Skip to content

Commit 74fc5b9

Browse files
jonatackjonatack
authored
Merge pull request #1800 from darosior/consensus_cleanup
BIP 54: Consensus Cleanup
2 parents 2fa52fc + 1ee4351 commit 74fc5b9

File tree

2 files changed

+241
-0
lines changed

2 files changed

+241
-0
lines changed

‎README.mediawiki‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,13 @@ Those proposing changes should consider that ultimately consent may rest with th
300300
| Michael Dubrovsky, Bogdan Penkovsky
301301
| Standard
302302
| Draft
303+
|-
304+
| [[bip-0054.md|54]]
305+
| Consensus (soft fork)
306+
| Consensus Cleanup
307+
| Antoine Poinsot, Matt Corallo
308+
| Standard
309+
| Draft
303310
<!-- 50 series reserved for a group of post-mortems -->
304311
|- style="background-color: #ffcfcf"
305312
| [[bip-0060.mediawiki|60]]

‎bip-0054.md‎

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
```
2+
BIP: 54
3+
Layer: Consensus (soft fork)
4+
Title: Consensus Cleanup
5+
Author: Antoine Poinsot <[email protected]>
6+
Matt Corallo <[email protected]>
7+
Comments-Summary: No comments yet.
8+
Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0054
9+
Status: Draft
10+
Type: Standards Track
11+
Created: 2024-04-11
12+
License: CC0-1.0
13+
```
14+
15+
## Abstract
16+
17+
This document proposes new consensus rules in order to fix the timewarp attack, reduce the worst
18+
case block validation time, prevent Merkle tree weaknesses, and avoid duplicate transactions without
19+
[bip-0030][BIP30] validation.
20+
21+
## Motivation
22+
23+
This proposal addresses a number of long-standing vulnerabilities and weaknesses in the Bitcoin
24+
protocol. Bundling these fixes together allows to overcome the fixed cost of deploying a Bitcoin
25+
soft fork.
26+
27+
The timewarp bug permits a majority hashrate attacker to arbitrarily increase the block rate,
28+
allowing them to steal block subsidy from future miners and increase validation costs to nodes that
29+
have to deal with the increased average transaction rate. By strategically setting the block
30+
timestamp, the [timewarp bug][SE timewarp] lets miners bring down the difficulty to its minimum
31+
within 38 days of starting the attack. The existence of this bug not only significantly empowers a
32+
51% attacker, but also makes it notably harder to reason about miners' incentives. It could indeed
33+
be in the interest of short-sighted miners as well as short-sighted users to exploit this
34+
vulnerability in a small enough proportion to increase the block rate without fatally hurting the
35+
network, as the effectively increased block space would — all other things being equal — bring fee
36+
rates down for users.
37+
38+
Specially crafted blocks may be expensive to process, with validation times ranging from a few
39+
minutes up to more than an hour on lower-end devices. Long block validation times are a nuisance to
40+
users, increasing the cost to independently fully validate the consensus rules. In addition they can
41+
be used by miners to attack their competition, creating perverse incentives, centralization
42+
pressures and leading to reduced network security.
43+
44+
In computing a block's Merkle root, a 64-byte transaction can be interpreted as an intermediate
45+
node in the tree in addition to a leaf. This makes it possible to fake inclusion proofs by
46+
pretending a 64-byte block transaction is an inner node, as well as to pretend the inner nodes on
47+
one level of the tree are the actual block transactions.
48+
49+
Since [bip-0034][BIP34] activation, explicit [bip-0030][BIP30] validation is not necessary until
50+
block height 1,983,702[^0]. Mandating new coinbase transactions be different from the early
51+
[bip-0034][BIP34] violations makes it possible to get rid of [bip-0030][BIP30] validation forever.
52+
Besides its unnecessary cost, another downside of [bip-0030][BIP30] validation is that it cannot be
53+
performed by Utreexo clients. Finally, leveraging the coinbase transaction's `nLockTime` field
54+
allows applications to recover the block height corresponding to a coinbase transaction without
55+
having to parse Script.
56+
57+
## Specification
58+
59+
For all blocks after activation the following new rules apply.
60+
61+
Given a block at height `N`:
62+
- if `N % 2016` is equal to 0, the timestamp of the block must be set to a value higher than or
63+
equal to the value of the timestamp of block at height `N-1` minus 7200 (T<sub>N</sub> &ge;
64+
T<sub>N−1</sub> − 7200);
65+
- if `N % 2016` is equal to 2015, the timestamp of the block must be set to a value higher than
66+
or equal to the value of the timestamp of the block at height `N-2015` (T<sub>N</sub> &ge;
67+
T<sub>N−2015</sub>).
68+
69+
A limit is set on the number of potentially executed signature operations in validating a
70+
transaction. It applies to all transactions in the block except the coinbase transaction[^1]. For
71+
each input in the transaction, count the number of `CHECKSIG` and `CHECKMULTISIG` in the input
72+
scriptSig and previous output's scriptPubKey, including the P2SH redeemScript. The accounting is the
73+
same as for [bip-0016][BIP16 specs]: a `CHECKSIG`/`CHECKSIGVERIFY` operation accounts for 1 and a
74+
`CHECKMULTISIG`/`CHECKMULTISIGVERIFY` accounts for the number of public keys associated, or 20 if
75+
the number of public keys is greater than 16. A `CHECKMULTISIG`/`CHECKMULTISIGVERIFY` not directly
76+
preceded by a minimally-pushed number between 1 and 16 (included) accounts for 20. If the
77+
total is strictly higher than 2500, the transaction is invalid.
78+
79+
Transactions whose witness-stripped serialized size is exactly 64 bytes are invalid.
80+
81+
The coinbase transaction's `nLockTime` field must be set to the height of the block minus 1[^2]
82+
and its `nSequence` field must not be equal to 0xffffffff.
83+
84+
## Rationale
85+
86+
The restrictions on the timestamp of the first and last blocks of a difficulty adjustment period fix
87+
the timewarp and Murch–Zawy vulnerabilities[^3]. The latter poses mostly theoretical concerns but is
88+
extremely low risk to fix: the duration of an adjustment period has never been, and should never be,
89+
negative. The former is fixed by preventing the timestamp of the first block of a difficulty period
90+
from being lower than the previous block's, with a two-hour grace period. A [previous
91+
proposal][BIP-XXXX] to fix timewarp used a ten-minute grace period instead, also adopted for
92+
[testnet4][BIP94 timewarp]. Out of an abundance of caution and because it only trivially worsens the
93+
block rate increase under attack, a two-hour grace period is used here[^4].
94+
95+
Disabling some Script operations and functionalities was [previously proposed][BIP-XXXX] to reduce
96+
the worst case block validation time but was met with resistance due to confiscation concerns[^5]. A
97+
delicate balance needs to be struck between minimizing the confiscation risks of a mitigation, even
98+
if merely theoretical, and bounding the costs one could impose on all other users of the system. To
99+
this effect a limit on the number of potentially executed signature operations pinpoints exactly the
100+
harmful behaviour, leaving maximum flexibility in how Script functionalities may have been used.
101+
Such a limit reduces the worst case block validation time by a factor of 40 and drastically
102+
increases the preparation cost of an attack to make it uneconomical for a miner[^6]. The maximum of
103+
2500 was chosen as the tightest value that did not make any non-pathological standard transaction
104+
invalid[^7].
105+
106+
In the presence of 64-byte transactions a block header's Merkle root may be valid for different sets
107+
of transactions. This is because in the Merkle tree construction a 64-byte transaction may be
108+
interpreted as the catenation of two 32-byte hashes, or the catenation of two 32-byte hashes may be
109+
interpreted as a transaction. The former allows to fake a block inclusion proof and the latter makes
110+
it such that for a valid block the Merkle root in the block header is not a unique identifier for
111+
the corresponding list of valid transactions[^8]. 64-byte transactions can only contain a
112+
scriptPubKey that lets anyone spend the funds, or one that burns them. 64-byte transactions have
113+
also been non-standard since 2019. It was suggested that the known vulnerabilities could instead be
114+
mitigated by committing to the Merkle tree depth in the header's version field[^9]. The authors
115+
believe it is preferable to address the root cause by invalidating 64-byte transactions. This
116+
approach also fixes the vulnerability without developers of SPV verifiers having to implement the
117+
mitigation or to know it is necessary in the first place.
118+
119+
Several blocks prior to [bip-0034][BIP34] activation contain a coinbase transaction whose scriptSig
120+
contains a valid [bip-0034][BIP34] commitment to a future block height. This offers an opportunity
121+
to duplicate these coinbase transactions in the future[^10] and for this reason [bip-0030][BIP30]
122+
validation will need to be re-activated from block 1,983,702. A simple way to prevent this is to
123+
mandate that future coinbase transactions vary from coinbase transactions before [bip-0034][BIP34]
124+
activation. There are multiple ways of achieving this, but setting and enforcing the timelock for
125+
the coinbase transaction makes it so all coinbase transactions past Consensus Cleanup activation
126+
could not have been valid before this height and therefore cannot be a duplicate[^11].
127+
128+
## Backward compatibility
129+
130+
This proposal only tightens the block validation rules: there is no block that is valid under the
131+
rules proposed in this BIP but not under the existing Bitcoin consensus rules. As a consequence
132+
these changes are backward-compatible with non-upgraded node software. That said, the authors
133+
strongly encourage node operators to upgrade in order to fully validate all consensus rules.
134+
135+
## Miner forward compatibility
136+
137+
Bitcoin Core version [29.0][Core 29.0] and later will not generate a block template that violates
138+
the timestamp restrictions introduced in this BIP. Although it would be extremely unlikely due to
139+
the grace period used in this proposal, miners should use the `curtime` or `mintime` field from the
140+
`getblocktemplate` result for their block's timestamp to make sure they always create blocks valid
141+
according to this proposal. Note this is not a new requirement: using a timestamp lower than the
142+
`mintime` field from the `getblocktemplate` result already leads to creating an invalid block.
143+
144+
Bitcoin Core as of version 29.0 may relay and create a block template including a transaction that
145+
violates the signature operations limit introduced in this BIP. A newer version of Bitcoin Core
146+
that makes this type of transaction non-standard should be widely adopted before this soft fork is
147+
considered for activation.
148+
149+
Bitcoin Core version [0.16.1][Core 0.16.1] and later will neither relay nor create block templates
150+
that include 64-byte transactions.
151+
152+
The coinbase transaction is usually crafted by mining pool software. To the best of the authors'
153+
knowledge, there does not exist an open source reference broadly in use today for such software.
154+
We encourage mining pools to update their software to craft coinbase transactions that are
155+
forward-compatible with the changes proposed in this BIP.
156+
157+
## Acknowledgements
158+
159+
This document builds upon an [earlier proposal][BIP-XXXX] by Matt Corallo.
160+
161+
The authors would like to thank everyone involved in researching the most appropriate mitigation for
162+
each of these bugs. We would like to thank in particular Anthony Towns and Sjors Provoost for their
163+
direct contributions to this proposal, as well as @0xb10c and Brian Groll for providing the authors
164+
with data to analyze the proposed mitigations.
165+
166+
## Copyright
167+
168+
This document is licensed under the Creative Commons CC0 1.0 Universal license.
169+
170+
171+
[^0]: Block 1,983,702 is the earliest future block which could contain a duplicate coinbase
172+
transaction while still respecting [bip-0034][BIP34]. See [this post][Delving duplicable] for a list
173+
of all such future blocks.
174+
[^1]: Technically this limit *cannot* apply to a coinbase transaction as the size of its sole
175+
input's scriptSig is limited.
176+
[^2]: The locktime validation, which is also performed for coinbase transactions, enforces that the
177+
nLockTime value is the last block at which a transaction is invalid, not the first one at which it
178+
is valid.
179+
[^3]: The timewarp attack is described [here][SE timewarp] and the Murch–Zawy attack [here][Delving
180+
Murch-Zawy].
181+
[^4]: The testnet4 difficulty exception pushed blocks' timestamps in the future when abused,
182+
revealing how some broken pool software may produce blocks that don't respect a 10 minutes grace
183+
period. Some [raised concerns][Sjors grace period] similarly broken software might be used on
184+
mainnet. Using a grace period of 2 hours instead of 10 minutes only reduces the expected block
185+
interval time under attack by ~2.2 seconds. See [this post][grace period debate summary] for more.
186+
[^5]: The argument is about someone having a timelocked presigned transaction using some of those
187+
features in its output script. The transaction cannot be mined before activation. Such outputs would
188+
not be covered by an amnesty for old UTxOs. See for instance [here][O'Connor OP_CODESEPARATOR] and
189+
[here][O'Connor sighash type] for discussions on this topic.
190+
[^6]: It is important to reduce the worst case block validation time as well as the ratio of
191+
validation time imposed over preparation cost. The former is to limit the damages an externally
192+
motivated attacker can do. The latter is to disincentivize miners slowing down their competition by
193+
mining expensive blocks. See [this thread][ML thread validation time] for more.
194+
[^7]: A non-pathological transaction would have a public key per signature operation and at least
195+
one signature per input. Per standardness a single P2SH input may not have more than 15 signature
196+
operations. Even by using 1-of-15 `CHECKMULTISIG`s a transaction would bump against the maximum
197+
standard transaction size before running into the newly introduced limit. To run against the newly
198+
introduced limit but not the transaction size a transaction would need to spend P2SH inputs with a
199+
redeem script similar to `CHECKSIG DROP CHECKSIG DROP ...`. This type of redeem script serves no
200+
purpose beyond increasing its validation cost, which is exactly what this proposal aims to mitigate.
201+
[^8]: See [this writeup][Suhas Merkle] by Suhas Daftuar for an explanation as well as a discussion
202+
of the consequences.
203+
[^9]: By Sergio Demian Lerner in a [blog post][Sergio post] surfaced [by Eric Voskuil][Eric
204+
version]. Eric also pushed back against the importance of fixing this issue. See [this post][64
205+
bytes debate] for an attempt at summarizing the arguments for both sides of this debate.
206+
[^10]: See [here][BIP34 list] for a full list of the heights of historical blocks including a valid
207+
bip-0034 height commitment and the corresponding future block height.
208+
[^11]: Technically it could be argued a duplicate could in principle always be possible before block
209+
31,001 when `nLockTime` enforcement [was originally soft-forked][Harding nLockTime]. But treating
210+
coinbase transactions as not having duplicate past Consensus Cleanup activation would be consistent
211+
for any implementation which enforces `nLockTime` from the genesis block, which is the behaviour
212+
notably of Bitcoin Core but also of all other implementations the authors are aware of.
213+
214+
[BIP30]: https://github.com/bitcoin/bips/blob/master/bip-0030.mediawiki
215+
[BIP-XXXX]: https://github.com/TheBlueMatt/bips/blob/7f9670b643b7c943a0cc6d2197d3eabe661050c2/bip-XXXX.mediawiki
216+
[BIP34]: https://github.com/bitcoin/bips/blob/master/bip-0034.mediawiki
217+
[BIP16 specs]: https://github.com/bitcoin/bips/blob/master/bip-0016.mediawiki#specification
218+
[SE timewarp]: https://bitcoin.stackexchange.com/questions/75831/what-is-time-warp-attack-and-how-does-it-work-in-general/75834#75834
219+
[Delving Murch-Zawy]: https://delvingbitcoin.org/t/zawy-s-alternating-timestamp-attack/1062#variant-on-zawys-attack-2
220+
[BIP94 timewarp]: https://github.com/bitcoin/bips/blob/master/bip-0094.mediawiki#user-content-Time_Warp_Fix
221+
[Sjors grace period]: https://delvingbitcoin.org/t/timewarp-attack-600-second-grace-period/1326
222+
[grace period debate summary]: https://delvingbitcoin.org/t/great-consensus-cleanup-revival/710/66
223+
[O'Connor OP_CODESEPARATOR]: https://gnusha.org/pi/bitcoindev/CAMZUoKneArC+YZ36YFwxNTKsDtJhEz5P2cosXKxJS8Rf_3Nyuw@mail.gmail.com
224+
[O'Connor sighash type]: https://gnusha.org/pi/bitcoindev/CAMZUoK=1kgZLR1YZ+cJgzwmEOwrABYFs=2Ri=xGX=BCr+w=VQw@mail.gmail.com
225+
[ML thread validation time]: https://gnusha.org/pi/bitcoindev/VsltJ2PHqWfzG4BU9YETTXjL7fYBbJhjVXKZQyItemySIA1okvNee9kf0zAOyLMeJ4Nqv1VOrYbWns5nP4TANCWvPJYu1ew_yxQSaudizzk=@protonmail.com
226+
[Suhas Merkle]: https://gnusha.org/pi/bitcoindev/CAFp6fsGtEm9p-ZQF_XqfqyQGzZK7BS2SNp2z680QBsJiFDraEA@mail.gmail.com
227+
[Sergio post]: https://bitslog.com/2018/06/09/leaf-node-weakness-in-bitcoin-merkle-tree-design
228+
[Eric version]: https://delvingbitcoin.org/t/great-consensus-cleanup-revival/710/37
229+
[64 bytes debate]: https://delvingbitcoin.org/t/great-consensus-cleanup-revival/710/41
230+
[BIP34 list]: https://delvingbitcoin.org/t/great-consensus-cleanup-revival/710/4
231+
[Harding nLockTime]: https://bitcoin.stackexchange.com/questions/90229/nlocktime-in-bitcoin-core
232+
[Delving duplicable]: https://delvingbitcoin.org/t/great-consensus-cleanup-revival/710/4
233+
[Core 0.16.1]: https://bitcoincore.org/en/releases/0.16.1
234+
[Core 29.0]: https://bitcoincore.org/en/releases/29.0

0 commit comments

Comments
 (0)