Delivery-date: Wed, 11 Dec 2024 22:15:40 -0800
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of weikeng.chen@l2iterative.com designates 2a00:1450:4864:20::131 as permitted sender) client-ip=2a00:1450:4864:20::131;
MIME-Version: 1.0
References: <ebd77d82-96ab-4530-909a-d085378b9868n@googlegroups.com>
 <Z1dAQ8pSIqn8XA56@camus> <Z1dp0Jtbrkcf7Roi@console> <87ttbccrql.fsf@rustcorp.com.au>
In-Reply-To: <87ttbccrql.fsf@rustcorp.com.au>
From: Weikeng Chen <weikeng.chen@l2iterative.com>
Date: Thu, 12 Dec 2024 11:17:12 +0800
Message-ID: <CAHNroFfAiBMFnUPxqAV-spGB_Nt2juf6-8J3bGAJbDQKM_w2bQ@mail.gmail.com>
Subject: Re: [bitcoindev] Difficulty in emulating "weaker" OP_SUCCESS and why
 it should be a real opcode
To: Rusty Russell <rusty@rustcorp.com.au>
Cc: Brandon Black <freedom@reardencode.com>, Andrew Poelstra <apoelstra@wpsoftware.net>, 
	Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Content-Type: multipart/alternative; boundary="0000000000002c6c8006290a27a7"
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

--0000000000002c6c8006290a27a7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I was mostly thinking about the names atm. OP_RETURN_TRUE may be a name
less confusing than OP_SUCCESS. It helps if one day we nickname/alias
OP_RETURN as OP_RETURN_FALSE.

This could eventually become an opcode BIP proposal that is pretty
causal---if a major soft fork happens (like the one that adds tapscript),
it could be piggybacked into it, otherwise, it would just stay as a
proposal as there is no urgency since it doesn't enhance the ability of
Bitcoin script (you can emulate it), but more to avoid bugs in code and for
clarity.

On Thu, Dec 12, 2024 at 10:54=E2=80=AFAM Rusty Russell <rusty@rustcorp.com.=
au>
wrote:

> Brandon Black <freedom@reardencode.com> writes:
> > Hey list,
> >
> > On 2024-12-09 (Mon) at 19:08:51 +0000, Andrew Poelstra wrote:
> >> On Mon, Dec 09, 2024 at 05:27:54AM -0800, Weikeng Chen wrote:
> >> > When I am implementing fraud proofs in Bitcoin script, I find it
> useful to
> >> > have an opcode "OP_SUCCESS" that will mark the execution to be
> successful
> >> > without running the rest of the script, if this opcode is being
> executed.
> >> > This is useful for writing code for fraud proofs such as BitVM, wher=
e
> the
> >> > verifier wins if it finds one mismatch, and the verifier does not
> need to
> >> > show the other mismatches.
> >> >
> >> > This OP_SUCCESS is weaker version of the OP_SUCCESSx in the Taproot
> >> > upgrade, which marks the execution as successful for the mere
> presence of
> >> > OP_SUCCESSx anywhere in the script. Rusty Russell in a 2023 article,
> >> > "Covenants: Examining ScriptPubkeys in Bitcoin Script", also
> mentioned
> >> > about the usefulness of such an opcode.
> >> >
> >> > <snip>
> >>
> >> In short, for purpose of softforking upgrade mechanism, the existing
> >> SUCCESS codes give us way more freedom of action.
> >>
> >> But it sounds like you want a "weak SUCCESS" opcode in order to use th=
e
> >> success semantics, not as an upgrade mechanism. Maybe it makes sense t=
o
> >> propose that one of the existing OP_SUCCESSx opcodes should be
> >> softforked to become OP_WEAK_SUCCESS?
> >
> > An alternative that Rusty Russel has discussed wanting as part of his
> > script restoration work is "OP_SEGMENT" which would split the script
> > execution for purposes of SUCCESS checking, allowing (for example) a
> > prefix to be required to execute before an arbitrary user provided
> > script that might contain an OP_SUCCESS.
> >
> > It occurred to me today when thinking about Weikeng's post that we can
> > slightly weaken the existing OP_SUCCESS behavior while retaining
> > essentially all of its benefits in practice without introducing
> > OP_SEGMENT by leveraging OP_CODESEPARATOR. Redefine OP_SUCCESS with a
> > soft fork from "make the script unconditionally valid" to "make the
> > script segment unconditionally valid", and define a script segment as
> > "each lexicographic section of the script containing no
> > OP_CODESEPARATOR".
> >
> > The script interpreter can perform SUCCESS checking as it currently doe=
s
> > until it encounters an OP_CODESEPARATOR. Each OP_CODESEPARATOR gets a
> > "SUCCESS" flag defaulted to false and SUCCESS checking now sets that
> > flag to true on the most recently encountered OP_CODESEPARATOR.
> >
> > During script execution, whenever an OP_CODESEPARATOR is popped (not
> > executed) its "SUCCESS" flag value is copied to the interpreter state.
> > After this state setting conditional, if the interpreter "SUCCESS" flag
> > is true, and fExec is true, the script immediately succeeds.
>
> Beware success inside branches?  This is why I preferred to segment the
> script and scan for OP_SUCCESS and evaluate each part in order (if you
> have part of an if statement inside one segment, you fail as expected).
> This is actually not that different inside Bitcoin's script.cpp.
>
> But that's kind of a detail.  IMHO there's nothing fundamentally wrong
> with runtime success opcodes, in fact several proposals work better if
> you allow them (e.g. "undefined bit patterns in operand to OP_TXHASH
> cause immediate success" lets you reserve some bits for future
> extension).
>
> (Also: OP_CODESEPARATOR is cursed, so I chose a different name :)
>
> Cheers,
> Rusty.
>

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/=
CAHNroFfAiBMFnUPxqAV-spGB_Nt2juf6-8J3bGAJbDQKM_w2bQ%40mail.gmail.com.

--0000000000002c6c8006290a27a7
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I was mostly thinking about the names atm. OP_RETURN_TRUE =
may be a name less confusing than OP_SUCCESS. It helps if one day we nickna=
me/alias OP_RETURN as OP_RETURN_FALSE.<div><br></div><div>This could eventu=
ally become an opcode BIP proposal that is pretty causal---if a major soft =
fork happens (like the one that adds tapscript), it could be piggybacked in=
to it, otherwise, it would just stay as a proposal as there is no urgency s=
ince it doesn&#39;t enhance the ability of Bitcoin script (you can emulate =
it), but more to avoid bugs in code and for clarity.</div></div><br><div cl=
ass=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_a=
ttr">On Thu, Dec 12, 2024 at 10:54=E2=80=AFAM Rusty Russell &lt;<a href=3D"=
mailto:rusty@rustcorp.com.au">rusty@rustcorp.com.au</a>&gt; wrote:<br></div=
><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border=
-left:1px solid rgb(204,204,204);padding-left:1ex">Brandon Black &lt;<a hre=
f=3D"mailto:freedom@reardencode.com" target=3D"_blank">freedom@reardencode.=
com</a>&gt; writes:<br>
&gt; Hey list,<br>
&gt;<br>
&gt; On 2024-12-09 (Mon) at 19:08:51 +0000, Andrew Poelstra wrote:<br>
&gt;&gt; On Mon, Dec 09, 2024 at 05:27:54AM -0800, Weikeng Chen wrote:<br>
&gt;&gt; &gt; When I am implementing fraud proofs in Bitcoin script, I find=
 it useful to <br>
&gt;&gt; &gt; have an opcode &quot;OP_SUCCESS&quot; that will mark the exec=
ution to be successful <br>
&gt;&gt; &gt; without running the rest of the script, if this opcode is bei=
ng executed. <br>
&gt;&gt; &gt; This is useful for writing code for fraud proofs such as BitV=
M, where the <br>
&gt;&gt; &gt; verifier wins if it finds one mismatch, and the verifier does=
 not need to <br>
&gt;&gt; &gt; show the other mismatches.<br>
&gt;&gt; &gt; <br>
&gt;&gt; &gt; This OP_SUCCESS is weaker version of the OP_SUCCESSx in the T=
aproot <br>
&gt;&gt; &gt; upgrade, which marks the execution as successful for the mere=
 presence of <br>
&gt;&gt; &gt; OP_SUCCESSx anywhere in the script. Rusty Russell in a 2023 a=
rticle, <br>
&gt;&gt; &gt; &quot;Covenants: Examining ScriptPubkeys in Bitcoin Script&qu=
ot;, also mentioned <br>
&gt;&gt; &gt; about the usefulness of such an opcode. <br>
&gt;&gt; &gt; <br>
&gt;&gt; &gt; &lt;snip&gt;<br>
&gt;&gt; <br>
&gt;&gt; In short, for purpose of softforking upgrade mechanism, the existi=
ng<br>
&gt;&gt; SUCCESS codes give us way more freedom of action.<br>
&gt;&gt; <br>
&gt;&gt; But it sounds like you want a &quot;weak SUCCESS&quot; opcode in o=
rder to use the<br>
&gt;&gt; success semantics, not as an upgrade mechanism. Maybe it makes sen=
se to<br>
&gt;&gt; propose that one of the existing OP_SUCCESSx opcodes should be<br>
&gt;&gt; softforked to become OP_WEAK_SUCCESS?<br>
&gt;<br>
&gt; An alternative that Rusty Russel has discussed wanting as part of his<=
br>
&gt; script restoration work is &quot;OP_SEGMENT&quot; which would split th=
e script<br>
&gt; execution for purposes of SUCCESS checking, allowing (for example) a<b=
r>
&gt; prefix to be required to execute before an arbitrary user provided<br>
&gt; script that might contain an OP_SUCCESS.<br>
&gt;<br>
&gt; It occurred to me today when thinking about Weikeng&#39;s post that we=
 can<br>
&gt; slightly weaken the existing OP_SUCCESS behavior while retaining<br>
&gt; essentially all of its benefits in practice without introducing<br>
&gt; OP_SEGMENT by leveraging OP_CODESEPARATOR. Redefine OP_SUCCESS with a<=
br>
&gt; soft fork from &quot;make the script unconditionally valid&quot; to &q=
uot;make the<br>
&gt; script segment unconditionally valid&quot;, and define a script segmen=
t as<br>
&gt; &quot;each lexicographic section of the script containing no<br>
&gt; OP_CODESEPARATOR&quot;.<br>
&gt;<br>
&gt; The script interpreter can perform SUCCESS checking as it currently do=
es<br>
&gt; until it encounters an OP_CODESEPARATOR. Each OP_CODESEPARATOR gets a<=
br>
&gt; &quot;SUCCESS&quot; flag defaulted to false and SUCCESS checking now s=
ets that<br>
&gt; flag to true on the most recently encountered OP_CODESEPARATOR.<br>
&gt;<br>
&gt; During script execution, whenever an OP_CODESEPARATOR is popped (not<b=
r>
&gt; executed) its &quot;SUCCESS&quot; flag value is copied to the interpre=
ter state.<br>
&gt; After this state setting conditional, if the interpreter &quot;SUCCESS=
&quot; flag<br>
&gt; is true, and fExec is true, the script immediately succeeds.<br>
<br>
Beware success inside branches?=C2=A0 This is why I preferred to segment th=
e<br>
script and scan for OP_SUCCESS and evaluate each part in order (if you<br>
have part of an if statement inside one segment, you fail as expected).<br>
This is actually not that different inside Bitcoin&#39;s script.cpp.<br>
<br>
But that&#39;s kind of a detail.=C2=A0 IMHO there&#39;s nothing fundamental=
ly wrong<br>
with runtime success opcodes, in fact several proposals work better if<br>
you allow them (e.g. &quot;undefined bit patterns in operand to OP_TXHASH<b=
r>
cause immediate success&quot; lets you reserve some bits for future<br>
extension).<br>
<br>
(Also: OP_CODESEPARATOR is cursed, so I chose a different name :)<br>
<br>
Cheers,<br>
Rusty.<br>
</blockquote></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/CAHNroFfAiBMFnUPxqAV-spGB_Nt2juf6-8J3bGAJbDQKM_w2bQ%40mail.gmail=
.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/ms=
gid/bitcoindev/CAHNroFfAiBMFnUPxqAV-spGB_Nt2juf6-8J3bGAJbDQKM_w2bQ%40mail.g=
mail.com</a>.<br />

--0000000000002c6c8006290a27a7--