How to make the coinbase UTXO(s) spendable by the guesser

Blockchain Architecture
1

This idea came out of a discussion with Thorkil.

Under normal circumstances, the Guesser only gets access to the Guesser UTXOs. It turns out that the Composer can produce a block proposal whose coinbase UTXOs are spendable by whoever guesses that block. Here is how to do it.

The coinbase UTXO’s lock script validates the following logic.

  • Read the transaction kernel MAST hash.
  • Divine in and authenticate the transaction’s inputs.
    • Assert that the length of inputs is 1. (Use Merge to combine this transaction with others.)
    • Note that inputs[0] is the hash of, among other things, the Utxo. That Utxo has a lock script hash. Assert that that lock script hash matches own program hash.
  • Divine in and authenticate the mutator set accumulator.
    • Divine in the index into the AOCL of the UTXO currently being spent, and authenticate it.
    • Divine in the index into the AOCL of the first Guesser UTXO of the block that created this UTXO. Divine in and authenticate that Guesser UTXO as well as its lock script hash and sender randomness. Note that the sender randomness corresponds to the block’s hash.
    • Divine in and authenticate the block’s transaction and its outputs and counts its number of outputs.
    • Assert that the UTXO currently being spent and the Guesser UTXO come from the same block, by checking that the difference of indices is smaller than the output count.
  • Verify that the Guesser UTXO’s lock script can be satisfied with the current transaction kernel mast hash. (Obvious optimization available if you know it’s a simple hash lock – no recursion.)
2

A concrete use case is that the composer, who makes these block proposals, can pay the guesser for the timelocked part of the block subsidy. The composer rewards himself all the timelocked reward, and creates liquid outputs with this special lock script from inputs that he owns. This way, the composers can make bids on the timelocked part of the bid subsidy without knowing or caring about who will do the guessing, without knowing who the counterparty is.

3

This gets extra complicated by the fact that the sender_randomness field is controllable by a transaction initiator, and that that is where the block_hashis stored for the guesser UTXOs. Care should be taken since the arbitrary sender_randomnessfields opens up for some attacks.