Discreet Log Contracts

cashu/core/base.py

@@ -127,6 +127,15 @@ class P2PKWitness(BaseModel):
     def from_witness(cls, witness: str):
         return cls(**json.loads(witness))
 
+class SCTWitness(BaseModel):
+    leaf_secret: str
+    merkle_proof: List[str]
+    witness: Optional[str] = None
+
+    @classmethod
+    def from_witness(cls, witness: str):
+        return cls(**json.loads(witness))
+
 
 class Proof(BaseModel):
     """
@@ -154,6 +163,8 @@ class Proof(BaseModel):
     melt_id: Union[
         None, str
     ] = None  # holds the id of the melt operation that destroyed this proof
+    all_spending_conditions: Optional[List[str]] = None # holds all eventual SCT spending conditions
+    dlc_root: Optional[str] = None # holds the root hash of a DLC contract
 
     def __init__(self, **data):
         super().__init__(**data)
@@ -169,6 +180,12 @@ def from_dict(cls, proof_dict: dict):
         else:
             # overwrite the empty string with None
             proof_dict["dleq"] = None
+
+        if (proof_dict.get("all_spending_conditions")
+            and isinstance(proof_dict["all_spending_conditions"], str)):
+            proof_dict["all_spending_conditions"] = json.loads(proof_dict["all_spending_conditions"])
+        else:
+            proof_dict["all_spending_conditions"] = None
         c = cls(**proof_dict)
         return c
 
@@ -205,6 +222,16 @@ def p2pksigs(self) -> List[str]:
         assert self.witness, "Witness is missing for p2pk signature"
         return P2PKWitness.from_witness(self.witness).signatures
 
+    @property
+    def dlc_leaf_secret(self) -> str:
+        assert self.witness, "Witness is missing for dlc leaf secret"
+        return SCTWitness.from_witness(self.witness).leaf_secret
+
+    @property
+    def dlc_merkle_proof(self) -> List[str]:
+        assert self.witness, "Witness is missing for dlc merkle proof"
+        return SCTWitness.from_witness(self.witness).merkle_proof
+
     @property
     def htlcpreimage(self) -> Union[str, None]:
         assert self.witness, "Witness is missing for htlc preimage"
@@ -1023,6 +1050,8 @@ class TokenV4(Token):
     t: List[TokenV4Token]
     # memo
     d: Optional[str] = None
+    # dlc root
+    r: Optional[str] = None
 
     @property
     def mint(self) -> str:
@@ -1078,6 +1107,10 @@ def proofs(self) -> List[Proof]:
             for p in token.p
         ]
 
+    @property
+    def dlc_root(self) -> Optional[str]:
+        return self.r
+
     @property
     def keysets(self) -> List[str]:
         return list({p.i.hex() for p in self.t})
@@ -1142,6 +1175,9 @@ def serialize_to_dict(self, include_dleq=False):
         # optional memo
         if self.d:
             return_dict.update(dict(d=self.d))
+        # optional dlc root
+        if self.r:
+            return_dict.update(dict(r=self.r))
         # mint
         return_dict.update(dict(m=self.m))
         # unit
@@ -1214,4 +1250,94 @@ def parse_obj(cls, token_dict: dict):
             u=token_dict["u"],
             t=[TokenV4Token(**t) for t in token_dict["t"]],
             d=token_dict.get("d", None),
+            r=token_dict.get("r", None),
+        )
+
+# -------- DLC STUFF --------
+
+class DiscreetLogContract(BaseModel):
+    """
+    A discrete log contract
+    """
+    settled: Optional[bool] = False
+    dlc_root: str
+    funding_amount: int
+    unit: str
+    inputs: Optional[List[Proof]] = None         # Need to verify these are indeed SCT proofs
+    debts: Optional[Dict[str, int]] = None       # We save who we owe money to here
+
+    @classmethod
+    def from_row(cls, row: Row):
+        return cls(
+            dlc_root=row["dlc_root"],
+            settled=bool(row["settled"]),
+            funding_amount=int(row["funding_amount"]),
+            unit=row["unit"],
+            debts=json.loads(row["debts"]) if row["debts"] else None,
         )
+
+class DlcBadInput(BaseModel):
+    index: int
+    detail: str
+
+class DlcFundingProof(BaseModel):
+    """
+    A dlc merkle root with its signature
+    or a dlc merkle root with bad inputs.
+    """
+    keyset: str
+    signature: str
+
+class DlcFundingAck(BaseModel):
+    dlc_root: str
+    funding_proof: DlcFundingProof
+
+class DlcFundingError(BaseModel):
+    dlc_root: str
+    bad_inputs: Optional[List[DlcBadInput]] # Used to specify potential errors
+
+class DlcOutcome(BaseModel):
+    """
+    Describes a DLC outcome
+    """
+    k: Optional[str]      # The blinded attestation secret
+    t: Optional[int]      # The timeout (claim when time is over)
+    P: str                # The payout structure associated with this outcome
+
+class DlcSettlement(BaseModel):
+    """
+    Data used to settle an outcome of a DLC
+    """
+    dlc_root: str
+    outcome: DlcOutcome
+    merkle_proof: List[str]
+
+class DlcSettlementAck(BaseModel):
+    """
+    Used by the mint to indicate the success of a DLC's funding, settlement, etc.
+    """
+    dlc_root: str
+
+class DlcSettlementError(BaseModel):
+    """
+    Indicates to the client that a DLC operation (funding, settlement, etc) failed.
+    """
+    dlc_root: str
+    details: str
+
+class DlcPayoutWitness(BaseModel):
+    # a BIP-340 signature on the root of the contract
+    signature: Optional[str] = None
+    # the discrete log of the public key (the private key)
+    secret: Optional[str] = None
+
+class DlcPayoutForm(BaseModel):
+    dlc_root: str
+    pubkey: str
+    outputs: List[BlindedMessage]
+    witness: DlcPayoutWitness
+
+class DlcPayout(BaseModel):
+    dlc_root: str
+    outputs: Optional[List[BlindedSignature]] = None
+    detail: Optional[str] = None    # error details

cashu/core/crypto/dlc.py

@@ -0,0 +1,100 @@
+from hashlib import sha256
+from typing import List, Optional, Tuple
+
+from secp256k1 import PrivateKey, PublicKey
+
+
+def sorted_merkle_hash(left: bytes, right: bytes) -> bytes:
+    '''Sorts `left` and `right` in non-ascending order and
+        computes the hash of their concatenation
+    '''
+    if right < left:
+        left, right = right, left
+    return sha256(left+right).digest()
+
+
+def merkle_root(
+    leaf_hashes: List[bytes],
+    track_branch: Optional[int] = None
+    ) -> Tuple[bytes, Optional[List[bytes]]]:
+    '''Computes the root of a list of leaf hashes
+        if `track_branch` is set, extracts the hashes for the branch that leads
+        to `leaf_hashes[track_branch]`
+    '''
+    if track_branch is not None:
+        if len(leaf_hashes) == 0:
+            return b"", []
+        elif len(leaf_hashes) == 1:
+            return leaf_hashes[0], []
+        else:
+            split = len(leaf_hashes) // 2
+            left, left_branch_hashes = merkle_root(leaf_hashes[:split],
+                track_branch if track_branch < split else None)
+            right, right_branch_hashes = merkle_root(leaf_hashes[split:],
+                track_branch-split if track_branch >= split else None)
+            branch_hashes = (left_branch_hashes if
+                track_branch < split else right_branch_hashes)
+            hashh = sorted_merkle_hash(left, right)
+            # Needed to pass mypy checks
+            assert branch_hashes is not None, "merkle_root fail: branch_hashes == None"
+            branch_hashes.append(right if track_branch < split else left)
+            return hashh, branch_hashes
+    else:
+        if len(leaf_hashes) == 0:
+            return b"", None
+        elif len(leaf_hashes) == 1:
+            return leaf_hashes[0], None
+        else:
+            split = len(leaf_hashes) // 2
+            left, _  = merkle_root(leaf_hashes[:split], None)
+            right, _ = merkle_root(leaf_hashes[split:], None)
+            hashh = sorted_merkle_hash(left, right)
+            return hashh, None
+
+def merkle_verify(root: bytes, leaf_hash: bytes, proof: List[bytes]) -> bool:
+    '''Verifies that `leaf_hash` belongs to a merkle tree
+        that has `root` as root
+    '''
+    h = leaf_hash
+    for branch_hash in proof:
+        h = sorted_merkle_hash(h, branch_hash)
+    return h == root
+
+def list_hash(leaves: List[str]) -> List[bytes]:
+    return [sha256(leaf.encode()).digest() for leaf in leaves]
+
+def sign_dlc(
+    dlc_root: str,
+    funding_amount: int,
+    privkey: PrivateKey,
+) -> bytes:
+    message = (
+        bytes.fromhex(dlc_root)
+        +funding_amount.to_bytes(8, "big")
+    )
+    return privkey.schnorr_sign(message, None, raw=True)
+
+def verify_dlc_signature(
+    dlc_root: str,
+    funding_amount: int,
+    signature: bytes,
+    pubkey: PublicKey,
+) -> bool:
+    message = (
+        bytes.fromhex(dlc_root)
+        +funding_amount.to_bytes(8, "big")
+    )
+    return pubkey.schnorr_verify(message, signature, None, raw=True)
+
+def verify_payout_signature(
+    dlc_root: bytes,
+    signature: bytes,
+    pubkey: PublicKey,
+) -> bool:
+    return pubkey.schnorr_verify(dlc_root, signature, None, raw=True)
+
+def verify_payout_secret(
+    secret: bytes,
+    pubkey: PublicKey,
+) -> bool:
+    return pubkey == PrivateKey(secret, raw=True).pubkey

cashu/core/errors.py

@@ -10,6 +10,9 @@ def __init__(self, detail, code=0):
         self.code = code
         self.detail = detail
 
+    def __str__(self):
+        return self.detail
+
 
 class NotAllowedError(CashuError):
     detail = "not allowed"
@@ -96,3 +99,45 @@ class QuoteNotPaidError(CashuError):
 
     def __init__(self):
         super().__init__(self.detail, code=2001)
+
+
+class DlcVerificationFail(CashuError):
+    detail = "dlc verification fail"
+    code = 30000
+    bad_inputs = None
+
+    def __init__(self, **kwargs):
+        super().__init__(self.detail, self.code)
+        self.bad_inputs = kwargs.get("bad_inputs", "")
+
+class DlcAlreadyRegisteredError(CashuError):
+    detail = "dlc already registered"
+    code = 30001
+
+    def __init__(self, **kwargs):
+        super().__init__(self.detail, self.code)
+        self.detail += kwargs.get("detail", "")
+
+class DlcNotFoundError(CashuError):
+    detail = "dlc not found"
+    code = 30002
+
+    def __init__(self, **kwargs):
+        super().__init__(self.detail, self.code)
+        self.detail += kwargs.get('detail', '') 
+
+class DlcSettlementFail(CashuError):
+    detail = "settlement verification failed: "
+    code = 30003
+
+    def __init__(self, **kwargs):
+        super().__init__(self.detail, self.code)
+        self.detail += kwargs.get("detail", "")
+
+class DlcPayoutFail(CashuError):
+    detail = "payout verification failed: "
+    code = 30004
+
+    def __init__(self, **kwargs):
+        super().__init__(self.detail, self.code)
+        self.detail += kwargs.get("detail", "")

cashu/core/models.py

@@ -6,6 +6,14 @@
     BlindedMessage,
     BlindedMessage_Deprecated,
     BlindedSignature,
+    DiscreetLogContract,
+    DlcFundingAck,
+    DlcFundingError,
+    DlcPayout,
+    DlcPayoutForm,
+    DlcSettlement,
+    DlcSettlementAck,
+    DlcSettlementError,
     MeltQuote,
     MintQuote,
     Proof,
@@ -339,3 +347,38 @@ class PostRestoreResponse(BaseModel):
     def __init__(self, **data):
         super().__init__(**data)
         self.promises = self.signatures
+
+
+# ------- API: DLC REGISTRATION -------
+
+class PostDlcRegistrationRequest(BaseModel):
+    registrations: List[DiscreetLogContract]
+
+class PostDlcRegistrationResponse(BaseModel):
+    funded: List[DlcFundingAck] = []
+    errors: Optional[List[DlcFundingError]] = None
+
+# ------- API: DLC SETTLEMENT -------
+
+class PostDlcSettleRequest(BaseModel):
+    settlements: List[DlcSettlement]
+
+class PostDlcSettleResponse(BaseModel):
+    settled: List[DlcSettlementAck] = []
+    errors: Optional[List[DlcSettlementError]] = None
+
+# ------- API: DLC PAYOUT -------
+class PostDlcPayoutRequest(BaseModel):
+    payouts: List[DlcPayoutForm]
+
+class PostDlcPayoutResponse(BaseModel):
+    paid: List[DlcPayout]
+    errors: Optional[List[DlcPayout]]
+
+# ------- API: DLC STATUS -------
+
+class GetDlcStatusResponse(BaseModel):
+    settled: bool
+    unit: Optional[str] = None
+    funding_amount: Optional[int] = None
+    debts: Optional[Dict[str, int]] = None

cashu/core/nuts.py

@@ -11,3 +11,4 @@
 DETERMINSTIC_SECRETS_NUT = 13
 MPP_NUT = 15
 WEBSOCKETS_NUT = 17
+DLC_NUT = 99