MIME-Version: 1.0
References: <CAO3Pvs_pkYAYsrAEtv3KuJevXQHBLZQ-ihjP4Ur_A1NjJRA+Lw@mail.gmail.com>
 <CAPv7TjYTjvSV7UFgOwif6tFj3jVxDfJdW-p_cyPoAGGWKQbwRQ@mail.gmail.com>
 <CAO3Pvs_-igT37fcD29=ATSRX7dW5mGKrLGrXp=iJjaN_t3NGww@mail.gmail.com>
 <CAPv7TjZjZU2bYvUrt-BEx80xKF=BHBbrYWigHB+=yY+YfZX9Yg@mail.gmail.com>
In-Reply-To: <CAPv7TjZjZU2bYvUrt-BEx80xKF=BHBbrYWigHB+=yY+YfZX9Yg@mail.gmail.com>
From: Olaoluwa Osuntokun <laolu32@gmail.com>
Date: Mon, 11 Apr 2022 15:51:55 -0400
Message-ID: <CAO3Pvs9mLc=6eYw=EO98CN9Muur8Kz-WHqb0sRVPQXKnJd0i9Q@mail.gmail.com>
To: Ruben Somsen <rsomsen@gmail.com>
Content-Type: multipart/alternative; boundary="0000000000006f5e3b05dc664735"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
 lightning-dev <lightning-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Taro: A Taproot Asset Representation Overlay
Precedence: list

--0000000000006f5e3b05dc664735
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Ruben,

> Also, the people that are responsible for the current shape of RGB aren't
> the people who originated the idea, so it would not be fair to the
> originators either (Peter Todd, Alekos Filini, Giacomo Zucco).

Sure I have no problems acknowledging them in the current BIP draft. Both
the protocols build off of ideas re client-side-validation, but then end up
exploring different parts of the large design space.  Peter Todd is already
there, but I can add the others you've listed. I might even just expand tha=
t
section into a longer "Related Work" section along the way.

> What I tried to say was that it does not make sense to build scripting
> support into Taro, because you can't actually do anything interesting wit=
h
> it due to this limitation.  can do with their own Taro tokens, or else he
> will burn them =E2=80=93 not very useful

I agree that the usage will be somewhat context specific, and dependent on
the security properties one is after. In the current purposefully simplifie=
d
version, it's correct that ignoring the rules leads to assets being burnt,
but in most cases imo that's a sufficient enough incentive to maintain and
validate the relevant set of witnesses.

I was thinking about the scripting layer a bit over the weekend, and came u=
p
with a "issuance covenant" design sketch that may or may not be useful. At =
a
high level, lets say we extend the system to allow a specified (so a new
asset type) or generalized script to be validated when an asset issuance
transaction is being validated. If we add some new domain specific covenant
op codes at the Taro level, then we'd be able to validate issuance events
like:

  * "Issuing N units of this assets can only be done if 1.5*N units of BTC
    are present in the nth output of the minting transaction. In addition,
    the output created must commit to a NUMs point for the internal key,
    meaning that only a script path is possible. The script paths must be
    revealed, with the only acceptable unlocking leaf being a time lock of =
9
    months".

I don't fully have a concrete protocol that would use something like that,
but that was an attempt to express certain collateralization requirements
for issuing certain assets. Verifiers would only recognize that asset if th=
e
issuance covenant script passes, and (perhaps) the absolute timelock on
those coins hasn't expired yet. This seems like a useful primitive for
creating assets that are somehow backed by on-chain BTC collateralization.
However this is just a design sketch that needs to answer questions like:

  * are the assets still valid after that timeout period, or are they
    considered to be burnt?

  * assuming that the "asset key family" (used to authorize issuance of
    related assets) are jointly owned, and maintained in a canonical
    Universe, then would it be possible for 3rd parties to verify the level
    of collateralization on-chain, with the join parties maintaining the
    pool of collateralized assets accordingly?

  * continuing with the above, is it feasible to use a DLC script within on=
e
    of these fixed tapscript leaves to allow more collateral to be
    added/removed from the pool backing those assets?

I think it's too early to conclude that the scripting layer isn't useful.
Over time I plan to add more concrete ideas like the above to the section
tracking the types of applications that can be built on Taro.

> So theoretically you could get Bitcoin covenants to enforce certain
> spending conditions on Taro assets. Not sure how practical that ends up
> being, but intriguing to consider.

Exactly! Exactly how practical it ends up being would depend on the types o=
f
covenants deployed in the future. With something like a TLUV and OP_CAT (as
they're sufficiently generalized vs adding op codes to very the proofs) a
Script would be able to re-create the set of commitments to restrict the se=
t
of outputs that can be created after spending. One would use OP_CAT to
handle re-creating the taro asset root, and TLUV (or something similar) to
handle the Bitcoin tapscript part (swap out leaf index 0 where the taro
commitment is, etc).

> The above also reminds me of another potential issue which you need to be
> aware of, if you're not already. Similar to my comment about how the
> location of the Taro tree inside the taproot tree needs to be
> deterministic for the verifier, the output in which you place the Taro
> tree also needs to be

Yep, the location needs to be fully specified which includes factoring the
output index as well. A simple way to restrict this would just to say it's
always the first output. Otherwise, you could lift the output index into th=
e
asset ID calculation.

-- Laolu

--0000000000006f5e3b05dc664735
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Ruben, <br><br>&gt; Also, the people that are responsib=
le for the current shape of RGB aren&#39;t<br>&gt; the people who originate=
d the idea, so it would not be fair to the<br>&gt; originators either (Pete=
r Todd, Alekos Filini, Giacomo Zucco).<br><br>Sure I have no problems ackno=
wledging them in the current BIP draft. Both<br>the protocols build off of =
ideas re client-side-validation, but then end up<br>exploring different par=
ts of the large design space.=C2=A0 Peter Todd is already<br>there, but I c=
an add the others you&#39;ve listed. I might even just expand that<br>secti=
on into a longer &quot;Related Work&quot; section along the way.<br><br>&gt=
; What I tried to say was that it does not make sense to build scripting<br=
>&gt; support into Taro, because you can&#39;t actually do anything interes=
ting with<br>&gt; it due to this limitation. =C2=A0can do with their own Ta=
ro tokens, or else he<br>&gt; will burn them =E2=80=93 not very useful<br><=
br>I agree that the usage will be somewhat context specific, and dependent =
on<br>the security properties one is after. In the current purposefully sim=
plified<br>version, it&#39;s correct that ignoring the rules leads to asset=
s being burnt,<br>but in most cases imo that&#39;s a sufficient enough ince=
ntive to maintain and<br>validate the relevant set of witnesses.<br><br>I w=
as thinking about the scripting layer a bit over the weekend, and came up<b=
r>with a &quot;issuance covenant&quot; design sketch that may or may not be=
 useful. At a<br>high level, lets say we extend the system to allow a speci=
fied (so a new<br>asset type) or generalized script to be validated when an=
 asset issuance<br>transaction is being validated. If we add some new domai=
n specific covenant<br>op codes at the Taro level, then we&#39;d be able to=
 validate issuance events<br>like:<br><br>=C2=A0 * &quot;Issuing N units of=
 this assets can only be done if 1.5*N units of BTC<br>=C2=A0 =C2=A0 are pr=
esent in the nth output of the minting transaction. In addition,<br>=C2=A0 =
=C2=A0 the output created must commit to a NUMs point for the internal key,=
<br>=C2=A0 =C2=A0 meaning that only a script path is possible. The script p=
aths must be<br>=C2=A0 =C2=A0 revealed, with the only acceptable unlocking =
leaf being a time lock of 9<br>=C2=A0 =C2=A0 months&quot;.<br><br>I don&#39=
;t fully have a concrete protocol that would use something like that,<br>bu=
t that was an attempt to express certain collateralization requirements<br>=
for issuing certain assets. Verifiers would only recognize that asset if th=
e<br>issuance covenant script passes, and (perhaps) the absolute timelock o=
n<br>those coins hasn&#39;t expired yet. This seems like a useful primitive=
 for<br>creating assets that are somehow backed by on-chain BTC collaterali=
zation.<br>However this is just a design sketch that needs to answer questi=
ons like:<br><br>=C2=A0 * are the assets still valid after that timeout per=
iod, or are they<br>=C2=A0 =C2=A0 considered to be burnt? <br><br>=C2=A0 * =
assuming that the &quot;asset key family&quot; (used to authorize issuance =
of<br>=C2=A0 =C2=A0 related assets) are jointly owned, and maintained in a =
canonical<br>=C2=A0 =C2=A0 Universe, then would it be possible for 3rd part=
ies to verify the level<br>=C2=A0 =C2=A0 of collateralization on-chain, wit=
h the join parties maintaining the<br>=C2=A0 =C2=A0 pool of collateralized =
assets accordingly?<br><br>=C2=A0 * continuing with the above, is it feasib=
le to use a DLC script within one<br>=C2=A0 =C2=A0 of these fixed tapscript=
 leaves to allow more collateral to be<br>=C2=A0 =C2=A0 added/removed from =
the pool backing those assets?<br><br>I think it&#39;s too early to conclud=
e that the scripting layer isn&#39;t useful.<br>Over time I plan to add mor=
e concrete ideas like the above to the section<br>tracking the types of app=
lications that can be built on Taro.<br><br>&gt; So theoretically you could=
 get Bitcoin covenants to enforce certain<br>&gt; spending conditions on Ta=
ro assets. Not sure how practical that ends up<br>&gt; being, but intriguin=
g to consider.<br><br>Exactly! Exactly how practical it ends up being would=
 depend on the types of<br>covenants deployed in the future. With something=
 like a TLUV and OP_CAT (as<br>they&#39;re sufficiently generalized vs addi=
ng op codes to very the proofs) a<br>Script would be able to re-create the =
set of commitments to restrict the set<br>of outputs that can be created af=
ter spending. One would use OP_CAT to<br>handle re-creating the taro asset =
root, and TLUV (or something similar) to<br>handle the Bitcoin tapscript pa=
rt (swap out leaf index 0 where the taro<br>commitment is, etc).<br><br>&gt=
; The above also reminds me of another potential issue which you need to be=
<br>&gt; aware of, if you&#39;re not already. Similar to my comment about h=
ow the<br>&gt; location of the Taro tree inside the taproot tree needs to b=
e<br>&gt; deterministic for the verifier, the output in which you place the=
 Taro<br>&gt; tree also needs to be<br><br>Yep, the location needs to be fu=
lly specified which includes factoring the<br>output index as well. A simpl=
e way to restrict this would just to say it&#39;s<br>always the first outpu=
t. Otherwise, you could lift the output index into the<br>asset ID calculat=
ion.<br><br>-- Laolu<br></div>

--0000000000006f5e3b05dc664735--