path: root/52/e012a6d73774e77168a1feda4b4ce5ac48b307

Delivery-date: Mon, 24 Mar 2025 15:01:05 -0700
Received: from mail-oo1-f60.google.com ([209.85.161.60])
	by mail.fairlystable.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.94.2)
	(envelope-from <bitcoindev+bncBDSJ7DXSQ4PRBF5MQ67QMGQEGT6NSOA@googlegroups.com>)
	id 1twpqy-0002M8-C4
	for bitcoindev@gnusha.org; Mon, 24 Mar 2025 15:01:05 -0700
Received: by mail-oo1-f60.google.com with SMTP id 006d021491bc7-602513d2204sf654270eaf.3
        for <bitcoindev@gnusha.org>; Mon, 24 Mar 2025 15:01:04 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1742853659; cv=pass;
        d=google.com; s=arc-20240605;
        b=hZgZ31KTD06wuvFLAv2NT9Vc/HmTvet4YpBREppoUlZHZIHTO/9LVfF3mB+PGXicuj
         Pkq5kFrs/Mi9B8GJ4MAPn4OlomKVy5OS3AnzQcPQtsf4DTyhne7KF5jP4W91qKMlnAiQ
         lylqNB3FW/vRmLqDDfZ4+IgQrVEtnPRAMqMOUyirT3rAb2wWSpTnVniWmOCVZPLJqMW9
         +wPjYhm2HmbuB9RgwhsTkMXc7ajCW70VqaBO8dz3M1Rj3AdEMDPQEnni5s/6/HGxFHzG
         UTPnNQTUXZvWXTNfq5hdeX1wSrZ8s7vljdmgg/xXd9ADOXwPShvMgMTrN1u3twqO827+
         T5Tg==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:content-transfer-encoding:cc:to
         :subject:message-id:date:from:in-reply-to:references:mime-version
         :sender:dkim-signature:dkim-signature;
        bh=IKiKY2YJkoOD7CGWqqMlrbUByI5lRNhfsBqzSaT5ncA=;
        fh=WDTKurnwgMjpMRgkUPdwgVkJ9nfAxXkKzOfScinmNVc=;
        b=X5z9GNICLW1e/gYunwdh/H7Luus1z46ESYX4o4zgWB7dklk7SJeS00mtrM07scONxf
         reQ5MJM08BJ2T0gik8mQOZOcZWGIe4ALlVoBzNQ3UdVvx5gxPIfSeQEvUmVKv1BcV3qo
         kXlZf+elJfzGvlAH6nj/34u0e5YV85SUkXdQAu0b/aUIWmRYo5peyuhF6IkKKTPiaUcN
         ytBge4k0bgi6MZrSPBEzI6PWqCrtmU10WXvJzYf2ooBRatkztIfg9TL9wxBA4STkzGb1
         HPYHJchrKvX7J9rhVGn255pfku+8tVelOjEaZ0Tntpd3lXWg5i8SCuHyVPbhihy463BV
         jOEQ==;
        darn=gnusha.org
ARC-Authentication-Results: i=2; gmr-mx.google.com;
       dkim=pass header.i=@gmail.com header.s=20230601 header.b="TN1gcG/I";
       spf=pass (google.com: domain of eth3rs@gmail.com designates 2a00:1450:4864:20::634 as permitted sender) smtp.mailfrom=eth3rs@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@googlegroups.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlegroups.com; s=20230601; t=1742853659; x=1743458459; darn=gnusha.org;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:content-transfer-encoding:cc:to:subject
         :message-id:date:from:in-reply-to:references:mime-version:sender
         :from:to:cc:subject:date:message-id:reply-to;
        bh=IKiKY2YJkoOD7CGWqqMlrbUByI5lRNhfsBqzSaT5ncA=;
        b=E7o52M4kzS5FDDEcs8a2cig93wiDNQul71SWHy0SJ9tXWFsP99GhHCM+RU6f2h6Q1N
         110V3brWj8CrVGuc1GtMnWkvPR3TV6HvmntHxxz3OfYlTFy7IBcEMyMX9P5f9DQKNmiW
         3Wmtv61DEqf9b7cPOIZc3tqXiGwvsA/L1wrUmoHaOh7UgGI/9p6eAfnaQBcO5MS4E5Pn
         HrNZe2oPnx8R2AaaeLPxWEomMoG/KI0BakzDcs1maHSpNPRyLWBkzIvJyxFZG68sF4J5
         zdBOgu5Rh554HIQwZ+e3WyzbQ+gDozGLfneY3MOB9XLO+ECdvQY9mB9YBKjvX4cF854i
         mFVw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1742853659; x=1743458459; darn=gnusha.org;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:content-transfer-encoding:cc:to:subject
         :message-id:date:from:in-reply-to:references:mime-version:from:to:cc
         :subject:date:message-id:reply-to;
        bh=IKiKY2YJkoOD7CGWqqMlrbUByI5lRNhfsBqzSaT5ncA=;
        b=i8zXk1W1eZiAl8T54eiGnbXZkT2dBZ4izYGh7jWP36/ppt21ynsLBG8jCiDO0nitvS
         3ys5HSqEqZJX+6MAEZixWRYyXHZgCSpGUdcyFoB27zEHswunLlhhJF74HJej3d2/fy65
         1JVT33w34kbA7En7UV76GexzzRbJ2FMi0Es6jpeO35PT9vPQbs8o2y660WqcWbuoqAE7
         LsU9J7sEHdWSM0D7lotk0alqyc8652zdif/koBsN/EWesx0N6wTwrUvp1sgpwvjreCjo
         eiPlILc+QOltmNPctrQd/xrR9z4DUmXMI4O7rq8iWeL2t4IFei+YOE93MxeiheX5xI7N
         YGkw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1742853659; x=1743458459;
        h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post
         :list-id:mailing-list:precedence:x-original-authentication-results
         :x-original-sender:content-transfer-encoding:cc:to:subject
         :message-id:date:from:in-reply-to:references:mime-version
         :x-beenthere:x-gm-message-state:sender:from:to:cc:subject:date
         :message-id:reply-to;
        bh=IKiKY2YJkoOD7CGWqqMlrbUByI5lRNhfsBqzSaT5ncA=;
        b=cXoPIisAuQIaA1rBRA0urrpfQovYgwKrEAE1lc+r9n+NChns3wSesIiiCgymejyvXY
         8rHT0KfaTtVFO7t+s9ZMj/mb3ZULQdNg+vWopVkDb3QFjZa4P73qTnQQTQrygu+6CDx/
         wTXFa2/15igcoP8dTm1XnlaQoXZUruu5sLevTmhqvLSpzRUQBzNfvtohUz8R0k0y4Jya
         CIjo6UB04v6yOsH0I+TbIzAwdDuGsae7M3pHN0Ax9Zdt1YFWK3ddBgKIeXxp1xuGwkxR
         nQWjSrP5j1E4Qvx37GuIWlLJMiZCz/dYXAqQLqr4ialc3W0WR0f73a517TqulVPpEpQ7
         rmAw==
Sender: bitcoindev@googlegroups.com
X-Forwarded-Encrypted: i=2; AJvYcCXh6XIpFTExWt15eCa0t1a9FDrk2hs2L9xUzzNrZazUM18GJGQESoDDuaWtOFVsDXTkhpm/KP7+4LJ6@gnusha.org
X-Gm-Message-State: AOJu0YycX6cPpNPKaSIW9bp8BnnGb0pp43tX823cHgGTs6lNp0jgGNNB
	jLmBJpcWKyWJjb2c1mpI4j0XzAfDTNZtmCQeDacE3j0H7+wZxSvv
X-Google-Smtp-Source: AGHT+IG+IozU4GmbrJjfTJgCvAWFtuLkRaKoaPSUJE7bCHHrQMfEmGKxRygUDNoTlqMVr/eJsNsHrw==
X-Received: by 2002:a05:6820:248b:b0:601:b2b6:aa5 with SMTP id 006d021491bc7-602345f188fmr6074857eaf.2.1742853658332;
        Mon, 24 Mar 2025 15:00:58 -0700 (PDT)
X-BeenThere: bitcoindev@googlegroups.com; h=ARLLPAJLCU2mCFejli37MbOoeMycoboUPJvZBHksikbktQ2qqw==
Received: by 2002:a05:6820:1c9a:b0:601:adb5:189a with SMTP id
 006d021491bc7-60229605798ls1670345eaf.1.-pod-prod-06-us; Mon, 24 Mar 2025
 15:00:55 -0700 (PDT)
X-Received: by 2002:a05:6808:6b8a:b0:3fb:2937:937c with SMTP id 5614622812f47-3febf7016c3mr9922621b6e.6.1742853655497;
        Mon, 24 Mar 2025 15:00:55 -0700 (PDT)
Received: by 2002:a05:600c:35d1:b0:43c:fd8b:faa8 with SMTP id 5b1f17b1804b1-43d504e9dd8ms5e9;
        Mon, 24 Mar 2025 14:51:57 -0700 (PDT)
X-Received: by 2002:a05:600c:4995:b0:43c:ed33:a500 with SMTP id 5b1f17b1804b1-43d491b7dc5mr146195965e9.10.1742853115851;
        Mon, 24 Mar 2025 14:51:55 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1742853115; cv=none;
        d=google.com; s=arc-20240605;
        b=BOMrE5RoHpZjOdNkpy6mo5qMTI8NmYyV3Kp7kjSZSssXzpxcxtC4nbak77fZHiUqwF
         FHoR7PVFPkcLY30lxm07hgk+1+oEHFtn9ThX0OGZN/r1E4FnUMJa/4pSEYDtWiLNSW1P
         krC04+o7ItH7Jl56TyBhs2Q19xpUyso7ZZbcDsOAq4Fz8SOyFp7ZvC04Aj0KmkseN222
         CkIkGaNZLCQI2pHttcTJQLswTTeUa7J2nfBfT1I5iZNAjLQURYkffJqsxNgLBP0QERsb
         /GlDFzctbu7Lq/Pq//izbaoHCH724w0Puu4My0kYnsMPCk6oNmZ1wQUTx0MXpMzU3RFF
         Ljpw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=content-transfer-encoding:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:dkim-signature;
        bh=yxePTfCdf4n3+GffNitsPsKRXYqTHrSe//lI8NBUrww=;
        fh=oW5/5oUmRRMvy96u/Fl5uZTynMYP3W/WShfBcMiH4EY=;
        b=B8uCBNBZYEdwkcqsQZo8YJFX36OceRvkOOkh988+4xjRYqsMXOlEX11d4rhMWbDIC5
         MoqENc3cP3kQ0A6D4KPv6yOdocSMdsjc9JbrsL8szzLXWWx8pHe+SAPjqkxdEbCzTpzU
         Vc4oxelhB7k2IxAOzpOqEEODHOx9isB17lGvnp9jh/gz2wiMl9QwfHId7B85lBpBRUn+
         JZ2GptwbMvqhcTUJk1BgsI6MTyU4C6eyV3vbULKutcSZU49eA1EsTzWlbwopEAeu4kDu
         thFsVDn0vdbdyH7G8I6J7I7aSO4H24Hlb74cdS6ODql0b+2TKCH92SUiEqejJ+c3Qp0o
         mqBg==;
        dara=google.com
ARC-Authentication-Results: i=1; gmr-mx.google.com;
       dkim=pass header.i=@gmail.com header.s=20230601 header.b="TN1gcG/I";
       spf=pass (google.com: domain of eth3rs@gmail.com designates 2a00:1450:4864:20::634 as permitted sender) smtp.mailfrom=eth3rs@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@googlegroups.com
Received: from mail-ej1-x634.google.com (mail-ej1-x634.google.com. [2a00:1450:4864:20::634])
        by gmr-mx.google.com with ESMTPS id 5b1f17b1804b1-43d6ddf25afsi87035e9.0.2025.03.24.14.51.55
        for <bitcoindev@googlegroups.com>
        (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
        Mon, 24 Mar 2025 14:51:55 -0700 (PDT)
Received-SPF: pass (google.com: domain of eth3rs@gmail.com designates 2a00:1450:4864:20::634 as permitted sender) client-ip=2a00:1450:4864:20::634;
Received: by mail-ej1-x634.google.com with SMTP id a640c23a62f3a-ac2aeada833so914625666b.0
        for <bitcoindev@googlegroups.com>; Mon, 24 Mar 2025 14:51:55 -0700 (PDT)
X-Gm-Gg: ASbGncug4kjPg0HR8M7RvodtaQ+uGvrMPWMTMpea9U5+murlXcVchvKKPO9/mRJrtm0
	pAKzEsUrJdDtFrhBblSgJ6Pel8XijEAzxWrDnXZt6DRjjb3rrGu3Ozp+AnWd3M/BC8y1R/Ik9gM
	Xq9Fd1c5Fz8h0y9rWmIOx9E1uBcY7xsF6QkU3fqusObxeWofVm3CtMfocSwEVOARYMTA3Ctkc=
X-Received: by 2002:a17:907:cd04:b0:abf:6d1c:8f4a with SMTP id
 a640c23a62f3a-ac3cdf883cemr1931584866b.18.1742853114919; Mon, 24 Mar 2025
 14:51:54 -0700 (PDT)
MIME-Version: 1.0
References: <CAEM=y+V_jUoupVRBPqwzOQaUVNdJj5uJy3LK9JjD7ixuCYEt-A@mail.gmail.com>
 <da040025-3ddd-4333-9c64-b4aab483ebb2n@googlegroups.com>
In-Reply-To: <da040025-3ddd-4333-9c64-b4aab483ebb2n@googlegroups.com>
From: Ethan Heilman <eth3rs@gmail.com>
Date: Mon, 24 Mar 2025 17:51:18 -0400
X-Gm-Features: AQ5f1JrzsD1GQzWf3wQnyO70mNRMEVOylXLKayZXHVfBbWxvXf4lEbcMC_Hhwgg
Message-ID: <CAEM=y+VqDLC_2nBUk+iDLiP=H3tc3tgSb1A-diAxw=AZch24Xw@mail.gmail.com>
Subject: Re: [bitcoindev] Re: Slashing covenants
To: Hunter Beast <hunter@surmount.systems>
Cc: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Original-Sender: eth3rs@gmail.com
X-Original-Authentication-Results: gmr-mx.google.com;       dkim=pass
 header.i=@gmail.com header.s=20230601 header.b="TN1gcG/I";       spf=pass
 (google.com: domain of eth3rs@gmail.com designates 2a00:1450:4864:20::634 as
 permitted sender) smtp.mailfrom=eth3rs@gmail.com;       dmarc=pass (p=NONE
 sp=QUARANTINE dis=NONE) header.from=gmail.com;       dara=pass header.i=@googlegroups.com
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com
List-ID: <bitcoindev.googlegroups.com>
X-Google-Group-Id: 786775582512
List-Post: <https://groups.google.com/group/bitcoindev/post>, <mailto:bitcoindev@googlegroups.com>
List-Help: <https://groups.google.com/support/>, <mailto:bitcoindev+help@googlegroups.com>
List-Archive: <https://groups.google.com/group/bitcoindev
List-Subscribe: <https://groups.google.com/group/bitcoindev/subscribe>, <mailto:bitcoindev+subscribe@googlegroups.com>
List-Unsubscribe: <mailto:googlegroups-manage+786775582512+unsubscribe@googlegroups.com>,
 <https://groups.google.com/group/bitcoindev/subscribe>
X-Spam-Score: -0.5 (/)

> What are some of the advantages of using slashing covenants instead of Bi=
tVM? Could this make the approach more practical?

You could use this as a separate mechanism to get covenants and then
use those covenants in BitVM. Is that useful to BitVM, I don't know,
someone who is a BitVM expert can supply a better answer.

> Does this absolutely require OP_CAT to work?

This does not require OP_CAT to work at all. It works today.

> What is the rough size of such a transaction?

SHA256 costs about 211kb of small script per compression function call
[0]. I think, if you are clever, you might be able to get away with
only one compression function call rather than two. Not sure how big
the ECC math would be. We could merklize some of the computation via
tapleaf, but probably at least a few hundred kilobytes.

That said, this huge slash transaction is only postable if the party
who vouched for the covenant spend cheats. The large size is actually
a feature not a bug to ensure the stake is burned rather than
reclaimed.

[0]: https://github.com/TomerStarkware/BitVM/tree/tomer/main

On Mon, Mar 24, 2025 at 9:55=E2=80=AFAM Hunter Beast <hunter@surmount.syste=
ms> wrote:
>
> I'm surprised nobody's noticed this. It's an interesting approach. I woul=
dn't discount it because it relies on incentives, since bitcoin mining itse=
lf is secure only through cryptoeconomic incentives, and yet that's good en=
ough. Plenty of things on bitcoin aren't perfect, but they're good enough t=
o do the job.
>
> Some questions...
> - What are some of the advantages of using slashing covenants instead of =
BitVM? Could this make the approach more practical?
> - Does this absolutely require OP_CAT to work?
> - What is the rough size of such a transaction?
>
> On Sunday, November 24, 2024 at 2:26:20=E2=80=AFPM UTC-7 Ethan Heilman wr=
ote:
>>
>> Slashing covenants is a protocol for covenants in Bitcoin via
>> incentives. A covenant is a set of rules about what transactions can
>> spend a Bitcoin output which is encumbered by that covenant. Typically
>> a covenant is enforced by preventing someone from spending that
>> output. In this protocol we instead allow the spending of the output
>> and then punish the spender by a loss of funds, i.e. we slash them, if
>> they do not follow the rules of the covenant. This is less secure than
>> a covenant enforced by an opcode, FE or ColliderScript, because it
>> relies on incentives over enforcement. The advantage of this approach
>> is that it is efficient, does not add new cryptographic assumptions
>> and is possible on Bitcoin today.
>>
>> This protocol uses very similar mechanisms to BitVM, originally I
>> thought this was how BitVM worked, which is why I didn=E2=80=99t publish=
 it.
>> After talking to many people it appears this technique is not used in
>> BitVM.
>>
>>
>> Notation
>> =3D=3D=3D=3D
>> By <x>32 we denote a value, x, in Bitcoin Script which is encoded as a
>> list of 32-bit stack elements. We can perform arbitrary computation on
>> such values using Bitcoin=E2=80=99s math opcodes, a.k.a., Small Script.
>>
>> Protocol
>> =3D=3D=3D=3D
>> The essential problem for enforcing covenants in Bitcoin outputs is
>> showing that a signature s1 that will pass CHECKSIGVERIFY is equal to
>> a signature s2 encoded for Small Script. This is because once we get a
>> signature into Small Script, we extract the sighash and do transaction
>> introspection. ColliderScript gets us covenants by using hash
>> collisions to check equality between s1 and <s2>32. CAT gets us
>> covenants by simply concatenating all the <s2>32 and then comparing
>> against s1 using EQUAL:
>>
>> s2 =3D CAT(<s2>32 [0], <s2>32 [1], <s2>32 [2], =E2=80=A6 <s2>32 [15])
>> EQUAL s1, s2
>>
>> Slashing covenants works by removing the requirement for this equality
>> check, but instead providing a fraud proof ifs1!=3Ds2, and posting that
>> fraud proof to punish the spending party. To do this we construct a
>> Bitcoin script output which takes as input:
>>
>> s1 - the spending signature.
>> <s2>32 - the spending signature encoded in small script. An honest
>> spender will set s1 =3D s2.
>> L - a Lamport signature on <s2>32.
>> <txn data>32 - data about the spending transaction that we use to open
>> the sighash
>>
>> The Bitcoin script covenant output then:
>> 1. checks s1 is a valid spending signature.
>> 2. Checks that <s2>32 is validly signed by the Lamport signature L
>> 3. Supplies <s2>32 and <txn data>32 to Small Script which enforces the
>> covenant under the assumption that s1=3Ds2.
>>
>> Covenant output (s1, <s2>32, L, <txn data>32):
>> CHECKSIGVERIFY s1
>> Lamport-Verify <s2>32, L
>> SmallScript Enforce-Cov <s2>32, <txn data>32
>>
>> As long as s1=3Ds2 the covenant is enforced. However if s1!=3Ds2 the
>> covenant can be broken. To punish spenders who set s1!=3Ds2, we create
>> an output that allows anyone to burn/slash the coins of the rule
>> breaker if and only if they spent a covenant and supplied s1 and s2
>> such that s1!=3Ds2.
>>
>> The Bitcoin script slash output takes as input: <s1>32, <s2>32, and L.
>>
>> Slashing output (<s1>32, <s2>32, L):
>> SmallScript CHECKSIGVERIFY <s1>32
>> Lamport-Verify <s2>32, L
>> IF <s1>32 !=3D <s2>32: Verify
>>
>> Thus the slashing output can only be spent if the rule breaker spent
>> the covenant with s1!=3Ds2. SmallScript CHECKSIGVERIFY is used to prove
>> the rule breaker signed s1, the lamport signature is used to prove the
>> rule breaker signed s2. Thus, we have a fraud proof that the rule
>> breaker signed s1!=3Ds2. The Lamport signature is only used here to
>> avoid having to do ECC math in Small Script in the covenant.
>>
>> Note that because we are doing CHECKSIGVERIFY in Small Script, the
>> spending transaction will be massive. The slashing occurs because of
>> the fees incurred by spending the slashing transaction. Note that such
>> a slashing output could also be done on ethereum. This would simplify
>> the construction.
>>
>> For the purposes of explanation, we assumed the spender is also the
>> party who is slashed. In actual practice it is more likely you could
>> have a set of N slashable cosigners who could attest to a spend not
>> violating the covenant. Using pre-signed transactions you could
>> recover an output if all n slashable cosigners were indefinitely
>> offline. If you could fit a SNARKS in Small Script, you could have
>> people join and leave the cosigner set dynamically for already posted
>> covenant outputs by simply proving they have posted slash outputs and
>> that the value in covenants < value in slash outputs.
>
> --
> You received this message because you are subscribed to the Google Groups=
 "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to bitcoindev+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/bitcoinde=
v/da040025-3ddd-4333-9c64-b4aab483ebb2n%40googlegroups.com.

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/=
CAEM%3Dy%2BVqDLC_2nBUk%2BiDLiP%3DH3tc3tgSb1A-diAxw%3DAZch24Xw%40mail.gmail.=
com.