MIME-Version: 1.0
References: <CALZpt+FvLb=N5Qygs+dPmh1o9QCwXj8RoznF5n47opOq7CG_0g@mail.gmail.com>
 <sfryINjjAWF5hDSvohEhqCl2nBlllag5nA9tiPleUb1HyjmBcb6Y6v7VwIfaHVXfyiXAHGAgQfbwNsIz8dvckOSjV-zxaq7DckjHStYPJZU=@protonmail.com>
In-Reply-To: <sfryINjjAWF5hDSvohEhqCl2nBlllag5nA9tiPleUb1HyjmBcb6Y6v7VwIfaHVXfyiXAHGAgQfbwNsIz8dvckOSjV-zxaq7DckjHStYPJZU=@protonmail.com>
From: Antoine Riard <antoine.riard@gmail.com>
Date: Fri, 28 May 2021 00:13:44 -0400
Message-ID: <CALZpt+G3cVam9oJRHA=11j9k7k4Fo99dP39P4pbWeHfh79Xs-g@mail.gmail.com>
To: darosior <darosior@protonmail.com>
Content-Type: multipart/alternative; boundary="000000000000ce8a9505c35c1aa5"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] A Stroll through Fee-Bumping Techniques :
 Input-Based vs Child-Pay-For-Parent
Precedence: list

--000000000000ce8a9505c35c1aa5
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

> Unfortunately, ACP | SINGLE is trivially pinable [0] (TL;DR: i can just
attach an output paying immediately to me, and construct a tx chain
spending it). We are using ACP | ALL for Revault,
> which is the reason why we need a well laid-out pool of fee-bumping UTXOs
(as you need to consume them entirely).

Oh yes, I should have mentioned this pinning vector. The witnessScript I've
in mind to make secure that type of chain of transactions would be one
MuSig key for all contract participants, where signature are committed with
SIGHASH_ANYPREVOUT | SIGHASH_IOMAP, one pubkey per participant to lockdown
the transaction with SIGHASH_ALL. I think it works and prevents malicious
in-flight attachment of input/output to a multi-party transaction ?

> I believe that it's better to broadcast a single fan-out transaction
creating your entire UTXO pool in advance. You could create one coin per
contract you are watching which value would be
> used to bump your transaction feerate from the presigned one to -say- the
average feerate over the past month, and then have smaller coins that you
could attach to any transaction to bump
> by a certain threshold (say, 10sat/vbyte). You would create as many small
coin as your reserve algorithm tells you (which could be "i need to be
able, worst case, to close all my contracts
> with the worst historical feerate." or (fractional reserve version) "i
need to be able, worst case, to close 10% of my contracts at the average
feerate of the past year, the remaining ones sorry
> for my loss"). [1]

> This method is both much more optimal (though you need to sometimes incur
the cost of many small additional inputs) and also makes sure that your
feebump does not depend on the confirmation of a first stage transaction
(as you can only RBF with new inputs if they are confirmed).

I see, so you spread your bumping UTXO pool in two ranges : at least one
bumping utxo per contract, and a subpool of emergency smaller coins, ready
to be attached on any contract. I think this strategy makes sense for
vaults as you can afford a bunch of small coins at different feerates,
spending the ones not used afterwards. And higher cells of feerate reserve
as the worst historical feerate are relatively not that much compared to
locked-in vaults value. That said, I'm more dubious about LN, where node
operators might not keep the worst-case fee-bumping reserve, as the time
value of the coins aren't worth the channel liquidity at stake.

> Why not just attaching it at the tail of the chain? Bumping the last
child with additional input would effectively be a CPFP for the entire
chain in this case.

Yes, input-based bumping targeting the tail of the chain works at the
transaction level. But if you assume bounded visibility of network
mempools, one of your counterparties might have broadcast a concurrent
state, thus making your CPFP irrelevant for propagation. Though smarter
tx-relay techniques such as "attach-on-contract-utxo-root" CPFP (or also
known as "blinded CPFP") might solve this issue.

Le jeu. 27 mai 2021 =C3=A0 17:45, darosior <darosior@protonmail.com> a =C3=
=A9crit :

> Hi,
>
> ## Input-Based
>
> I think input-based fee-bumping has been less studied as fee-bumping
> primitive for L2s [1]. One variant of input-based fee-bumping usable toda=
y
> is the leverage of the SIGHASH_ANYONECANPAY/SIGHASH_SINGLE malleability
> flags. If the transaction is the latest stage of the contract, a bumping
> input can be attached just-in-time, thus increasing the feerate of the
> whole package.
>
>
> Unfortunately, ACP | SINGLE is trivially pinable [0] (TL;DR: i can just
> attach an output paying immediately to me, and construct a tx chain
> spending it). We are using ACP | ALL for Revault,
> which is the reason why we need a well laid-out pool of fee-bumping UTXOs
> (as you need to consume them entirely).
>
> Input-based (today): If the bumping utxo is offering an adequate feerate
> point in function of network mempools congestion at time of broadcast, on=
ly
> 1 input. If a preliminary fan-out transaction to adjust feerate point mus=
t
> be broadcasted first, 1 input and 2 outputs more must be accounted for.
> Onchain footprint: 2 inputs + 3 outputs.
>
>
> I believe that it's better to broadcast a single fan-out transaction
> creating your entire UTXO pool in advance. You could create one coin per
> contract you are watching which value would be
> used to bump your transaction feerate from the presigned one to -say- the
> average feerate over the past month, and then have smaller coins that you
> could attach to any transaction to bump
> by a certain threshold (say, 10sat/vbyte). You would create as many small
> coin as your reserve algorithm tells you (which could be "i need to be
> able, worst case, to close all my contracts
> with the worst historical feerate." or (fractional reserve version) "i
> need to be able, worst case, to close 10% of my contracts at the average
> feerate of the past year, the remaining ones sorry
> for my loss"). [1]
>
> This method is both much more optimal (though you need to sometimes incur
> the cost of many small additional inputs) and also makes sure that your
> feebump does not depend on the confirmation
> of a first stage transaction (as you can only RBF with new inputs if they
> are confirmed).
>
> Input-based (today): In case of rebroadcast, the fee-bumping input is
> attached to the root of the chain of transactions and as such breaks the
> chain validity in itself. Beyond the rebroadcast of the updated root unde=
r
> replacement policy, the remaining transactions must be updated and
> rebroadcast. Rebroadcast footprint: the whole chain of transactions.
>
>
> Why not just attaching it at the tail of the chain? Bumping the last chil=
d
> with additional input would effectively be a CPFP for the entire chain in
> this case.
>
>
> Thanks for starting this discussion :)
> Antoine
>
> [0]
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2020-May/017835.h=
tml
> [1] Credits to Jacob Swambo, who came up with the single fan-out
> transaction and with whom i'm discussing how to practically apply these
> ideas to Revault.
>

--000000000000ce8a9505c35c1aa5
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">&gt; Unfortunately, ACP | SINGLE is trivially pinable [0] =
(TL;DR: i can just attach an output paying immediately to me, and construct=
 a tx chain spending it). We are using ACP | ALL for Revault,<br>&gt; which=
 is the reason why we need a well laid-out pool of fee-bumping UTXOs (as yo=
u need to consume them entirely).<br><br>Oh yes, I should have mentioned th=
is pinning vector. The witnessScript I&#39;ve in mind to make secure that t=
ype of chain of transactions would be one MuSig key for all contract partic=
ipants, where signature are committed with SIGHASH_ANYPREVOUT | SIGHASH_IOM=
AP, one pubkey per participant to lockdown the transaction with SIGHASH_ALL=
. I think it works and prevents malicious in-flight attachment of input/out=
put to a multi-party transaction ?<br><br>&gt; I believe that it&#39;s bett=
er to broadcast a single fan-out transaction creating your entire UTXO pool=
 in advance. You could create one coin per contract you are watching which =
value would be<br>&gt; used to bump your transaction feerate from the presi=
gned one to -say- the average feerate over the past month, and then have sm=
aller coins that you could attach to any transaction to bump<br>&gt; by a c=
ertain threshold (say, 10sat/vbyte). You would create as many small coin as=
 your reserve algorithm tells you (which could be &quot;i need to be able, =
worst case, to close all my contracts<br>&gt; with the worst historical fee=
rate.&quot; or (fractional reserve version) &quot;i need to be able, worst =
case, to close 10% of my contracts at the average feerate of the past year,=
 the remaining ones sorry<br>&gt; for my loss&quot;). [1]<br><br>&gt; This =
method is both much more optimal (though you need to sometimes incur the co=
st of many small additional inputs) and also makes sure that your feebump d=
oes not depend on the confirmation of a first stage transaction (as you can=
 only RBF with new inputs if they are confirmed).<br><br>I see, so you spre=
ad your bumping UTXO pool in two ranges : at least one bumping utxo per con=
tract, and a subpool of emergency smaller coins, ready to be attached on an=
y contract. I think this strategy makes sense for vaults as you can afford =
a bunch of small coins at different feerates, spending the ones not used af=
terwards. And higher cells of feerate reserve as the worst historical feera=
te are relatively not that much compared to locked-in vaults value. That sa=
id, I&#39;m more dubious about LN, where node operators might not keep the =
worst-case fee-bumping reserve, as the time value of the coins aren&#39;t w=
orth the channel liquidity at stake.<br>=C2=A0<br>&gt; Why not just attachi=
ng it at the tail of the chain? Bumping the last child with additional inpu=
t would effectively be a CPFP for the entire chain in this case.<br><br>Yes=
, input-based bumping targeting the tail of the chain works at the transact=
ion level. But if you assume bounded visibility of network mempools, one of=
 your counterparties might have broadcast a concurrent state, thus making y=
our CPFP irrelevant for propagation. Though smarter tx-relay techniques suc=
h as &quot;attach-on-contract-utxo-root&quot; CPFP (or also known as &quot;=
blinded CPFP&quot;) might solve this issue.<br></div><br><div class=3D"gmai=
l_quote"><div dir=3D"ltr" class=3D"gmail_attr">Le=C2=A0jeu. 27 mai 2021 =C3=
=A0=C2=A017:45, darosior &lt;<a href=3D"mailto:darosior@protonmail.com">dar=
osior@protonmail.com</a>&gt; a =C3=A9crit=C2=A0:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div>Hi,<br></div><div><br></div><blockquo=
te type=3D"cite"><div dir=3D"ltr"><div>## Input-Based<br></div><div><br></d=
iv><div>I think input-based fee-bumping has been less studied as fee-bumpin=
g primitive for L2s [1]. One variant of input-based fee-bumping usable toda=
y is the leverage of the SIGHASH_ANYONECANPAY/SIGHASH_SINGLE malleability f=
lags. If the transaction is the latest stage of the contract, a bumping inp=
ut can be attached just-in-time, thus increasing the feerate of the whole p=
ackage.<br></div></div></blockquote><div><div><br></div><div>Unfortunately,=
 ACP | SINGLE is trivially pinable [0] (TL;DR: i can just attach an output =
paying immediately to me, and construct a tx chain spending it). We are usi=
ng ACP | ALL for Revault,<br>which is the reason why we need a well laid-ou=
t pool of fee-bumping UTXOs (as you need to consume them entirely).<br></di=
v><div><br></div></div><blockquote type=3D"cite"><div dir=3D"ltr"><div>Inpu=
t-based (today): If the bumping utxo is offering an adequate feerate point =
in function of network mempools congestion at time of broadcast, only 1 inp=
ut. If a preliminary fan-out transaction to adjust feerate point must be br=
oadcasted first, 1 input and 2 outputs more must be accounted for. Onchain =
footprint: 2 inputs + 3 outputs.<br></div></div></blockquote><div><br></div=
><div>I believe that it&#39;s better to broadcast a single fan-out transact=
ion creating your entire UTXO pool in advance. You could create one coin pe=
r contract you are watching which value would be<br>used to bump your trans=
action feerate from the presigned one to -say- the average feerate over the=
 past month, and then have smaller coins that you could attach to any trans=
action to bump<br>by a certain threshold (say, 10sat/vbyte). You would crea=
te as many small coin as your reserve algorithm tells you (which could be &=
quot;i need to be able, worst case, to close all my contracts<br>with the w=
orst historical feerate.&quot; or (fractional reserve version) &quot;i need=
 to be able, worst case, to close 10% of my contracts at the average feerat=
e of the past year, the remaining ones sorry<br>for my loss&quot;). [1]<br>=
</div><div><br></div><div>This method is both much more optimal (though you=
 need to sometimes incur the cost of many small additional inputs) and also=
 makes sure that your feebump does not depend on the confirmation<br>of a f=
irst stage transaction (as you can only RBF with new inputs if they are con=
firmed).<br></div><div><br></div><blockquote type=3D"cite"><div dir=3D"ltr"=
><div>Input-based (today): In case of rebroadcast, the fee-bumping input is=
 attached to the root of the chain of transactions and as such breaks the c=
hain validity in itself. Beyond the rebroadcast of the updated root under r=
eplacement policy, the remaining transactions must be updated and rebroadca=
st. Rebroadcast footprint: the whole chain of transactions.<br></div></div>=
</blockquote><div><br></div><div>Why not just attaching it at the tail of t=
he chain? Bumping the last child with additional input would effectively be=
 a CPFP for the entire chain in this case.<br></div><div><br></div><div><br=
></div><div>Thanks for starting this discussion :)<br>Antoine<br></div><div=
><br></div><div><div><div>[0] <a href=3D"https://lists.linuxfoundation.org/=
pipermail/bitcoin-dev/2020-May/017835.html" target=3D"_blank">https://lists=
.linuxfoundation.org/pipermail/bitcoin-dev/2020-May/017835.html</a><br></di=
v></div></div><div>[1] Credits to Jacob Swambo, who came up with the single=
 fan-out transaction and with whom i&#39;m discussing how to practically ap=
ply these ideas to Revault.<br></div></blockquote></div>

--000000000000ce8a9505c35c1aa5--