Anthony Towns <a...@erisian.com.au> writes: > If you publish to the blockchain: ... > 4 can be dropped, state 5 and finish can be altered). Since the CSV delay > is chosen by the participants, the above is still a possible scenario > in eltoo, though, and it means there's some risk for someone accepting > bitcoins that result from a non-cooperative close of an eltoo channel.
AJ, this was a meandering random walk which shed very little light. I don't find the differentiation between malicious and non-malicious double-spends convincing. Even if you trust A, you already have to worry about person-who-sent-the-coins-to-A. This expands that set to be "miner who mined coins sent-to-A", but it's very hard to see what difference that makes to how you'd handle coins from A. > Beyond that, I think NOINPUT has two fundamental ways to cause problems > for the people doing NOINPUT sigs: > > 1) your signature gets applied to a unexpectedly different > script, perhaps making it look like you've being dealing > with some blacklisted entity. OP_MASK and similar solves > this. ... followed by two paragraphs describing how it's not a "fundamental way to cause problems" that you (or I) can see. > For the second case, that seems a little more concerning. The nightmare > scenario is maybe something like: > > * naive users do silly things with NOINPUT signatures, and end up > losing funds due to replays like the above As we've never seen with SIGHASH_NONE? > * initial source of funds was some major exchange, who decide it's > cheaper to refund the lost funds than deal with the customer complaints > > * the lost funds end up costing enough that major exchanges just outright > ban sending funds to any address capable of NOINPUT, which also bans > all taproot/schnorr addresses I don't find this remotely credible. > FWIW, I don't have a strong opinion here yet, but: > > - I'm still inclined to err on the side of putting more safety > measures in for NOINPUT, rather than fewer In theory, sure. But not feel-good and complex "safety measures" which don't actually help in practical failure scenarios. > - the "must have a sig that commits to the input tx" seems like it > should be pretty safe, not too expensive, and keeps taproot's privacy > benefits in the cases where you end up needing to use NOINPUT If this is considered necessary, can it be a standardness rule rather than consensus? Thanks, Rusty. _______________________________________________ bitcoin-dev mailing list bitcoin-dev@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
