Date: Sat, 06 May 2023 02:51:33 +0000
To: Weiji Guo <weiji.g@gmail.com>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <-ZXduH8kzOVdK_FBE0VvMtuKDAFSU0Z4joKeIqM7CFnHO9kymMHfVwGjlwEHLzAnFWXLd_jVtNrkdeQGVobYUqjwASXEQ2w8BHh5FtEMJzs=@protonmail.com>
In-Reply-To: <CA+ydi=KMm6LW7W+NAUfRDESaJCg+smkiGS2WHKtYRWVGmM_0YA@mail.gmail.com>
References: <CA+ydi=LtskFh89TW75=CBwbdZzWR-ZjWS77TnrF4G+xUfm8z+Q@mail.gmail.com>
 <xNzSDtvj-BH4EW9eJMqn_yAiVUEiggnS3WIrvLml6gGAZ6CPADO9pbPV4B30txzSY9laEmX3ckXX8L2Hu18ZrWMUjMH23csL-YK-mDse6DY=@protonmail.com>
 <CA+ydi=K7kePFPXbTP6S63SdddORnc6nVoHqR4gDVoeX3uY-S-Q@mail.gmail.com>
 <s3urNahBotY-aYGaQyY7wz2Sh8UXbqHX2PvZyRcyaMJF6MjUrabv0p_ytE3m1Cu9r79MY649RoulaBPuqGLrSD8qwOfCS-n-HymOEyih5yQ=@protonmail.com>
 <CA+ydi=+6oSQ2oEeuBDQs7fzWL75h4CYb3k4_SS3VbFgxJwDGiA@mail.gmail.com>
 <O8340coA0WBuYzHgkZ6ov7Yp3aqvnGeCeFKHh9bqZdkQTS3xtjEDlW4Hjhc7UgD1XltJyYDOFzDN4JthXq1pdCrMM8cYNfVBIOvLbR8tro8=@protonmail.com>
 <CA+ydi=KMm6LW7W+NAUfRDESaJCg+smkiGS2WHKtYRWVGmM_0YA@mail.gmail.com>
Feedback-ID: 2872618:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] proposal: new opcode OP_ZKP to enable ZKP-based
	spending authorization
Precedence: list

Good Morning Weiji,


> Hi ZmnSCPxy,
> > As the network is pseudonymous, an anonymous attacker can flood the ful=
lnode mempool network with large numbers of non-aggregated transactions, th=
en in cooperation with a miner confirm a single aggregated transaction with=
 lower feerate than what it put in the several non-aggregated transactions.
>=20
> Arguably this is hardly a feasible attack. Let's suppose the attacker cre=
ates 1000 such transactions, and attaches each transaction with a small amo=
unt of transaction fee X. The total fee will be 1000*X collectible by the a=
ggregation vendor, who pays the miner a fee Y. We can reasonably assume tha=
t 1000*X is much larger than Y, yet X is much smaller than Y. Note that Y i=
s already much larger than the regular fee for other transactions as the ag=
gregated transaction should contain many inputs and many outputs, thus very=
 large in size.
>=20
> Now, the attacker will have to generate proofs for these 1000 transaction=
s, which is non-trivial; and pay for 1000*X upfront. The aggregation vendor=
 has to spend more computing power doing the aggregation (or recursive veri=
fication) and take (1000*X - Y) as profit. Miner gets Y.

The entire point is that there has to be a separate, paid aggregator, in or=
der to ensure that the free mempool service is not overloaded.
Basically, keep the aggregation outside the mempool, not in the mempool.
If aggregation is paid for, that is indeed sufficient to stop the attack, a=
s you noted.

Regards,
ZmnSCPxj