[bitcoin-dev] BIP draft: HTLC transactions

[Sean Bowe via bitcoin-dev]

I'm requesting feedback for Hash Time-Locked Contract (HTLC) transactions
in Bitcoin.

HTLC transactions allow you to pay for the preimage of a hash. CSV/CLTV can
be used to recover your funds if the other party is not cooperative. These
scripts take the following general form:

[HASHOP] <digest> OP_EQUAL
OP_IF
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP] OP_DROP <buyer pubkey>
OP_ENDIF
OP_CHECKSIG

These transactions are useful for both the Lightning network and in
zero-knowledge contingent payments. This very script (using CLTV and
SHA256) was used as part of our "pay-to-sudoku" ZKCP demo earlier this
year: https://github.com/zcash/pay-to-sudoku

Members of the community have expressed the desire for a BIP to submitted
in coordination with changes to Bitcoin Core that support these
transactions in the wallet.

Please review my draft BIP here:
https://gist.github.com/ebfull/8306903041d46e4119a39442f72a3741

An implementation is being worked on here:
https://github.com/bitcoin/bitcoin/pull/7601

Thanks!

Sean Bowe
Zcash

[Peter Todd via bitcoin-dev]

Post by Sean Bowe via bitcoin-dev
I'm requesting feedback for Hash Time-Locked Contract (HTLC) transactions
in Bitcoin.
HTLC transactions allow you to pay for the preimage of a hash. CSV/CLTV can
be used to recover your funds if the other party is not cooperative. These
[HASHOP] <digest> OP_EQUAL
OP_IF
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP] OP_DROP <buyer pubkey>
OP_ENDIF
OP_CHECKSIG

Note that because you're hashing the top item on the stack regardless
scriptSig's that satisfy HTLC's are malleable: that top stack item can be
changed anything in the digest-not-provided case and the script still passes.

[Luke Dashjr via bitcoin-dev]

Post by Peter Todd via bitcoin-dev

Post by Sean Bowe via bitcoin-dev
I'm requesting feedback for Hash Time-Locked Contract (HTLC) transactions
in Bitcoin.
HTLC transactions allow you to pay for the preimage of a hash. CSV/CLTV
can be used to recover your funds if the other party is not cooperative.
These
[HASHOP] <digest> OP_EQUAL
OP_IF
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP] OP_DROP <buyer pubkey>
OP_ENDIF
OP_CHECKSIG

Note that because you're hashing the top item on the stack regardless
scriptSig's that satisfy HTLC's are malleable: that top stack item can be
changed anything in the digest-not-provided case and the script still passes.

OP_SIZE
OP_IF
[HASHOP] <digest> OP_EQUALVERIFY
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP]
<buyer pubkey>
OP_ENDIF
OP_CHECKSIG

[Peter Todd via bitcoin-dev]

Post by Luke Dashjr via bitcoin-dev

Post by Peter Todd via bitcoin-dev

Post by Sean Bowe via bitcoin-dev
I'm requesting feedback for Hash Time-Locked Contract (HTLC) transactions
in Bitcoin.
HTLC transactions allow you to pay for the preimage of a hash. CSV/CLTV
can be used to recover your funds if the other party is not cooperative.
These
[HASHOP] <digest> OP_EQUAL
OP_IF
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP] OP_DROP <buyer pubkey>
OP_ENDIF
OP_CHECKSIG

Note that because you're hashing the top item on the stack regardless
scriptSig's that satisfy HTLC's are malleable: that top stack item can be
changed anything in the digest-not-provided case and the script still passes.

OP_SIZE
OP_IF
[HASHOP] <digest> OP_EQUALVERIFY
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP]
<buyer pubkey>
OP_ENDIF
OP_CHECKSIG

Ha! That's brilliant; good job.

[Johnson Lau via bitcoin-dev]

Post by Luke Dashjr via bitcoin-dev

Post by Peter Todd via bitcoin-dev

Post by Sean Bowe via bitcoin-dev
I'm requesting feedback for Hash Time-Locked Contract (HTLC) transactions
in Bitcoin.
HTLC transactions allow you to pay for the preimage of a hash. CSV/CLTV
can be used to recover your funds if the other party is not cooperative.
These
[HASHOP] OP_EQUAL
OP_IF
OP_ELSE
[TIMEOUTOP] OP_DROP
OP_ENDIF
OP_CHECKSIG

Note that because you're hashing the top item on the stack regardless
scriptSig's that satisfy HTLC's are malleable: that top stack item can be
changed anything in the digest-not-provided case and the script still passes.

OP_SIZE
OP_IF
[HASHOP] <digest> OP_EQUALVERIFY
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP]
<buyer pubkey>
OP_ENDIF
OP_CHECKSIG

This is incompatible with my proposal for fixing the OP_IF/NOTIF malleability in segwit ("MINIMALIF"). In this case only the timeout branch may be executed.

To make it compatible, you may use one of the following 2 scripts:

OP_SIZE OP_0NOTEQUAL
OP_IF
[HASHOP] <digest> OP_EQUALVERIFY
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP] OP_DROP
<buyer pubkey>
OP_ENDIF
OP_CHECKSIG

or

OP_IF
[HASHOP] <digest> OP_EQUALVERIFY
<seller pubkey>
OP_ELSE
<num> [TIMEOUTOP] OP_DROP
<buyer pubkey>
OP_ENDIF
OP_CHECKSIG

The overall witness size are the same for these scripts. They are 1 byte larger than Luke's script, in case MINIMALIF is not enforced.

(btw, the OP_DROP after TIMEOUTOP is missing in Luke's script)