revault / revault_tx

Script descriptors and transaction creation routines for Revault

Revault

Revault is a Bitcoin vault architecture for multi-party situations.

This library defines the Miniscript descriptors and handles PSBT management of Revault-specific transactions.

Minimum Supported Rust Version

This library should always compile with any combination of features on Rust 1.48.

Contributing

Contributions are very welcome. For general guidelines, see CONTRIBUTING.md.

Discussions happen either here in issues or at #revault on Libera.

Licence

Released under the BSD 3-Clause Licence. See the LICENCE file.

revault_tx's Issues

Increase the CPFP outputs value

https://github.com/re-vault/practical-revault/issues/44

A small helper to get the VaultTransaction as hex

We could use bitcoin::hashes::hex::ToHex and implement a method for our transaction types that don't implement RevaultTransaction.

Note to self: check continuous fuzzing

Deserialization tests

We should do some tests at deserialization time. The same as at creation time actually.

Configurable dust limit

Get rid of `SpendTxOut`

It doesn't serve much purpose and prevents roundtrips.

TODO:

• roundtrip twice in the fuzz targets: once for the encoded PSBTs, once for the transaction data structures

Move the inner-exposing functions out of the RevaultTransaction trait

After #55 , we have a set of assumptions for a RevaultTransaction that hold in pretty much all cases. It would be nice to get rid of that "pretty much" by preventing the user of the interface to at all access the inner PSBT as mutable. Namely to remove inner_tx_mut.

Then, we could also move inner_tx to be a private interface and have public wrappers for accessing the inner PSBT info.

Make Emergency creation optional in routines

In order to support https://github.com/re-vault/practical-revault/issues/72

Fetch CSV from UnvaultDescriptor

The API is currently polluted by requiring the Unvault CSV in order to apply it to the Spend inputs' sequence. We should be able to fetch it through the Unvault descriptor, required in all the same places

Exhaustive test of all deployment settings

Now that we have strict bounds in the number of participants we can afford doing this.

Take sigops into account in virtual bytes calculation

Add doc example to Revault transactions

Get rid of String in the Error enum

In favor of a more detailed enum, that may take deeper errors as parameters

RevocationTransaction, RevocationTxin traits instead of the bloated "RevaultTransaction" one

fuzz: fix run.sh script and some warnings in fuzz_targets

It's not clear to know where to use run.sh, ./fuzz/run.sh or cd fuzz & ./run.sh ?

cd corpus && git clone https://github.com/revault/revault_tx_corpus

cargo install --force cargo-fuzz
for target in $(ls fuzz/fuzz_targets);do
    cargo +nightly fuzz run "${target%.*}" -- -runs=0
done

corpus is in fuzz directory and for target in $(ls fuzz/fuzz_targets) means we are in revault_tx root directory

---

When running some warnings are often:

warning: unused `Result` that must be used
  --> fuzz_targets/parse_unvault.rs:45:9
   |
45 |         tx.verify_input(0);
   |         ^^^^^^^^^^^^^^^^^^^
   |
   = note: `#[warn(unused_must_use)]` on by default
   = note: this `Result` may be an `Err` variant, which should be handled

warning: unused `Result` that must be used
  --> fuzz_targets/parse_unvault.rs:51:9
   |
51 |         tx.finalize(&secp);
   |         ^^^^^^^^^^^^^^^^^^^
   |
   = note: this `Result` may be an `Err` variant, which should be handled

Use miniscript's re-exported `bitcoin`

Once they allow re-export rand as well.

More test coverage

Some trivial error paths are not tested yet (you can use the script in contrib/gen_test_coverage.sh to find them).

Document when `managers_threshold` return `None`

Fix repository in cargo.toml

in cargo.toml:
repository = "https://github.com/re-vault/revault_tx"

Add a CPFP output to the spend tx

We can reuse the same descriptor as for the unvault tx.

Upgrade to latest rust-miniscript

Probably not for 0.1

fixes #41

Integration of mutation testing

revault_tx is a pretty good target for mutation testing, as any mutation in the transaction/script creation routines i can think of should result in a sanity check failure.

Change as_bitcoin_serialized to into_bitcoin_serialized

It clones internally, it makes no sense.

Check if it's possible to import a spend without the CPFP output

Opening this issue as a reminder, I should double-check that importing a spend without the cpfp output is not possible

Adaptable insane fee sanity check

The point of the insane fee sanity check is to be a belt-and-suspender in case our feerate computation is wrong.

However, 0.2BTC of fees may be reasonable for, say, a hundred-inputs Spend transaction (w/ many outputs too). Maybe we could have a check depending on the amount spent? As a sweet pot between straightforwardness of the check and adaptability to many transaction.

Fuzz the `managers_threshold` method

Move the deposit transaction into the vault table

I think it makes much more sense. That's the only non-PSBT transaction..

Can create a spend transaction with a dust output

Change method names to comply with standard onesœ

Use as_ for reference, into_ for moves. I used get_ sometimes and that Is Bad.

Port (some of) the signature checker tests removed from `revaultd`

We lately removed a bunch of logic for checking signatures from revaultd (revault/revaultd#284, revault/revaultd#305). This logic was pretty well tested and some parts might be good additions to this repo's logic tests.

Commit to a MSRV

1.43 looks reasonable (1.48 in Debian bullseye), need to dig more into rustc's release notes.

Better test for CSV failure

I get a different error when the CSV is > (1 << 17) ...

Custom implem of Debug for transactions

It's a pain to read logs with txs that take 150 lines. Base64 is better.

Impl Display and FromStr for RevaultTransaction

As for serde, just use as_psbt_string and from_psbt_str

Fix comment

https://github.com/re-vault/revault_tx/blob/63d239666b6addb62aaaea2e713bc801099da03a/src/transactions.rs#L959

"are finalized"

Exhaustive parsing checks

Right now, we only sanity-check the PSBTs in from_psbt_serialized() are sane with regard to our internal assumptions (unwrap()s basically). This may be enough, but we may also want complete parsing checks to be sure that whether a transaction is parsed or created with the constructor it will hold to our requirements (eg, no dust amounts, sane feerate, etc..). This is quite some more hairy code though..

Transaction size limits

Should we set the keypath in PSBTs inputs

That'd be YA thing to think about but maybe some HW require it..

spend_transaction_from_deposits shoudl take multiple derivation paths

transaction_chain is creating Cancel transactions with a Sequence locktime!!!!

Sigh.

Test custom policies (especially wrt managers with different keys)

A helper for checking if a PSBT is final or finalizable

Are all inputs entirely satisfied ?

Serde for Revault transactions

(Moved from #20)

If you naively put features = ["use-serde"] in the cargo.toml for bitcoin, will serde's #[derive(Serialize, Deserialize)] work for the ravault tx types?

@darosior : No, it's a newtype: i need to make it a trivial implem (not using #derive).

Implement bypass transaction

Allow to create a transaction spending from the N-of-N "vault" aka deposit multisig

Rename vault_[whatever] to deposit_[whatever]

It's going to be invasive but... We agreed it would be less confusing for new contributors.

transactions: when Psbt is deserving us

Having VaultTransaction and FeeBumpTx store a Psbt is both semantically incorrect and makes it impossible to use downstream without huge hacks.

Checking `partial_sigs` when parsing a `RevaultTransaction`

This would allow to make even more safety assumptions but:

• Can we really guarantee it?
• Where do we stop? Should it be the role of this library to ensure that the partial_sigs field only contains valid signatures?

Improve BadParamenters error

The error should include more details, so in the installer it's easier to understand what's going wrong
See revault/revault-gui#123 (comment)

Optimize our Script tests

It was Ok to be dumb until now, but they start getting slow. There are pretty easy fix such as not creating a secp context a thousand times, removing redundant loops, etc..

Add some examples