feat: discounted fees for confidential transactions

This is a mempool policy only change to enable cheaper fees for
Confidential Transactions.

At a feerate of 1 sat/vb for a 2 input, 3 output transaction:
- explicit tx fee 326 sats
- confidential tx fee 437 sats

src/chainparams.cpp

@@ -887,6 +887,8 @@ class CCustomParams : public CRegTestParams {
         const CScript default_script(CScript() << OP_TRUE);
         consensus.fedpegScript = StrHexToScriptWithDefault(args.GetArg("-fedpegscript", ""), default_script);
         consensus.start_p2wsh_script = args.GetIntArg("-con_start_p2wsh_script", consensus.start_p2wsh_script);
+        accept_discount_ct = args.GetBoolArg("-acceptdiscountct", false);
+        create_discount_ct = args.GetBoolArg("-creatediscountct", false);
 
         // Calculate pegged Bitcoin asset
         std::vector<unsigned char> commit = CommitToArguments(consensus, strNetworkID);
@@ -1023,7 +1025,7 @@ class CLiquidTestNetParams : public CCustomParams {
  */
 class CLiquidV1Params : public CChainParams {
 public:
-    CLiquidV1Params()
+    explicit CLiquidV1Params(const ArgsManager& args)
     {
 
         strNetworkID = "liquidv1";
@@ -1118,6 +1120,8 @@ class CLiquidV1Params : public CChainParams {
         enforce_pak = true;
 
         multi_data_permitted = true;
+        accept_discount_ct = args.GetBoolArg("-acceptdiscountct", true);
+        create_discount_ct = args.GetBoolArg("-creatediscountct", false);
 
         parentGenesisBlockHash = uint256S("000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f");
         const bool parent_genesis_is_null = parentGenesisBlockHash == uint256();
@@ -1261,7 +1265,7 @@ class CLiquidV1Params : public CChainParams {
  */
 class CLiquidV1TestParams : public CLiquidV1Params {
 public:
-    explicit CLiquidV1TestParams(const ArgsManager& args)
+    explicit CLiquidV1TestParams(const ArgsManager& args) : CLiquidV1Params(args)
     {
         // Our goal here is to override ONLY the things from liquidv1 that make no sense for a test chain / which are pointless and burdensome to require people to override manually.
 
@@ -1466,6 +1470,8 @@ class CLiquidV1TestParams : public CLiquidV1Params {
         enforce_pak = args.GetBoolArg("-enforce_pak", enforce_pak);
 
         multi_data_permitted = args.GetBoolArg("-multi_data_permitted", multi_data_permitted);
+        accept_discount_ct = args.GetBoolArg("-acceptdiscountct", accept_discount_ct);
+        create_discount_ct = args.GetBoolArg("-creatediscountct", create_discount_ct);
 
         if (args.IsArgSet("-parentgenesisblockhash")) {
             parentGenesisBlockHash = uint256S(args.GetArg("-parentgenesisblockhash", ""));
@@ -1557,7 +1563,7 @@ std::unique_ptr<const CChainParams> CreateChainParams(const ArgsManager& args, c
     } else if (chain == CBaseChainParams::REGTEST) {
         return std::unique_ptr<CChainParams>(new CRegTestParams(args));
     } else if (chain == CBaseChainParams::LIQUID1) {
-        return std::unique_ptr<CChainParams>(new CLiquidV1Params());
+        return std::unique_ptr<CChainParams>(new CLiquidV1Params(args));
     } else if (chain == CBaseChainParams::LIQUID1TEST) {
         return std::unique_ptr<CChainParams>(new CLiquidV1TestParams(args));
     } else if (chain == CBaseChainParams::LIQUIDTESTNET) {

src/chainparams.h

@@ -135,6 +135,8 @@ class CChainParams
     const std::string& ParentBlech32HRP() const { return parent_blech32_hrp; }
     bool GetEnforcePak() const { return enforce_pak; }
     bool GetMultiDataPermitted() const { return multi_data_permitted; }
+    bool GetAcceptDiscountCT() const { return accept_discount_ct; }
+    bool GetCreateDiscountCT() const { return create_discount_ct; }
 
 protected:
     CChainParams() {}
@@ -167,6 +169,8 @@ class CChainParams
     std::string parent_blech32_hrp;
     bool enforce_pak;
     bool multi_data_permitted;
+    bool accept_discount_ct;
+    bool create_discount_ct;
 };
 
 /**

src/core_write.cpp

@@ -236,6 +236,14 @@ void TxToUniv(const CTransaction& tx, const uint256& hashBlock, UniValue& entry,
     entry.pushKV("version", static_cast<int64_t>(static_cast<uint32_t>(tx.nVersion)));
     entry.pushKV("size", (int)::GetSerializeSize(tx, PROTOCOL_VERSION));
     entry.pushKV("vsize", (GetTransactionWeight(tx) + WITNESS_SCALE_FACTOR - 1) / WITNESS_SCALE_FACTOR);
+    // ELEMENTS: add discountvsize
+    if (Params().GetAcceptDiscountCT() && tx.IsConfidential()) {
+        // this is inlined here since we don't have access to GetDiscountedVirtualTransactionSize from policy.h
+        int size = ::GetSerializeSize(tx, PROTOCOL_VERSION | SERIALIZE_TRANSACTION_NO_WITNESS) + (::GetSerializeSize(tx.witness.vtxinwit, PROTOCOL_VERSION) + WITNESS_SCALE_FACTOR - 1) / WITNESS_SCALE_FACTOR;
+        entry.pushKV("discountvsize", size);
+    } else {
+        entry.pushKV("discountvsize", (GetTransactionWeight(tx) + WITNESS_SCALE_FACTOR - 1) / WITNESS_SCALE_FACTOR);
+    }
     entry.pushKV("weight", GetTransactionWeight(tx));
     entry.pushKV("locktime", (int64_t)tx.nLockTime);
 

src/init.cpp

@@ -640,6 +640,8 @@ void SetupServerArgs(ArgsManager& argsman)
     argsman.AddArg("-initialreissuancetokens=<n>", "The amount of reissuance tokens created in the genesis block. (default: 0)", ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
     argsman.AddArg("-ct_bits", strprintf("The default number of hiding bits in a rangeproof. Will be exceeded to cover amounts exceeding the maximum hiding value. (default: %d)", 52), ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
     argsman.AddArg("-ct_exponent", strprintf("The hiding exponent. (default: %s)", 0), ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
+    argsman.AddArg("-acceptdiscountct", "Accept discounted fees for Confidential Transactions (default: true for liquidv1, false for other chains)", ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
+    argsman.AddArg("-creatediscountct", "Create Confidential Transactions with discounted fees (default: false)", ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
 
 #if defined(USE_SYSCALL_SANDBOX)
     argsman.AddArg("-sandbox=<mode>", "Use the experimental syscall sandbox in the specified mode (-sandbox=log-and-abort or -sandbox=abort). Allow only expected syscalls to be used by bitcoind. Note that this is an experimental new feature that may cause bitcoind to exit or crash unexpectedly: use with caution. In the \"log-and-abort\" mode the invocation of an unexpected syscall results in a debug handler being invoked which will log the incident and terminate the program (without executing the unexpected syscall). In the \"abort\" mode the invocation of an unexpected syscall results in the entire process being killed immediately by the kernel without executing the unexpected syscall.", ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);

src/net_processing.cpp

@@ -4964,7 +4964,9 @@ bool PeerManagerImpl::SendMessages(CNode* pto)
                         auto txid = txinfo.tx->GetHash();
                         auto wtxid = txinfo.tx->GetWitnessHash();
                         // Peer told you to not send transactions at that feerate? Don't bother sending it.
-                        if (txinfo.fee < filterrate.GetFee(txinfo.vsize)) {
+                        // ELEMENTS: use the discounted vsize here so that discounted CTs are relayed.
+                        // discountvsize only differs from vsize if accept_discount_ct is true.
+                        if (txinfo.fee < filterrate.GetFee(txinfo.discountvsize)) {
                             continue;
                         }
                         if (pto->m_tx_relay->pfilter && !pto->m_tx_relay->pfilter->IsRelevantAndUpdate(*txinfo.tx)) continue;

src/policy/policy.h

@@ -135,4 +135,10 @@ static inline int64_t GetVirtualTransactionInputSize(const CTransaction& tx)
     return GetVirtualTransactionInputSize(tx, 0, 0, 0);
 }
 
+// ELEMENTS: use a smaller virtual size for discounted Confidential Transactions
+static inline int64_t GetDiscountedVirtualTransactionSize(const CTransaction& tx)
+{
+    return ::GetSerializeSize(tx, PROTOCOL_VERSION | SERIALIZE_TRANSACTION_NO_WITNESS) + (::GetSerializeSize(tx.witness.vtxinwit, PROTOCOL_VERSION) + WITNESS_SCALE_FACTOR - 1) / WITNESS_SCALE_FACTOR;
+}
+
 #endif // BITCOIN_POLICY_POLICY_H

src/primitives/transaction.cpp

@@ -162,3 +162,12 @@ std::string CTransaction::ToString() const
         str += "    " + tx_out.ToString() + "\n";
     return str;
 }
+
+bool CTransaction::IsConfidential() const
+{
+    for (const CTxOut& out : vout) {
+        if (out.IsFee()) continue;
+        if (out.nValue.IsExplicit() || out.nAsset.IsExplicit()) return false;
+    }
+    return true;
+}

src/primitives/transaction.h

@@ -515,6 +515,8 @@ class CTransaction
     const uint32_t nLockTime;
     // For elements we need to keep track of some extra state for script witness outside of vin
     const CTxWitness witness;
+    // ELEMENTS: true if all outputs (except fee) are blinded
+    bool IsConfidential() const;
 
 private:
     /** Memory only. */

src/txmempool.cpp

@@ -965,7 +965,14 @@ void CTxMemPool::queryHashes(std::vector<uint256>& vtxid) const
 }
 
 static TxMempoolInfo GetInfo(CTxMemPool::indexed_transaction_set::const_iterator it) {
-    return TxMempoolInfo{it->GetSharedTx(), it->GetTime(), it->GetFee(), it->GetTxSize(), it->GetModifiedFee() - it->GetFee()};
+    // ELEMENTS: include the discounted vsize of the tx
+    size_t discountvsize = it->GetTxSize();
+    CTransaction tx = it->GetTx();
+    // discountvsize only differs from vsize if we accept discounted CTs
+    if (Params().GetAcceptDiscountCT() && tx.IsConfidential()) {
+        discountvsize = GetDiscountedVirtualTransactionSize(tx);
+    }
+    return TxMempoolInfo{it->GetSharedTx(), it->GetTime(), it->GetFee(), it->GetTxSize(), it->GetModifiedFee() - it->GetFee(), discountvsize};
 }
 
 std::vector<TxMempoolInfo> CTxMemPool::infoAll() const

src/txmempool.h

@@ -345,6 +345,9 @@ struct TxMempoolInfo
 
     /** The fee delta. */
     int64_t nFeeDelta;
+
+    /** ELEMENTS: Discounted CT size. */
+    size_t discountvsize;
 };
 
 /** Reason why a transaction was removed from the mempool,

src/validation.cpp

@@ -914,7 +914,12 @@ bool MemPoolAccept::PreChecks(ATMPArgs& args, Workspace& ws)
 
     // No transactions are allowed below minRelayTxFee except from disconnected
     // blocks
-    if (!bypass_limits && !CheckFeeRate(ws.m_vsize, ws.m_modified_fees, state)) return false;
+    bool fee_check = CheckFeeRate(ws.m_vsize, ws.m_modified_fees, state);
+    // ELEMENTS: accept discounted fees for Confidential Transactions only, if enabled.
+    if (Params().GetAcceptDiscountCT() && tx.IsConfidential()) {
+        fee_check = CheckFeeRate(GetDiscountedVirtualTransactionSize(tx), ws.m_modified_fees, state);
+    }
+    if (!bypass_limits && !fee_check) return false;
 
     ws.m_iters_conflicting = m_pool.GetIterSet(ws.m_conflicts);
     // Calculate in-mempool ancestors, up to a limit.

src/wallet/spend.cpp

@@ -174,6 +174,11 @@ TxSize CalculateMaximumSignedTxSize(const CTransaction &tx, const CWallet *walle
     CTransaction ctx(txNew);
     int64_t vsize = GetVirtualTransactionSize(ctx);
     int64_t weight = GetTransactionWeight(ctx);
+    // ELEMENTS: use discounted vsize for CTs if enabled
+    if (Params().GetCreateDiscountCT() && tx.IsConfidential()) {
+        vsize = GetDiscountedVirtualTransactionSize(ctx);
+    }
+
     return TxSize{vsize, weight};
 }
 

test/functional/feature_discount_ct.py

@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+# Copyright (c) 2016 The Bitcoin Core developers
+# Distributed under the MIT/X11 software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+from decimal import Decimal
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import (
+    assert_equal,
+)
+
+class CTTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 3
+        self.setup_clean_chain = True
+        args = [
+            "-anyonecanspendaremine=1",
+            "-con_blocksubsidy=0",
+            "-con_connect_genesis_outputs=1",
+            "-initialfreecoins=2100000000000000",
+            "-txindex=1",
+        ]
+        self.extra_args = [
+            # node 0 does not accept nor create discounted CTs
+            args + ["-acceptdiscountct=0", "-creatediscountct=0"],
+            # node 1 accepts but does not create discounted CTs
+            args + ["-acceptdiscountct=1", "-creatediscountct=0"],
+            # node 2 both accepts and creates discounted CTs
+            args + ["-acceptdiscountct=1", "-creatediscountct=1"],
+        ]
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_wallet()
+
+    def run_test(self):
+        feerate = 1.0
+
+        node0 = self.nodes[0]
+        node1 = self.nodes[1]
+        node2 = self.nodes[2]
+
+        self.generate(node0, 101)
+        balance = node0.getbalance()
+        assert_equal(balance['bitcoin'], 21000000)
+
+        self.log.info("Create UTXOs")
+        many = {}
+        num = 25
+        for i in range(num):
+            addr = node0.getnewaddress()
+            info = node0.getaddressinfo(addr)
+            many[info['unconfidential']] = 1
+        for i in range(10):
+            addr = node1.getnewaddress()
+            info = node1.getaddressinfo(addr)
+            many[info['unconfidential']] = 1
+        for i in range(10):
+            addr = node2.getnewaddress()
+            info = node2.getaddressinfo(addr)
+            many[info['unconfidential']] = 1
+
+        txid = node0.sendmany("", many)
+        self.generate(node0, 1)
+
+        self.log.info("Send explicit tx to node 0")
+        addr = node0.getnewaddress()
+        info = node0.getaddressinfo(addr)
+        txid = node0.sendtoaddress(info['unconfidential'], 1.0, "", "", False, None, None, None, None, None, None, feerate)
+        tx = node0.gettransaction(txid, True, True)
+        decoded = tx['decoded']
+        vin = decoded['vin']
+        vout = decoded['vout']
+        assert_equal(len(vin), 2)
+        assert_equal(len(vout), 3)
+        assert_equal(tx['fee']['bitcoin'], Decimal('-0.00000326'))
+        assert_equal(decoded['vsize'], 326)
+        self.generate(node0, 1)
+
+        self.log.info("Send confidential tx to node 0")
+        addr = node0.getnewaddress()
+        info = node0.getaddressinfo(addr)
+        txid = node0.sendtoaddress(info['confidential'], 1.0, "", "", False, None, None, None, None, None, None, feerate)
+        tx = node0.gettransaction(txid, True, True)
+        decoded = tx['decoded']
+        vin = decoded['vin']
+        vout = decoded['vout']
+        assert_equal(len(vin), 2)
+        assert_equal(len(vout), 3)
+        assert_equal(tx['fee']['bitcoin'], Decimal('-0.00002575'))
+        assert_equal(decoded['vsize'], 2575)
+        self.generate(node0, 1)
+
+        self.log.info("Send explicit tx to node 1")
+        addr = node1.getnewaddress()
+        info = node1.getaddressinfo(addr)
+        txid = node0.sendtoaddress(info['unconfidential'], 1.0, "", "", False, None, None, None, None, None, None, feerate)
+        tx = node0.gettransaction(txid, True, True)
+        decoded = tx['decoded']
+        vin = decoded['vin']
+        vout = decoded['vout']
+        assert_equal(len(vin), 2)
+        assert_equal(len(vout), 3)
+        assert_equal(tx['fee']['bitcoin'], Decimal('-0.00000326'))
+        assert_equal(decoded['vsize'], 326)
+        self.generate(node0, 1)
+
+        self.log.info("Send confidential (undiscounted) tx to node 1")
+        addr = node1.getnewaddress()
+        info = node1.getaddressinfo(addr)
+        txid = node0.sendtoaddress(info['confidential'], 1.0, "", "", False, None, None, None, None, None, None, feerate)
+        tx = node0.gettransaction(txid, True, True)
+        decoded = tx['decoded']
+        vin = decoded['vin']
+        vout = decoded['vout']
+        assert_equal(len(vin), 2)
+        assert_equal(len(vout), 3)
+        assert_equal(tx['fee']['bitcoin'], Decimal('-0.00002575'))
+        assert_equal(decoded['vsize'], 2575)
+        self.generate(node0, 1)
+
+        self.log.info("Send confidential (discounted) tx to node 1")
+        bitcoin = 'b2e15d0d7a0c94e4e2ce0fe6e8691b9e451377f6e46e8045a86f7c4b5d4f0f23'
+        addr = node1.getnewaddress()
+        info = node1.getaddressinfo(addr)
+        txid = node2.sendtoaddress(info['confidential'], 1.0, "", "", False, None, None, None, None, None, None, feerate)
+        # node0 won't accept or relay the tx
+        self.sync_mempools([node1, node2])
+        assert_equal(node0.getrawmempool(), [])
+        self.generate(node2, 1, sync_fun=self.sync_blocks)
+        for node in [node2, node1]:
+            tx = node.gettransaction(txid, True, True)
+            decoded = tx['decoded']
+            vin = decoded['vin']
+            vout = decoded['vout']
+            assert_equal(len(vin), 2)
+            assert_equal(len(vout), 3)
+            if 'bitcoin' in decoded['fee']:
+                assert_equal(decoded['fee']['bitcoin'], Decimal('-0.00000437'))
+            else:
+                assert_equal(decoded['fee'][bitcoin], Decimal('0.00000437'))
+            assert_equal(decoded['vsize'], 2575)
+            assert_equal(decoded['discountvsize'], 437)
+
+        # node0 should report the same discountvsize and vsize
+        tx = node0.getrawtransaction(txid, True)
+        assert_equal(tx['vsize'], 2575)
+        assert_equal(tx['discountvsize'], 2575)
+
+
+if __name__ == '__main__':
+    CTTest().main()

test/functional/test_runner.py

@@ -185,6 +185,8 @@
     'wallet_avoidreuse.py --descriptors',
     'mempool_reorg.py',
     'mempool_persist.py',
+    # ELEMENTS: discounted Confidential Transactions
+    'feature_discount_ct.py',
     'wallet_multiwallet.py --legacy-wallet',
     'wallet_multiwallet.py --descriptors',
     'wallet_multiwallet.py --usecli',