Ephemeral Anchors (tx fees and policy, mempool)

https://github.com/bitcoin/bitcoin/pull/26403

Host: instagibbbs  -  PR author: instagibbs

Notes

Background

Please review V3 and Package RBF Part 1 and Part 2 for background info on the problem setting and proposed solution for RBF pinning.

The proposed Ephemeral Anchor BIP is hosted here.

There is also a bitcoin-inquisition PR.

Motivation

Version 3 transactions solve the issue with what is commonly dubbed BIP125 rule#3 pinning: A large, low fee-rate transaction enters the mempool, and becomes economically prohibitive to remove from the mempool via today’s RBF rules. By limiting the size of a child transaction in a parent-child relationship to 1 KvB, we can bound this economic damage to a small multiple which depends upon what an “honest” CPFP’ing child transaction would look like given a users’ wallet utxo makeup. In essence, it is a “RBF carveout” policy.

Ephemeral anchors are a special type of output that are watermarked (by policy only) via a short static output script. These, along with a few policy ground rules, enable a new, more general “CPFP Carveout” which can sidestep package limit pinning. It also allows relaxation of output script requirements, increasing smart contract composability.

Lighting Network BOLT03 for some “light” reading about how to avoid package limit pinning(poorly) with today’s mempool policies. See option_anchors scripts, with 1 OP_CHECKSEQUENCEVERIFY OP_DROP as the canonical widget to avoid pinning.

Questions

  1. Did you review the PR? Concept ACK, approach ACK, tested ACK, or NACK? What was your review approach?

  2. Why do anti-pinning measures in BOLT03 appear suboptimal?

  3. What is today’s CPFP carve-out in Bitcoin Core? What are its limitations?

  4. In what ways could BOLT03 be improved with Ephemeral Anchors?

  5. What use cases are helped by including an ephemeral anchor? What use cases is it not helpful for?

  6. Why does the usage of ephemeral anchors rely on package relay?

  7. What mechanisms do we have in place to discourage dust level utxos?

  8. Are 0-value outputs consensus valid to create? How about in policy? (Hint: see standardness checks for vout).

  9. Are 0-value outputs consensus valid to spend? How about in policy?

  10. Does this increase the risk of dust entering the utxo set? Can you think of any situations that might arise?

  11. Why does this new output type use OP_TRUE?

  12. What benefits does this PR get from requiring V3 transactions? What properties of V3 does it rely on, if any?

  13. Why are non-0 value outputs allowed to be Ephemeral Anchors?

  14. Why not just watermark ephemeral anchors by being a dust output?

  15. What is the bitcoin-inquisition PR doing differently? Why?

Meeting Log

  117:00 <instagibbs> looks like it's time to get started! This week we're taking a look at Ephemeral Anchors, notes etc here https://bitcoincore.reviews/26403
  217:00 <michaelfolkson> hi
  317:00 <LarryRuane> hi
  417:00 <instagibbs> everyone make some digital noise
  517:00 <lightlike> Hi
  617:00 <abubakarsadiq> hi
  717:00 <DaveBeer> hi
  817:00 <Luke96> First time here
  917:00 <michaelfolkson> #startmeeting
 1017:01 <schmidty> hi
 1117:01 <instagibbs> oops thanks michaelfolkson
 1217:01 <instagibbs> This is my first time hosting, IIUC I just dive on in by asking: Did you get a change to look at the notes? y/n
 1317:02 <Luke96> n
 1417:02 <michaelfolkson> y
 1517:02 <abubakarsadiq> y
 1617:02 <DaveBeer> y, at notes
 1717:02 <LarryRuane> Hope you don't mind a very basic question, something I've wondered for a while... the BIP says "Ephemeral anchors of any satoshi value are standard for relay" -- is there ever a difference between standardness for *relay* versus *mempool accept*? Or are those always the same?
 1817:02 <glozow> hi
 1917:02 <glozow> y
 2017:02 <glozow> LarryRuane: theyre the same
 2117:03 <instagibbs> LarryRuane great question! Sometimes things can be standard for mempool entry but not propagate for various racey reasons... hopefully not super important for EA
 2217:03 <LarryRuane> 0.5y (notes)
 2317:03 <LarryRuane> instagibbs: +1 thanks!
 2417:04 <instagibbs> Regarding the PR, Concept ACK, approach ACK, tested ACK, or NACK? What was your review approach?
 2517:05 <LarryRuane> concept ACK, but (probably questionable to say this) mainly because I know many very smart people have worked on it! I believe we can all be influenced in that way
 2617:05 <michaelfolkson> I guess so far this seems the best solution hence Concept ACK but unsure whether something else could end up being better
 2717:05 <DaveBeer> lost myself in study of package RBF, version 3 and ephemeral anchors, need deeper understanding of problem to review, here mostly to lurk & learn
 2817:07 <michaelfolkson> I guess similar to LarryRuane I'm kinda trusting that the design space has been exhausted at this point and this is best
 2917:07 <instagibbs> related email on exploring the space, for reading later https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2023-January/021334.html
 3017:07 <instagibbs> ok let's dive into nitty gritty
 3117:08 <instagibbs> 2) Why do anti-pinning measures in BOLT03 appear suboptimal?
 3217:08 <michaelfolkson> instagibbs: Ah nice that link wasn't in the notes
 3317:08 <instagibbs> Can anyone understand the measures in place in BOLT03 to stop pinning?
 3417:08 <glozow> Anchor outputs suck: they're tiny little outputs that often don't get spent and hang out in utxo set, you need 1 for each party and CPFP carve out only works for 2 party.
 3517:09 <glozow> Also pinning
 3617:09 <instagibbs> right, today there are two dusty outputs per commitment transaction, and lots of pinning vectors. If we adopt V3 transactions we can already do a lot better.
 3717:10 <instagibbs> What anti-pinning measures do the "balance" outputs have?
 3817:10 <instagibbs> to_us IIRC
 3917:10 <instagibbs> to_local, excuse me
 4017:10 <michaelfolkson> Locks to the funding key
 4117:11 <glozow> I have a question. IIUC one motivation for OP_CSV 1 is we don't want any unconfirmed descendants to be added to these outputs, we only want unconfirmed children added to the anchor outputs. Are there other reasons to have the 1 block relative timelock?
 4217:11 <instagibbs> glozow sorry I was trying to talk about this feature
 4317:11 <instagibbs> look for "option_anchors" which includes " 1 OP_CHECKSEQUENCEVERIFY OP_DROP" snippets in code
 4417:12 <instagibbs> the only reason they are there is to stop people from spending that output with large junk, pinning the transaction
 4517:12 <instagibbs> There is simply no other reason for it
 4617:12 <glozow> ah! good to know, i thought there was another reason
 4717:12 <lightlike> instagibbs: aren't these part of the to_remote outputs instead of to_local?
 4817:13 <instagibbs> yes, LN today is very confusing, I was turned around :)
 4917:13 <instagibbs> to_local has the realy timelock delay, to_remote does not
 5017:13 <instagibbs> just the single block to stop spending
 5117:13 <instagibbs> to swing back to what glozow mentioned
 5217:13 <instagibbs> What is today’s CPFP carve-out in Bitcoin Core? What are its limitations?
 5317:15 <michaelfolkson> An exception to the max package size
 5417:15 <lightlike> If one parties CPFP's their anchor up to the mempool package size limit in order to pin the tx, the other party can use "one more" tx for their anchor, even though that exceeds the limit by 1.
 5517:15 <instagibbs> correct, "just one more", up to some fairly large size tx
 5617:16 <instagibbs> So as glozow mentioned, this only scales to 2 spendable unconfirmed outputs
 5717:16 <instagibbs> so if we wanted multiparty channels, robust CPFP of batched payouts, etc, it doesn't quite work
 5817:16 <michaelfolkson> And we don't have package relay yet so this CPFP carve out isn't actually possible to be utilized currently?
 5917:17 <michaelfolkson> Even though it is in Core
 6017:17 <instagibbs> the parent tx has to be higher than the min feerate of the node's mempool
 6117:17 <instagibbs> then CPFP takes care of the rest
 6217:17 <instagibbs> So in other words, you cann't have a 0-fee parent you bump, without package relay
 6317:18 <instagibbs> So, assuming we already have package relay/V3....
 6417:18 <instagibbs> 4) In what ways could BOLT03 be improved with Ephemeral Anchors?
 6517:18 <glozow> er another question sorry. why do we need 2 anchors instead of 1 anyone can spend anchor for example?
 6617:19 <instagibbs> We only need the one, sorry might have not said something clearly...
 6717:19 <instagibbs> Ah
 6817:19 <glozow> sorry i meant 2 in the current spc
 6917:19 <glozow> spec*
 7017:19 <michaelfolkson> glozow: Currently in the BOLT there are 2 needed
 7117:19 <michaelfolkson> Right
 7217:20 <glozow> yes, my question is why
 7317:20 <michaelfolkson> It says "to prevent a malicious peer from attaching child transactions with a low fee density to an anchor"
 7417:20 <michaelfolkson> So a form of pinning, right?
 7517:20 <instagibbs> So the idea was that Alice OR Bob could CPFP either version of the latest commitment transaction
 7617:21 <instagibbs> but in practice, that is really hairy, because mempools are not synced, so generally speaking you should be trying to bump your version only
 7717:21 <glozow> Ah so Rule 3 pinning. If it was anyone can spend, somebody might add 100ksat 1sat/vB child and you'd need to RBF that to do a new bump
 7817:21 <instagibbs> Oh, yes, EA *today* without V3 means child can be 101kvb
 7917:21 <instagibbs> sorry, didn't understand
 8017:22 <glozow> (note to self to specify whether I mean "today" "with v3" or "with ea" in the future)
 8117:22 <instagibbs> right, so today anchors require key material
 8217:22 <lightlike> does that mean that one anyone-can-spend anchor would work suffice if RBF rules were pinning-safe? And we need 2 because RBF rules aren't?
 8317:23 <instagibbs> lightlike you may not want anyone to bump your tx, theoretically, but that's the vast majority of the motivation yes
 8417:23 <instagibbs> Alice and Bob could have a single anchor they share key material for I suppose
 8517:23 <michaelfolkson> MuSig output
 8617:23 <glozow> lightlike: along the same lines... I'm wondering if, with v3, we could do 1 anyonecanpay anchor?
 8717:24 <instagibbs> glozow you could do wsh(OP_TRUE) with minimal sats, yes
 8817:24 <instagibbs> extra bytes to be standard to relay the output, and "not dust"
 8917:24 <michaelfolkson> Oh no MuSig output wouldn't work, or sharing key material, because you need this if your counterparty is unresponsive
 9017:24 <glozow> that is larger than a bare OP_TRUE though, and small UTXO if not spent. so still see value in EA
 9117:25 <glozow> cool
 9217:25 <instagibbs> Also there are cases where you can't "bleed out" value
 9317:25 <lightlike> glozow: isn't that basically what ephemeral anchor is, with the added benefit that it *must' be spent?
 9417:25 <glozow> lightlike: basically, but I think the biggest draw is the 0-value
 9517:26 <glozow> and the smaller size is pretty nice imo
 9617:26 <instagibbs> Well not just that, but also the fact you can un-CSV other outputs
 9717:26 <glozow> ahhhhhhhh
 9817:26 <instagibbs> "balance" outputs can now be whatever you want
 9917:26 <instagibbs> the "option_anchors" stuff I was talking about can safely be removed
10017:27 <instagibbs> think of the EA output as a "mutex" on an unconfirmed transaction's outputs.
10117:28 <instagibbs> So for LN with EA, we would get rid of the dusty values in the single anchor, and relax all the scripts required for the spec. This makes splicing much more powerful
10217:29 <lightlike> Is it a problem, that when the child is replaced by different parties CPFP'ing, each party needs to contribute the fees for the entire package (not just the delta) because the parent is always 0 fee?
10317:29 <instagibbs> 5) What use cases are helped by including an ephemeral anchor? What use cases is it not helpful for?
10417:30 <instagibbs> we already talked a bit about LN, other ideas?
10517:30 <michaelfolkson> Can you elaborate on the splicing more powerful thing? You still need to agree any splicing with your counterparty
10617:31 <instagibbs> so for splicing, you want to be able to send funds to arbitrary destinations, even if counter-party doesn't know what the underlying script is
10717:31 <instagibbs> so they may want a 1 block CSV to stop pinning
10817:32 <instagibbs> but even if you wanted to doxx your script showing the 1 block CSV is in the script(handwave), things like LN funding outputs are incompatible!
10917:32 <instagibbs> So you could not splice out into a new LN channel, in this example
11017:32 <michaelfolkson> So this could increase the channel capacity without your counterparty agreeing to it?
11117:33 <instagibbs> it just makes splicing out easier to design from anti-pin perspective
11217:33 <michaelfolkson> Ok
11317:35 <instagibbs> So EA is not useful for situations where you have ample ability to RBF your transactions
11417:35 <michaelfolkson> On the use cases vaults always comes up with this kinda stuff
11517:35 <instagibbs> that's the main thing it doesn't really help
11617:35 <instagibbs> Another use-case I like to mention is that it allows a separation of "custodied" funds from fee funds. This is helpful in business settings or custodial settings
11717:36 <instagibbs> hurrying along
11817:36 <instagibbs> 6) Why does the usage of ephemeral anchors rely on package relay?
11917:38 <glozow> because the only reason it's ephemeral is it's spent immediately by the child that it can't live without. Otherwise it's just "potentially dust anchors."
12017:38 <glozow> Or “never propagated 0fee transactions”
12117:38 <instagibbs> exactly, basically those two
12217:38 <instagibbs> 7) What mechanisms do we have in place to discourage dust level utxos?
12317:39 <michaelfolkson> DoS standardness limits
12417:39 <LarryRuane> transactions spending dust aren't standard (not relayed) (?)
12517:40 <abubakarsadiq> ephimeral policy rules
12617:40 <instagibbs> LarryRuane creating or spending dust?
12717:40 <abubakarsadiq> I mean policy rules :)
12817:40 <LarryRuane> i thought spending
12917:41 <instagibbs> LarryRuane incorrect! Spending dust is actually something we all want. It's making dust utxos we don't want
13017:41 <michaelfolkson> Spending is good, it reduces the UTXO set. Creating them is bad
13117:41 <LarryRuane> ah shoot, bad memory! :)
13217:41 <instagibbs> 8) Are 0-value outputs consensus valid to create? How about in policy? (Hint: see standardness checks for vout).
13317:42 <abubakarsadiq> I think they are consensus valid
13417:42 <abubakarsadiq> policy invalid
13517:42 <instagibbs> correct!
13617:43 <LarryRuane> instagibbs: that's right, though, dust outputs bloat the UTXO set... spending them reduces the UTXO set... thanks
13717:43 <instagibbs> 9) Are 0-value outputs consensus valid to spend? How about in policy?
13817:43 <instagibbs> We just answered this one I think
13917:43 <instagibbs> yes and yes. making utxo set smaller is good
14017:44 <instagibbs> 10) Does this (EA) increase the risk of dust entering the utxo set? Can you think of any situations that might arise?
14117:45 <michaelfolkson> It doesn't increase the risk assuming everyone applies these policy rules. It is a policy adoption question?
14217:45 <abubakarsadiq> Yes assuming v3 policy is applied I think it does not
14317:46 <instagibbs> correct, using "stock" PR it will not be mined into utxo set, but miners could of course modify their software
14417:46 <LarryRuane> for anyone else wondering, here's where dust outputs are deemed nonstandard: https://github.com/bitcoin/bitcoin/blob/8e7179aa132598b946d0e03f4ec452edc6ef3bc4/src/policy/policy.cpp#L144
14517:47 <instagibbs> thanks for the link
14617:47 <instagibbs> Please jump back to old questions if you like, I'm just plowing forward
14717:48 <glozow> In order for dust to enter the utxo set this way, a miner basically has to modify their node so they can mine a 0 fee tx on its own. seems not impossible, but pretty unlikely
14817:48 <instagibbs> If they're being paid out of band, the user could just as easily spend the EA and add fees themselves
14917:48 <instagibbs> that's the whole point!
15017:48 <instagibbs> 11) Why does this new output type use OP_TRUE?
15117:49 <michaelfolkson> There could be a tx with an ephemeral anchor output and other outputs that pays a non zero fee?
15217:50 <LarryRuane> more general question, there seem to be many policy (standardness) restrictions that are not consensus restrictions... is that mainly because if it's consensus, then we can't remove the restriction (should it be discovered to be necessary) without needed a hardfork?
15317:50 <michaelfolkson> In which case it would need to be caught by policy, otherwise it would be propagated
15417:51 <instagibbs> LarryRuane yes making something (non)standard first is a typical step to making something have additional consensus meaning
15517:52 <instagibbs> This question is mostly asking why that particular script and not something else? We already talked about wsh(OP_TRUE) being possible today, half answered at least
15617:54 <instagibbs> Answer being: Spending the output requires no witness data, and no scriptSig data, making the input as small as possible
15717:54 <instagibbs> 12) What benefits does this PR get from requiring V3 transactions? What properties of V3 does it rely on, if any?
15817:55 <michaelfolkson> Assuming policy changes are adopted gradually rather than instantly there would be a window where these transactions/package with an ephemeral anchor wouldn't be propagated until adoption had lift-off
15917:55 <instagibbs> michaelfolkson correct, as with any policy relaxation, you'll need some large minority of the network plus some miners to update to accept it
16017:55 <michaelfolkson> So Lightning protocol changes to take advantage of these changes would probably wait until sufficient adoption
16117:55 <michaelfolkson> Ok
16217:55 <instagibbs> not only that, but for LN, all old channels would have to be upgraded, hitting the chain
16317:56 <instagibbs> otherwise old states could still be broadcasted!
16417:56 <instagibbs> time for one more question only I think so jumping to end.
16517:56 <instagibbs> 15) What is the bitcoin-inquisition PR doing differently? Why?
16617:57 <glozow> So iiuc you're skirting around package relay by having mempool validation prioritise the parent at 1sat/vB automatically?
16717:57 <glozow> feerate configurable using ephemeraldelta
16817:58 <instagibbs> correct
16917:58 <instagibbs> everything except the "is this spent in the same package" is checked
17017:58 <instagibbs> due to lack of package relay
17117:58 <glozow> ok and whats the usage of -blockmintxfee? Just to exercise the logic that the parent needs to be bumped? So ephemeral delta takes care of minrelay, and then blockmintxfee stops it from getting mined before the child comes in?
17218:00 <instagibbs> IIRC it allows the miner to allow them into mempool, yet not mine them, with special config
17318:00 <instagibbs> https://github.com/bitcoin-inquisition/bitcoin/pull/23#discussion_r1139697940
17418:00 <instagibbs> #endmeeting
17518:00 <instagibbs> thanks everyone for coming!
17618:00 <glozow> ok hm. i kinda need to get rid of blockmintxfee for pakcage relay tho 🤣
17718:01 <instagibbs> well.... if you get relay in, bitcoin-inquisition will rebase :D
17818:01 <instagibbs> problem solved
17918:01 <glozow> tru tru
18018:01 <glozow> 🔫
18118:01 <glozow> thanks for hosting!!!
18218:01 <instagibbs> please reach out if things didnt make sense or you have nagging questions
18318:01 <michaelfolkson> Thanks instagibbs
18418:03 <LarryRuane> thanks @instagibbs and all!
18518:04 <lightlike> thanks instagibbs!
18618:05 <michaelfolkson> It would be nice to get all the required eltoo policy changes in with sufficient adoption before a APO soft fork was considered. With the lag in adoption n all
18718:07 <instagibbs> you really need ~10% uptake or so, plus some miners. I think the lead time would be plenty. Still lots of policy work being done
18818:08 <instagibbs> I'm very much intersted in improving mempool policy/relay long before consensus changes that require them to be safe :)