Date: Fri, 22 Apr 2022 11:11:41 +0000
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: darosior <darosior@protonmail.com>
Reply-To: darosior <darosior@protonmail.com>
Message-ID: <p3P0m2_aNXd-4oYhFjCKJyI8zQXahmZed6bv7lnj9M9HbP9gMqMtJr-pP7XRAPs-rn_fJuGu1cv9ero5i8f0cvyZrMXYPzPx17CxJ2ZSvRk=@protonmail.com>
Feedback-ID: 7060259:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: [bitcoin-dev] ANYPREVOUT in place of CTV
Precedence: list

I would like to know people's sentiment about doing (a very slightly tweake=
d version of) BIP118 in place of
(or before doing) BIP119.

SIGHASH_ANYPREVOUT and its precedent iterations have been discussed for ove=
r 6 years. It presents proven and
implemented usecases, that are demanded and (please someone correct me if i=
'm wrong) more widely accepted than
CTV's.

SIGHASH_ANYPREVOUTANYSCRIPT, if its "ANYONECANPAY" behaviour is made option=
al [0], can emulate CTV just fine.
Sure then you can't have bare or Segwit v0 CTV, and it's a bit more expensi=
ve to use. But we can consider CTV
an optimization of APO-AS covenants.

CTV advocates have been presenting vaults as the flagship usecase. Although=
 as someone who've been trying to
implement practical vaults for the past 2 years i doubt CTV is necessary no=
r sufficient for this (but still
useful!), using APO-AS covers it. And it's not a couple dozen more virtual =
bytes that are going to matter for
a potential vault user.

If after some time all of us who are currently dubious about CTV's stated u=
secases are proven wrong by onchain
usage of a less efficient construction to achieve the same goal, we could r=
oll-out CTV as an optimization.  In
the meantime others will have been able to deploy new applications leveragi=
ng ANYPREVOUT (Eltoo, blind
statechains, etc..[1]).


Given the interest in, and demand for, both simple covenants and better off=
chain protocols it seems to me that
BIP118 is a soft fork candidate that could benefit more (if not most of) Bi=
tcoin users.
Actually i'd also be interested in knowing if people would oppose the APO-A=
S part of BIP118, since it enables
CTV's features, for the same reason they'd oppose BIP119.


[0] That is, to not commit to the other inputs of the transaction (via `sha=
_sequences` and maybe also
`sha_amounts`). Cf https://github.com/bitcoin/bips/blob/master/bip-0118.med=
iawiki#signature-message.

[1] https://anyprevout.xyz/ "Use Cases" section