MIME-Version: 1.0
References: <CAO3Pvs_pkYAYsrAEtv3KuJevXQHBLZQ-ihjP4Ur_A1NjJRA+Lw@mail.gmail.com>
 <CAPv7TjYTjvSV7UFgOwif6tFj3jVxDfJdW-p_cyPoAGGWKQbwRQ@mail.gmail.com>
 <CAO3Pvs_-igT37fcD29=ATSRX7dW5mGKrLGrXp=iJjaN_t3NGww@mail.gmail.com>
 <CAPv7TjZjZU2bYvUrt-BEx80xKF=BHBbrYWigHB+=yY+YfZX9Yg@mail.gmail.com>
 <CAO3Pvs9mLc=6eYw=EO98CN9Muur8Kz-WHqb0sRVPQXKnJd0i9Q@mail.gmail.com>
In-Reply-To: <CAO3Pvs9mLc=6eYw=EO98CN9Muur8Kz-WHqb0sRVPQXKnJd0i9Q@mail.gmail.com>
From: Ruben Somsen <rsomsen@gmail.com>
Date: Fri, 15 Apr 2022 15:14:40 +0200
Message-ID: <CAPv7Tjavs7aNDkfE5YvRuqr2b8hfREcYBNEyOJvbWpETD=tptA@mail.gmail.com>
To: Olaoluwa Osuntokun <laolu32@gmail.com>
Content-Type: multipart/alternative; boundary="00000000000021670c05dcb13254"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
 lightning-dev <lightning-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Taro: A Taproot Asset Representation Overlay
Precedence: list

--00000000000021670c05dcb13254
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Laolu,

> ignoring the rules leads to assets being burnt, but in most cases imo
that's a sufficient enough incentive to maintain and validate the relevant
set of witnesses

I agree it is sufficient, but only because using Bitcoin script without an
additional scripting language inside of Taro is already sufficient. Perhaps
you could show me a concrete example where you think replicating Bitcoin's
scripting capabilities inside Taro can be useful, so I can show you where I
think it fails.

> came up with a "issuance covenant" design sketch that may or may not be
useful

To summarize my view from my first post, I basically think there are two
broad exceptions to the "can't do scripting" rule:

1. Self-encumbrance: you have to use the token according to the rules, else
the token becomes burned/invalid. The example you're giving here can be
said to fall under this category. The usefulness of this is
extremely narrow, and merely replicating Bitcoin's script inside of Taro is
certainly not sufficient to achieve it.

2. On-chain validation: instead of keeping the satisfaction of the script
off-chain, you publish it on-chain in the Bitcoin blockchain. This works,
but breaks a fundamental design goal of Taro/RGB (remaining off-chain), and
adds significant complexity.

These two points lead me to my conclusion that off-chain validation
protocols (to rule out the exception in point 2) can't do any meaningful
(to rule out the exception in point 1) scripting.

This doesn't mean you can't still add some scripting to facilitate certain
use cases that fall under the two exceptions, but a regular scripting
language for on-chain payments such as Bitcoin's is not going to cut it (at
least not without significant changes).

Personally I'd be inclined to leave out the scripting language altogether
(as the encumbrance of Bitcoin UTXOs is sufficient in most cases), unless
you have a very specific and compelling use case in mind that justify the
complexity.

Cheers,
Ruben


On Mon, Apr 11, 2022 at 9:52 PM Olaoluwa Osuntokun <laolu32@gmail.com>
wrote:

> Hi Ruben,
>
> > Also, the people that are responsible for the current shape of RGB aren=
't
> > the people who originated the idea, so it would not be fair to the
> > originators either (Peter Todd, Alekos Filini, Giacomo Zucco).
>
> Sure I have no problems acknowledging them in the current BIP draft. Both
> the protocols build off of ideas re client-side-validation, but then end =
up
> exploring different parts of the large design space.  Peter Todd is alrea=
dy
> there, but I can add the others you've listed. I might even just expand
> that
> section into a longer "Related Work" section along the way.
>
> > What I tried to say was that it does not make sense to build scripting
> > support into Taro, because you can't actually do anything interesting
> with
> > it due to this limitation.  can do with their own Taro tokens, or else =
he
> > will burn them =E2=80=93 not very useful
>
> I agree that the usage will be somewhat context specific, and dependent o=
n
> the security properties one is after. In the current purposefully
> simplified
> version, it's correct that ignoring the rules leads to assets being burnt=
,
> but in most cases imo that's a sufficient enough incentive to maintain an=
d
> validate the relevant set of witnesses.
>
> I was thinking about the scripting layer a bit over the weekend, and came
> up
> with a "issuance covenant" design sketch that may or may not be useful. A=
t
> a
> high level, lets say we extend the system to allow a specified (so a new
> asset type) or generalized script to be validated when an asset issuance
> transaction is being validated. If we add some new domain specific covena=
nt
> op codes at the Taro level, then we'd be able to validate issuance events
> like:
>
>   * "Issuing N units of this assets can only be done if 1.5*N units of BT=
C
>     are present in the nth output of the minting transaction. In addition=
,
>     the output created must commit to a NUMs point for the internal key,
>     meaning that only a script path is possible. The script paths must be
>     revealed, with the only acceptable unlocking leaf being a time lock o=
f
> 9
>     months".
>
> I don't fully have a concrete protocol that would use something like that=
,
> but that was an attempt to express certain collateralization requirements
> for issuing certain assets. Verifiers would only recognize that asset if
> the
> issuance covenant script passes, and (perhaps) the absolute timelock on
> those coins hasn't expired yet. This seems like a useful primitive for
> creating assets that are somehow backed by on-chain BTC collateralization=
.
> However this is just a design sketch that needs to answer questions like:
>
>   * are the assets still valid after that timeout period, or are they
>     considered to be burnt?
>
>   * assuming that the "asset key family" (used to authorize issuance of
>     related assets) are jointly owned, and maintained in a canonical
>     Universe, then would it be possible for 3rd parties to verify the lev=
el
>     of collateralization on-chain, with the join parties maintaining the
>     pool of collateralized assets accordingly?
>
>   * continuing with the above, is it feasible to use a DLC script within
> one
>     of these fixed tapscript leaves to allow more collateral to be
>     added/removed from the pool backing those assets?
>
> I think it's too early to conclude that the scripting layer isn't useful.
> Over time I plan to add more concrete ideas like the above to the section
> tracking the types of applications that can be built on Taro.
>
> > So theoretically you could get Bitcoin covenants to enforce certain
> > spending conditions on Taro assets. Not sure how practical that ends up
> > being, but intriguing to consider.
>
> Exactly! Exactly how practical it ends up being would depend on the types
> of
> covenants deployed in the future. With something like a TLUV and OP_CAT (=
as
> they're sufficiently generalized vs adding op codes to very the proofs) a
> Script would be able to re-create the set of commitments to restrict the
> set
> of outputs that can be created after spending. One would use OP_CAT to
> handle re-creating the taro asset root, and TLUV (or something similar) t=
o
> handle the Bitcoin tapscript part (swap out leaf index 0 where the taro
> commitment is, etc).
>
> > The above also reminds me of another potential issue which you need to =
be
> > aware of, if you're not already. Similar to my comment about how the
> > location of the Taro tree inside the taproot tree needs to be
> > deterministic for the verifier, the output in which you place the Taro
> > tree also needs to be
>
> Yep, the location needs to be fully specified which includes factoring th=
e
> output index as well. A simple way to restrict this would just to say it'=
s
> always the first output. Otherwise, you could lift the output index into
> the
> asset ID calculation.
>
> -- Laolu
>

--00000000000021670c05dcb13254
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Laolu,<div><br></div><div>&gt; ignoring the rules leads=
 to assets being burnt, but in most cases imo that&#39;s a sufficient enoug=
h incentive to maintain and validate the relevant set of witnesses</div><di=
v><br></div><div>I agree it is sufficient, but only because using Bitcoin s=
cript without=C2=A0an additional scripting language inside of Taro is alrea=
dy sufficient. Perhaps you could show=C2=A0me a concrete example where you =
think replicating Bitcoin&#39;s scripting capabilities inside Taro can be u=
seful, so I can show you where I think it fails.</div><div><br></div><div>&=
gt; came up with a &quot;issuance covenant&quot; design sketch that may or =
may not be useful</div><div><br></div><div>To summarize my view from my fir=
st post, I basically think=C2=A0there are two broad exceptions to the &quot=
;can&#39;t do scripting&quot; rule:</div><div><br></div><div>1. Self-encumb=
rance: you have to use the token according to the rules, else the token bec=
omes burned/invalid. The example you&#39;re giving here can be said to fall=
 under this category. The usefulness of this is extremely=C2=A0narrow, and =
merely replicating Bitcoin&#39;s script inside of Taro is certainly not suf=
ficient to achieve it.</div><div><br></div><div>2. On-chain validation: ins=
tead of keeping the satisfaction of the script off-chain, you publish it on=
-chain in the Bitcoin blockchain. This works, but breaks a fundamental desi=
gn goal of Taro/RGB (remaining off-chain), and adds significant complexity.=
</div><div><br></div><div>These two points lead=C2=A0me to my conclusion th=
at off-chain validation protocols (to rule out the exception in point 2) ca=
n&#39;t do any meaningful (to rule out the exception in point 1) scripting.=
=C2=A0</div><div><br></div><div>This doesn&#39;t mean you can&#39;t still a=
dd some scripting to facilitate certain use cases that fall under the two e=
xceptions, but a regular scripting language for on-chain payments such as B=
itcoin&#39;s is not going to cut it (at least not without significant chang=
es).</div><div><br></div><div>Personally I&#39;d be inclined to leave out t=
he scripting language altogether (as the encumbrance of Bitcoin UTXOs is su=
fficient in most cases), unless you have a very specific and compelling use=
 case in mind that justify the complexity.</div><div><br></div><div>Cheers,=
</div><div>Ruben</div><div><br></div></div><br><div class=3D"gmail_quote"><=
div dir=3D"ltr" class=3D"gmail_attr">On Mon, Apr 11, 2022 at 9:52 PM Olaolu=
wa Osuntokun &lt;<a href=3D"mailto:laolu32@gmail.com">laolu32@gmail.com</a>=
&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px =
0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div=
 dir=3D"ltr">Hi Ruben, <br><br>&gt; Also, the people that are responsible f=
or the current shape of RGB aren&#39;t<br>&gt; the people who originated th=
e idea, so it would not be fair to the<br>&gt; originators either (Peter To=
dd, Alekos Filini, Giacomo Zucco).<br><br>Sure I have no problems acknowled=
ging them in the current BIP draft. Both<br>the protocols build off of idea=
s re client-side-validation, but then end up<br>exploring different parts o=
f the large design space.=C2=A0 Peter Todd is already<br>there, but I can a=
dd the others you&#39;ve listed. I might even just expand that<br>section i=
nto a longer &quot;Related Work&quot; section along the way.<br><br>&gt; Wh=
at I tried to say was that it does not make sense to build scripting<br>&gt=
; support into Taro, because you can&#39;t actually do anything interesting=
 with<br>&gt; it due to this limitation. =C2=A0can do with their own Taro t=
okens, or else he<br>&gt; will burn them =E2=80=93 not very useful<br><br>I=
 agree that the usage will be somewhat context specific, and dependent on<b=
r>the security properties one is after. In the current purposefully simplif=
ied<br>version, it&#39;s correct that ignoring the rules leads to assets be=
ing burnt,<br>but in most cases imo that&#39;s a sufficient enough incentiv=
e to maintain and<br>validate the relevant set of witnesses.<br><br>I was t=
hinking about the scripting layer a bit over the weekend, and came up<br>wi=
th a &quot;issuance covenant&quot; design sketch that may or may not be use=
ful. At a<br>high level, lets say we extend the system to allow a specified=
 (so a new<br>asset type) or generalized script to be validated when an ass=
et issuance<br>transaction is being validated. If we add some new domain sp=
ecific covenant<br>op codes at the Taro level, then we&#39;d be able to val=
idate issuance events<br>like:<br><br>=C2=A0 * &quot;Issuing N units of thi=
s assets can only be done if 1.5*N units of BTC<br>=C2=A0 =C2=A0 are presen=
t in the nth output of the minting transaction. In addition,<br>=C2=A0 =C2=
=A0 the output created must commit to a NUMs point for the internal key,<br=
>=C2=A0 =C2=A0 meaning that only a script path is possible. The script path=
s must be<br>=C2=A0 =C2=A0 revealed, with the only acceptable unlocking lea=
f being a time lock of 9<br>=C2=A0 =C2=A0 months&quot;.<br><br>I don&#39;t =
fully have a concrete protocol that would use something like that,<br>but t=
hat was an attempt to express certain collateralization requirements<br>for=
 issuing certain assets. Verifiers would only recognize that asset if the<b=
r>issuance covenant script passes, and (perhaps) the absolute timelock on<b=
r>those coins hasn&#39;t expired yet. This seems like a useful primitive fo=
r<br>creating assets that are somehow backed by on-chain BTC collateralizat=
ion.<br>However this is just a design sketch that needs to answer questions=
 like:<br><br>=C2=A0 * are the assets still valid after that timeout period=
, or are they<br>=C2=A0 =C2=A0 considered to be burnt? <br><br>=C2=A0 * ass=
uming that the &quot;asset key family&quot; (used to authorize issuance of<=
br>=C2=A0 =C2=A0 related assets) are jointly owned, and maintained in a can=
onical<br>=C2=A0 =C2=A0 Universe, then would it be possible for 3rd parties=
 to verify the level<br>=C2=A0 =C2=A0 of collateralization on-chain, with t=
he join parties maintaining the<br>=C2=A0 =C2=A0 pool of collateralized ass=
ets accordingly?<br><br>=C2=A0 * continuing with the above, is it feasible =
to use a DLC script within one<br>=C2=A0 =C2=A0 of these fixed tapscript le=
aves to allow more collateral to be<br>=C2=A0 =C2=A0 added/removed from the=
 pool backing those assets?<br><br>I think it&#39;s too early to conclude t=
hat the scripting layer isn&#39;t useful.<br>Over time I plan to add more c=
oncrete ideas like the above to the section<br>tracking the types of applic=
ations that can be built on Taro.<br><br>&gt; So theoretically you could ge=
t Bitcoin covenants to enforce certain<br>&gt; spending conditions on Taro =
assets. Not sure how practical that ends up<br>&gt; being, but intriguing t=
o consider.<br><br>Exactly! Exactly how practical it ends up being would de=
pend on the types of<br>covenants deployed in the future. With something li=
ke a TLUV and OP_CAT (as<br>they&#39;re sufficiently generalized vs adding =
op codes to very the proofs) a<br>Script would be able to re-create the set=
 of commitments to restrict the set<br>of outputs that can be created after=
 spending. One would use OP_CAT to<br>handle re-creating the taro asset roo=
t, and TLUV (or something similar) to<br>handle the Bitcoin tapscript part =
(swap out leaf index 0 where the taro<br>commitment is, etc).<br><br>&gt; T=
he above also reminds me of another potential issue which you need to be<br=
>&gt; aware of, if you&#39;re not already. Similar to my comment about how =
the<br>&gt; location of the Taro tree inside the taproot tree needs to be<b=
r>&gt; deterministic for the verifier, the output in which you place the Ta=
ro<br>&gt; tree also needs to be<br><br>Yep, the location needs to be fully=
 specified which includes factoring the<br>output index as well. A simple w=
ay to restrict this would just to say it&#39;s<br>always the first output. =
Otherwise, you could lift the output index into the<br>asset ID calculation=
.<br><br>-- Laolu<br></div>
</blockquote></div>

--00000000000021670c05dcb13254--