At the moment, the only test is this one: https://github.com/bitcoin-core/secp256k1/blob/1605b02f751cf7762dc9ae9a23d6d1daeb4d52df/src/tests.c#L2262-L2267
That is, even a blank return 1 would pass the tests.
Some calls to secp256k1_scalar_check_overflow in the tests were removed in #1484 because I deemed them redundant. But that’s not entirely true. Their primary purpose was to check for overflows in other test code, and this is indeed redundant. But a secondary effect of these calls was to test secp256k1_scalar_check_overflow itself.
We could revert this, but I think it’s better to have a bunch of dedicated tests:
- Check a handful of static inputs including the edge cases.
- Check some random inputs. Uniformly random inputs should not overflow. But if we tweak in the right way (e.g., setting top bits), they should overflow.