BlockValidationResult::BLOCK_CHECKPOINT, "bad-fork-prior-to-checkpoint");
         }
+
+        // Check that the block chain matches the known block chain up to a checkpoint
+        if (!checkpoint_data.CheckBlock(nHeight, block.GetHash())) {
+            LogPrintf("ERROR: %s: rejected by checkpoint lock-in at %d\n", __func__, nHeight);
+            return state.Invalid(BlockValidationResult::BLOCK_CHECKPOINT, "checkpoint-mismatch");
+        }
     }
 
     // Check timestamp against prev