You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: bip-0078.mediawiki
+24-24Lines changed: 24 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -95,7 +95,7 @@ The payjoin proposal PSBT is sent in the HTTP response body, base64 serialized w
95
95
96
96
To ensure compatibility with web-wallets and browser-based-tools, all responses (including errors) must contain the HTTP header <code>Access-Control-Allow-Origin: *</code>.
97
97
98
-
The sender must ensure that the url refers to a scheme or protocol using authenticated encryption, for example TLS with certificate validation, or a .onion link to a hidden service whose public key identifier has already been communicated via a TLS connection. Senders SHOULD NOT accept a url representing an unencrypted or unauthenticated connection.
98
+
The sender must ensure that the URL refers to a scheme or protocol using authenticated encryption, for example TLS with certificate validation, or a .onion link to a hidden service whose public key identifier has already been communicated via a TLS connection. Senders SHOULD NOT accept a URL representing an unencrypted or unauthenticated connection.
99
99
100
100
The original PSBT MUST:
101
101
* Have all the <code>witnessUTXO</code> or <code>nonWitnessUTXO</code> information filled in.
@@ -108,7 +108,7 @@ The original PSBT MAY:
108
108
109
109
The payjoin proposal MUST:
110
110
* Use all the inputs from the original PSBT.
111
-
* Use all the outputs which do not belongs to the receiver from the original PSBT.
111
+
* Use all the outputs which do not belong to the receiver from the original PSBT.
112
112
* Only finalize the inputs added by the receiver. (Referred later as <code>additional inputs</code>)
113
113
* Only fill the <code>witnessUTXO</code> or <code>nonWitnessUTXO</code> for the additional inputs.
114
114
@@ -187,10 +187,10 @@ The well-known error codes are:
187
187
|The receiver rejected the original PSBT.
188
188
|}
189
189
190
-
The receiver is allowed to return implementationspecific errors which may assist the sender to diagnose any issue.
190
+
The receiver is allowed to return implementation-specific errors which may assist the sender to diagnose any issue.
191
191
192
192
However, it is important that error codes that are not well-known and that the message do not appear on the sender's software user interface.
193
-
Such error codes or messages could be used maliciously to phish a nontechnical user.
193
+
Such error codes or messages could be used maliciously to phish a non-technical user.
194
194
Instead those errors or messages can only appear in debug logs.
195
195
196
196
It is advised to hard code the description of the well known error codes into the sender's software.
@@ -213,7 +213,7 @@ To prevent this, the sender can agree to pay more fee so the receiver make sure
213
213
214
214
* The sender's transaction is time sensitive.
215
215
216
-
When a sender pick a specific fee rate, the sender expects the transaction to be confirmed after a specific amount of time. But if the receiver adds an input without bumping the fee of the transaction, the payjoin transaction fee rate will be lower, and thus, longer to confirm.
216
+
When a sender picks a specific fee rate, the sender expects the transaction to be confirmed after a specific amount of time. But if the receiver adds an input without bumping the fee of the transaction, the payjoin transaction fee rate will be lower, and thus, longer to confirm.
217
217
218
218
Our recommendation for <code>maxadditionalfeecontribution=</code> is <code>originalPSBTFeeRate * vsize(sender_input_type)</code>.
219
219
@@ -244,8 +244,8 @@ The receiver needs to do some check on the original PSBT before proceeding:
244
244
* If the sender included inputs in the original PSBT owned by the receiver, the receiver must either return error <code>original-psbt-rejected</code> or make sure they do not sign those inputs in the payjoin proposal.
245
245
* If the sender's inputs are all from the same scriptPubKey type, the receiver must match the same type. If the receiver can't match the type, they must return error <code>unavailable</code>.
246
246
* Make sure that the inputs included in the original transaction have never been seen before.
247
-
** This prevent [[#probing-attack|probing attacks]].
248
-
** This prevent reentrant payjoin, where a sender attempts to use payjoin transaction as a new original transaction for a new payjoin.
247
+
** This prevents [[#probing-attack|probing attacks]].
248
+
** This prevents reentrant payjoin, where a sender attempts to use payjoin transaction as a new original transaction for a new payjoin.
249
249
250
250
<code>*</code>: Interactive receivers are not required to validate the original PSBT because they are not exposed to [[#probing-attack|probing attacks]].
251
251
@@ -257,26 +257,26 @@ The sender should check the payjoin proposal before signing it to prevent a mali
257
257
* If the receiver's BIP21 signalled <code>pjos=0</code>, disable payment output substitution.
258
258
* Verify that the transaction version, and the nLockTime are unchanged.
259
259
* Check that the sender's inputs' sequence numbers are unchanged.
260
-
* For each inputs in the proposal:
261
-
** Verify that no keypaths is in the PSBT input
260
+
* For each input in the proposal:
261
+
** Verify that no keypaths are in the PSBT input
262
262
** Verify that no partial signature has been filled
263
-
** If it is one of the sender's input
263
+
** If it is one of the sender's inputs:
264
264
*** Verify that input's sequence is unchanged.
265
265
*** Verify the PSBT input is not finalized
266
266
*** Verify that <code>non_witness_utxo</code> and <code>witness_utxo</code> are not specified.
267
-
** If it is one of the receiver's input
267
+
** If it is one of the receiver's inputs:
268
268
*** Verify the PSBT input is finalized
269
269
*** Verify that <code>non_witness_utxo</code> or <code>witness_utxo</code> are filled in.
270
-
** Verify that the payjoin proposal did not introduced mixed input's sequence.
271
-
** Verify that the payjoin proposal did not introduced mixed input's type.
270
+
** Verify that the payjoin proposal inputs all specify the same sequence value.
271
+
** Verify that the payjoin proposal did not introduce mixed input's type.
272
272
** Verify that all of sender's inputs from the original PSBT are in the proposal.
273
-
* For each outputs in the proposal:
274
-
** Verify that no keypaths is in the PSBT output
273
+
* For each output in the proposal:
274
+
** Verify that no keypaths are in the PSBT output
275
275
** If the output is the [[#fee-output|fee output]]:
276
276
*** The amount that was subtracted from the output's value is less than or equal to <code>maxadditionalfeecontribution</code>. Let's call this amount <code>actual contribution</code>.
277
-
*** Make sure the actual contribution is only paying fee: The <code>actual contribution</code> is less than or equals to the difference of absolute fee between the payjoin proposal and the original PSBT.
278
-
*** Make sure the actual contribution is only paying for fee incurred by additional inputs: <code>actual contribution</code> is less than or equals to <code>originalPSBTFeeRate * vsize(sender_input_type) * (count(payjoin_proposal_inputs) - count(original_psbt_inputs))</code>. (see [[#fee-output|Fee output]] section)
279
-
** If the output is the payment output and payment output substitution is allowed.
277
+
*** Make sure the actual contribution is only going towards fees: The <code>actual contribution</code> is less than or equals to the difference of absolute fee between the payjoin proposal and the original PSBT.
278
+
*** Make sure the actual contribution is only paying for fees incurred by additional inputs: <code>actual contribution</code> is less than or equal to <code>originalPSBTFeeRate * vsize(sender_input_type) * (count(payjoin_proposal_inputs) - count(original_psbt_inputs))</code>. (see [[#fee-output|Fee output]] section)
279
+
** If the output is the payment output and payment output substitution is allowed,
280
280
*** Do not make any check
281
281
** Else
282
282
*** Make sure the output's value did not decrease.
@@ -287,8 +287,8 @@ The sender must be careful to only sign the inputs that were present in the orig
287
287
288
288
Note:
289
289
* The sender must allow the receiver to add/remove or modify the receiver's own outputs. (if payment output substitution is disabled, the receiver's outputs must not be removed or decreased in value)
290
-
* The sender should allow the receiver to not add any inputs. This is useful for the receiver to change the paymout output scriptPubKey type.
291
-
* If no input have been added, the sender's wallet implementation should accept the payjoin proposal, but not mark the transaction as an actual payjoin in the user interface.
290
+
* The sender should allow the receiver to not add any inputs. This is useful for the receiver to change the payment output scriptPubKey type.
291
+
* If the receiver added no inputs, the sender's wallet implementation should accept the payjoin proposal, but not mark the transaction as an actual payjoin in the user interface.
292
292
293
293
Our method of checking the fee allows the receiver and the sender to batch payments in the payjoin transaction.
294
294
It also allows the receiver to pay the fee for batching adding his own outputs.
@@ -344,7 +344,7 @@ On top of this the receiver can poison analysis by randomly faking a round amoun
Unless disallowed by sender explicitly via `disableoutputsubstitution=true` or by the BIP21 url via query parameter the `pjos=0`, the receiver is free to decrease the amount, remove, or change the scriptPubKey output paying to himself.
347
+
Unless disallowed by the sender explicitly via <code>disableoutputsubstitution=true</code> or by the BIP21 URL via the query parameter <code>pjos=0</code>, the receiver is free to decrease the amount, remove, or change the scriptPubKey output paying to himself.
348
348
Note that if payment output substitution is disallowed, the reveiver can still increase the amount of the output. (See [[#reference-impl|the reference implementation]])
349
349
350
350
For example, if the sender's scriptPubKey type is P2WPKH while the receiver's payment output in the original PSBT is P2SH, then the receiver can substitute the payment output to be P2WPKH to match the sender's scriptPubKey type.
@@ -358,7 +358,7 @@ A compromised payjoin server could steal the hot wallet outputs of the receiver,
358
358
359
359
===Impacted heuristics===
360
360
361
-
Our proposal of payjoin is breaking the following blockchain heuristics:
361
+
Our proposal of payjoin breaks the following blockchain heuristics:
362
362
363
363
* Common inputs heuristics.
364
364
@@ -408,7 +408,7 @@ With payjoin, the maximum amount of money that can be lost is equal to two payme
<code>RequestPayjoin</code> takes the bip21 URI of the payment, the wallet and the <code>signedPSBT</code>.
411
+
<code>RequestPayjoin</code> takes the BIP21 URI of the payment, the wallet and the <code>signedPSBT</code>.
412
412
413
413
The <code>signedPSBT</code> represents a PSBT which has been fully signed, but not yet finalized.
414
414
We then prepare <code>originalPSBT</code> from the <code>signedPSBT</code> via the <code>CreateOriginalPSBT</code> function and get back the <code>proposal</code>.
@@ -674,7 +674,7 @@ A successful exchange with:
674
674
675
675
==Backward compatibility==
676
676
677
-
The receivers are advertising payjoin capabilities through [[bip-0021.mediawiki|BIP21's URI Scheme]].
677
+
The receivers advertise payjoin capabilities through [[bip-0021.mediawiki|BIP21's URI Scheme]].
678
678
679
679
Senders not supporting payjoin will just ignore the <code>pj</code> variable and thus, will proceed to normal payment.
0 commit comments