49ddcccd12
It is impossible to serialize/deserialize a Data with a negative constructor. So the only way this can happen is by programmatically construct a value using builtin constr_data. While possible, it is entirely at the responsibility of the programmer, but not malleable from an attacker who can only provide values as 'Data' (and thus, must be decoded like others).
Untyped Plutus Core
A crate for working with untyped plutus core. It handles parsing, conversion between various forms, and flat encoding/decoding.