diff --git a/bip-ephemeralanchors.mediawiki b/bip-ephemeralanchors.mediawiki new file mode 100644 index 0000000000..bd0187acb7 --- /dev/null +++ b/bip-ephemeralanchors.mediawiki @@ -0,0 +1,157 @@ +
+ BIP: ? + Layer: Mempool Policy + Title: Ephemeral Anchors + Author: Gregory Sanders+ +==Introduction== + +===Abstract=== + +Ephemeral Anchors are a mempool policy carve-out that allows any value utxos, +even 0-value dust, to be created, provided it is also consumed within the same +mempool package. This ephemeral anchor is a "mutex lock" for the transaction, +allowing for robust fee bumping by wallets, not requiring any special key material +to do so, and avoiding all known transaction pinning vectors. + +===Motivation=== + +One definition of transaction pinning is the intentional or unintentional blocking +of a getting a transaction mined that would otherwise be rational for the miner +to include in the next block without the attacker paying anything in many cases. +This can result in wallets simply not supporting fee bumping due to complexity, +or in certain smart contract cases such as Hash Time Locked Contracts, outright theft. + +[https://github.com/bitcoin/bitcoin/pull/28948 V3] transactions, which this proposal is built on, greatly mitigates [https://github.com/bitcoin/bips/blob/master/bip-0125.mediawiki BIP125] +pinning vectors, where an adversary can vastly increase the required fees to replace a +transaction that will not be mined quickly, or disallow replacement altogether. +Depending on certain factors, this economic value can reach over 500 times increase +in required fees to replace the attacker's transaction. V3 transactions end +up reducing this attack surface by 100 times, resulting in 5 times increase in fees +using the same running example. This policy can be thought of as a "RBF carve-out". + +The major pinning vector left is "package limit pinning", where a counterparty +either maliciously or accidentally pins a transaction by exhausting the maximum +descendant limit of a transaction package using their own outputs, and is unwilling +or unable to get the package mined. This leaves the honest user unable to spend their +own outputs in the transaction package, as there is no RBF rule in place for evicting +"sibling" output spends from the same parent transaction. + +One existing mitigation for this issue is the [https://github.com/bitcoin/bitcoin/pull/15681 CPFP carve out], which allows +a "one more" policy these limits, given some restrictions. This carve-out only works for +transactions with up to two immediately-spendable outputs. This leaves a lot to be +desired: + +* It does not solve many-party contract pinning, such as a three-party payment channel +* It does not solve batched payments pinning if the service is unable to double-spend its own inputs. For example, an exchange may require strict separation between client funds and fee funds for security reasons. +* In two-party smart contracts, all but two outputs must be relative-timelocked, which interferes with tooling such as [https://bitcoin.sipa.be/miniscript/ Miniscript] and smart contract composition such as making an output that is directly deposited into another smart contract or any wallet with standard address types. + +This proposal gives a standard way to create a 0-fee "parent" transaction +which can be fee-bumped by any wallet by introducing a special 0-value anchor output +which MUST be spent within the same relay package. + +===Implications=== + +In conjunction with V3 rules of a transaction having up to one child, +if a "parent" transaction has an ephemeral anchor, any spend of that parent transaction's +outputs must also include the ephemeral anchor spend in the same transaction, meaning it can +be double-spent by any other party via existing RBF rules. This "mutex lock" supersedes +the LN-focused CPFP carve-out, neatly solving the remaining issues with multiparty constructs and Miniscript +compatibility. + +===Expected Use Cases=== + +* Batched payments with segregated fee pools: Batched payments that can be fee bumped without access to customer deposit related key material +* Simplified watchtowers: No requirement for watchtowers to be registered with privileged key material +* Payment accelerators: Users can submit transactions to transaction accelerators, who can fee bump using their own infrastructure +* Multiparty smart contracts: LN BOLTs can be revamped to remove `1 CSV` and value-sapping anchors. +* [https://bitcoin.stackexchange.com/questions/100537/what-is-spacechain Spacechains] + +===Unsolved Pinning Scenarios=== + +One major class of pinning vectors yet unsolved is when the pre-signed transaction uses +SIGHASH_ANYONECANPAY. This mode should be avoided as a pinning DoS is trivial. + +Second is any other transaction type such as coinjoins, where the wallet user doesn't +have "veto" power over all inputs in the transaction. A counterparty can double-spend +their inputs, and this can still result in a variety of pinning vectors, albeit +perhaps reduced in severity or chance of success. + +===Related Work=== + +[https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2020-September/018168.html Transaction Sponsors] is a softfork proposal to allow transactions to +indirectly sponsor transactions with no explicit relationship in the classical utxo +model. Ephemeral Anchors can be viewed as a type of opt-in transaction sponsors implemented +purely in policy. + +Using a 0-value CPFP anchor is not a new idea, see: + +* [https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-May/015931.html LN-dev discussion on 0-value anchors] + +The discussion lacked a solution to the issue of the dust entering into the utxo set +causing negative externalities, and also was more weakly motivated by not solving package limit pinning. +Repackaging the idea within the context of ancestor package relay and in light of the latest transaction pinning +research, we can mitigate the negative externalities while solving substantial problems. + +==Definitions== + +Ephemeral anchor: An output with the scriptPubKey of exactly+ Status: Draft + License: BSD-3-Clause + Type: Standards Track + Created: 2023-01-11 +
OP_1 <0x4e73>
, which is a non-taproot witness v1 script.
+
+Ephemeral anchor transaction: A transaction that has an ephemeral anchor
+
+==Specification==
+
+A new output script type is made policy standard to spend, known as an ephemeral anchor.
+
+Ephemeral anchors of any satoshi value are standard for relay.
+
+When received by a peer for inclusion to the mempool an ephemeral anchors transaction MUST:
+
+* Be an otherwise valid V3 transaction
+* Be 0-fee
+* Have only one ephemeral anchor
+* Have the ephemeral anchor spent in the same ancestor relay package
+
+or will be rejected by policy. All other policy checks are left in place.
+If included in an otherwise valid block, these additional constraints do not apply
+as this is a policy-only change.
+
+It is recommended that miners should not mine ephemeral anchor transactions
+without also mining the spend in the same block. This means miners should not
+prioritise transactions that create ephemeral anchors but instead should just prioritise the spend;
+mining software is encouraged to enforce that limitation.
+
+No witness data for ephemeral anchors spends should be allowed, to preclude witness
+stuffing.
+
+== Backward compatibility ==
+
+Ephemeral anchor spends were previously non-standard, so there are no known conflicts
+with previous usage.
+
+==Implementation==
+
+https://github.com/bitcoin/bitcoin/pull/29001
+
+==Acknowledgements==
+
+Thank you to all those listed for foundational work
+and insightful feedback(in last name order):
+
+* Richard Meyers
+* James O'Beirne
+* Antoine Poinsot
+* Antoine Riard
+* Jeremy Rubin
+* Bastien Teinturier
+* Anthony Towns
+* Gloria Zhao
+
+==References and Rationale==
+
+