npub1gy…dvff7

Last Notes

2023-06-07 23:20:06 GMT

- reply

📅 Original date posted:2023-03-30
🗒️ Summary of this message: Bitcoin should not add functionality to support private businesses relying on on-chain storage. Such businesses contribute little fees and increase costs for node operators.
📝 Original message:Hi alicexbtc,
Under no circumstance should Bitcoin add any functionality intended to
support private businesses that rely on on-chain storage for their business
model.
Regarding “Fees paid: 150 BTC” (uh, *citation needed*):
To optimize for profitability a business would generally attempt to operate
using zero- or low-fee transactions. Therefore they tend to contribute
comparatively little fees but are depriving public use of these cheap
transactions. Worse, they exert a constant upward pressure on fee levels,
making it more expensive for everyone else to transact.
Unlike miners, node operators do not receive any compensation. They however
incur additional cost for bandwidth, electricity and processing time to not
only support some current business but all businesses in the past that ever
tried to turn a profit at their expense, so also after such business failed
and has been long gone. They foot the bill.
Lastly, I don’t believe there is any value in having for instance Ordinals
spam the blockchain with images of wojaks, bored apes and other crap but
perhaps you wish to clarify why this might be something to be “excited
about”.
Your other arguments are nonsensical so excuse me for ignoring them.
Zac
On Thu, 30 Mar 2023 at 03:57, alicexbt <alicexbt at protonmail.com> wrote:
> Hi Zac,
>
> Let me share what those parasites achieved:
>
> - Fees paid: 150 BTC
> - Lot of users and developers trying bitcoin that either never tried or
> gave up early in 2013-15
> - Mempools of nodes of being busy on weekends and got lots of transactions
> - PSBT became cool and application devs are trying their best to use it in
> different ways
> - Some developers exploring taproot and multisig
> - AJ shared things how covenants could help in fair, non-custodial,
> on-chain auction of ordinals that is MEV resistant although I had shared it
> earlier which involves more steps:
> https://twitter.com/1440000bytes/status/1634368411760476161
> - Investors exploring about funding projects
> - Bitcoin more than Bitcoin and people excited about it
>
> We can have difference of opinion, however I want bitcoin to be money and
> money means different things for people in this world. Please respect that
> else it will become like Linux, something used by 1% of world.
>
> /dev/fd0
> floppy disk guy
>
> Sent with Proton Mail secure email.
>
> ------- Original Message -------
> On Wednesday, March 29th, 2023 at 12:40 PM, Zac Greenwood via bitcoin-dev <
> bitcoin-dev at lists.linuxfoundation.org> wrote:
>
>
> > I’m not sure why any effort should be spent on theorizing how new
> opcodes might be used to facilitate parasitical use cases of the blockchain.
> >
> > If anything, business models relying on the ability to abuse the
> blockchain as a data store must be made less feasible, not more.
> >
> > Zac
> >
> >
> > On Fri, 24 Mar 2023 at 20:10, Anthony Towns via bitcoin-dev <
> bitcoin-dev at lists.linuxfoundation.org> wrote:
> >
> > > On Tue, Mar 07, 2023 at 10:45:34PM +1000, Anthony Towns via
> bitcoin-dev wrote:
> > > > I think there are perhaps four opcodes that are interesting in this
> class:
> > > >
> > > > idx sPK OP_FORWARD_TARGET
> > > > -- sends the value to a particular output (given by idx), and
> > > > requires that output have a particular scriptPubKey (given
> > > > by sPK).
> > > >
> > > > idx [...] n script OP_FORWARD_LEAF_UPDATE
> > > > -- sends the value to a particular output (given by idx), and
> > > > requires that output to have almost the same scriptPubKey as this
> > > > input, _except_ that the current leaf is replaced by "script",
> > > > with that script prefixed by "n" pushes (of values given by [...])
> > > >
> > > > idx OP_FORWARD_SELF
> > > > -- sends the value to a particular output (given by idx), and
> > > > requires that output to have the same scriptPubKey as this input
> > > >
> > > > amt OP_FORWARD_PARTIAL
> > > > -- modifies the next OP_FORWARD_* opcode to only affect "amt",
> > > > rather than the entire balance. opcodes after that affect the
> > > > remaining balance, after "amt" has been subtracted. if "amt" is
> > > > 0, the next OP_FORWARD_* becomes a no-op.
> > >
> > > The BIP 345 draft has been updated [0] [1] and now pretty much defines
> > > OP_VAULT to have the behaviour specced for OP_FORWARD_LEAF_UPDATE
> above,
> > > and OP_VAULT_RECOVER to behave as OP_FORWARD_TARGET above. Despite
> > > that, for this email I'm going to continue using the OP_FORWARD_*
> > > naming convention.
> > >
> > > Given the recent controversy over the Yuga labs ordinal auction [2],
> > > perhaps it's interesting to consider that these proposed opcodes come
> > > close to making it possible to do a fair, non-custodial, on-chain
> auction
> > > of ordinals [3].
> > >
> > > The idea here is that you create a utxo on chain that contains the
> ordinal
> > > in question, which commits to the address of the current leading
> bidder,
> > > and can be spent in two ways:
> > >
> > > 1) it can be updated to a new bidder, if the bid is raised by at least
> > > K satoshis, in which case the previous bidder is refunded their
> > > bid; or,
> > >
> > > 2) if there have been no new bids for a day, the current high bidder
> > > wins, and the ordinal is moved to their address, while the funds
> > > from their winning bid are sent to the original vendor's address.
> > >
> > > I believe this can be implemented in script as follows,
> > > assuming the opcodes OP_FORWARD_TARGET(OP_VAULT_RECOVER),
> > > OP_FORWARD_LEAF_UPDATE(OP_VAULT), OP_FORWARD_PARTIAL (as specced
> above),
> > > and OP_PUSHCURRENTINPUTINDEX (as implemented in liquid/elements [4])
> > > are all available.
> > >
> > > First, figure out the parameters:
> > >
> > > * Set VENDOR to the scriptPubKey corresponding to the vendor's address.
> > > * Set K to the minimum bid increment [5].
> > > * Initially, set X equal to VENDOR.
> > > * Initially, set V to just below the reserve price (V+K is the
> > > minimum initial bid).
> > >
> > > Then construct the following script:
> > >
> > > [X] [V] [SSS] TOALT TOALT TOALT
> > > 0 PUSHCURRENTINPUTINDEX EQUALVERIFY
> > > DEPTH NOT IF
> > > 0 10000 FORWARD_PARTIAL
> > > 0 FROMALT FORWARD_TARGET
> > > 1 [VENDOR] FWD_TARGET
> > > 144
> > > ELSE
> > > FROMALT SWAP TUCK FROMALT
> > > [K] ADD GREATERTHANOREQUAL VERIFY
> > > 1 SWAP FORWARD_TARGET
> > > DUP FORWARD_PARTIAL
> > > 0 ROT ROT
> > > FROMALT DUP 3 SWAP FORWARD_LEAF_UPDATE
> > > 0
> > > ENDIF
> > > CSV
> > > 1ADD
> > >
> > > where "SSS" is a pushdata of the rest of the script ("TOALT TOALT TOALT
> > > .. 1ADD").
> > >
> > > Finally, make that script the sole tapleaf, accompanied by a NUMS point
> > > as the internal public key, calculate the taproot address corresponding
> > > to that, and send the ordinal to that address as the first satoshi.
> > >
> > > There are two ways to spend that script. With an empty witness stack,
> > > the following will be executed:
> > >
> > > [X] [V] [SSS] TOALT TOALT TOALT
> > > -- altstack now contains [SSS V X]
> > > 0 PUSHCURRENTINPUTINDEX EQUALVERIFY
> > > -- this input is the first, so the ordinal will move to the first
> > > output
> > > DEPTH NOT IF
> > > -- take this branch: the auction is over!
> > > 1 [VENDOR] FWD_TARGET
> > > -- output 1 gets the entire value of this input, and pays to
> > > the vendor's hardcoded scriptPubKey
> > > 0 10000 FORWARD_PARTIAL
> > > 0 FROMALT FORWARD_TARGET
> > > -- we forward at least 10k sats to output 0 (if there were 0 sats,
> > > the ordinal would end up in output 1 instead, which would be a
> > > bug), and output 0 pays to scriptPubKey "X"
> > > 144
> > > ELSE .. ENDIF
> > > -- skip over the other branch
> > > CSV
> > > -- check that this input has baked for 144 blocks (~1 day)
> > > 1ADD
> > > -- leave 145 on the stack, which is true. success!
> > >
> > > Alternatively, if you want to increase the bid you provide a stack with
> > > two items: your scriptPubKey and the new bid [X' V']. Execution this
> > > time looks like:
> > >
> > > [X] [V] [SSS] TOALT TOALT TOALT
> > > -- stack contains [X' V'], altstack now contains [SSS V X]
> > > 0 PUSHCURRENTINPUTINDEX EQUALVERIFY
> > > -- this input is the first, so the ordinal will move to the first
> > > output
> > > DEPTH NOT IF ... ELSE
> > > -- skip over the other branch (without violating minimalif rules)
> > > FROMALT SWAP TUCK FROMALT
> > > -- stack contains [X' V' X V' V], altstack contains [SSS]
> > > [K] ADD GREATERTHANOREQUAL VERIFY
> > > -- check V' >= V+K, stack contains [X' V' X]
> > > 1 SWAP FORWARD_TARGET
> > > -- output 1 pays to X (previous bidder's scriptPubKey), and the
> > > entire value of this input goes there; stack contains [X' V']
> > > DUP FORWARD_PARTIAL
> > > -- execute "V' FORWARD_PARTIAL", stack contains [X' V']
> > > 0 ROT ROT
> > > -- stack contains [0 X' V']
> > > FROMALT DUP 3 SWAP FORWARD_LEAF_UPDATE
> > > -- execute "0 X' V' SSS 3 SSS FORWARD_LEAF_UPDATE" which checks
> > > that output 0 spends at least V' satoshis back to the same
> > > script (because that's how we defined SSS), except the first
> > > three pushes (previously X V SSS) are replaced by X' V' SSS.
> > > 0
> > > ENDIF
> > > CSV
> > > -- "0 CSV" requires nSequnce to be set, which makes the tx rbf'able,
> > > which hopefully makes it harder to pin
> > > 1ADD
> > > -- ends with 1 on the stack; success!
> > >
> > > (The "SSS n SSS FORWARD_LEAF_UPDATE" construct is more or less a quine,
> > > ie a program that outputs its own source code)
> > >
> > > I think that script is about 211 witness bytes, with an additional 40
> > > witness bytes for X'/V', so when making a bid, your tx would be
> > > something like:
> > >
> > > tx header, 10vb
> > > input 0: 103vb for the old bid including witness and control block
> > > input 1: 58vb for a taproot key path spend
> > > output 0: 43vb for the new bid
> > > output 1: 43vb for your change
> > >
> > > for a total of about 257vb -- slightly larger than a regular 2-in-2-out
> > > transaction, but not terribly much. Mostly because input 0 doesn't
> require
> > > a signature -- it's size is effectively 6 pubkeys: X, X' VENDOR twice,
> > > and the script code twice, along with a little extra to encode the
> > > various numbers (10000, 144, K, V, V').
> > >
> > > This approach seems pretty "MEV" resistant: you pay fees via input 1 if
> > > your bid succeeds; if it doesn't, you don't pay any fees. A potential
> > > scalper might want to put in an early low ball bid, then prevent
> > > higher bidders from winning the auction, take control of the ordinal,
> > > and resell it later, but unless they can prevent another miner from
> > > mining alternative bids for 144 blocks, they will fail at that. The bid
> > > is fixed by the bidder and committed to by the signature on input 1, so
> > > frontrunning a bid can't do anything beyond invalidate the bid
> entirely.
> > >
> > > Obviously, this is a pretty limited auction mechanism in various ways;
> > > eg maybe you'd rather specify K as a percentage than an absoute
> increment;
> > > maybe you'd like to have the auction definitely finish by some
> particular
> > > time; maybe you'd like to be able to have the auction be able to
> continue
> > > above 21.47 BTC (2**31 sats); maybe you'd like to do a dutch auction
> > > rather than an english auction. I think you can probably do all those
> > > things with this set of opcodes and clever scripting, though it
> probably
> > > gets ugly.
> > >
> > > I don't think this is easily extensible to taro or rgb style assets,
> > > as rather than being able to ensure the asset is transferred by
> > > controlling the input/output positions, I think you'd need to build
> > > up merkle trees and do point tweaks beyond what's supported by
> > > OP_FORWARD_LEAF_UPDATE/OP_VAULT. Of course, without something like
> > > OP_PUSHCURRENTINPUTINDEX I don't think you could do it for ordinals
> > > either.
> > >
> > > Cheers,
> > > aj
> > >
> > > [0]
> https://github.com/bitcoin/bips/blob/7f747fba82675f28c239df690a07b75529bd0960/bip-0345.mediawiki
> > >
> > > [1] https://twitter.com/jamesob/status/1639019107432513537
> > >
> > > [2]
> https://cointelegraph.com/news/scammers-dream-yuga-s-auction-model-for-bitcoin-nfts-sees-criticism
> > >
> > > [3] Inscriptions remain a wasteful way of publishing/committing
> > > to content, however!
> > >
> > > [4]
> https://github.com/ElementsProject/elements/blob/master/doc/tapscript_opcodes.md
> > >
> > > [5] Setting K too low probably invites griefing, where a bidder may be
> > > able to use rbf pinning vectors to prevent people who would be willing
> > > to bid substantially higher from getting their bid confirmed on
> > > chain.
> > > _______________________________________________
> > > bitcoin-dev mailing list
> > > bitcoin-dev at lists.linuxfoundation.org
> > > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20230330/00fa836d/attachment-0001.html>

2023-06-07 23:07:50 GMT

- reply

📅 Original date posted:2022-04-22
📝 Original message:On Fri, 22 Apr 2022 at 09:56, Keagan McClelland via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:
> I think that trying to find ways to activate non-invasive changes should
> be everyone's goal, *even if* they personally may not have an immediate use
> case
>
A change that increases the number of use cases of Bitcoin affects all
users and is *not* non-invasive. More use cases means more blockchain usage
which increases the price of a transaction for *everyone*.
I like the maxim of Peter Todd: any change of Bitcoin must benefit *all*
users. This means that every change must have well-defined and transparent
benefits. Personally I believe that the only additions to the protocol that
would still be acceptable are those that clearly benefit layer 2 solutions
such as LN *and* do not carry the dangerous potential of getting abused by
freeloaders selling commercial services on top of “free” eternal storage on
the blockchain.
Zac
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20220422/0fd0ef11/attachment.html>

2023-06-07 22:57:26 GMT

- reply

📅 Original date posted:2021-08-05
📝 Original message:Hi Billy,
> It sounds like you're proposing an opcode
No. I don’t have enough knowledge of Bitcoin to be able to tell how (and
if) rate-limiting can be implemented as I suggested. I am not able to
reason about opcodes, so I kept my description at a more functional level.
> I still don't understand why its useful to specify those as absolute
block heights
I feel that this a rather uninteresting data representation aspect that’s
not worth going back and forth about. Sure, specifying the length of the
epoch may also be an option, although at the price of giving up some
functionality, and without much if any gains.
By explicitly specifying the start and end block of an epoch, the user has
more flexibility in shifting the epoch (using alternate values for
epochStart and epochEnd) and simultaneously increasing the length of an
epoch. These seem rather exotic features, but there’s no harm in retaining
them.
> if you have a UTXO encumbered by rateLimit(epochStart = 800100, epochEnd
= 800200, limit = 100k, remain = 100k), what happens if you don't spend
that UTXO before block 800200?
The rate limit remains in place. So if this UTXO is spent in block 900000,
then at most 100k may be spent. Also, the new epoch must be at least 100
blocks and remain must correctly account for the actual amount spent.
> This is how I'd imagine creating an opcode like this:
> rateLimit(windowSize = 144 blocks, limit = 100k sats)
This would require the system to bookkeep how much was spent since the
first rate-limited output. It is a more intuitive way of rate-limiting but
it may be much more difficult to implement, which is why I went with the
epoch-based rate limiting solution. In terms of functionality, I believe
the two solutions are nearly identical for all practical purposes.
Your next section confuses me. As I understand it, using an address as
input for a transaction will always spends the full amount at that address.
That’s why change addresses are required, no? If Bitcoin were able to pay
exact amounts then there wouldn’t be any need for change outputs.
Zac
On Thu, 5 Aug 2021 at 08:39, Billy Tetrud <billy.tetrud at gmail.com> wrote:
> > A maximum amount is allowed to be spent within EVERY epoch.
>
> It sounds like you're proposing an opcode that takes in epochStart and
> epochEnd as parameters. I still don't understand why its useful to specify
> those as absolute block heights. You mentioned that this enables more
> straightforward validation logic, but I don't see how. Eg, if you have a
> UTXO encumbered by rateLimit(epochStart = 800100, epochEnd = 800200, limit
> = 100k, remain = 100k), what happens if you don't spend that UTXO before
> block 800200? Is the output no longer rate limited then? Or is the opcode
> calculating 800200-800100 = 100 and applying a rate limit for the next
> epoch? If the first, then the UTXO must be spent within one epoch to remain
> rate limited. If the second, then it seems nearly identical to simply
> specifying window=100 as a parameter instead of epochStart and epochEnd.
>
> > then there must be only a single (rate-limited) output
>
> This rule would make transactions tricky if you're sending money into
> someone else's wallet that may be rate limited. If the requirement is that
> only you yourself can send money into a rate limited wallet, then this
> point is moot but it would be ideal to not have such a requirement.
>
> This is how I'd imagine creating an opcode like this:
>
> rateLimit(windowSize = 144 blocks, limit = 100k sats)
>
> This would define that the epoch is 1 day's worth of blocks. This would
> evenly divide bitcoin's retarget period and so each window would start and
> end at those dividing lines (eg the first 144 blocks of the retargetting
> period, then the second, then the third, etc).
>
> When this output is spent, it ensures that there's a maximum of 100k sats
> is sent to addresses other than the originating address. It also records
> the amount spent in the current 144 block window for that address (eg by
> simply recording the already-spent amount on the resulting UTXO and having
> an index that allows looking up UTXOs by address and adding them up). That
> way, when any output from that address is spent again, if a new 144 block
> window has started, the limit is reset, but if its still within the same
> window, the already-spent amounts for UTXOs from that address are added up
> and subtracted from the limit, and that number is the remaining limit a
> subsequent transaction needs to adhere to.
>
> This way, 3rd party could send transactions into an address like this, and
> multiple outputs can be combined and used to spend to arbitrary outputs (up
> to the rate limit of course).
>
> On Wed, Aug 4, 2021 at 3:48 AM Zac Greenwood <zachgrw at gmail.com> wrote:
>
>> > Ah I see, this is all limited to within a single epoch.
>>
>> No, that wouldn't be useful. A maximum amount is allowed to be spent
>> within EVERY epoch.
>>
>> Consider an epoch length of 100 blocks with a spend limit of 200k per
>> epoch. The following is allowed:
>>
>> epoch1 (800101 - 800200): spend 120k in block 800140. Remaining for
>> epoch1: 80k;
>> epoch1 (800101 - 800200): spend another 60k in block 800195. Remaining
>> for epoch1: 20k;
>> epoch2 (800201 - 800300): spend 160k in block 800201. Remaining for
>> epoch2: 40k.
>>
>> Since the limit pertains to each individual epoch, it is allowed to spend
>> up to the full limit at the start of any new epoch. In this example, the
>> spending was as follows:
>>
>> 800140: 120k
>> 800195: 60k
>> 800201: 160k.
>>
>> Note that in a span of 62 blocks a total of 340k sats was spent. This may
>> seem to violate the 200k limit per 100 blocks, but this is the result of
>> using a per-epoch limit. This allows a maximum of 400k to be spent in 2
>> blocks llke so: 200k in the last block of an epoch and another 200k in the
>> first block of the next epoch. However this is inconsequential for the
>> intended goal of rate-limiting which is to enable small spends over time
>> from a large amount and to prevent theft of a large amount with a single
>> transaction.
>>
>> To explain the proposed design more clearly, I have renamed the params as
>> follows:
>>
>> epochStart: block height of first block of the current epoch (was: h0);
>> epochEnd: block height of last block of the current epoch (was: h1);
>> limit: the maximum total amount allowed to be spent within the current
>> epoch (was: a);
>> remain: the remaining amount allowed to be spent within the current epoch
>> (was: a_remaining);
>>
>> Also, to illustrate that the params are specific to a transaction, I will
>> hence precede the param with the transaction name like so:
>> tx8_limit, tx31c_remain, tx42z_epochStart, ... etc.
>>
>> For simplicity, only transactions with no more than one rate-limited
>> input are considered, and with no more than two outputs: one rate-limited
>> change output, and a normal (not rate-limited) output.
>>
>> Normally, a simple transaction generates two outputs: one for a payment
>> to a third party and one for the change address. Again for simplicity, we
>> demand that a transaction which introduces rate-limiting must have only a
>> single, rate-limited output. The validation rule might be: if a transaction
>> has rate-limiting params and none of its inputs are rate-limited, then
>> there must be only a single (rate-limited) output (and no second or change
>> output).
>>
>> Consider rate limiting transactions tx1 having one or more normal (non
>> rate-limited) inputs:
>>
>> tx1 gets included at block height 800004;
>> The inputs of tx1 are not rate-limited => tx1 must have only a single
>> output which will become rate-limited;
>> params: tx1_epochStart=800001, tx1_epochEnd=800100, tx1_limit=200k,
>> tx1_remain=200k;
>> => This defines that an epoch has 100 blocks and no more than 200k sats
>> may be spent in any one epoch. Within the current epoch, 200k sats may
>> still be spent.
>>
>> This transaction begins to rate-limit a set of inputs, so it has a single
>> rate-limited output.
>> Let's explore transactions that have the output of tx1 as their input. I
>> will denote the output of tx1 as "out1".
>>
>> tx2a has out1 as its only input;
>> tx2a spends 50k sats and gets included at block height 803050;
>> tx2a specifies the following params for its change output "chg2a":
>> chg2a_epochStart=803001, chg2a_epochEnd=803100;
>> chg2a_limit=200k, chg2a_remain=150k.
>>
>> To enforce rate-limiting, the system must validate the params of the
>> change output chg2a to ensure that overspending is not allowed.
>>
>> The above params are allowed because:
>> => 1. the epoch does not become smaller than 100 blocks [(chg2a_epochEnd
>> - chg2a_epochStart) >= (tx1_epochEnd - tx1_epochStart)]
>> => 2. tx1_limit has not been increased (ch2a_limit <= tx1_limit)
>> => 3. the amount spent (50k sats) does not exceed tx1_remain AND does not
>> exceed chg2a_limit;
>> => 4. chg2a_remain" is 50k sats less than chg2a_limit.
>>
>> A transaction may also further constrain further spending like so:
>>
>> tx2b has out1as its only input;
>> tx2b spends 8k sats and gets included at block height 808105;
>> tx2b specifies the following params for its change output "chg2b":
>> chg2b_epochStart=808101, chg2b_epochEnd=808250;
>> chg2b_limit=10k, chg2b_remain=0.
>>
>> These params are allowed because:
>> => 1. the epoch does not become smaller than100 blocks. It is fine to
>> increase the epoch to 150 blocks because it does not enable exceeding the
>> original rate-limit;
>> => 2. the limit (chg2b_limit) has been decreased to 10k sats, further
>> restricting the maximum amount allowed to be spent within the current and
>> any subsequent epochs;
>> => 3. the amount spent (10k sats) does not exceed tx1_remain AND does not
>> exceed chg2b_limit;
>> => 4. chg2b_remain has been set to zero, meaning that within the current
>> epoch (block height 808101 to and including 808250), tx2b cannot be used as
>> a spending input to any transaction.
>>
>> Starting from block height 808251, a new epoch will start and the
>> rate-limited output of tx2b may again be used as an input for a subsequent
>> rate-limited transaction tx3b. This transaction tx3b must again be
>> accompanied by params that do not violate the rate-limit as defined by the
>> params of tx2b and which are stored with output out2b. So, the epoch of
>> tx3b must be at minimum 150 blocks, the maximum that is allowed to be spent
>> per epoch is at most 10k sats, and chg3b_remain must be decreased by at
>> least the amount spent by tx3b.
>>
>> From the above, the rate-limiting mechanics should hopefully be clear and
>> full set of validation rules could be defined in a more generalized way
>> with little additional effort.
>>
>> Note that I conveniently avoided talking about how to represent the
>> parameters within transactions or outputs, simply because I currently lack
>> enough understanding to reason about this. I am hoping that others may
>> offer help.
>>
>> Zac
>>
>>
>> On Tue, Aug 3, 2021 at 8:12 PM Billy Tetrud <billy.tetrud at gmail.com>
>> wrote:
>>
>>> > To enable more straightforward validation logic.
>>> > within the current epoch
>>>
>>> Ah I see, this is all limited to within a single epoch. I think that
>>> sufficiently limits the window of time in which nodes have to store
>>> information for rate limited outputs. However, I don't see how specifying
>>> block ranges simplifies the logic - wouldn't this complicate the logic with
>>> additional user-specified constraints? It also prevents the output from
>>> being able to be rate limited over the span of multiple epochs, which would
>>> seem to make it a lot more difficult to use for certain types of wallets
>>> (eg cold wallets).
>>>
>>> I think I see the logic of your 'remaining' parameter there. If you
>>> start with a single rate-limited input, you can split that into many
>>> outputs, only one of which have a 'remaining' balance. The rest can simply
>>> remain unspendable for the rest of the epoch. That way these things don't
>>> need to be tied together. However, that doesn't solve the problem of 3rd
>>> parties being able to send money into the wallet.
>>>
>>> > I don't believe that the marginal added functionality would justify
>>> the increased implementation complexity
>>>
>>> Perhaps, but I think there is a lot of benefit in allowing these kinds
>>> of things to operate as similarly as possible to normal transactions, for
>>> one because of usability reasons. If each opcode has its own quirks that
>>> are not intuitively related to their purpose (eg if a rate-limited wallet
>>> had no way to get a receiving address), it would confuse end-users (eg who
>>> wonder how to get a receiving address and how they can ask people to send
>>> money into their wallet) or require a lot of technical complexity in
>>> applications (eg to support something like cooperatively connecting with
>>> their wallet so that a transaction can be made that creates a new
>>> single-output for the wallet). A little complexity in this opcode can save
>>> a lot of external complexity here I think.
>>>
>>> > my understanding of Bitcoin is way too low to be able to write a BIP
>>> and do the implementation
>>>
>>> You might be able to find people willing to help. I would be willing to
>>> help write the BIP spec. I'm not the right person to help with the
>>> implementation, but perhaps you could find someone else who is. Even if the
>>> BIP isn't adopted, it could be a starting point or inspiration for someone
>>> else to write an improved version.
>>>
>>> On Mon, Aug 2, 2021 at 2:32 AM Zac Greenwood <zachgrw at gmail.com> wrote:
>>>
>>>> [Note: I've moved your reply to the newly started thread]
>>>>
>>>> Hi Billy,
>>>>
>>>> Thank you for your kind and encouraging feedback.
>>>>
>>>> I don't quite understand why you'd want to define a specific span of
>>>>> blocks for the rate limit. Why not just specify the size of the window (in
>>>>> blocks) to rate limit within, and the limit?
>>>>
>>>>
>>>> To enable more straightforward validation logic.
>>>>
>>>> You mentioned change addresses, however, with the parameters you
>>>>> defined, there would be no way to connect together the change address with
>>>>> the original address, meaning they would have completely separate rate
>>>>> limits, which wouldn't work since the change output would ignore the
>>>>> previous rate limit.
>>>>
>>>>
>>>> The rate-limiting parameters must be re-specified for each rate-limited
>>>> input. So, a transaction that has a rate-limited input is only valid if its
>>>> output is itself rate-limited such that it does not violate the
>>>> rate-limiting constraints of its input.
>>>>
>>>> In my thread-starter, I gave the below example of a rate-limited
>>>> address a2 that serves as input for transaction t2:
>>>>
>>>> a2: 99.8 sats at height 800100;
>>>> Rate-limit params: h0=800000, h1=800143, a=500k, a_remaining=300k;
>>>>
>>>> Transaction t2:
>>>> Included at block height 800200
>>>> Spend: 400k + fees.
>>>> Rate-limiting params: h0=800144, h1=800287, a=500k, a_remaining=100k.
>>>>
>>>> Note how transaction t2 re-specifies the rate-limiting parameters.
>>>> Validation must ensure that the re-specified parameters are within bounds,
>>>> i.e., do not allow more spending per epoch than the rate-limiting
>>>> parameters of its input address a2. Re-specifying the rate-limiting
>>>> parameters offers the flexibility to further restrict spending, or to
>>>> disable any additional spending within the current epoch by setting
>>>> a_remaining to zero.
>>>>
>>>> Result:
>>>> Value at destination address: 400k sats;
>>>> Rate limiting params at destination address: none;
>>>> Value at change address a3: 99.4m sats;
>>>> Rate limiting params at change address a3: h0=800144, h1=800287,
>>>> a=500k, a_remaining=100k.
>>>>
>>>> As a design principle I believe it makes sense if the system is able to
>>>> verify the validity of a transaction without having to consider any
>>>> transactions that precede its inputs. As a side-note, doing away with this
>>>> design principle would however enable more sophisticated rate-limiting
>>>> (such as rate-limiting per sliding window instead of rate-limiting per
>>>> epoch having a fixed start and end block), but while at the same time
>>>> reducing the size of per rate-limiting transaction (because it would enable
>>>> specifying the rate-limiting parameters more space-efficiently). To test
>>>> the waters and to keep things relatively simple, I chose not to go into
>>>> this enhanced form of rate-limiting.
>>>>
>>>> I haven't gone into how to process a transaction having multiple
>>>> rate-limited inputs. The easiest way to handle this case is to not allow
>>>> any transaction having more than one rate-limited input. One could imagine
>>>> complex logic to handle transactions having multiple rate-limited inputs by
>>>> creating multiple rate-limited change addresses. However at first glance I
>>>> don't believe that the marginal added functionality would justify the
>>>> increased implementation complexity.
>>>>
>>>> I'd be interested in seeing you write a BIP for this.
>>>>
>>>>
>>>> Thank you, but sadly my understanding of Bitcoin is way too low to be
>>>> able to write a BIP and do the implementation. However I see tremendous
>>>> value in this functionality. Favorable feedback of the list regarding the
>>>> usefulness and the technical feasibility of rate-limiting functionality
>>>> would of course be an encouragement for me to descend further down the
>>>> rabbit hole.
>>>>
>>>> Zac
>>>>
>>>>
>>>> On Sun, Aug 1, 2021 at 10:09 AM Zac Greenwood <zachgrw at gmail.com>
>>>> wrote:
>>>>
>>>>> [Resubmitting to list with minor edits. My previous submission ended
>>>>> up inside an existing thread, apologies.]
>>>>>
>>>>> Hi list,
>>>>>
>>>>> I'd like to explore whether it is feasible to implement new scripting
>>>>> capabilities in Bitcoin that enable limiting the output amount of a
>>>>> transaction based on the total value of its inputs. In other words, to
>>>>> implement the ability to limit the maximum amount that can be sent from an
>>>>> address.
>>>>>
>>>>> Two use cases come to mind:
>>>>>
>>>>> UC1: enable a user to add additional protection their funds by
>>>>> rate-limiting the amount that they are allowed to send during a certain
>>>>> period (measured in blocks). A typical use case might be a user that
>>>>> intends to hodl their bitcoin, but still wishes to occasionally send small
>>>>> amounts. Rate-limiting avoids an attacker from sweeping all the users'
>>>>> funds in a single transaction, allowing the user to become aware of the
>>>>> theft and intervene to prevent further thefts.
>>>>>
>>>>> UC2: exchanges may wish to rate-limit addresses containing large
>>>>> amounts of bitcoin, adding warm- or hot-wallet functionality to a
>>>>> cold-storage address. This would enable an exchange to drastically reduce
>>>>> the number of times a cold wallet must be accessed with private keys that
>>>>> give access to the full amount.
>>>>>
>>>>> In a typical setup, I'd envision using multisig such that the user has
>>>>> two sets of private keys to their encumbered address (with a "set" of keys
>>>>> meaning "one or more" keys). One set of private keys allows only for
>>>>> sending with rate-limiting restrictions in place, and a second set of
>>>>> private keys allowing for sending any amount without rate-limiting,
>>>>> effectively overriding such restriction.
>>>>>
>>>>> The parameters that define in what way an output is rate-limited might
>>>>> be defined as follows:
>>>>>
>>>>> Param 1: a block height "h0" indicating the first block height of an
>>>>> epoch;
>>>>> Param 2: a block height "h1" indicating the last block height of an
>>>>> epoch;
>>>>> Param 3: an amount "a" in satoshi indicating the maximum amount that
>>>>> is allowed to be sent in any epoch;
>>>>> Param 4: an amount "a_remaining" (in satoshi) indicating the maximum
>>>>> amount that is allowed to be sent within the current epoch.
>>>>>
>>>>> For example, consider an input containing 100m sats (1 BTC) which has
>>>>> been rate-limited with parameters (h0, h1, a, a_remaining) of (800000,
>>>>> 800143, 500k, 500k). These parameters define that the address is
>>>>> rate-limited to sending a maximum of 500k sats in the current epoch that
>>>>> starts at block height 800000 and ends at height 800143 (or about one day
>>>>> ignoring block time variance) and that the full amount of 500k is still
>>>>> sendable. These rate-limiting parameters ensure that it takes at minimum
>>>>> 100m / 500k = 200 transactions and 200 x 144 blocks or about 200 days to
>>>>> spend the full 100m sats. As noted earlier, in a typical setup a user
>>>>> should retain the option to transact the entire amount using a second (set
>>>>> of) private key(s).
>>>>>
>>>>> For rate-limiting to work, any change output created by a transaction
>>>>> from a rate-limited address must itself be rate-limited as well. For
>>>>> instance, expanding on the above example, assume that the user spends 200k
>>>>> sats from a rate-limited address a1 containing 100m sats:
>>>>>
>>>>> Start situation:
>>>>> At block height 800000: rate-limited address a1 is created;
>>>>> Value of a1: 100.0m sats;
>>>>> Rate limiting params of a1: h0=800000, h1=800143, a=500k,
>>>>> a_remaining=500k;
>>>>>
>>>>> Transaction t1:
>>>>> Included at block height 800100;
>>>>> Spend: 200k + fee;
>>>>> Rate limiting params: h0=800000, h1=800143, a=500k, a_remaining=300k.
>>>>>
>>>>> Result:
>>>>> Value at destination address: 200k sats;
>>>>> Rate limiting params at destination address: none;
>>>>> Value at change address a2: 99.8m sats;
>>>>> Rate limiting params at change address a2: h0=800000, h1=800143,
>>>>> a=500k, a_remaining=300k.
>>>>>
>>>>> In order to properly enforce rate limiting, the change address must be
>>>>> rate-limited such that the original rate limit of 500k sats per 144 blocks
>>>>> cannot be exceeded. In this example, the change address a2 were given the
>>>>> same rate limiting parameters as the transaction that served as its input.
>>>>> As a result, from block 800100 up until and including block 800143, a
>>>>> maximum amount of 300k sats is allowed to be spent from the change address.
>>>>>
>>>>> Example continued:
>>>>> a2: 99.8 sats at height 800100;
>>>>> Rate-limit params: h0=800000, h1=800143, a=500k, a_remaining=300k;
>>>>>
>>>>> Transaction t2:
>>>>> Included at block height 800200
>>>>> Spend: 400k + fees.
>>>>> Rate-limiting params: h0=800144, h1=800287, a=500k, a_remaining=100k.
>>>>>
>>>>> Result:
>>>>> Value at destination address: 400k sats;
>>>>> Rate limiting params at destination address: none;
>>>>> Value at change address a3: 99.4m sats;
>>>>> Rate limiting params at change address a3: h0=800144, h1=800287,
>>>>> a=500k, a_remaining=100k.
>>>>>
>>>>> Transaction t2 is allowed because it falls within the next epoch
>>>>> (running from 800144 to 800287) so a spend of 400k does not violate the
>>>>> constraint of 500k per epoch.
>>>>>
>>>>> As could be seen, the rate limiting parameters are part of the
>>>>> transaction and chosen by the user (or their wallet). This means that the
>>>>> parameters must be validated to ensure that they do not violate the
>>>>> intended constraints.
>>>>>
>>>>> For instance, this transaction should not be allowed:
>>>>> a2: 99.8 sats at height 800100;
>>>>> Rate-limit params of a2: h0=800000, h1=800143, a=500k,
>>>>> a_remaining=300k;
>>>>>
>>>>> Transaction t2a:
>>>>> Included at block height 800200;
>>>>> Spend: 400k + fees;
>>>>> Rate-limit params: h0=800124, h1=800267, a=500k, a_remaining=100k.
>>>>>
>>>>> This transaction t2a attempts to shift the epoch forward by 20 blocks
>>>>> such that it starts at 800124 instead of 800144. Shifting the epoch forward
>>>>> like this must not be allowed because it enables spending more that the
>>>>> rate limit allows, which is 500k in any epoch of 144 blocks. It would
>>>>> enable overspending:
>>>>>
>>>>> t1: spend 200k at 800100 (epoch 1: total: 200k);
>>>>> t2a: spend 400k at 800200 (epoch 2: total: 400k);
>>>>> t3a: spend 100k at 800201 (epoch 2: total: 500k);
>>>>> t4a: spend 500k at 800268 (epoch 2: total: 1000k, overspending for
>>>>> epoch 2).
>>>>>
>>>>> Specifying the rate-limiting parameters explicitly at every
>>>>> transaction allows the user to tighten the spending limit by setting
>>>>> tighter limits or for instance by setting a_remainder to 0 if they wish to
>>>>> enforce not spending more during an epoch. A second advantage of explicitly
>>>>> specifying the four rate-limiting parameters with each transaction is that
>>>>> it allows the system to fully validate the transaction without having to
>>>>> consider any previous transactions within an epoch.
>>>>>
>>>>> I will stop here because I would like to gauge interest in this idea
>>>>> first before continuing work on other aspects. Two main pieces of work jump
>>>>> to mind:
>>>>>
>>>>> Define all validations;
>>>>> Describe aggregate behaviour of multiple (rate-limited) inputs, proof
>>>>> that two rate-limited addresses cannot spend more than the sum of their
>>>>> individual limits.
>>>>>
>>>>> Zac
>>>>>
>>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20210805/55d5d18c/attachment-0001.html>

2023-06-07 22:57:12 GMT

- reply

📅 Original date posted:2021-07-28
📝 Original message:Hi Billy,
Thank you for your comprehensive reply. My purpose was to find out whether
a proposal to somehow limit the amount being sent from an address exists
and to further illustrate my thoughts by giving a concrete example of how
this might work functionally without getting to deep into the
technicalities.
As for your assumption: for an amount limit to have the desired effect, I
realize now that there must also exist some limit on the number of
transactions that will be allowed from the encumbered address.
Taking a step back, a typical use case would be a speculating user
intending to hodl bitcoin but who still wishes to be able to occasionally
transact minor amounts.
Ideally, such user should optionally still be able to bypass the rate limit
and spend the entire amount in a single transaction by signing with an
additional private key (multisig).
During the setup phase, a user sends all their to-be-rate-limited coin to a
single address. When spending from this rate limited address, any change
sent to the change address must be rate limited as well using identical
parameters. I believe that’s also what you’re suggesting.
I believe that a smart wallet should be able to set up and maintain
multiple rate-limited addresses in such a way that their aggregate
behaviour meets any rate-limiting parameters as desired by the user. This
ought to alleviate your privacy concerns because it means that the wallet
will be able to mix outputs.
The options for the to-be implemented rate-limiting parameters vary from
completely arbitrary to more restrictive.
Completely arbitrary parameters would allow users to set up a rate limit
that basically destroys their funds, for instance rate-limiting an address
to an amount of 1 satoshi per 100 blocks.
More restrictive rate limits would remove such footgun and may require that
only a combination of parameters are allowed such that all funds will be
spendable within a set number of blocks (for instance 210,000).
As for the rate-limiting parameters, in addition to a per-transaction
maximum of (minimum amount in satoshi or a percentage of the total amount
stored at the address), also the transaction frequency must be limited. I
would propose this to be expressed as a number of blocks before a next
transaction can be sent from the encumbered address(es).
I believe such user-enabled rate-limiting is superior to one that requires
a third party.
As an aside, I am not sure how a vault solution would be able to prevent an
attacker who is in possession of the vaults’ private key from sabotaging
the user by replacing the user transaction with one having a higher fee
every time the user attempts to transact. I am probably missing something
here though.
Zac
On Tue, 27 Jul 2021 at 19:21, Billy Tetrud <billy.tetrud at gmail.com> wrote:
> Hi Zac,
>
> I haven't heard of any proposal for limiting the amount that can be sent
> from an address. I assume you mean limiting the amount that can be sent in
> a period of time - eg something that would encode that for address A, only
> X bitcoin can be sent from the address in a given day/week/etc, is that
> right? That would actually be a somewhat difficult thing to do in the
> output-based system Bitcoin uses, and would be easier in an account based
> system like Ethereum. The problem is that each output is separate, and
> there's no concept in bitcoin of encumbering outputs together.
>
> What you could do is design a system where coins would be combined in a
> single output, and then encumber that output with a script that allows a
> limited amount of coin be sent to a destination address and requires all
> other bitcoins be returned to sender in a new change output that is also
> timelocked. That way, the new change output can't be used again until the
> timelock expires (eg a week). However, to ensure this wallet works
> properly, any deposit into the wallet would have to also spend the wallet's
> single output, so as to create a new single output at that address. So 3rd
> parties wouldn't be able to arbitrarily send money in (or rather, they
> could, but each output would have its own separate spending limit).
>
> > such kind of restriction would be extremely effective in thwarting the
> most damaging type of theft being the one where all funds are swept in a
> single transaction
>
> It would. However a normal wallet vault basically already has this
> property - a thief can't simply sweep funds instantly, but instead the
> victim will see an initiated transaction and will be able to reverse it
> within a delay time-window. I don't think adding a spending limit would add
> meaningful security to a delayed-send wallet vault like that. But it could
> be used to increase the security of a wallet vault that can be instantly
> spent from - ie if the attacker successfully steals funds, then the victim
> has time to go gather their additional keys and move the remaining
> (unstolen) funds into a new wallet.
>
> OP_CD could potentially be augmented to allow specifying limit amounts for
> each destination, which would allow you to create a wallet like this. It
> would be a bit of an awkward wallet to use tho, since you couldn't receive
> directly into it from a 3rd party and you also couldn't keep separate
> outputs (which is bad for privacy).
>
> An alternate way of doing this that you don't need any new opcodes for
> would be to have a 3rd party service that signs multisig transactions from
> a wallet only up to a limit. The end-user could have additional keys such
> that the 3rd party can't prevent them from accessing that (if they turn
> uncooperative), and the 3rd party would only have a single key so they
> can't steal funds, but the user would sign a transaction with one key, and
> the 3rd party with another as long as the spending limit hasn't been
> reached. This wouldn't have much counterparty risk, but would be a less
> awkward wallet than what I described above - meaning anyone could send
> funds into the wallet without defeating the spending limit, and privacy
> could be kept intact (minus the fact that the 3rd party would know what
> your outputs are).
>
> BT
>
> On Tue, Jul 27, 2021 at 4:18 AM Zac Greenwood <zachgrw at gmail.com> wrote:
>
>> Hi Billy,
>>
>> On the topic of wallet vaults, are there any plans to implement a way to
>> limit the maximum amount to be sent from an address?
>>
>> An example of such limit might be: the maximum amount allowed to send is
>> max(s, p) where s is a number of satoshi and p a percentage of the total
>> available (sendable) amount.
>>
>> A minimum value may be imposed on the percentage to ensure that the
>> address can be emptied within a reasonable number of transactions. The
>> second parameter s allows a minimum permitted amount. (This is necessary
>> because with only the percentage parameter the minimum permitted amount
>> converges to zero, making it impossible to empty the address).
>>
>> There may be other ways too. In my view, such kind of restriction would
>> be extremely effective in thwarting the most damaging type of theft being
>> the one where all funds are swept in a single transaction.
>>
>> Zac
>>
>>
>> On Tue, 27 Jul 2021 at 03:26, Billy Tetrud via bitcoin-dev <
>> bitcoin-dev at lists.linuxfoundation.org> wrote:
>>
>>> Hey James,
>>>
>>> In the examples you mentioned, what I was exploring was a mechanism of
>>> attack by which the attacker could steal user A's key and use that key to
>>> send a transaction with the maximum possible fee. User B would still
>>> receive some funds (probably), but if the fee could be large, the attacker
>>> would either do a lot of damage to user B (griefing) or could make an
>>> agreement with a miner to give back some of the large fee (theft).
>>>
>>> But as for use cases, the proposal mentions a number of use cases
>>> <https://github.com/fresheneesz/bip-efficient-bitcoin-vaults/blob/main/cd/bip-constraindestination.md#motivation> and
>>> most overlap with the use cases of op_ctv <https://utxos.org/uses/> (Jeremy
>>> Rubin's website for op_ctv has a lot of good details, most of which are
>>> also relevant to op_cd). The use case I'm most interested in is wallet
>>> vaults. This opcode can be used to create a wallet vault where the user
>>> only needs to use, for example, 1 key to spend funds, but the attacker must
>>> steal 2 or more keys to spend funds. The benefits of a 2 key wallet vault
>>> like this vs a normal 2-of-2 multisig wallet are that not only does an
>>> attacker have to steal both keys (same level of security), but also the
>>> user can lose one key and still recover their funds (better redundancy) and
>>> also that generally the user doesn't need to access their second key - so
>>> that can remain in a much more secure location (which would also probably
>>> make that key harder to steal). The only time the second key only comes
>>> into play if one key is stolen and the attacker attempts to send a
>>> transaction. At that point, the user would go find and use his second key
>>> (along with the first) to send a revoke transaction to prevent the attacker
>>> from stealing their funds. This is somewhat akin to a lightning watchtower
>>> scenario, where your wallet would watch the chain and alert you about an
>>> unexpected transaction, at which point you'd manually do a revoke (vs a
>>> watchtower's automated response). You might be interested in taking a look
>>> at this wallet vault design
>>> <https://github.com/fresheneesz/bip-efficient-bitcoin-vaults/blob/main/cd/op_cdWalletVault1.md>
>>> that uses OP_CD or even my full vision
>>> <https://github.com/fresheneesz/bip-efficient-bitcoin-vaults> of the
>>> wallet vault I want to be able to create.
>>>
>>> With a covenant opcode like this, its possible to create very usable and
>>> accessible but highly secure wallets that can allow normal people to hold
>>> self custody of their keys without fear of loss or theft and without the
>>> hassle of a lot of safe deposit boxes (or other secure seed storage
>>> locations).
>>>
>>> Cheers,
>>> BT
>>>
>>>
>>>
>>>
>>>
>>> On Mon, Jul 26, 2021 at 2:08 PM James MacWhyte <macwhyte at gmail.com>
>>> wrote:
>>>
>>>> Hi Billy!
>>>>
>>>> See above, but to break down that situation a bit further, these are
>>>>> the two situations I can think of:
>>>>>
>>>>> 1. The opcode limits user/group A to send the output to user/group
>>>>> B
>>>>> 2. The opcode limits user A to send from one address they own to
>>>>> another address they own.
>>>>>
>>>>> I'm trying to think of a good use case for this type of opcode. In
>>>> these examples, an attacker who compromises the key for user A can't steal
>>>> the money because it can only be sent to user B. So if the attacker wants
>>>> to steal the funds, they would need to compromise the keys of both user A
>>>> and user B.
>>>>
>>>> But how is that any better than a 2-of-2 multisig? Isn't the end result
>>>> exactly the same?
>>>>
>>>> James
>>>>
>>> _______________________________________________
>>> bitcoin-dev mailing list
>>> bitcoin-dev at lists.linuxfoundation.org
>>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20210728/9ad7f8bf/attachment-0001.html>