(mostly) Lock free transactions

Current wallets tend to commit to the inputs for a transaction during its construction. This is both undesirable and unnecessary.
A wallet only needs to commit to a partial excess.

The following describes a Just-in-Time method of picking inputs.

Both (or all in general) parties engaging in a transaction derive the blinding factor for their output (or each of their outputs in general), and also pick a random offset.

Their partial excess is the sum of all these.
EDIT: I had this wrong; the partial excess should be the sum of the output blinding factors MINUS the offset.

It also picks a random nonce.

After exchanging commitments to the partial excesses and random nonces, each party can compute their partial signature.

The slate is then passed around with each party adding their output(s), rangeproof(s), and partial signature to the aggregate. Only at this point does it add any inputs it might have, at the same time subtracting their blinding factors from its offset, and adding the resulting offset to the aggregate.

If there is only sender and receiver, and the slate ends up at the sender last, then it can publish the tx immediately after picking its input(s), minimizing the time they stay locked, no matter how long it took to construct the transaction. This should be of particular interest to exchanges.

10 Likes

I don’t quite understand how this works. Could you provide a minimal example of a transaction flow the way it is done now by the wallets and how they could improve it?

Right now if I only have one output, and send out a slate to pay someone, then that “locks” my single output, and I cannot send out slates to anyone else I want to pay, until the first slate comes back and the tx gets published and confirmed.

2 Likes

Yeah, this makes sense :ok_hand: why do you think exchanges benefit from this the most? Is the assumption here that they have a few utxos that get locked up?

Exchanges may be relying on http to avoid the complexities of having many locked outputs.

2 Likes

Why does the title indicate “mostly”? Is it in regards to 3+ parties in the transaction?

I believe the wallet considers an output locked until its spending is sufficiently confirmed.

Yeastplume pointed out that i had an offset sign issue in the original post. I decided to fix it in place, as marked with an EDIT.