You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: bip-0443.mediawiki
+15-31Lines changed: 15 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,20 +38,15 @@ This document is licensed under the 3-clause BSD license.
38
38
The ability to constrain the future of coins beyond what is possible with presigned transactions is at the core of
39
39
numerous attempts to improve bitcoin. Some of the proposed applications include:
40
40
41
-
* UTXO sharing schemes like Ark, CoinPools, Timeout Trees, etc. use various types of output restrictions in order to
42
-
enable multiple parties to share the control of a UTXO, while ensuring that each participant controls their own
43
-
balance.
44
-
* <code>OP_VAULT</code><ref>[[bip-0345.mediawiki|BIP-345]]</ref> is a proposed opcode to implement a 2-step withdrawal
45
-
process, enabling on-chain reactive security.
46
-
* <code>OP_CHECKTEMPLATEVERIFY</code><ref>[[bip-119.mediawiki|BIP-114]]</ref> is a long-proposed opcode to constrain a
47
-
transaction to a ''template'' with a fixed set of outputs.
48
-
* Sidechains and rollups could be implemented via a UTXO encumbered with a recursive covenant, updating the sidechain
49
-
state root every time it is spent.
41
+
* UTXO sharing schemes like Ark, CoinPools, Timeout Trees, etc. use various types of output restrictions in order to enable multiple parties to share the control of a UTXO, while ensuring that each participant controls their own `balance.
42
+
* <code>OP_VAULT</code><ref>[[bip-0345.mediawiki|BIP-345]]</ref> is a proposed opcode to implement a 2-step withdrawal process, enabling on-chain reactive security.
43
+
* <code>OP_CHECKTEMPLATEVERIFY</code><ref>[[bip-119.mediawiki|BIP-114]]</ref> is a long-proposed opcode to constrain a transaction to a ''template'' with a fixed set of outputs.
44
+
* Sidechains and rollups could be implemented via a UTXO encumbered with a recursive covenant, updating the sidechain state root every time it is spent.
50
45
51
46
Constructions like BitVM<ref>https://bitvm.org/</ref> try to side-step the lack of a primitive allowing UTXOs to carry
52
47
state with a clever use of Lamport Signatures, and optimistic execution of smart contracts. This comes with an extremely
53
-
high cost in term of complexity, interactivity, and (potentially) in block size occupation, for some of the possible
54
-
execution paths. Moreover, the design of fully trustless bridges remains elusive.
48
+
high cost in term of complexity, interactivity, and (potentially) in block size occupation, for some of the possible
49
+
execution paths. Moreover, the design of fully trustless bridges remains elusive.
55
50
56
51
Rather than providing a construct optimized for a specific application, this BIP aims to provide a fundamental building
57
52
block that is widely applicable, and common to many constructions.
@@ -73,13 +68,9 @@ The resulting key is the taproot internal key per BIP-341.
73
68
This allows to embed a commitment to the data that can be validated during the script execution, while staying fully
74
69
compatible with taproot. Notably:
75
70
* the committed data does not make the UTXO any larger;
76
-
* the keypath spend is still available to any party that possesses the private key of the naked key, as long as they
77
-
have knowledge of the embedded data (or at least the data’s hash)<ref>For example, in a multi-party contract, the
78
-
naked key could be an aggregate key using [[bip-0327.mediawiki|MuSig2]]; the taproot keypath would therefore allow a
79
-
''cooperative'' spend, without executing any script at all. Like for all taproot transactions, this is indeed the
71
+
* the keypath spend is still available to any party that possesses the private key of the naked key, as long as they have knowledge of the embedded data (or at least the data’s hash)<ref>For example, in a multi-party contract, the naked key could be an aggregate key using [[bip-0327.mediawiki|MuSig2]]; the taproot keypath would therefore allow a ''cooperative'' spend, without executing any script at all. Like for all taproot transactions, this is indeed the
80
72
cheapest way of spending the UTXO — albeit not always possible in practice.</ref>;
81
-
* if multiple scripts are in different leaves of the taptree, only the ones that actually need to access the data have
82
-
to pay a cost for it, in terms of additional witness bytes.
73
+
* if multiple scripts are in different leaves of the taptree, only the ones that actually need to access the data have to pay a cost for it, in terms of additional witness bytes.
83
74
84
75
<code>OP_CHECKCONTRACTVERIFY</code> can be applied to introspect the program and data of one of the inputs of the
85
76
transaction (typically, the UTXO being spent, in order to access its committed data), or one of the outputs of the
@@ -93,11 +84,9 @@ outputs in the expected way. Therefore, the opcode already includes an amount se
93
84
94
85
There are three supported modes for the opcode when checking an output, depending on the value of the <code>mode</code>
95
86
parameter:
96
-
* ''default'': the residual amount of the current input must be preserved in the output (aggregate across the inputs
97
-
that specify the output);
87
+
* ''default'': the residual amount of the current input must be preserved in the output (aggregate across the inputs that specify the output);
98
88
* ''ignore'': the output amount is ignored.
99
-
* ''deduct'': the amount of the checked output is subtracted from the amount of the current input (the residual amount
100
-
is then available for further checks);
89
+
* ''deduct'': the amount of the checked output is subtracted from the amount of the current input (the residual amount is then available for further checks);
101
90
102
91
The ''default'' logic covers the common case where a UTXO’s full amount is required to be sent to a specific output.
103
92
@@ -155,10 +144,8 @@ When evaluating <code>OP_CHECKCONTRACTVERIFY</code> (<code>OP_SUCCESS187</code>,
155
144
where:
156
145
157
146
* <code><mode></code> is a minimally encoded integer, according to one of the values defined below.
158
-
* <code><taptree></code> is the Merkle root of the taproot tree, or a minimally encoded <code>-1</code>, or the empty
159
-
buffer.
160
-
* <code><pk></code> is called the ''naked key'', and it's a valid 32-byte x-only public key, or a minimally encoded
161
-
<code>-1</code>, or the empty buffer.
147
+
* <code><taptree></code> is the Merkle root of the taproot tree, or a minimally encoded <code>-1</code>, or the empty buffer.
148
+
* <code><pk></code> is called the ''naked key'', and it's a valid 32-byte x-only public key, or a minimally encoded <code>-1</code>, or the empty buffer.
162
149
* <code><index></code> is a minimally encoded -1, or a minimally encoded non-negative integer.
163
150
* <code><data></code> is a buffer of arbitrary length.
164
151
@@ -181,18 +168,15 @@ The following value of the <code><mode></code> are defined:
181
168
* <code>CCV_MODE_CHECK_INPUT = -1</code>: Check an input's script; no amount check.
182
169
* <code>CCV_MODE_CHECK_OUTPUT = 0</code>: Check an output's script; preserve the (possibly residual) amount.
183
170
* <code>CCV_MODE_CHECK_OUTPUT_IGNORE_AMOUNT = 1</code>: Check an output's script; ignore amounts.
184
-
* <code>CCV_MODE_CHECK_OUTPUT_DEDUCT_AMOUNT = 2</code>: Check an output's script; deduct the output amount from the
185
-
input's residual amount.
171
+
* <code>CCV_MODE_CHECK_OUTPUT_DEDUCT_AMOUNT = 2</code>: Check an output's script; deduct the output amount from the input's residual amount.
186
172
187
173
Any other value of the <code><mode></code> makes the opcode succeed validation immediately for the current
188
174
input<ref>This allows to soft-fork future behavior by introducing new values for the <code><mode></code>. As the mode
189
175
would always be hard-coded via a push in the script, the risk of mistakes seems negligible.</ref>.
190
176
191
177
The following values of the other parameters have special meanings:
192
-
* If the <code><taptree></code> is -1, it is replaced with the Merkle root of the current input's tapscript tree. If the
193
-
taptree is the empty buffer, then the taptweak is skipped.
194
-
* If the <code><pk></code> is 0, it is replaced with the NUMS x-only pubkey <code>0x50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0</code>
195
-
defined in BIP-0340. If the <code><pk></code> is -1, it is replaced with the taproot internal key of the current input.
178
+
* If the <code><taptree></code> is -1, it is replaced with the Merkle root of the current input's tapscript tree. If the taptree is the empty buffer, then the taptweak is skipped.
179
+
* If the <code><pk></code> is 0, it is replaced with the NUMS x-only pubkey <code>0x50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0</code> defined in BIP-0340. If the <code><pk></code> is -1, it is replaced with the taproot internal key of the current input.
196
180
* If the <code><index></code> is -1, it is replaced with the index of the current input.
197
181
* If the <code><data></code> is the empty buffer, then there is no data tweak for the input/output being checked.
0 commit comments