How to construct a schnorr multi-signature transaction

[robertcc0410]

give an example

[Roasbeef]

You mean like musig, or using `OP_CHECKSIGADD``?

[robertcc0410]

You mean like musig, or using `OP_CHECKSIGADD``?

github.com/btcsuite/btcd/btcec/v2/schnorr/musig2
I used signer.Sign(msg), but I have been unable to construct the correct transfer msg. Is msg constructed like this?

	prevOutFetcher := txscript.NewMultiPrevOutFetcher(map[wire.OutPoint]*wire.TxOut{
		*unspentList[0].Outpoint: {
			PkScript: changeScript,
			Value:    unspentList[0].Output.Value,
		},
	})
	sigHashes := txscript.NewTxSigHashes(tx, prevOutFetcher)
	witnessArray, _ := txscript.CalcTaprootSignatureHash(sigHashes, txscript.SigHashDefault, tx, 0, prevOutFetcher)
        ... // sign
        finalSig := combiner.FinalSig()
	tx.TxIn[0].Witness = wire.TxWitness{finalSig.Serialize()}

it reports an error non-mandatory-script-verify-flag (Invalid Schnorr signature)，witnessArray is the transaction msg

[guggero]

https://github.com/lightningnetwork/lnd/blob/master/itest/lnd_taproot_test.go#L580

[robertcc0410]

https://github.com/lightningnetwork/lnd/blob/master/itest/lnd_taproot_test.go#L580

func main() {

	const numSigners = 2
	// First generate the set of signers along with their public keys.
	signerKeys := make([]*btcec.PrivateKey, 0)
	signSet := make([]*btcec.PublicKey, 0)
	privateKeyHex01 := "7e3503d37b624a541815ce378f00f5ba01914708d9c8572ddc7057cc649659de"
	privateKeyBytes01, _ := hex.DecodeString(privateKeyHex01)
	privateKey01, pubKey01 := btcec.PrivKeyFromBytes(privateKeyBytes01)

	privateKeyHex02 := "ddcc69506d5c7088078315386fac523d36d2d88c37ab0d56fa6e24501f1a4463"
	privateKeyBytes02, _ := hex.DecodeString(privateKeyHex02)
	privateKey02, pubKey02 := btcec.PrivKeyFromBytes(privateKeyBytes02)

	signerKeys = append(signerKeys, privateKey01, privateKey02)
	signSet = append(signSet, pubKey01, pubKey02)

	var combinedKey *btcec.PublicKey

	var ctxOpts []m2.ContextOption

	ctxOpts = append(ctxOpts, m2.WithBip86TweakCtx())

	ctxOpts = append(ctxOpts, m2.WithKnownSigners(signSet))

	// Now that we have all the signers, we'll make a new context, then
	// generate a new session for each of them(which handles nonce
	// generation).
	signers := make([]*m2.Session, numSigners)
	for i, signerKey := range signerKeys {
		signCtx, err := m2.NewContext(
			signerKey, false, ctxOpts...,
		)
		if err != nil {
			log.Fatalf("unable to generate context: %v", err)
		}

		if combinedKey == nil {
			combinedKey, err = signCtx.CombinedKey()
			if err != nil {
				log.Fatalf("combined key not available: %v", err)
			}
		}

		session, err := signCtx.NewSession()
		if err != nil {
			log.Fatalf("unable to generate new session: %v", err)
		}
		signers[i] = session
	}

	fromAddr, err := btcutil.NewAddressTaproot(schnorr.SerializePubKey(txscript.ComputeTaprootKeyNoScript(combinedKey)), &chaincfg.SigNetParams)
	if err != nil {
		fmt.Println("NewAddressTaproot:", err)
		return
	}
	fmt.Println("address:", fromAddr.EncodeAddress())
	// Next, in the pre-signing phase, we'll send all the nonces to each
	// signer.

	netParams := &chaincfg.SigNetParams
	btcApiClient := mempool.NewClient(netParams)
	unspentList, err := btcApiClient.ListUnspent(fromAddr)
	if err != nil {
		fmt.Println("ListUnspent err:", err)
		return
	}
	if len(unspentList) == 0 {
		return
	}

	tx := wire.NewMsgTx(2)
	tx.TxIn = []*wire.TxIn{{
		PreviousOutPoint: *unspentList[0].Outpoint,
	}}

	totalSenderAmount := btcutil.Amount(0)
	totalSenderAmount = btcutil.Amount(unspentList[0].Output.Value)

	changeAmount := int64(totalSenderAmount) - 1000

	p2wkhPkScript, err := txscript.PayToAddrScript(fromAddr)
	if err != nil {
		fmt.Println("PayToAddrScript err:", err)
		return
	}
	tx.TxOut = []*wire.TxOut{{
		PkScript: p2wkhPkScript,
		Value:    changeAmount,
	}}

	prevOutputFetcher := txscript.NewCannedPrevOutputFetcher(
		unspentList[0].Output.PkScript, unspentList[0].Output.Value,
	)
	sighashes := txscript.NewTxSigHashes(tx, prevOutputFetcher)

	sigHash, err := txscript.CalcTaprootSignatureHash(
		sighashes, txscript.SigHashDefault, tx, 0, prevOutputFetcher,
	)
	msg := [32]byte(sigHash)

	var wg sync.WaitGroup
	for i, signCtx := range signers {
		signCtx := signCtx

		wg.Add(1)
		go func(idx int, signer *m2.Session) {
			defer wg.Done()

			for j, otherCtx := range signers {
				if idx == j {
					continue
				}

				nonce := otherCtx.PublicNonce()
				haveAll, err := signer.RegisterPubNonce(nonce)
				if err != nil {
					log.Fatalf("unable to add public nonce")
				}

				if j == len(signers)-1 && !haveAll {
					log.Fatalf("all public nonces should have been detected")
				}
			}
		}(i, signCtx)
	}

	wg.Wait()

	// In the final step, we'll use the first signer as our combiner, and
	// generate a signature for each signer, and then accumulate that with
	// the combiner.
	combiner := signers[0]
	for i := range signers {
		signer := signers[i]
		partialSig, err := signer.Sign(msg)
		if err != nil {
			log.Fatalf("unable to generate partial sig: %v", err)
		}

		// We don't need to combine the signature for the very first
		// signer, as it already has that partial signature.
		if i != 0 {
			haveAll, err := combiner.CombineSig(partialSig)
			if err != nil {
				log.Fatalf("unable to combine sigs: %v", err)
			}

			if i == len(signers)-1 && !haveAll {
				log.Fatalf("final sig wasn't reconstructed")
			}
		}
	}

	// Finally we'll combined all the nonces, and ensure that it validates
	// as a single schnorr signature.
	finalSig := combiner.FinalSig()

	if !finalSig.Verify(msg[:], combinedKey) {
		log.Fatalf("final sig is invalid!")
	}

	tx.TxIn[0].Witness = wire.TxWitness{finalSig.Serialize()}
         
        //  SendRawTransaction

}

I wrote a demo and still got an error when sending a transaction. Can you help me find out the specific reason?

[guggero]

You're double tweaking the taproot key:

	fromAddr, err := btcutil.NewAddressTaproot(schnorr.SerializePubKey(txscript.ComputeTaprootKeyNoScript(combinedKey)), &chaincfg.SigNetParams)

The combinedKey is already bip86 tweaked. So you can just do:

	fromAddr, err := btcutil.NewAddressTaproot(schnorr.SerializePubKey(combinedKey), &chaincfg.SigNetParams)

[guggero]

Also, you first need to send to the address created from the combined key. You can't directly take any UTXO and provide a MuSig2 signature.

[robertcc0410]

Also, you first need to send to the address created from the combined key. You can't directly take any UTXO and provide a MuSig2 signature.

I don’t quite understand what you mean. Please help me find out what is wrong with the link below.

1. Use privateKeyHex01 and privateKeyHex01 accounts to generate combinedKey
2. Use combinedKey to generate fromAddress
3. Transfer test coins to fromAddress
4. Query the utxo in the fromAddress address and construct a tx to transfer to toAddress
5. Sign tx with mulsig2
6. Broadcasting Transactions
   This problem has puzzled me for a long time. I have been unable to send a successful shcnorr multi-signature transaction.

[guggero]

Did you send new coins to the correct address after you fixed the double tweaking bug I pointed out above? That created a new address with a different taproot key.

[robertcc0410]

Yes, I modified it as you suggested and sent test coins to the new address. It still reported an error. I can confirm that the error was not caused here.

[guggero]

Your ListUnspent was incorrect, it returned the wrong pkScript. Here's the fixed version:

	unspentOutputs := make([]*btcapi.UnspentOutput, 0)
	for _, utxo := range utxos {
		txHash, err := chainhash.NewHashFromStr(utxo.Txid)
		if err != nil {
			return nil, err
		}
		pkScript, err := txscript.PayToAddrScript(address)
		if err != nil {
			return nil, err
		}

		unspentOutputs = append(unspentOutputs, &btcapi.UnspentOutput{
			Outpoint: wire.NewOutPoint(txHash, uint32(utxo.Vout)),
			Output:   wire.NewTxOut(utxo.Value, pkScript),
		})
	}
	return unspentOutputs, nil

[robertcc0410]

Thank you very much, it successfully solved my problem

[vendersen]

@Roasbeef Are there any examples of m-of-n?