MIME-Version: 1.0
References: <CAPfvXfKrnju1fzxOKs3Fx00NOPWHjedF7e4xMSGs8buwc0O2kw@mail.gmail.com>
In-Reply-To: <CAPfvXfKrnju1fzxOKs3Fx00NOPWHjedF7e4xMSGs8buwc0O2kw@mail.gmail.com>
From: Greg Sanders <gsanders87@gmail.com>
Date: Fri, 11 Feb 2022 07:09:06 +0800
Message-ID: <CAB3F3DtDwThU-Bnk6Qrb1d4UAfpHkG6p-1erL3e00psEXviWuQ@mail.gmail.com>
To: "James O'Beirne" <james.obeirne@gmail.com>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="0000000000001cc56a05d7b20ae1"
Subject: Re: [bitcoin-dev] Thoughts on fee bumping
Precedence: list

--0000000000001cc56a05d7b20ae1
Content-Type: text/plain; charset="UTF-8"

One quick thought to the proposal and perhaps to sponsors in general(didn't
have time to go over original proposal again):

Since sponsors can come from anywhere, the wallet application must have
access to the mempool to know what inputs must be double spent to RBF the
sponsor transaction.

Seems like an important difference to be considered.

On Fri, Feb 11, 2022 at 3:49 AM James O'Beirne via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> There's been much talk about fee-bumping lately, and for good reason -
> dynamic fee management is going to be a central part of bitcoin use as
> the mempool fills up (lord willing) and right now fee-bumping is
> fraught with difficulty and pinning peril.
>
> Gloria's recent post on the topic[0] was very lucid and highlights a
> lot of the current issues, as well as some proposals to improve the
> situation.
>
> As others have noted, the post was great. But throughout the course
> of reading it and the ensuing discussion, I became troubled by the
> increasing complexity of both the status quo and some of the
> proposed remedies.
>
> Layering on special cases, more carve-outs, and X and Y percentage
> thresholds is going to make reasoning about the mempool harder than it
> already is. Special consideration for "what should be in the next
> block" and/or the caching of block templates seems like an imposing
> dependency, dragging in a bunch of state and infrastructure to a
> question that should be solely limited to mempool feerate aggregates
> and the feerate of the particular txn package a wallet is concerned
> with.
>
> This is bad enough for protocol designers and Core developers, but
> making the situation any more intractable for "end-users" and wallet
> developers feels wrong.
>
> I thought it might be useful to step back and reframe. Here are a few
> aims that are motivated chiefly by the quality of end-user experience,
> constrained to obey incentive compatibility (i.e. miner reward, DoS
> avoidance). Forgive the abstract dalliance for a moment; I'll talk
> through concretes afterwards.
>
>
> # Purely additive feerate bumps should never be impossible
>
> Any user should always be able to add to the incentive to mine any
> transaction in a purely additive way. The countervailing force here
> ends up being spam prevention (a la min-relay-fee) to prevent someone
> from consuming bandwidth and mempool space with a long series of
> infinitesimal fee-bumps.
>
> A fee bump, naturally, should be given the same per-byte consideration
> as a normal Bitcoin transaction in terms of relay and block space,
> although it would be nice to come up with a more succinct
> representation. This leads to another design principle:
>
>
> # The bandwidth and chain space consumed by a fee-bump should be minimal
>
> Instead of prompting a rebroadcast of the original transaction for
> replacement, which contains a lot of data not new to the network, it
> makes more sense to broadcast the "diff" which is the additive
> contribution towards some txn's feerate.
>
> This dovetails with the idea that...
>
>
> # Special transaction structure should not be required to bump fees
>
> In an ideal design, special structural foresight would not be needed
> in order for a txn's feerate to be improved after broadcast.
>
> Anchor outputs specified solely for CPFP, which amount to many bytes of
> wasted chainspace, are a hack. It's probably uncontroversial at this
> point to say that even RBF itself is kind of a hack - a special
> sequence number should not be necessary for post-broadcast contribution
> toward feerate. Not to mention RBF's seemingly wasteful consumption of
> bandwidth due to the rebroadcast of data the network has already seen.
>
> In a sane design, no structural foresight - and certainly no wasted
> bytes in the form of unused anchor outputs - should be needed in order
> to add to a miner's reward for confirming a given transaction.
>
> Planning for fee-bumps explicitly in transaction structure also often
> winds up locking in which keys are required to bump fees, at odds
> with the idea that...
>
>
> # Feerate bumps should be able to come from anywhere
>
> One of the practical downsides of CPFP that I haven't seen discussed in
> this conversation is that it requires the transaction to pre-specify the
> keys needed to sign for fee bumps. This is problematic if you're, for
> example, using a vault structure that makes use of pre-signed
> transactions.
>
> What if the key you specified n the anchor outputs for a bunch of
> pre-signed txns is compromised? What if you'd like to be able to
> dynamically select the wallet that bumps fees? CPFP does you no favors
> here.
>
> There is of course a tension between allowing fee bumps to come from
> anywhere and the threat of pinning-like attacks. So we should venture
> to remove pinning as a possibility, in line with the first design
> principle I discuss.
>
>
> ---
>
> Coming down to earth, the "tabula rasa" thought experiment above has led
> me to favor an approach like the transaction sponsors design that Jeremy
> proposed in a prior discussion back in 2020[1].
>
> Transaction sponsors allow feerates to be bumped after a transaction's
> broadcast, regardless of the structure of the original transaction.
> No rebroadcast (wasted bandwidth) is required for the original txn data.
> No wasted chainspace on only-maybe-used prophylactic anchor outputs.
>
> The interface for end-users is very straightforward: if you want to bump
> fees, specify a transaction that contributes incrementally to package
> feerate for some txid. Simple.
>
> In the original discussion, there were a few main objections that I noted:
>
> 1. In Jeremy's original proposal, only one sponsor txn per txid is
>    allowed by policy. A malicious actor could execute a pinning-like
>    attack by specifying an only-slightly-helpful feerate sponsor that
>    then precludes other larger bumps.
>
> I think there are some ways around this shortcoming. For example: what
> if, by policy, sponsor txns had additional constraints that
>
>   - each input must be signed {SIGHASH_SINGLE,SIGHASH_NONE}|ANYONECANPAY,
>   - the txn must be specified RBFable,
>   - a replacement for the sponsor txn must raise the sponsor feerate,
>     including ancestors (maybe this is inherent in "is RBFable," but
>     I don't want to conflate absolute feerates into this).
>
> That way, there is still at most a single sponsor txn per txid in the
> mempool, but anyone can "mix in" inputs which bump the effective
> feerate of the sponsor.
>
> This may not be the exact solution we want, but I think it demonstrates
> that the sponsors design has some flexibility and merits some thinking.
>
> The second objection about sponsors was
>
> 2. (from Suhas) sponsors break the classic invariant: "once a valid
>    transaction is created, it should not become invalid later on unless
>    the inputs are double-spent."
>
> This doesn't seem like a huge concern to me if you consider the txid
> being sponsored as a sort of spiritual input to the sponsor. While the
> theoretical objection against broadening where one has to look in a txn
> to determine its dependencies is understandable, I don't see what the
> practical cost here is.
>
> Reorg complexity seems comparable if not identical, especially if we
> broaden sponsor rules to allow blocks to contain sponsor txns that are
> both for txids in the same block _or_ already included in the chain.
>
> This theoretical concession seems preferable to heaping more rules onto
> an already labyrinthine mempool policy that is difficult for both
> implementers and users to reason about practically and conceptually.
>
> A third objection that wasn't posed, IIRC, but almost certainly would
> be:
>
> 3. Transaction sponsors requires a soft-fork.
>
> Soft-forks are no fun, but I'll tell you what also isn't fun: being on
> the hook to model (and sometimes implement) a dizzying potpourri of
> mempool policies and special-cases. Expecting wallet implementers to
> abide by a maze of rules faithfully in order to ensure txn broadcast and
> fee management invites bugs for perpetuity and network behavior that is
> difficult to reason about a priori. Use of CPFP in the long-term also
> risks needless chain waste.
>
> If a soft-fork is the cost of cleaning up this essential process,
> consideration should be given to paying it as a one-time cost. This
> topic merits a separate post, but consider that in the 5 years leading
> up to the 2017 SegWit drama, we averaged about a soft-fork a year.
> Uncontroversial, "safe" changes to the consensus protocol shouldn't be
> out of the question when significant practical benefit is plain to see.
>
> ---
>
> I hope this message has added some framing to the discussion on fees,
> as well prompting other participants to go back and give the
> transaction sponsor proposal a serious look. The sponsors interface is
> about the simplest I can imagine for wallets, and it seems easy to
> reason about for implementers on Core and elsewhere.
>
> I'm not out to propose soft-forks lightly, but the current complexity
> in fee management feels untenable, and as evidenced by all the
> discussion lately, fees are an increasingly crucial part of the system.
>
>
>
> [0]:
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-January/019817.html
> [1]:
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2020-September/018168.html
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--0000000000001cc56a05d7b20ae1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">One quick thought to the proposal and perhaps to sponsors =
in general(didn&#39;t have time to go over original proposal again):<div><b=
r></div><div>Since sponsors=C2=A0can come from anywhere, the wallet applica=
tion=C2=A0must have access to the mempool to know what inputs must be doubl=
e spent to RBF the sponsor transaction.=C2=A0<br></div><div><br></div><div>=
Seems like an important difference to be considered.</div></div><br><div cl=
ass=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Feb 11, 2=
022 at 3:49 AM James O&#39;Beirne via bitcoin-dev &lt;<a href=3D"mailto:bit=
coin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</=
a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0p=
x 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><d=
iv dir=3D"ltr"><div>There&#39;s been much talk about fee-bumping lately, an=
d for good reason -<br>dynamic fee management is going to be a central part=
 of bitcoin use as<br>the mempool fills up (lord willing) and right now fee=
-bumping is<br>fraught with difficulty and pinning peril.<br><br>Gloria&#39=
;s recent post on the topic[0] was very lucid and highlights a<br>lot of th=
e current issues, as well as some proposals to improve the<br>situation.<br=
><br>As others have noted, the post was great. But throughout the course<br=
>of reading it and the ensuing discussion, I became troubled by the<br>incr=
easing complexity of both the status quo and some of the <br></div><div>pro=
posed remedies. <br></div><div><br>Layering on special cases, more carve-ou=
ts, and X and Y percentage<br>thresholds is going to make reasoning about t=
he mempool harder than it<br>already is. Special consideration for &quot;wh=
at should be in the next<br>block&quot; and/or the caching of block templat=
es seems like an imposing<br>dependency, dragging in a bunch of state and i=
nfrastructure to a<br>question that should be solely limited to mempool fee=
rate aggregates<br>and the feerate of the particular txn package a wallet i=
s concerned<br>with. <br><br>This is bad enough for protocol designers and =
Core developers, but<br>making the situation any more intractable for &quot=
;end-users&quot; and wallet<br>developers feels wrong.<br><br>I thought it =
might be useful to step back and reframe. Here are a few<br>aims that are m=
otivated chiefly by the quality of end-user experience,<br>constrained to o=
bey incentive compatibility (i.e. miner reward, DoS<br>avoidance). Forgive =
the abstract dalliance for a moment; I&#39;ll talk<br>through concretes aft=
erwards.<br><br><br># Purely additive feerate bumps should never be impossi=
ble<br><br>Any user should always be able to add to the incentive to mine a=
ny<br>transaction in a purely additive way. The countervailing force here<b=
r>ends up being spam prevention (a la min-relay-fee) to prevent someone<br>=
from consuming bandwidth and mempool space with a long series of<br>infinit=
esimal fee-bumps. <br><br>A fee bump, naturally, should be given the same p=
er-byte consideration<br>as a normal Bitcoin transaction in terms of relay =
and block space,<br>although it would be nice to come up with a more succin=
ct<br>representation. This leads to another design principle:<br><br><br># =
The bandwidth and chain space consumed by a fee-bump should be minimal<br><=
br>Instead of prompting a rebroadcast of the original transaction for<br>re=
placement, which contains a lot of data not new to the network, it<br>makes=
 more sense to broadcast the &quot;diff&quot; which is the additive<br>cont=
ribution towards some txn&#39;s feerate. <br><br>This dovetails with the id=
ea that...<br><br><br># Special transaction structure should not be require=
d to bump fees<br><br>In an ideal design, special structural foresight woul=
d not be needed <br>in order for a txn&#39;s feerate to be improved after b=
roadcast.<br><br>Anchor outputs specified solely for CPFP, which amount to =
many bytes of<br>wasted chainspace, are a hack. It&#39;s probably uncontrov=
ersial at this<br>point to say that even RBF itself is kind of a hack - a s=
pecial<br>sequence number should not be necessary for post-broadcast contri=
bution<br>toward feerate. Not to mention RBF&#39;s seemingly wasteful consu=
mption of<br>bandwidth due to the rebroadcast of data the network has alrea=
dy seen.<br><br>In a sane design, no structural foresight - and certainly n=
o wasted<br>bytes in the form of unused anchor outputs - should be needed i=
n order<br>to add to a miner&#39;s reward for confirming a given transactio=
n.<br><br>Planning for fee-bumps explicitly in transaction structure also o=
ften<br>winds up locking in which keys are required to bump fees, at odds<b=
r>with the idea that...<br><br><br># Feerate bumps should be able to come f=
rom anywhere<br><br>One of the practical downsides of CPFP that I haven&#39=
;t seen discussed in<br>this conversation is that it requires the transacti=
on to pre-specify the<br>keys needed to sign for fee bumps. This is problem=
atic if you&#39;re, for<br>example, using a vault structure that makes use =
of pre-signed<br>transactions. <br><br>What if the key you specified n the =
anchor outputs for a bunch of<br>pre-signed txns is compromised? What if yo=
u&#39;d like to be able to<br>dynamically select the wallet that bumps fees=
? CPFP does you no favors<br>here.<br><br>There is of course a tension betw=
een allowing fee bumps to come from<br>anywhere and the threat of pinning-l=
ike attacks. So we should venture<br>to remove pinning as a possibility, in=
 line with the first design<br>principle I discuss.<br><br><br>---<br><br>C=
oming down to earth, the &quot;tabula rasa&quot; thought experiment above h=
as led<br>me to favor an approach like the transaction sponsors design that=
 Jeremy<br>proposed in a prior discussion back in 2020[1].<br><br>Transacti=
on sponsors allow feerates to be bumped after a transaction&#39;s<br>broadc=
ast, regardless of the structure of the original transaction.<br>No rebroad=
cast (wasted bandwidth) is required for the original txn data.<br>No wasted=
 chainspace on only-maybe-used prophylactic anchor outputs. <br><br>The int=
erface for end-users is very straightforward: if you want to bump<br>fees, =
specify a transaction that contributes incrementally to package<br>feerate =
for some txid. Simple.<br><br>In the original discussion, there were a few =
main objections that I noted:<br><br>1. In Jeremy&#39;s original proposal, =
only one sponsor txn per txid is<br>=C2=A0 =C2=A0allowed by policy. A malic=
ious actor could execute a pinning-like <br>=C2=A0 =C2=A0attack by specifyi=
ng an only-slightly-helpful feerate sponsor that <br>=C2=A0 =C2=A0then prec=
ludes other larger bumps.<br><br>I think there are some ways around this sh=
ortcoming. For example: what<br>if, by policy, sponsor txns had additional =
constraints that <br><br>=C2=A0 - each input must be signed {SIGHASH_SINGLE=
,SIGHASH_NONE}|ANYONECANPAY,<br>=C2=A0 - the txn must be specified RBFable,=
<br>=C2=A0 - a replacement for the sponsor txn must raise the sponsor feera=
te, <br>=C2=A0 =C2=A0 including ancestors (maybe this is inherent in &quot;=
is RBFable,&quot; but <br>=C2=A0 =C2=A0 I don&#39;t want to conflate absolu=
te feerates into this).<br><br>That way, there is still at most a single sp=
onsor txn per txid in the<br>mempool, but anyone can &quot;mix in&quot; inp=
uts which bump the effective<br>feerate of the sponsor.<br><br>This may not=
 be the exact solution we want, but I think it demonstrates<br>that the spo=
nsors design has some flexibility and merits some thinking.<br><br>The seco=
nd objection about sponsors was<br><br>2. (from Suhas) sponsors break the c=
lassic invariant: &quot;once a valid<br>=C2=A0 =C2=A0transaction is created=
, it should not become invalid later on unless <br>=C2=A0 =C2=A0the inputs =
are double-spent.&quot;<br><br>This doesn&#39;t seem like a huge concern to=
 me if you consider the txid<br>being sponsored as a sort of spiritual inpu=
t to the sponsor. While the<br>theoretical objection against broadening whe=
re one has to look in a txn<br>to determine its dependencies is understanda=
ble, I don&#39;t see what the<br>practical cost here is. <br><br>Reorg comp=
lexity seems comparable if not identical, especially if we<br>broaden spons=
or rules to allow blocks to contain sponsor txns that are<br>both for txids=
 in the same block _or_ already included in the chain.<br><br>This theoreti=
cal concession seems preferable to heaping more rules onto<br>an already la=
byrinthine mempool policy that is difficult for both<br>implementers and us=
ers to reason about practically and conceptually.<br><br>A third objection =
that wasn&#39;t posed, IIRC, but almost certainly would<br>be:<br><br>3. Tr=
ansaction sponsors requires a soft-fork.<br><br>Soft-forks are no fun, but =
I&#39;ll tell you what also isn&#39;t fun: being on<br>the hook to model (a=
nd sometimes implement) a dizzying potpourri of<br>mempool policies and spe=
cial-cases. Expecting wallet implementers to<br>abide by a maze of rules fa=
ithfully in order to ensure txn broadcast and<br>fee management invites bug=
s for perpetuity and network behavior that is<br>difficult to reason about =
a priori. Use of CPFP in the long-term also<br>risks needless chain waste.<=
br><br>If a soft-fork is the cost of cleaning up this essential process,<br=
>consideration should be given to paying it as a one-time cost. This<br>top=
ic merits a separate post, but consider that in the 5 years leading<br>up t=
o the 2017 SegWit drama, we averaged about a soft-fork a year.<br>Uncontrov=
ersial, &quot;safe&quot; changes to the consensus protocol shouldn&#39;t be=
<br>out of the question when significant practical benefit is plain to see.=
<br><br>---<br><br>I hope this message has added some framing to the discus=
sion on fees,<br>as well prompting other participants to go back and give t=
he<br>transaction sponsor proposal a serious look. The sponsors interface i=
s<br>about the simplest I can imagine for wallets, and it seems easy to<br>=
reason about for implementers on Core and elsewhere. =C2=A0 =C2=A0 =C2=A0 =
=C2=A0<br><br>I&#39;m not out to propose soft-forks lightly, but the curren=
t complexity<br>in fee management feels untenable, and as evidenced by all =
the<br>discussion lately, fees are an increasingly crucial part of the syst=
em. <br><br><br><br>[0]: <a href=3D"https://lists.linuxfoundation.org/piper=
mail/bitcoin-dev/2022-January/019817.html" target=3D"_blank">https://lists.=
linuxfoundation.org/pipermail/bitcoin-dev/2022-January/019817.html</a><br>[=
1]: <a href=3D"https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2020=
-September/018168.html" target=3D"_blank">https://lists.linuxfoundation.org=
/pipermail/bitcoin-dev/2020-September/018168.html</a><br></div></div>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--0000000000001cc56a05d7b20ae1--