Date: Wed, 7 Jun 2023 16:30:07 +0300 (TRT)
From: Burak Keceli <burak@buraks.blog>
To: "David A. Harding" <dave@dtrt.org>
Message-ID: <345972294.3114897.1686144607871@eu1.myprofessionalmail.com>
In-Reply-To: <c78b9e621e994f3cf3500e4480b61b0e@dtrt.org>
References: <1300890009.1516890.1684742043892@eu1.myprofessionalmail.com>
 <3c6c3b8b562bb56bbb855dc2b2b71f78@dtrt.org>
 <558171558.1686821.1685102160441@eu1.myprofessionalmail.com>
 <c78b9e621e994f3cf3500e4480b61b0e@dtrt.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Importance: Normal
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Ark: An Alternative Privacy-preserving Second
 Layer Solution
Precedence: list

> A problem with the idea of using one-show signatures as double-spend
> protection is that miner-claimable fidelity bonds don't work as well
> against adversaries that are not just counterparties but also miners
> themselves.=20

Hey David,

The fidelity bonds in the Ark context are nothing but the vTXOs themselves,=
 which in simple terms, have two possible closures: (1) a key-path collabor=
ative closure with higher precedence and (2) a script-path closure with low=
er precedence.

The key-path closure is a 2-of-2 between the rightful owner of the vTXO and=
 the service provider. The script path closure, on the other hand, lets the=
 service provider sweep funds after a relative lock time. The key-path clos=
ure has higher precedence over the script-path closure since it can be trig=
gered immediately with a satisfying signature.

If the service provider double-spends a transaction that enforces a one-tim=
e signature where Bob is the vendor, Bob can forge the service provider=E2=
=80=99s signature from the 2-of-2 and can immediately claim his previously-=
spent vTXO(s). If Alice (or the service provider) is a miner she won=E2=80=
=99t be able steal funds regardless, since she won=E2=80=99t be able co-sig=
n from the Bob=E2=80=99s key.

Best,
Burak