Date: Fri, 24 Jun 2022 16:06:05 +1000
From: Anthony Towns <aj@erisian.com.au>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <20220624060605.GC5322@erisian.com.au>
References: <87h75xoet1.fsf@rustcorp.com.au>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <87h75xoet1.fsf@rustcorp.com.au>
User-Agent: Mutt/1.10.1 (2018-07-13)
Subject: Re: [bitcoin-dev] [PROPOSAL] OP_TX: generalized covenants reduced
 to OP_CHECKTEMPLATEVERIFY
Precedence: list

On Tue, May 10, 2022 at 08:05:54PM +0930, Rusty Russell via bitcoin-dev wrote:

> OPTX_SEPARATELY: treat fields separately (vs concatenating)
> OPTX_UNHASHED: push on the stack without hashing (vs SHA256 before push)

> OPTX_SELECT_OUTPUT_AMOUNT32x2*: sats out, as a high-low u31 pair
> OPTX_SELECT_OUTPUT_SCRIPTPUBKEY*: output scriptpubkey

Doing random pie-in-the-sky contract design, I had a case where I
wanted to be able to say "update the CTV hash from commiting to outputs
[A,B,C,D,E] to outputs [A,B,X,D,E]". The approach above and the one CTV
takes are somewhat awkward for that:

 * you have to include all of A,B,D,E in order to generate both hashes,
   which seems less efficient than a merkle path

 * proving that you're taking an output in its entirety, rather than,
   say, the last 12 bytes of C and the first 30 bytes of D, seems hard.
   Again, it seems like a merkle path would be better?

This is more of an upgradability concern I think -- ie, only relevant if
additional features like CAT or TLUV or similar are added; but both OP_TX
and CTV seem to be trying to take upgradability into account in advance,
so I thought this was worth raising.

Cheers,
aj