Sabitlenmiş Tweet

i want to explain the rationale of this construction, because people are like "why not just do it all in one tx".
- you have to assume the attacker has all private keys based on ec pubkeys
- you are locking data behind a secret that, when revealed will allow anyone to steal funds
- phase 1: lock funds for "k" blocks in a covenant that has 2 paths: forces the spender to either create a proof-of-secret ctv-locked transaction OR to a "do over" transaction.
WHY? Because CTV locks outputs. You can't use it for phase 1. You need TXHASH to lock *partial* information - "auth needed, but we don't know where it's going yet".
-phase 2: post a spend that follows those rules... the spend goes to a CTV and auth-locked address that will, eventually go to your real destination.
- phase 3: wait!. you need to look on-chain to be sure your spend is in a block... not some attacker's spend. wait long enough that a reorg is not a concern. a reorg would allow an attacker to commit a sneaky new phase1...and steal!
... now you can safely reveal the secret and clear the CTV locked transaction to it's final destination.
it doesn't matter *what* the attacker does at all. the attacker can only move funds to where CTV says it will go!
what happens if an attacker "steals" by making an EVIL PHASE 2! well, they can. but remember that nice "do over" spending path? you can use it! it moves funds to an address with the same template as the original... starting the sequence over again (the attacker can post this... but... why would they?)
all the attacker can do is "grief" with their nonexistent trillion dollar quantum computer. not steal.
AND we get two lovely new covenants that are useful for other things besides protecting us from pseudoscience!
delvingbitcoin.org/t/a-quantum-re…
English




















