I'm reading the Confidential Transactions paper, and it says that the blinding factor in the pedersen commitment is derived using a shared secret, but I can't understand what's preventing the sender from cheating a bit.
The sender generates a ephemeral private key, and derives the secret as
(ephemeral private key * receivers public key), and is supposed to pack the ephemeral public key in the transaction, so that the receiver can derive the shared secret
(receivers private key * ephemeral public key) and get the blinding factor and derive transaction amount.
What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount.
The sender might be up to mischief, or claim that he sent a transaction (and show the transaction ID as proof), and claim that the receiver (maybe an exchange) is not depositing the right amount.