会話

画像
OP_CAT and the Infinite Nothing
OP_CAT与无限的虚无

Introduction
介绍

You may have heard about re-enabling OP_CAT as a potential upgrade for bitcoin's script language. Depending on where you get your news OP_CAT has been called "only 10 lines of code", "the best way to enable experimentation with covenants", "too powerful", "dangerous and leading to miner centralization", or "guaranteed to lead to a contentious soft fork". I'm going to make the case that all of these perspectives are mistaken. OP_CAT is very useful, can be used as a covenant, and not (alone) the best next move for bitcoin. Nothing more, and nothing less.
您可能听说过重新启用OP_CAT作为比特币脚本语言的潜在升级。根据你从哪里得到你的新闻,OP_CAT被称为“只有 10 行代码”、“实现契约实验的最佳方式”、“太强大”、“危险并导致矿工中心化”或“保证会导致有争议的软分叉”。我要说明的是,所有这些观点都是错误的。OP_CAT非常有用,可以用作契约,而不是(单独)比特币的最佳下一步行动。仅此而已。
To make that case, I'm going to explore several (apparently disjoint) topics, some of which were new to me a few short months ago. I'm going to try and arrange this in a way that provides the necessary background in one place.
为了说明这一点,我将探讨几个(显然是不相干的)主题,其中一些在短短几个月前对我来说是新的。我将尝试以一种在一个地方提供必要背景的方式进行安排。

How and What OP_CAT Does
OP_CAT如何以及做什么

Introspection with CAT
CAT内省

Let's tackle the burning question that many have when first exposed to OP_CAT. How can a few lines of code that combine two items from the stack into one (A B CAT -> AB) possibly enable anything interesting? Andrew Poelstra has eloquently explained in , and I posted a silly and brief explanation:
让我们解决许多人第一次接触OP_CAT时遇到的紧迫问题。将堆栈中的两个项目合并为一个(A B CAT -> AB)的几行代码怎么可能实现任何有趣的事情?安德鲁·波尔斯特拉(Andrew Poelstra)在最近的采访中雄辩地解释了,我发布了一个愚蠢而简短的解释:
Rearden 🍯🦡 🦢 | embrace forks
里尔登 🍯 🦡 🦢 |拥抱叉子
@reardencode
返信先: さん
回复: @mikeinspace Mr./Ms.
Bitcoin is a bit weird, so it can also split things. Then SHA256 lets us undo hashes. Then because cryptography is just math and we know how to grind, CAT lets us extract a hash from a signature verification. And as a result we can inspect anything hashed inside a signature
比特币有点奇怪,所以它也可以拆分东西。然后 SHA256 让我们撤消哈希值。然后,由于密码学只是数学,并且我们知道如何研磨,CAT允许我们从签名验证中提取哈希值。因此,我们可以检查签名中散列的任何内容
さらに表示
显示更多
Because bitcoin script is strictly a verification language, each opcode can be used in forward or reverse. A script can be given a hash and require a preimage, or given a preimage and require a hash using OP_SHA256. This insight gives us the first two parts of how OP_CAT covenants work.
因为比特币脚本严格来说是一种验证语言,所以每个操作码都可以正向或反向使用。可以为脚本提供哈希值并需要前映像,也可以使用OP_SHA256给定前映像并需要哈希值。这个洞见为我们提供了圣约如何运作OP_CAT的前两个部分。
If a bitcoin script could get access to a hash of the transaction it's verifying, it could require that the spend stack provide the hash preimage, split in whatever way the script requires, and then validate any particular part of that preimage. This is exactly what a covenant is - validating a part of the transaction spending some bitcoin.
如果比特币脚本可以访问它正在验证的交易的哈希值,它可能要求支出堆栈提供哈希前映像,以脚本所需的任何方式进行拆分,然后验证该前映像的任何特定部分。这正是契约的本质——验证交易的一部分,花费一些比特币。
That's great, but bitcoin doesn't have an opcode like to give the script access to the transaction's hash. Here, we take advantage of the signature verification equation to require that the user provide the hash. If the user provides a value that will be a valid transaction hash if the script concatenates the byte 0x00 to the end of it, that value will also be a part of a valid BIP340 signature (with certain other parameters fixed) if the script concatenates the byte 0x01 to it.
这很好,但比特币没有像 OP_TXHASH 这样的操作码来让脚本访问交易的哈希值。在这里,我们利用 BIP340 Schnorr 签名验证方程来要求用户提供哈希值。如果用户提供的值在脚本将字节0x00连接到它的末尾时将是有效的事务哈希值,那么如果脚本将字节0x01连接到它,则该值也将成为有效 BIP340 签名的一部分(某些其他参数是固定的)。
Combining these techniques, enables OP_CAT to check any part of its spending transaction that can be signed, and even to look back at its parent transactions in some limited ways. With some careful codecraft, one can build , , and more.
结合这些技术,OP_CAT 可以检查其支出交易中可以签名的任何部分,甚至可以以一些有限的方式回顾其父交易。通过一些仔细的代码处理,可以构建 Purrfect Vaults、CatVM 等。

Other uses for CAT
CAT的其他用途

But we shouldn't. Building these things with OP_CAT results in difficult to maintain abominations. Instead, we should use OP_CAT for what it's good for, and there's plenty of that: It enables the equivalent of , checking Merkle inclusion proofs, combining data for signature verification with , and more.
但我们不应该这样做。用OP_CAT建造这些东西会导致难以维持的可憎之物。相反,我们应该将 OP_CAT 用于它的好处,而且有很多:它支持相当于OP_CHECKSEPARATESIG、检查 Merkle 包含证明、将签名验证数据与OP_CHECKSIGFROMSTACK相结合等等。

Problems with CAT
CAT 的问题

Now that we know what CAT does, what's the problem? Why have people (myself included) said that it's a dangerous beast? Using the introspection technique described above, CAT enables two specific constructions: Hashrate escrows, and (supposedly) automated market makers (AMMs). Until recently, both of these were considered significant risks of bringing centralizing MEV to bitcoin.
现在我们知道了 CAT 的作用,有什么问题呢?为什么人们(包括我自己)说它是危险的野兽?使用上述自省技术,CAT 支持两种特定结构:哈希率托管和(据称)自动做市商 (AMM)。直到最近,这两者都被认为是将中心化MEV引入比特币的重大风险。

MEV, MEVil and Miner Centralization
MEV、MEVil 和矿工中心化

The term MEV (Miner Extractable Value) is a bit confusing. In the plainest interpretation it would include transaction fees, which of course we want paid to miners to help ensure the security of bitcoin long into the future. MEV is generally used to mean additional value that miners can extract from their blocks beyond the fees visible on the public relay network. This could come in the form of out of band payments, miners participating in contracts and reordering transactions in ways that favor themselves, or even outright theft of goods and services by miners mining blocks that reorg and double spend a confirmed payment to a merchant. All of these forms of MEV can be considered generally bad for the participants in the network, as the miners are using their position in the network to their own benefit at the expense of other network participants. However, MEV alone does not present a systemic problem by driving miner centralization, only a local problem for the specifically impacted participants.
MEV(矿工可提取价值)一词有点令人困惑。在最简单的解释中,它将包括交易费用,我们当然希望支付给矿工,以帮助确保比特币在未来很长一段时间内的安全。MEV 通常用于表示矿工可以从他们的区块中提取的额外价值,超出公共中继网络上可见的费用。这可能以带外支付的形式出现,矿工参与合同并以有利于自己的方式重新排序交易,甚至是矿工挖矿区块直接盗窃商品和服务,这些区块重组并双倍花费给商家的确认付款。所有这些形式的MEV通常都对网络参与者不利,因为矿工正在利用他们在网络中的地位为自己谋取利益,而牺牲其他网络参与者的利益。然而,MEV本身并不能通过推动矿工集中化而带来系统性问题,而只是针对特定受影响的参与者的局部问题。
MEVil is a term that is sometimes used for MEV which drives miner centralization - I prefer the term centralizing MEV and will use it going forward. Several things are necessary to change MEV into centralizing MEV:
MEVil 是一个有时用于推动矿工中心化的 MEV 的术语 - 我更喜欢集中化 MEV 这个词,并将在未来使用它。将 MEV 更改为集中式 MEV 需要做以下几件事:
  1. It must be sufficiently difficult to extract that an open source block template builder cannot reasonably extract it
    提取起来必须足够困难,以至于开源块模板构建器无法合理地提取它
  2. The total value extractable must grow with a miner's bitcoin hash rate
    可提取的总价值必须随着矿工的比特币哈希率而增长
  3. The extractable value must justify the cost of extraction
    可提取价值必须证明提取成本的合理性
If all of these requirements are met then only a sufficiently large miner will have the incentive to begin extracting the MEV. Once they do, they will be able to outpace their smaller peers' growth thanks to the additional revenue extracted. The more costly the MEV is to extract (up to the point where it is not worth it for any miner) the worse the centalizing pressure it creates.
如果满足所有这些要求,那么只有足够大的矿工才有动力开始提取MEV。一旦他们这样做,由于提取了额外的收入,他们将能够超过较小的同行的增长。MEV的提取成本越高(直到对任何矿工来说都不值得),它产生的中心化压力就越严重。
Avoiding centralizing MEV then is (in a sense) simple: Ensure that whatever opportunities for MEV exist on bitcoin are either so easy to extract that everyone does it or cost more to extract than they're worth (either because they're so small or because they're so costly).
因此,避免集中MEV(从某种意义上说)很简单:确保比特币上存在的任何MEV机会要么很容易提取,以至于每个人都这样做,要么提取成本高于其价值(要么是因为它们太小了,要么是因为它们太昂贵了)。
For more information, check out 's .
有关更多信息,请查看 @TheBlueMatt 最近的帖子。

Hashrate Escrows (née Drivechains)
Hashrate Escrows (née Drivechains)

Many years ago (before the Lightning Network or ideas like Ark, Timeout Trees, roll-ups, BitVM, or CatVM) sidechains were considered the ultimate scaling solution for bitcoin. The idea was conceptually simple: bitcoin blocks must stay limited in size for all the usual decentralization reasons, but we can attach sidechains to bitcoin and those can have faster blocks, bigger blocks, more computation, or whatever. In practice, however, implementing sidechains was not so easy. Bitcoin's final settlement is fundamentally tied to proof of work, an unfalsifiable cost to reorder transactions, how does a sidechain inherit that? Also, how can bitcoin be transferred to and from the sidechain? The best known proposal to answer these two questions is called Drivechains (BIPs and ). I won't bore you with the details of Drivechains, but suffice it to say, there are only two outcomes of such sidechain systems: Either they are relatively unused (and therefore useless) or they are widely used and become a de facto block size increase for bitcoin. A de facto block size increase of this sort is a form of centralizing MEV where only larger miners will be able to cost effectively participate in the additional revenue opportunities offered by the potentially large and complex sidechain blocks.
许多年前(在闪电网络或Ark、Timeout Trees、roll-ups、BitVM或CatVM等想法出现之前),侧链被认为是比特币的终极扩容解决方案。这个想法在概念上很简单:出于所有通常的去中心化原因,比特币区块必须保持大小限制,但我们可以将侧链附加到比特币上,这些侧链可以有更快的区块、更大的区块、更多的计算量或其他什么。然而,在实践中,实现侧链并不是那么容易。比特币的最终结算从根本上与工作量证明有关,工作量证明是重新排序交易的不可证伪成本,侧链如何继承它?此外,比特币如何与侧链之间转移?回答这两个问题的最著名建议称为驱动链(BIP 300 和 301)。我不会让你厌烦Drivechains的细节,但可以说,这种侧链系统只有两种结果:要么它们相对未使用(因此无用),要么被广泛使用并成为比特币事实上的区块大小增加。事实上,这种区块大小的增加是集中式MEV的一种形式,只有较大的矿工才能经济高效地参与潜在的大型和复杂的侧链区块提供的额外收入机会。
Hashrate escrows, which can be built with OP_CAT, are one small part of the Drivechains proposals. This is a system of restricting withdrawals from sidechains by using a counter whose value can only be changed by miners, starts at a high value, and must reach zero before a sidechain withdrawal can be processed. This is claimed to be a "trustless" transfer out from a sidechain, but actually creates a federation of miners with control of all bitcoin held in sidechains.
可以使用OP_CAT构建的哈希率托管是Drivechains提案的一小部分。这是一个通过使用计数器来限制从侧链提款的系统,其值只能由矿工更改,从高值开始,并且必须达到零才能处理侧链提款。这据称是从侧链转出的“无信任”转移,但实际上创建了一个矿工联盟,控制着侧链中持有的所有比特币。
Since the development of the Drivechains proposals, it has become (to our detriment) common to refer to any proposal which can be used to create a withdrawal predicated on a miner-controlled counter as "Drivechains". Hopefully it clear at this point why this inappropriate shorthand is unhelpful - Drivechains are either worthless or dangerous, but hashrate escrows are merely a way to transfer control the outcome of some transaction to the implicit federation of miners.
自从 Drivechains 提案开发以来,将任何可用于创建基于矿工控制计数器的提款的提案都称为“Drivechains”,这对我们不利。希望在这一点上能清楚为什么这种不恰当的速记是无益的——驱动链要么毫无价值,要么很危险,但哈希率托管只是将某些交易结果的控制权转移给隐式矿工联盟的一种方式。

Tokens and AMMs
代币和 AMM

Tokens
令 牌

For reasons that will never be entirely clear to me, humans love a good token (or a bad token or really just tokens). Nearly from the beginning of bitcoin there has been talk of how to embed other tokens into the protocol, from and , to the more recent and . All of these protocols have one thing in common: They require an external index of bitcoin transactions that either has knowledge of external data or processes data from the sequence of bitcoin transactions in order to determine the transformations of tokens within the protocol. The salient point for this article is that bitcoin locking scripts are completely unaware of the existence of the tokens, and even bitcoin nodes that validate transactions are unaware of the tokens (i.e. even if a bitcoin locking script had full access to the complete bitcoin UTXO set, it could not discover the state of any of these tokens).
出于我永远不会完全清楚的原因,人类喜欢一个好的代币(或一个坏的代币,或者实际上只是代币)。几乎从比特币诞生之初,人们就一直在讨论如何将其他代币嵌入到协议中,从彩色硬币和交易对手,到最近的 Taproot 资产和符文。所有这些协议都有一个共同点:它们需要比特币交易的外部索引,该索引要么了解外部数据,要么处理来自比特币交易序列的数据,以确定协议内代币的转换。本文的要点是,比特币锁定脚本完全不知道代币的存在,甚至验证交易的比特币节点也不知道代币的存在(即,即使比特币锁定脚本对完整的比特币UTXO集具有完全访问权限,它也无法发现任何这些代币的状态)。

Automated Market Makers (AMMs)
自动做市商 (AMM)

On other blockchain systems it is common for contracts known as AMMs to be used to (for example) peg the ratio between two tokens by buying and selling at a fixed price. The rules that can be encoded in an AMM are beyond the scope of this article. Suffice it to say that AMMs create huge opportunities for MEV and because of the private exchange relationships needed to maximize the returns on that MEV also centralizing MEV. This has often been used as an argument against building more expressive bitcoin scripts - we genuinely do want to avoid exposing the bitcoin network to the vagaries of centralizing MEV. However, as I've described above there simply is no practical way for bitcoin scripts, no matter how expressive, to evaluate the state of any token other than bitcoin. Bitcoin scripts cannot locate a rare sat. They can't find a Rune balance. They can't identify a Taproot Asset.
在其他区块链系统上,通常使用称为AMM的合约(例如)通过以固定价格买卖来固定两个代币之间的比率。可以在 AMM 中编码的规则超出了本文的讨论范围。可以说,AMM 为 MEV 创造了巨大的机会,并且由于 MEV 回报最大化所需的私人交换关系,MEV 也集中了 MEV。这经常被用作反对构建更具表现力的比特币脚本的论据——我们确实希望避免将比特币网络暴露在中心化 MEV 的变幻莫测中。然而,正如我上面所描述的,比特币脚本根本没有实用的方法,无论多么富有表现力,都无法评估比特币以外的任何代币的状态。比特币脚本无法找到稀有的卫星。他们找不到符文平衡。他们无法识别 Taproot 资产。
Without access to any information about the disposition of non-bitcoin assets, the entire concept of a bitcoin script based AMM ceases to make sense. Token locations can be attested to by a signature from an oracle, but oracle attestations do not make an AMM. They can be used to facilitate specific manual trades, but not a durable automated system. Moreover, such an oracle-based system could be built today with no changes to bitcoin.
如果无法获得有关非比特币资产处置的任何信息,基于比特币脚本的AMM的整个概念就不再有意义。令牌位置可以通过预言机的签名来证明,但预言机证明不会创建 AMM。它们可用于促进特定的手动交易,但不能用于耐用的自动化系统。此外,这样一个基于预言机的系统可以在今天构建,而无需对比特币进行任何更改。

Conclusion
结论

As you can hopefully see, CAT is not such a frightful beast. It's not really much of a beast at all. It has neither infinite capability nor magical powers. It's just a little opcode that can be very helpful. The one thing we probably want to avoid is activating OP_CAT without another way to do transaction introspection, such as OP_TXHASH, OP_TX, or both. Even enabling it with LNHANCE is an improvement on OP_CAT alone because it reduces the size and complexity of the scripts needed to achieve many OP_CAT introspection protocols.
正如你所看到的,猫并不是那么可怕的野兽。它根本不是什么野兽。它既没有无限的能力,也没有神奇的力量。这只是一个非常有用的小操作码。我们可能想要避免的一件事是激活OP_CAT而没有其他方法进行交易内省,例如OP_TXHASH、OP_TX或两者兼而有之。即使使用 LNHANCE 启用它也是对单独OP_CAT的改进,因为它减少了实现许多OP_CAT自省协议所需的脚本的大小和复杂性。
Rearden 🍯🦡 🦢 | embrace forks
里尔登 🍯 🦡 🦢 |拥抱叉子
@reardencode
I think at this point, the "CAT introduces infinite everything" has been reduced to ~nothing. It introduces helpful introspection in a shitty way that nobody should use. To help people not use it, we should enable CAT along with TXHASH or similar. x.com/rot13maxi/stat
我认为在这一点上,“CAT 引入了无限的一切”已经减少到~无。 它以一种没有人应该使用的糟糕方式引入了有用的内省。为了帮助人们不使用它,我们应该启用 CAT 以及 TXHASH 或类似工具。 x.com/rot13maxi/stat
さらに表示
显示更多
引用
Rearden 🍯🦡 🦢 | embrace forks
里尔登 🍯 🦡 🦢 |拥抱叉子
@reardencode
This exchange has been very useful to me. I think the "CAT introduces infinite everything" has been reduced to the following: CAT introduces the possibility of open sequence AMMs and trustless 2wp sidechains. These essentially devolve to the same thing: a miner can choose x.com/TheBlueMatt/st…
这次交流对我非常有用。 我认为“CAT 引入了无限的一切”已经简化为以下内容: CAT 引入了开放序列 AMM 和无需信任的 2wp 侧链的可能性。 这些基本上归结为同一件事:矿工可以选择 x.com/TheBlueMatt/st......
さらに表示
显示更多

記事の公開をご希望の場合
如果您想发表文章
プレミアムプラスにアップグレード
升级至 Premium Plus
3.3万
件の表示