In a confidential transaction, what guarantees that the sender packed the correct ephemeral public key for the pederson blinding factor? I'm reading the Confidential Transactions paper, and it says that the blinding factor in the pedersen commitment is derived using a shared secret, but I can't understand what's preventing the sender from cheating a bit. 

The sender generates a ephemeral private key, and derives the secret as (ephemeral private key * receivers public key), and is supposed to pack the ephemeral public key in the transaction, so that the receiver can derive the shared secret (receivers private key * ephemeral public key) and get the blinding factor and derive transaction amount. 

What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. 

The sender might be up to mischief, or claim that he sent a transaction (and show the transaction ID as proof), and claim that the receiver (maybe an exchange) is not depositing the right amount.
What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. 


The fact that the receiver wouldn't treat the result as a valid payment.

This is no different from them sending the right amount to the wrong address.