Date: Tue, 02 May 2023 15:01:01 +0000
To: Weiji Guo <weiji.g@gmail.com>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <s3urNahBotY-aYGaQyY7wz2Sh8UXbqHX2PvZyRcyaMJF6MjUrabv0p_ytE3m1Cu9r79MY649RoulaBPuqGLrSD8qwOfCS-n-HymOEyih5yQ=@protonmail.com>
In-Reply-To: <CA+ydi=K7kePFPXbTP6S63SdddORnc6nVoHqR4gDVoeX3uY-S-Q@mail.gmail.com>
References: <CA+ydi=LtskFh89TW75=CBwbdZzWR-ZjWS77TnrF4G+xUfm8z+Q@mail.gmail.com>
 <xNzSDtvj-BH4EW9eJMqn_yAiVUEiggnS3WIrvLml6gGAZ6CPADO9pbPV4B30txzSY9laEmX3ckXX8L2Hu18ZrWMUjMH23csL-YK-mDse6DY=@protonmail.com>
 <CA+ydi=K7kePFPXbTP6S63SdddORnc6nVoHqR4gDVoeX3uY-S-Q@mail.gmail.com>
Feedback-ID: 2872618:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] proposal: new opcode OP_ZKP to enable ZKP-based
	spending authorization
Precedence: list


Good morning Weiji,

> Meanwhile, as we can potentially aggregate many proofs or recursively ver=
ify even more, the average cost might still be manageable.

Are miners supposed to do this aggregation?

If miners do this aggregation, then that implies that all fullnodes must al=
so perform the **non**-aggregated validation as transactions flow from tran=
saction creators to miners, and that is the cost (viz. the **non**-aggregat=
ed cost) that must be reflected in the weight.
We should note that fullnodes are really miners with 0 hashpower, and any c=
ost you impose on miners is a cost you impose on all fullnodes.

If you want to aggregate, you might want to do that in a separate network t=
hat does ***not*** involve Bitcoin fullnodes, and possibly allow for some k=
ind of extraction of fees to do aggregation, then have already-aggregated t=
ransactions in the Bitcoin mempool, so that fullnodes only need validate al=
ready-aggregated transactions.

Remember, validation is run when a transaction enters the mempool, and is *=
*not** re-run when an in-mempool transaction is seen in a block (`blocksonl=
y` of course does not follow this as it has no mempool, but most fullnodes =
are not `blocksonly`).
If you intend to aggregate transactions in the mempool, then at the worst c=
ase a fullnode will be validating every non-aggregated transaction, and tha=
t is what we want to limit by increasing the weight of heavy-validation tra=
nsactions.

Regards,
ZmnSCPxj