tapsend+proof: Add STXO exclusion proof to params

This commit adds the STXO exclusion proof to the proof parameters. It
stores them in `params.ExclusionProofs[].CommitmentProof.STXOProofs[]`
where they are later encoded when creating the actual proofs.

Author: gijswijs

proof/mint.go

@@ -158,6 +158,23 @@ func (p *BaseProofParams) HaveInclusionProof(anchorOutputIndex uint32) bool {
 	return p.OutputIndex == int(anchorOutputIndex)
 }
 
+// HaveSTXOExclusionProof returns true if we have an STXO exclusion proof for
+// the given anchor output index.
+func (p *BaseProofParams) HaveSTXOExclusionProof(
+	anchorOutputIndex uint32) bool {
+
+	for _, proof := range p.ExclusionProofs {
+		if proof.OutputIndex == anchorOutputIndex &&
+			proof.CommitmentProof != nil &&
+			len(proof.CommitmentProof.STXOProofs) > 0 {
+
+			return true
+		}
+	}
+
+	return false
+}
+
 // MintParams holds the set of chain level information needed to make a proof
 // file for the set of assets minted in a batch.
 type MintParams struct {
@@ -289,6 +306,7 @@ func baseProof(params *BaseProofParams, prevOut wire.OutPoint) (*Proof, error) {
 		InternalKey: params.InternalKey,
 	}
 	proof.ExclusionProofs = params.ExclusionProofs
+
 	return proof, nil
 }
 

tapsend/proof.go

@@ -9,9 +9,11 @@ import (
 	"github.com/lightninglabs/taproot-assets/asset"
 	"github.com/lightninglabs/taproot-assets/commitment"
 	"github.com/lightninglabs/taproot-assets/fn"
+	"github.com/lightninglabs/taproot-assets/mssmt"
 	"github.com/lightninglabs/taproot-assets/proof"
 	"github.com/lightninglabs/taproot-assets/tappsbt"
 	"github.com/lightningnetwork/lnd/lnwallet/chainfee"
+	"golang.org/x/exp/maps"
 )
 
 // FundedPsbt represents a fully funded PSBT transaction.
@@ -265,6 +267,19 @@ func proofParams(finalTx *wire.MsgTx, vPkt *tappsbt.VPacket,
 			allVirtualOutputs, rootOut.Asset, rootParams,
 			outputCommitments,
 		)
+
+		// Add STXO exclusion proofs for all the other outputs, for all
+		// STXOs spent by _all_ VOutputs that anchor in this output.
+		// First Collect all STXOs for this anchor output. Then add
+		// exclusion proofs for all the other anchor outputs. Add these
+		// in proofParams in tapsend/proof.go Those proofParams end up
+		// in `CreateTransitionProof` in tapsend/append.go, where we
+		// create the basic proof template. There we drop the STXO
+		// exclusion proofs in proof.UnknownOddTypes.
+		err := addSTXOExclusionProofs(
+			allVirtualOutputs, rootOut.Asset, rootParams,
+			outputCommitments,
+		)
 		if err != nil {
 			return nil, err
 		}
@@ -326,9 +341,119 @@ func proofParams(finalTx *wire.MsgTx, vPkt *tappsbt.VPacket,
 	return splitParams, nil
 }
 
+// addSTXOExclusionProofs adds exclusion proofs for all the STXOs of the asset,
+// for all the outputs that are asset outputs but haven't been processed yet,
+// otherwise they'll be skipped. This should only be called after
+// `addOtherOutputExclusionProofs` because it depends on
+// `params.ExclusionProofs` already being set.
+func addSTXOExclusionProofs(outputs []*tappsbt.VOutput,
+	newAsset *asset.Asset, params *proof.TransitionParams,
+	outputCommitments map[uint32]*commitment.TapCommitment) error {
+
+	stxoAssets, err := asset.CollectSTXO(newAsset)
+	if err != nil {
+		return fmt.Errorf("error collecting STXO assets: %w", err)
+	}
+
+	for idx := range outputs {
+		vOut := outputs[idx]
+
+		outIndex := vOut.AnchorOutputIndex
+
+		// We can use `HaveInclusionProof` here because it is just a
+		// check on whether we are processing our own anchor output.
+		haveIProof := params.HaveInclusionProof(outIndex)
+		haveEProof := params.HaveSTXOExclusionProof(outIndex)
+		if haveIProof || haveEProof {
+			continue
+		}
+
+		tapTree := outputCommitments[outIndex]
+
+		// Find the exclusion proofs for this output.
+		var eProof *proof.TaprootProof
+		for idx := range params.ExclusionProofs {
+			e := params.ExclusionProofs[idx]
+			if e.OutputIndex == outIndex {
+				eProof = &params.ExclusionProofs[idx]
+				break
+			}
+		}
+		if eProof == nil {
+			return fmt.Errorf("no exclusion proof for "+
+				"output %d", outIndex)
+		}
+
+		// There aren't any assets in this output, we can skip
+		// creating exclusion proofs for it.
+		if eProof.CommitmentProof == nil {
+			continue
+		}
+
+		commitmentProof := eProof.CommitmentProof
+
+		commitmentProof.STXOProofs = make(
+			map[asset.SerializedKey]commitment.Proof,
+			len(stxoAssets),
+		)
+
+		for idx := range stxoAssets {
+			stxoAsset := stxoAssets[idx].(*asset.Asset)
+			pubKey := stxoAsset.ScriptKey.PubKey
+			identifier := asset.ToSerialized(pubKey)
+
+			_, exclusionProof, err := tapTree.Proof(
+				stxoAsset.TapCommitmentKey(),
+				stxoAsset.AssetCommitmentKey(),
+			)
+			if err != nil {
+				return err
+			}
+
+			// Confirm that we are creating the stxo proofs for the
+			// asset that is being created. We do this by confirming
+			// that the exclusion proof for the newly created asset
+			// is already present.
+			err = assertAssetExcluded(eProof, newAsset, tapTree)
+			if err != nil {
+				return fmt.Errorf("v0 exclusion proof for "+
+					"newly created asset not found during "+
+					"creation of stxo proofs: %w", err)
+			}
+
+			commitmentProof.STXOProofs[identifier] = *exclusionProof
+		}
+	}
+
+	return nil
+}
+
+// assertAssetExcluded checks that the asset exclusion proof for the newly
+// created asset is present in the v0 exclusion proof for the given output.
+func assertAssetExcluded(exclusionProof *proof.TaprootProof,
+	newAsset *asset.Asset, target *commitment.TapCommitment) error {
+
+	derivedKeys, err := exclusionProof.DeriveByAssetExclusion(
+		newAsset.AssetCommitmentKey(), newAsset.TapCommitmentKey(),
+	)
+	if err != nil {
+		return fmt.Errorf("error deriving by asset exclusion: %w", err)
+	}
+
+	commitments := maps.Values(derivedKeys)
+	if fn.NotAny(commitments, func(c *commitment.TapCommitment) bool {
+		return mssmt.IsEqualNode(c.TreeRoot, target.TreeRoot)
+	}) {
+
+		return fmt.Errorf("no derived commitment matches")
+	}
+
+	return nil
+}
+
 // addOtherOutputExclusionProofs adds exclusion proofs for all the outputs that
-// are asset outputs but haven't been processed yet (the skip function needs to
-// return false for not yet processed outputs, otherwise they'll be skipped).
+// are asset outputs but haven't been processed yet, otherwise they'll be
+// skipped.
 func addOtherOutputExclusionProofs(outputs []*tappsbt.VOutput,
 	asset *asset.Asset, params *proof.TransitionParams,
 	outputCommitments map[uint32]*commitment.TapCommitment) error {