OP_KEEPCHANGE - mitigating dust outputs

OP_KEEPCHANGE - mitigating dust outputs
2024-09-26  1:22 ` Pieter Wuille
  
From: James Ferguson @ 2024-09-26  0:44 UTC (permalink / raw)
  To: Bitcoin Development Mailing List


[-- Attachment #1.1: Type: text/plain, Size: 4394 bytes --]

My first post to list - Hi
- tell me if I am in the wrong place or following idea is absurd 
- otherwise please onboard me towards adding value (tell me when I've 
overlooked standards etc)

So, at risk of proving foolish  - I think I may have a novel and useful 
idea (did some searches and found nothing).

best James

Title: "Keep the Change" dust mitigation

Category:** Consensus (Soft Fork  - I think)

*Abstract *

Introduction of provisionally named  "OP_KEEPCHANGE" allows small residual 
UTXO (change) to be automatically credited to the primary recipient’s 
address.
  
This aims to reduce inefficiencies associated with the creation of dust 
outputs, reduce bloat, improve transaction efficiency, and optimise network 
performance by minimising the accumulation of tiny un-spendable UTXO.

*Motivation*

When a user sends Bitcoin, any leftover amount is typically returned to a 
change address controlled by the sender. 
If this leftover amount is sufficiently small (dust) it is not economically 
spendable, representing a small reduction in the money supply.

This causes problems:

- UTXO bloat:  More UTXOs mean a larger blockchain size, increasing storage 
and bandwidth requirements for nodes and threatens decentralisation.
- Higher transaction fees: Dust outputs, when combined in future 
transactions, increase the transaction size, leading to higher fees.
- Inefficient use of UTXOs: Managing numerous small change outputs makes 
transaction construction more complex and potentially inefficient.

OP_KEEPCHANGE mitigates these issues while offering additional secondary 
benefits:

a) Prevention of Value Erosion: 
When transferring funds between wallets owned by the same party, small 
change amounts can lead to minor value erosion due to repeated fees and 
inefficiencies.
This proposal eliminates such erosion by crediting the residual amount to 
the recipient wallet.

b) Enhanced Privacy: . 
This provides a slight improvement in transaction privacy by obfuscating 
the typical patterns used to identify change outputs.

c) Mitigation of Money Supply Reduction: 
As dust UTXOs accumulate over time and become economically unspendable, 
they effectively reduce the Bitcoin money supply.
This proposal helps mitigate a calculable reduction in the overall Bitcoin 
supply, preserving value and improving the network’s long-term 
sustainability.

d) Recipient Benefit A provider (eg a merchant) accepting bitcoin or  fiat 
exchange users buying bitcoin (especially small sums after DCA'ing) gain a 
small proportional uplift in revenues at no cost to the sender)

f) Reduction in dust threshold: In so far as transaction costs are reduced 
a small reduction in the dust threshold is thereby achieved

g) Equitable with positive feedback : By reducing dust UTXO size increases 
- larger UTXO makes for lower default dust - All users benefit from reduced 
dust whether they make further OP_KEEPCHANGE transactions or not

*High Level Specification Outline*

- Introduce  OP_KEEPCHANGE 

- Assume some dust threshold (XXX satoshis)  configurable by wallet user

- During input UTXO selection to transfer some value, a wallet or user 
seeks the minimum change value that would normally be generated as a return 
UTXO. This involves by judicious input UTXO selection. 
If this is below the dust threshold a transaction can be marked with 
OP_KEEPCHANGE

- When used in a transaction, `OP_KEEPCHANGE` signals that any excess 
change be added to the primary output instead of generating a separate 
change output. 

Instead of funding eternally useless UTXOs the recipient’s output is 
increased by this amount.

*Summary*

By implementing this fairly simple backwardly compatible mechanism, the 
Bitcoin network can achieve greater efficiency, decentralisation, cost 
savings, and improved privacy for its users while maintaining a healthier 
and more predictable money supply.

-- 
2: Type: text/html, Size: 5004 bytes --]

 permalink raw reply	[|nested]
2024-09-26  0:44 [bitcoindev] OP_KEEPCHANGE - mitigating dust outputs James Ferguson

  2024-09-26  9:05   ` James Ferguson
  
From: Pieter Wuille @ 2024-09-26  1:22 UTC (permalink / raw)
  To: James Ferguson;  Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 4043 bytes --]

Hi James,

I believe you're imagining that Bitcoin works very differently from how it actually does. Comments below inline.

On Wednesday, September 25th, 2024 at 8:44 PM, James Ferguson <jamesfergusonch@gmail•com> wrote:

> Introduction of provisionally named "OP_KEEPCHANGE" allows small residual UTXO (change) to be automatically credited to the primary recipient’s address.

Bitcoin doesn't have a concept of address balances at the protocol level, or even addresses at all, let alone a "primary recipient address". Balances you see in wallets and blockchain explorers simply report the sum of the values of UTXOs under control of a given address, but this is a local interpretation made by that software; the protocol itself does not know or care about these things.

The way to "credit an address" in Bitcoin is literally to create a UTXO locked with (the script corresponding to) the address in question, so barring an extremely invasive overhaul of how the entire protocol works, there isn't actually any UTXO set size benefit to this proposal - change UTXOs would still need to be created. In addition, if your proposal requires revealing what the recipient of a payment is (as "crediting primary recipient" implies), it would necessarily also undo the primary privacy benefit of having a UTXO model in the first place: today, one cannot generally tell which output of a transaction is the payee, and this is by design.

Of course, a hypothetical proposal could change anything about Bitcoin's design if it were to have enough support. If the Bitcoin ecosystem really wanted an address balance model, nothing prevents the introduction of that. In that case, there is no point to have UTXOs, or change, at all. Just make transaction deduct some address balances, and credit some others directly. This removes many of the issues you seem to want to address much more directly (including coin selection, dust accumulation, UTXO set growth to some extent, and many more, while adding other complications in other places, of course). However, it would also massively hurt privacy, as there would be an on-chain cost to creating new addresses/balances, incentivizing keeping one's funds in just one. The current UTXO model does not care about the distinction between payments and change and this is very much desirable: sending your change to a new change address with pristine history costs exactly the same as sending it back to the address the spend coins were assigned to.

> b) Enhanced Privacy: .
> This provides a slight improvement in transaction privacy by obfuscating the typical patterns used to identify change outputs.

But it does so at the cost of incentivizing not transitioning to a new address on every transaction, a huge privacy leak.

> - When used in a transaction, `OP_KEEPCHANGE` signals that any excess change be added to the primary output instead of generating a separate change output.

Change does not exist at the protocol level. It is just an output like any normal payment output, and indistinguishable from it. The protocol also has no knowledge of excess - that is a concept purely local to the sender wallet. It chooses​ to add an output back to itself, to balance the amounts in the inputs with the amounts in the outputs (minus fee). At the very least your proposal would require a way to signal how much to send back, and to where (remember that multiple parties can cooperate to jointly construct a single transaction!). At this point you're not far off from just having another output...

Cheers,

--
Pieter

-- 


[-- Attachment #2: Type: text/html, Size: 8066 bytes --]

 permalink raw reply	[|nested]
2024-09-26  1:22 ` Pieter Wuille

  2024-09-28  2:28     ` Keagan McClelland
  
From: James Ferguson @ 2024-09-26  9:05 UTC (permalink / raw)
  To: Pieter Wuille;  Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 4954 bytes --]

Pieter

- Thank you, very helpful explanation

 So  suggestion sucks -  I withdraw it to avoid wasting others time !

However,  it seems dust benefits could be achieved simply by wallets
proposing dust roundup to recipient when creating the transaction rather
than providing a change output - It seems wallet providers could automate
this small benefit to be adopted with no protocol change.

So it fair to describe dust as a "tragedy of the commons" (wallets leave
value at small cost but no benefit) that bloats the time chain ?

Thanks for your assistance - I want to get into this but need to pick a
niche to grow initial understanding. - Suggestions welcome

Cheers, James



On Thu, 26 Sept 2024 at 03:23, Pieter Wuille <bitcoin-dev@wuille•net> wrote:

> Hi James,
>
> I believe you're imagining that Bitcoin works very differently from how it
> actually does. Comments below inline.
>
> On Wednesday, September 25th, 2024 at 8:44 PM, James Ferguson <
> jamesfergusonch@gmail•com> wrote:
>
> Introduction of provisionally named "OP_KEEPCHANGE" allows small residual
> UTXO (change) to be automatically credited to the primary recipient’s
> address.
>
>
> Bitcoin doesn't have a concept of address balances at the protocol level,
> or even addresses at all, let alone a "primary recipient address". Balances
> you see in wallets and blockchain explorers simply report the sum of the
> values of UTXOs under control of a given address, but this is a local
> interpretation made by that software; the protocol itself does not know or
> care about these things.
>
> The way to "credit an address" in Bitcoin is literally to create a UTXO
> locked with (the script corresponding to) the address in question, so
> barring an extremely invasive overhaul of how the entire protocol works,
> there isn't actually any UTXO set size benefit to this proposal - change
> UTXOs would still need to be created. In addition, if your proposal
> requires revealing what the recipient of a payment is (as "crediting
> primary recipient" implies), it would necessarily also undo the primary
> privacy benefit of having a UTXO model in the first place: today, one
> cannot generally tell which output of a transaction is the payee, and this
> is by design.
>
> Of course, a hypothetical proposal could change anything about Bitcoin's
> design if it were to have enough support. If the Bitcoin ecosystem really
> wanted an address balance model, nothing prevents the introduction of that.
> In that case, there is no point to have UTXOs, or change, at all. Just make
> transaction deduct some address balances, and credit some others directly.
> This removes many of the issues you seem to want to address much more
> directly (including coin selection, dust accumulation, UTXO set growth to
> some extent, and many more, while adding other complications in other
> places, of course). However, it would also massively hurt privacy, as there
> would be an on-chain cost to creating new addresses/balances, incentivizing
> keeping one's funds in just one. The current UTXO model does not care about
> the distinction between payments and change and this is very much
> desirable: sending your change to a new change address with pristine
> history costs exactly the same as sending it back to the address the spend
> coins were assigned to.
>
> b) Enhanced Privacy: .
> This provides a slight improvement in transaction privacy by obfuscating
> the typical patterns used to identify change outputs.
>
>
> But it does so at the cost of incentivizing not transitioning to a new
> address on every transaction, a huge privacy leak.
>
> - When used in a transaction, `OP_KEEPCHANGE` signals that any excess
> change be added to the primary output instead of generating a separate
> change output.
>
>
> Change does not exist at the protocol level. It is just an output like any
> normal payment output, and indistinguishable from it. The protocol also has
> no knowledge of excess - that is a concept purely local to the sender
> wallet. It *chooses*​ to add an output back to itself, to balance the
> amounts in the inputs with the amounts in the outputs (minus fee). At the
> very least your proposal would require a way to signal how much to send
> back, and to where (remember that multiple parties can cooperate to jointly
> construct a single transaction!). At this point you're not far off from
> just having another output...
>
> Cheers,
>
> --
> Pieter
>
>

-- 


[-- Attachment #2: Type: text/html, Size: 9194 bytes --]

 permalink raw reply	[|nested]
2024-09-26  9:05   ` James Ferguson

  
From: Keagan McClelland @ 2024-09-28  2:28 UTC (permalink / raw)
  To: james;  Pieter Wuille, Bitcoin Development Mailing List

[-- Attachment #1: Type: text/plain, Size: 6060 bytes --]

I think a number of wallets will refuse to create dust outputs and will
offer the would-be dust as extra fees if there would be dust. This is
ultimately up to wallet policy and there are some UX quirks to be worked
out but this is entirely in the application domain, as opposed to at the
protocol layer.

Keagan

On Thu, Sep 26, 2024 at 3:46 AM James Ferguson <jamesfergusonch@gmail•com>
wrote:

> Pieter
>
> - Thank you, very helpful explanation
>
>  So  suggestion sucks -  I withdraw it to avoid wasting others time !
>
> However,  it seems dust benefits could be achieved simply by wallets
> proposing dust roundup to recipient when creating the transaction rather
> than providing a change output - It seems wallet providers could automate
> this small benefit to be adopted with no protocol change.
>
> So it fair to describe dust as a "tragedy of the commons" (wallets leave
> value at small cost but no benefit) that bloats the time chain ?
>
> Thanks for your assistance - I want to get into this but need to pick a
> niche to grow initial understanding. - Suggestions welcome
>
> Cheers, James
>
>
>
> On Thu, 26 Sept 2024 at 03:23, Pieter Wuille <bitcoin-dev@wuille•net>
> wrote:
>
>> Hi James,
>>
>> I believe you're imagining that Bitcoin works very differently from how
>> it actually does. Comments below inline.
>>
>> On Wednesday, September 25th, 2024 at 8:44 PM, James Ferguson <
>> jamesfergusonch@gmail•com> wrote:
>>
>> Introduction of provisionally named "OP_KEEPCHANGE" allows small residual
>> UTXO (change) to be automatically credited to the primary recipient’s
>> address.
>>
>>
>> Bitcoin doesn't have a concept of address balances at the protocol level,
>> or even addresses at all, let alone a "primary recipient address". Balances
>> you see in wallets and blockchain explorers simply report the sum of the
>> values of UTXOs under control of a given address, but this is a local
>> interpretation made by that software; the protocol itself does not know or
>> care about these things.
>>
>> The way to "credit an address" in Bitcoin is literally to create a UTXO
>> locked with (the script corresponding to) the address in question, so
>> barring an extremely invasive overhaul of how the entire protocol works,
>> there isn't actually any UTXO set size benefit to this proposal - change
>> UTXOs would still need to be created. In addition, if your proposal
>> requires revealing what the recipient of a payment is (as "crediting
>> primary recipient" implies), it would necessarily also undo the primary
>> privacy benefit of having a UTXO model in the first place: today, one
>> cannot generally tell which output of a transaction is the payee, and this
>> is by design.
>>
>> Of course, a hypothetical proposal could change anything about Bitcoin's
>> design if it were to have enough support. If the Bitcoin ecosystem really
>> wanted an address balance model, nothing prevents the introduction of that.
>> In that case, there is no point to have UTXOs, or change, at all. Just make
>> transaction deduct some address balances, and credit some others directly.
>> This removes many of the issues you seem to want to address much more
>> directly (including coin selection, dust accumulation, UTXO set growth to
>> some extent, and many more, while adding other complications in other
>> places, of course). However, it would also massively hurt privacy, as there
>> would be an on-chain cost to creating new addresses/balances, incentivizing
>> keeping one's funds in just one. The current UTXO model does not care about
>> the distinction between payments and change and this is very much
>> desirable: sending your change to a new change address with pristine
>> history costs exactly the same as sending it back to the address the spend
>> coins were assigned to.
>>
>> b) Enhanced Privacy: .
>> This provides a slight improvement in transaction privacy by obfuscating
>> the typical patterns used to identify change outputs.
>>
>>
>> But it does so at the cost of incentivizing not transitioning to a new
>> address on every transaction, a huge privacy leak.
>>
>> - When used in a transaction, `OP_KEEPCHANGE` signals that any excess
>> change be added to the primary output instead of generating a separate
>> change output.
>>
>>
>> Change does not exist at the protocol level. It is just an output like
>> any normal payment output, and indistinguishable from it. The protocol also
>> has no knowledge of excess - that is a concept purely local to the sender
>> wallet. It *chooses*​ to add an output back to itself, to balance the
>> amounts in the inputs with the amounts in the outputs (minus fee). At the
>> very least your proposal would require a way to signal how much to send
>> back, and to where (remember that multiple parties can cooperate to jointly
>> construct a single transaction!). At this point you're not far off from
>> just having another output...
>>
>> Cheers,
>>
>> --
>> Pieter
>>
>> --
> You received this message because you are subscribed to the Google Groups
> "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to bitcoindev+unsubscribe@googlegroups•com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/bitcoindev/CABCM42TOD8fOJhy-1xEhGHiW3W9-MBnrhcHLOvsNwkjSiaG0VA%40mail.gmail.com
> <https://groups.google.com/d/msgid/bitcoindev/CABCM42TOD8fOJhy-1xEhGHiW3W9-MBnrhcHLOvsNwkjSiaG0VA%40mail.gmail.com?utm_medium=email&utm_source=footer>
> .
>

-- 


[-- Attachment #2: Type: text/html, Size: 10628 bytes --]

 permalink raw reply	[|nested]