Skip to content

Commit 3b286ea

Browse files
delta1delta1
committed
init: elip for discounted CT
1 parent 3df95e2 commit 3b286ea

File tree

2 files changed

+147
-2
lines changed

2 files changed

+147
-2
lines changed

‎elip-0150.mediawiki

+1-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
  Author: Andrew Poelstra <[email protected]>
66
          Tim Ruffing <[email protected]>
77
  Comments-Summary: No comments yet.
8-
  Comments-URI: https://github.com/ElementsProject/elips/wiki/Comments:ELIP-????
8+
  Comments-URI: https://github.com/ElementsProject/elips/wiki/Comments:ELIP-0150
99
  Status: Draft
1010
  Type: Standards Track
1111
  Created: 2022-10-06
@@ -190,4 +190,3 @@ Finally, the following are invalid test vectors that should not be parseable:
190190
==Acknowledgements==
191191
192192
We would like to thank Leo Comandini for describing practical requirements by wallet authors, and to Jonas Nick for providing feedback on the cryptographic design.
193-

‎elip-XXXX.mediawiki

+146
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
<pre>
2+
  ELIP: XXX
3+
  Layer: Applications
4+
  Title: Discounted fees for Confidential Transactions
5+
  Author: Byron Hambly <[email protected]>
6+
  Comments-Summary: No comments yet.
7+
  Comments-URI: https://github.com/ElementsProject/elips/wiki/Comments:ELIP-XXXX
8+
  Status: Draft
9+
  Type: Standards Track
10+
  Created: 2024-02-23
11+
  License: BSD-3-Clause
12+
</pre>
13+
14+
==Introduction==
15+
16+
===Abstract===
17+
18+
This document proposes a method of reducing fees for Confidential Transactions.
19+
It specifies the calculation that wallets can use to determine the discounted fee, as well
20+
as changes necessary to the Elements node for relaying and mining these discounted transactions.
21+
22+
===Copyright===
23+
24+
This document is licensed under the 3-clause BSD license.
25+
26+
===Motivation===
27+
28+
In Elements, Confidential Transactions (CT) are approximately ten times larger than ordinary explicit transactions.
29+
Output amounts are replaced with Pedersen commitments, and they include an additional asset commitment and an ECDH ephemeral key.
30+
Outputs also have additional witness data: a Range Proof that the amount value is in a valid range, and a Surjection Proof
31+
that the output asset matches an input asset.
32+
33+
Since they are larger, CT require an order of magnitude higher transaction fee than explicit transactions.
34+
This means there may be some incentive for a fee-minimizing actor to prefer explicit transactions over the privacy gains from CT.
35+
In order to incentivize CT, this ELIP proposes a policy change in Elements that would accept and relay CT at a discounted fee rate.
36+
With this discount, fees for CT are in the same order of magnitude as explicit transactions, and there is less incentive to use explicit transactions.
37+
38+
==Design==
39+
40+
===Overview===
41+
42+
A new calculation for "discount virtual size" (discountvsize) is proposed.
43+
In explicit transactions, this is precisely the same as the transaction's vsize. In CT, for each confidential output in the transaction,
44+
the transaction weight is reduced before the virtual transaction size calculation.
45+
46+
For wallets, this discount calculation is used during transaction creation for fee estimation, presuming that the connected Elements
47+
node has the respective setting to accept and relay such discounted CT.
48+
49+
For nodes, this discount calculation is used during mempool
50+
acceptance validation and during peer messaging when determining which transactions to relay.
51+
52+
===Drawbacks===
53+
54+
By using the discountvsize for fee calculation, discounted CT have a lower ''real'' fee rate than the fee rate specified during
55+
transaction creation. Currently, the block assembler first selects transaction packages with the highest ancestor fee rates.
56+
This means discounted CT will only be selected after explicit transactions and undiscounted CT at the same nominal fee rates.
57+
The proposed solution is to change transaction ordering in the block assembler to fee rate according to the discounted virtual
58+
size. This means the block template no longer maximizes fees, which is considered an acceptable trade-off for prioritizing CT
59+
privacy with reduced fees.
60+
61+
===Specification===
62+
63+
====Wallet====
64+
65+
Wallets can construct their transactions as normal, with a placeholder amount in a fee output. After filling in dummy signatures,
66+
the transaction weight should be calculated according to BIP-0141<ref>BIP-0141: https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki#Transaction_size_calculations</ref>:
67+
68+
<code>Weight = Base transaction size * 3 + Total transaction size</code>
69+
70+
Where:
71+
72+
<code>Base transaction size</code> is the size of the transaction serialized with the witness data stripped.
73+
74+
<code>Total transaction size</code> is the transaction size in bytes serialized as described in BIP-0144<ref>BIP-0144: https://github.com/bitcoin/bips/blob/master/bip-0144.mediawiki#user-content-Serialization</ref>, including base data and witness data.
75+
76+
To calculate the discount weight, for each output:
77+
78+
* subtract the weight of the output witness if any, leaving 2 bytes that encode an empty witness
79+
* subtract 24 bytes if the amount is a commitment, the difference between commitment (33 bytes) and explicit amount (9 bytes)
80+
* subtract 32 bytes if the nonce is a commitment, the difference between commitment (33 bytes) and no nonce (1 byte)
81+
82+
Then calculate discountvsize as <code>(discount weight + 3) / 4</code>, and set the fee output amount to <code>chosen fee rate * discountvsize</code>.
83+
84+
Fee outputs can be ignored for the purposes of the discount calculation, since they have no witness or nonce, and the amount is explicit.
85+
86+
=====Example calculation=====
87+
88+
Transaction from LiquidV1<ref>https://blockstream.info/liquid/tx/221c8a8bb81d1e33f3b6556ec9eb10815469ff02fd4bb4dd5127442eaa16d988</ref>:
89+
90+
This transaction has 2 confidential outputs and 1 fee output.
91+
92+
Weight: 10536 WU
93+
94+
* Subtract first output witness (4277) - 2: 10536 - 4275 = 6261
95+
* Subtract 24 for amount commitment: 6261 - 24 = 6237
96+
* Subtract 32 for nonce commitment: 6237 - 32 = 6205
97+
* Subtract second output witness (4277) - 2: 6205 - 4275 = 1930
98+
* Subtract 24 for amount commitment: 1930 - 24 = 1906
99+
* Subtract 32 for nonce commitment: 1906 - 32 = 1874
100+
101+
Discount Weight: 1874 WU
102+
103+
Discount Virtual Size: (1874 + 3) / 4 = 469 vB
104+
105+
====Node====
106+
107+
Nodes should add a new configuration option to define whether they accept and relay these discounted CT.
108+
In the reference implementation this is called "accept_discount_ct".
109+
When this configuration option is enabled, the node must use the discountvsize instead of vsize when calculating the
110+
fee rate for acceptance to its mempool, and for responding to inventory messages at its peers' given filter fee rates.
111+
112+
In the block template assembler, ordering by ancestor fee rate should also be changed to use fee per discountvsize instead of fee per vsize.
113+
114+
==Backwards Compatibility==
115+
116+
Transactions at any fee rate, or even without a fee output, are consensus valid on LiquidV1 and can be included in blocks
117+
by default in Elements. At the current default minimum fee rate in Elements (0.1 sats/vb), discounted CT as specified above will
118+
not meet the minimum fee rate to be relayed by un-upgraded nodes. As long as the discounted CT can be relayed via upgraded
119+
nodes to a block miner (or signer) node, then it can be included in a block. This becomes easier as more nodes upgrade to
120+
accept discount CT.
121+
122+
The following table outlines if the different transaction types will be relayed by un-upgraded nodes, and upgraded nodes configured
123+
to accept discount CT:
124+
125+
{| class="wikitable" style="margin:auto"
126+
|-
127+
! Transaction Type !! Un-upgraded Node !! Upgraded node
128+
|-
129+
| Explicit || Yes || Yes
130+
|-
131+
| Normal CT || Yes || Yes
132+
|-
133+
| Discount CT || No || Yes
134+
|}
135+
136+
==Reference Implementation==
137+
138+
https://github.com/ElementsProject/elements/pull/1317
139+
140+
==Alternate Implementation==
141+
142+
https://github.com/ElementsProject/rust-elements/pull/204
143+
144+
==References==
145+
146+
<references />

0 commit comments

Comments
 (0)