Add support for taproot zero-fee commitment format

We add support for the zero-fee commitment format specified in
lightning/bolts#1330.

Channels using this commitment format benefit from better protection
against pinning attacks (thanks to TRUC/v3 transactions), don't need
the `update_fee` mechanism, have less dust exposure risk, and use an
overall simpler state machine, while benefiting from the privacy
improvements of taproot channels.

Author: t-bast

eclair-core/src/main/resources/reference.conf

@@ -77,6 +77,7 @@ eclair {
     option_attribution_data = optional
     option_onion_messages = optional
     zero_fee_commitments = disabled
+    taproot_zero_fee_commitments_staging = disabled
     // This feature should only be enabled when acting as an LSP for mobile wallets.
     // When activating this feature, the peer-storage section should be customized to match desired SLAs.
     option_provide_storage = disabled

eclair-core/src/main/scala/fr/acinq/eclair/Features.scala

@@ -445,6 +445,11 @@ object Features {
     val mandatory = 180
   }
 
+  case object TaprootZeroFeeCommitmentsStaging extends Feature with InitFeature with NodeFeature with ChannelTypeFeature {
+    val rfcName = "taproot_zero_fee_commitments_staging"
+    val mandatory = 182
+  }
+
   /**
    * Activate this feature to provide on-the-fly funding to remote nodes, as specified in bLIP 36: https://github.com/lightning/blips/blob/master/blip-0036.md.
    * TODO: add NodeFeature once bLIP is merged.
@@ -491,6 +496,7 @@ object Features {
     SimpleClose,
     SimpleTaprootChannelsPhoenix,
     SimpleTaprootChannelsStaging,
+    TaprootZeroFeeCommitmentsStaging,
     WakeUpNotificationClient,
     TrampolinePaymentPrototype,
     AsyncPaymentPrototype,

eclair-core/src/main/scala/fr/acinq/eclair/blockchain/fee/OnChainFeeConf.scala

@@ -93,7 +93,7 @@ case class OnChainFeeConf(feeTargets: FeeTargets,
       case Transactions.ZeroFeeHtlcTxAnchorOutputsCommitmentFormat | Transactions.ZeroFeeHtlcTxSimpleTaprootChannelCommitmentFormat =>
         // If the fee has a large enough change, we update the fee.
         currentFeeratePerKw.toLong == 0 || Math.abs((currentFeeratePerKw.toLong - nextFeeratePerKw.toLong).toDouble / currentFeeratePerKw.toLong) > updateFeeMinDiffRatio
-      case Transactions.ZeroFeeCommitmentFormat =>
+      case Transactions.ZeroFeeCommitmentFormat | Transactions.TaprootZeroFeeCommitmentFormat =>
         // We never send update_fee when using zero-fee commitments.
         false
     }
@@ -114,7 +114,7 @@ case class OnChainFeeConf(feeTargets: FeeTargets,
     val networkFeerate = feerates.fast
     val networkMinFee = feerates.minimum
     commitmentFormat match {
-      case Transactions.ZeroFeeCommitmentFormat => FeeratePerKw(0 sat)
+      case Transactions.ZeroFeeCommitmentFormat | Transactions.TaprootZeroFeeCommitmentFormat => FeeratePerKw(0 sat)
       case Transactions.UnsafeLegacyAnchorOutputsCommitmentFormat | Transactions.PhoenixSimpleTaprootChannelCommitmentFormat =>
         // Since Bitcoin Core v28, 1-parent-1-child package relay has been deployed: it should be ok if the commit tx
         // doesn't propagate on its own.

eclair-core/src/main/scala/fr/acinq/eclair/channel/ChannelFeatures.scala

@@ -113,6 +113,15 @@ object ChannelTypes {
     override def commitmentFormat: CommitmentFormat = ZeroFeeHtlcTxSimpleTaprootChannelCommitmentFormat
     override def toString: String = s"simple_taproot_channel_staging${if (scidAlias) "+scid_alias" else ""}${if (zeroConf) "+zeroconf" else ""}"
   }
+  case class TaprootZeroFeeCommitments(scidAlias: Boolean = false, zeroConf: Boolean = false) extends SupportedChannelType {
+    override def features: Set[ChannelTypeFeature] = Set(
+      if (scidAlias) Some(Features.ScidAlias) else None,
+      if (zeroConf) Some(Features.ZeroConf) else None,
+      Some(Features.TaprootZeroFeeCommitmentsStaging)
+    ).flatten
+    override def commitmentFormat: CommitmentFormat = TaprootZeroFeeCommitmentFormat
+    override def toString: String = s"taproot_zero_fee_commitments${if (scidAlias) "+scid_alias" else ""}${if (zeroConf) "+zeroconf" else ""}"
+  }
 
   case class UnsupportedChannelType(featureBits: Features[InitFeature]) extends ChannelType {
     override def features: Set[InitFeature] = featureBits.activated.keySet
@@ -144,6 +153,10 @@ object ChannelTypes {
     ZeroFeeCommitments(zeroConf = true),
     ZeroFeeCommitments(scidAlias = true),
     ZeroFeeCommitments(scidAlias = true, zeroConf = true),
+    TaprootZeroFeeCommitments(),
+    TaprootZeroFeeCommitments(zeroConf = true),
+    TaprootZeroFeeCommitments(scidAlias = true),
+    TaprootZeroFeeCommitments(scidAlias = true, zeroConf = true),
     SimpleTaprootChannelsPhoenix,
   ).map {
     channelType => Features(channelType.features.map(_ -> FeatureSupport.Mandatory).toMap) -> channelType
@@ -163,7 +176,9 @@ object ChannelTypes {
 
   /** Returns our preferred channel type for public channels, if supported by our peer. */
   def preferredForPublicChannels(localFeatures: Features[InitFeature], remoteFeatures: Features[InitFeature], announceChannel: Boolean): Option[SupportedChannelType] = {
-    if (Features.canUseFeature(localFeatures, remoteFeatures, Features.ZeroFeeCommitments)) {
+    if (Features.canUseFeature(localFeatures, remoteFeatures, Features.TaprootZeroFeeCommitmentsStaging)) {
+      Some(TaprootZeroFeeCommitments(scidAlias = !announceChannel && Features.canUseFeature(localFeatures, remoteFeatures, Features.ScidAlias)))
+    } else if (Features.canUseFeature(localFeatures, remoteFeatures, Features.ZeroFeeCommitments)) {
       Some(ZeroFeeCommitments(scidAlias = !announceChannel && Features.canUseFeature(localFeatures, remoteFeatures, Features.ScidAlias)))
     } else if (Features.canUseFeature(localFeatures, remoteFeatures, Features.AnchorOutputsZeroFeeHtlcTx)) {
       Some(AnchorOutputsZeroFeeHtlcTx(scidAlias = !announceChannel && Features.canUseFeature(localFeatures, remoteFeatures, Features.ScidAlias)))

eclair-core/src/main/scala/fr/acinq/eclair/channel/Commitments.scala

@@ -173,7 +173,7 @@ object LocalCommit {
     log.info(s"built local commit number=$localCommitIndex toLocalMsat=${spec.toLocal.toLong} toRemoteMsat=${spec.toRemote.toLong} htlc_in={} htlc_out={} feeratePerKw=${spec.commitTxFeerate} txid=${localCommitTx.tx.txid} fundingTxId=$fundingTxId", spec.htlcs.collect(DirectedHtlc.incoming).map(_.id).mkString(","), spec.htlcs.collect(DirectedHtlc.outgoing).map(_.id).mkString(","))
     val remoteCommitSigOk = commitmentFormat match {
       case _: SegwitV0CommitmentFormat => localCommitTx.checkRemoteSig(fundingKey.publicKey, remoteFundingPubKey, commit.signature)
-      case _: SimpleTaprootChannelCommitmentFormat => commit.sigOrPartialSig match {
+      case _: TaprootCommitmentFormat => commit.sigOrPartialSig match {
         case _: IndividualSignature => false
         case remoteSig: PartialSignatureWithNonce =>
           val localNonce = NonceGenerator.verificationNonce(fundingTxId, fundingKey, remoteFundingPubKey, localCommitIndex)
@@ -211,7 +211,7 @@ case class RemoteCommit(index: Long, spec: CommitmentSpec, txId: TxId, remotePer
       case _: SegwitV0CommitmentFormat =>
         val sig = remoteCommitTx.sign(fundingKey, remoteFundingPubKey)
         Right(CommitSig(channelParams.channelId, sig, htlcSigs.toList, batchSize))
-      case _: SimpleTaprootChannelCommitmentFormat =>
+      case _: TaprootCommitmentFormat =>
         remoteNonce_opt match {
           case Some(remoteNonce) =>
             val localNonce = NonceGenerator.signingNonce(fundingKey.publicKey, remoteFundingPubKey, commitInput.outPoint.txid)
@@ -639,7 +639,7 @@ case class Commitment(fundingTxIndex: Long,
     Metrics.recordHtlcsInFlight(spec, remoteCommit.spec)
     val sig = commitmentFormat match {
       case _: SegwitV0CommitmentFormat => remoteCommitTx.sign(fundingKey, remoteFundingPubKey)
-      case _: SimpleTaprootChannelCommitmentFormat =>
+      case _: TaprootCommitmentFormat =>
         nextRemoteNonce_opt match {
           case Some(remoteNonce) =>
             val localNonce = NonceGenerator.signingNonce(fundingKey.publicKey, remoteFundingPubKey, fundingTxId)
@@ -1102,7 +1102,7 @@ case class Commitments(channelParams: ChannelParams,
     val localNextPerCommitmentPoint = channelKeys.commitmentPoint(localCommitIndex + 2)
     val localCommitNonces = active.flatMap(c => c.commitmentFormat match {
       case _: SegwitV0CommitmentFormat => None
-      case _: SimpleTaprootChannelCommitmentFormat =>
+      case _: TaprootCommitmentFormat =>
         val localNonce = NonceGenerator.verificationNonce(c.fundingTxId, c.localFundingKey(channelKeys), c.remoteFundingPubKey, localCommitIndex + 2)
         Some(c.fundingTxId -> localNonce.publicNonce)
     })

eclair-core/src/main/scala/fr/acinq/eclair/channel/Helpers.scala

@@ -133,7 +133,7 @@ object Helpers {
     }
     val channelFeatures = ChannelFeatures(channelType, localFeatures, remoteFeatures, open.channelFlags.announceChannel)
     channelType.commitmentFormat match {
-      case _: SimpleTaprootChannelCommitmentFormat => if (open.commitNonce_opt.isEmpty) return Left(MissingCommitNonce(open.temporaryChannelId, TxId(ByteVector32.Zeroes), commitmentNumber = 0))
+      case _: TaprootCommitmentFormat => if (open.commitNonce_opt.isEmpty) return Left(MissingCommitNonce(open.temporaryChannelId, TxId(ByteVector32.Zeroes), commitmentNumber = 0))
       case _: SegwitV0CommitmentFormat => ()
     }
 
@@ -243,7 +243,7 @@ object Helpers {
 
     val channelFeatures = ChannelFeatures(channelType, localFeatures, remoteFeatures, open.channelFlags.announceChannel)
     channelType.commitmentFormat match {
-      case _: SimpleTaprootChannelCommitmentFormat => if (accept.commitNonce_opt.isEmpty) return Left(MissingCommitNonce(open.temporaryChannelId, TxId(ByteVector32.Zeroes), commitmentNumber = 0))
+      case _: TaprootCommitmentFormat => if (accept.commitNonce_opt.isEmpty) return Left(MissingCommitNonce(open.temporaryChannelId, TxId(ByteVector32.Zeroes), commitmentNumber = 0))
       case _: SegwitV0CommitmentFormat => ()
     }
     extractShutdownScript(accept.temporaryChannelId, localFeatures, remoteFeatures, accept.upfrontShutdownScript_opt).map(script_opt => (channelFeatures, script_opt))
@@ -295,7 +295,7 @@ object Helpers {
     channelType match {
       case _: ChannelTypes.AnchorOutputs | _: ChannelTypes.AnchorOutputsZeroFeeHtlcTx => remoteFeeratePerKw < FeeratePerKw.MinimumFeeratePerKw
       case _: ChannelTypes.SimpleTaprootChannelsStaging | ChannelTypes.SimpleTaprootChannelsPhoenix => remoteFeeratePerKw < FeeratePerKw.MinimumFeeratePerKw
-      case _: ChannelTypes.ZeroFeeCommitments => false
+      case _: ChannelTypes.ZeroFeeCommitments | _: ChannelTypes.TaprootZeroFeeCommitments => false
     }
   }
 
@@ -558,7 +558,7 @@ object Helpers {
         val localNextPerCommitmentPoint = channelKeys.commitmentPoint(commitments.localCommitIndex + 1)
         val localCommitNonces = commitments.active.flatMap(c => c.commitmentFormat match {
           case _: SegwitV0CommitmentFormat => None
-          case _: SimpleTaprootChannelCommitmentFormat =>
+          case _: TaprootCommitmentFormat =>
             val fundingKey = channelKeys.fundingKey(c.fundingTxIndex)
             val n = NonceGenerator.verificationNonce(c.fundingTxId, fundingKey, c.remoteFundingPubKey, commitments.localCommitIndex + 1).publicNonce
             Some(c.fundingTxId -> n)
@@ -787,7 +787,7 @@ object Helpers {
                   val dummySig = IndividualSignature(Transactions.PlaceHolderSig)
                   val dummySignedTx = dummyTx.aggregateSigs(dummyPubkey, dummyPubkey, dummySig, dummySig)
                   SimpleClosingTxFee.PaidByUs(Transactions.weight2fee(feerate, dummySignedTx.weight()))
-                case _: SimpleTaprootChannelCommitmentFormat =>
+                case _: TaprootCommitmentFormat =>
                   val dummySignedTx = dummyTx.tx.updateWitness(dummyTx.inputIndex, Script.witnessKeyPathPay2tr(Transactions.PlaceHolderSig))
                   SimpleClosingTxFee.PaidByUs(Transactions.weight2fee(feerate, dummySignedTx.weight()))
               }
@@ -803,7 +803,7 @@ object Helpers {
         val localFundingKey = channelKeys.fundingKey(commitment.fundingTxIndex)
         val localNonces = CloserNonces.generate(localFundingKey.publicKey, commitment.remoteFundingPubKey, commitment.fundingTxId)
         val tlvs: TlvStream[ClosingCompleteTlv] = commitment.commitmentFormat match {
-          case _: SimpleTaprootChannelCommitmentFormat =>
+          case _: TaprootCommitmentFormat =>
             remoteNonce_opt match {
               case None => return Left(MissingClosingNonce(commitment.channelId))
               case Some(remoteNonce) =>
@@ -842,7 +842,7 @@ object Helpers {
         // If our output isn't dust, they must provide a signature for a transaction that includes it.
         // Note that we're the closee, so we look for signatures including the closee output.
         commitment.commitmentFormat match {
-          case _: SimpleTaprootChannelCommitmentFormat => localNonce_opt match {
+          case _: TaprootCommitmentFormat => localNonce_opt match {
             case None => Left(MissingClosingNonce(commitment.channelId))
             case Some(localNonce) =>
               (closingTxs.localAndRemote_opt, closingTxs.localOnly_opt) match {
@@ -1207,7 +1207,7 @@ object Helpers {
         // In that case, we don't need to create a dedicated anchor transaction which avoids using wallet inputs.
         val useMainTxForAnchor = commitment.commitmentFormat match {
           case _: AnchorOutputsCommitmentFormat | _: SimpleTaprootChannelCommitmentFormat => false
-          case ZeroFeeCommitmentFormat =>
+          case ZeroFeeCommitmentFormat | TaprootZeroFeeCommitmentFormat =>
             val commitFee = Transactions.weight2fee(feerates.fastest, commitTx.weight())
             mainTx_opt.exists(_.tx.txOut.map(_.amount).sum > commitFee)
         }
@@ -1237,10 +1237,8 @@ object Helpers {
 
       /** Claim our main output from the remote commitment transaction, if available. */
       def claimMainOutput(commitKeys: RemoteCommitmentKeys, commitTx: Transaction, dustLimit: Satoshi, commitmentFormat: CommitmentFormat, feerate: FeeratePerKw, finalScriptPubKey: ByteVector)(implicit log: LoggingAdapter): Option[ClaimRemoteMainOutputTx] = {
-        commitmentFormat match {
-          case _: AnchorOutputsCommitmentFormat | _: SimpleTaprootChannelCommitmentFormat | ZeroFeeCommitmentFormat => withTxGenerationLog("remote-main") {
-            ClaimRemoteMainOutputTx.createUnsignedTx(commitKeys, commitTx, dustLimit, finalScriptPubKey, feerate, commitmentFormat)
-          }
+        withTxGenerationLog("remote-main") {
+          ClaimRemoteMainOutputTx.createUnsignedTx(commitKeys, commitTx, dustLimit, finalScriptPubKey, feerate, commitmentFormat)
         }
       }
 
@@ -1405,10 +1403,8 @@ object Helpers {
         val feeratePenalty = feerates.fast
 
         // First we will claim our main output right away.
-        val mainTx_opt = commitmentFormat match {
-          case _: AnchorOutputsCommitmentFormat | _: SimpleTaprootChannelCommitmentFormat | ZeroFeeCommitmentFormat => withTxGenerationLog("remote-main") {
-            ClaimRemoteMainOutputTx.createUnsignedTx(commitKeys, commitTx, dustLimit, finalScriptPubKey, feerateMain, commitmentFormat)
-          }
+        val mainTx_opt = withTxGenerationLog("remote-main") {
+          ClaimRemoteMainOutputTx.createUnsignedTx(commitKeys, commitTx, dustLimit, finalScriptPubKey, feerateMain, commitmentFormat)
         }
 
         // Then we punish them by stealing their main output.

eclair-core/src/main/scala/fr/acinq/eclair/channel/fsm/Channel.scala

@@ -157,7 +157,7 @@ object Channel {
     case _: ChannelTypes.AnchorOutputs | _: ChannelTypes.AnchorOutputsZeroFeeHtlcTx => 483
     case _: ChannelTypes.SimpleTaprootChannelsStaging | ChannelTypes.SimpleTaprootChannelsPhoenix => 483
     // When using v3 transactions, the maximum package size is more restrictive than v2 transactions.
-    case _: ChannelTypes.ZeroFeeCommitments => 114
+    case _: ChannelTypes.ZeroFeeCommitments | _: ChannelTypes.TaprootZeroFeeCommitments => 114
   }
 
   // We may need to rely on our peer's commit tx in certain cases (backup/restore) so we must ensure their transactions
@@ -2422,7 +2422,7 @@ class Channel(val nodeParams: NodeParams, val channelKeys: ChannelKeys, val wall
       val nextFundingTlv: Set[ChannelReestablishTlv] = Set(ChannelReestablishTlv.NextFundingTlv(d.signingSession.fundingTxId))
       val nonceTlvs = d.signingSession.fundingParams.commitmentFormat match {
         case _: SegwitV0CommitmentFormat => Set.empty
-        case _: SimpleTaprootChannelCommitmentFormat =>
+        case _: TaprootCommitmentFormat =>
           val localFundingKey = channelKeys.fundingKey(0)
           val remoteFundingPubKey = d.signingSession.fundingParams.remoteFundingPubKey
           val currentCommitNonce_opt = d.signingSession.localCommit match {
@@ -2490,7 +2490,7 @@ class Channel(val nodeParams: NodeParams, val channelKeys: ChannelKeys, val wall
       val nextCommitNonces: Map[TxId, IndividualNonce] = d.commitments.active.flatMap(c => {
         c.commitmentFormat match {
           case _: SegwitV0CommitmentFormat => None
-          case _: SimpleTaprootChannelCommitmentFormat =>
+          case _: TaprootCommitmentFormat =>
             val localFundingKey = channelKeys.fundingKey(c.fundingTxIndex)
             Some(c.fundingTxId -> NonceGenerator.verificationNonce(c.fundingTxId, localFundingKey, c.remoteFundingPubKey, d.commitments.localCommitIndex + 1).publicNonce)
         }