MIME-Version: 1.0
References: <CAD5xwhjmu-Eee47Ho5eA6E6+aAdnchLU0OVZo=RTHaXnN17x8A@mail.gmail.com>
 <20210704011341.ddbiruuomqovrjn6@ganymede>
 <CAD5xwhimPBEV_tLpSPxs9B+XGUhvPx_dnhok=8=hyksyi4=B6g@mail.gmail.com>
 <20210704203230.37hlpdyzr4aijiet@ganymede>
 <5keA_aPvmCO5yBh_mBQ6Z5SwnnvEW0T-3vahesaDh57f-qv4FbG1SFAzDvT3rFhre6kFl282VsxV_pynwn_CdvF7fzH2q9NW1ZQHPH1pmdo=@protonmail.com>
 <CAMZUoKnuRXNG1pyupHrL+Wo80TXTbADVrexoB=+BKC633v-qMw@mail.gmail.com>
 <CAGpPWDZ6FhAn+dBf-_yf7YVzRB7NWV7zaKqKYewgZecBxWUx5A@mail.gmail.com>
In-Reply-To: <CAGpPWDZ6FhAn+dBf-_yf7YVzRB7NWV7zaKqKYewgZecBxWUx5A@mail.gmail.com>
From: "Russell O'Connor" <roconnor@blockstream.com>
Date: Tue, 6 Jul 2021 07:26:28 -0400
Message-ID: <CAMZUoKkAUodCT+2aQG71xwHYD8KXeTAdQq4NmXZ4GBe0pcD=9A@mail.gmail.com>
To: Billy Tetrud <billy.tetrud@gmail.com>
Content-Type: multipart/alternative; boundary="0000000000000a849f05c672b2e4"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Unlimited covenants,
 was Re: CHECKSIGFROMSTACK/{Verify} BIP for Bitcoin
Precedence: list

--0000000000000a849f05c672b2e4
Content-Type: text/plain; charset="UTF-8"

On Tue, Jul 6, 2021 at 2:26 AM Billy Tetrud <billy.tetrud@gmail.com> wrote:

> >  when people are talking about enabling covenants, we are talking about
> whether OP_CAT should be allowed or not
>
> Are they? Are you implying that anything that enables covenants is
> equivalent to enabling OP_CAT? Generally when I think about enabling
> covenants, I'm thinking more about OP_CTV (or some similarly specific
> opcode
> <https://github.com/fresheneesz/bip-efficient-bitcoin-vaults/blob/main/bip-constraindestination.md>
> ).
>
> > OP_TWEAK
>
> I wasn't able to find anything about what that is. Would you mind
> clarifying what that concept is?
>

In tapscript one can generally recover the current input's scriptPubkey
through sighash introspection via the usual covenant tricks.  This allows
you to make a recursive covenant by spending funds back to the same
identical scriptPubkey.  However, in order for a recursive covenant to be
actually interesting, there needs to be some sort of state update in each
transition.  If there is no state update then sending funds back to itself
is of very limited value.  It will reset the timer on relative locks, but
that is about all.

The "normal" way of writing useful recursive covenants is to modify the
scriptPubkey by changing a fragment of it that contains some sort of
state.  However in order to update a tapscript pubkey one needs to apply
not only hashing, to create a Merkel root, but also to create a tweaked
taproot pubkey that commits to this root.  While script currently comes
with a SHA-256 hashing opcode, there is no opcode that will let you perform
the necessary tweaking to create a taproot scriptPubkey.

But as I mentioned afterwards, there are other places in the UTXO that you
could put data in order to perform a state update.

--0000000000000a849f05c672b2e4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail=
_attr">On Tue, Jul 6, 2021 at 2:26 AM Billy Tetrud &lt;<a href=3D"mailto:bi=
lly.tetrud@gmail.com">billy.tetrud@gmail.com</a>&gt; wrote:<br></div><block=
quote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1=
px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">&gt;=C2=A0

when people are talking about enabling covenants, we are talking about whet=
her OP_CAT should be allowed or not<div><br></div><div>Are they? Are you im=
plying that anything that enables covenants is equivalent to enabling OP_CA=
T? Generally when I think about enabling covenants, I&#39;m thinking more a=
bout OP_CTV (or some similarly specific <a href=3D"https://github.com/fresh=
eneesz/bip-efficient-bitcoin-vaults/blob/main/bip-constraindestination.md" =
target=3D"_blank">opcode</a>).</div><div><br></div><div>&gt; OP_TWEAK=C2=A0=
</div><div><br></div><div>I wasn&#39;t able to find anything about=C2=A0wha=
t that is. Would you mind clarifying what that concept is? <br></div></div>=
</blockquote><div><br></div><div>In tapscript one can generally recover the=
 current input&#39;s scriptPubkey through sighash introspection via the usu=
al covenant tricks.=C2=A0 This allows you to make a recursive covenant by s=
pending funds back to the same identical scriptPubkey.=C2=A0 However, in or=
der for a recursive covenant to be actually interesting, there needs to be =
some sort of state update in each transition.=C2=A0 If there is no state up=
date then sending funds back to itself is of very limited value.=C2=A0 It w=
ill reset the timer on relative locks, but that is about all.</div><div><br=
></div><div>The &quot;normal&quot; way of writing useful recursive covenant=
s is to modify the scriptPubkey by changing a fragment of it that contains =
some sort of state.=C2=A0 However in order to update a tapscript pubkey one=
 needs to apply not only hashing, to create a Merkel root, but also to crea=
te a tweaked taproot pubkey that commits to this root.=C2=A0 While script c=
urrently comes with a SHA-256 hashing opcode, there is no opcode that will =
let you perform the necessary tweaking to create a taproot scriptPubkey.</d=
iv><div><br></div><div>But as I mentioned afterwards, there are other place=
s in the UTXO that you could put data in order to perform a state update.<b=
r></div></div></div>

--0000000000000a849f05c672b2e4--