search

bitcoinjs / bitcoinjs-lib

A javascript Bitcoin library for node.js and browsers.
MIT License
5.7k stars 2.11k forks source link

Psbt requires txHash for p2pkh utxos while TransactionBuilder doesn't #1495

Closed JoleMile closed 5 years ago

JoleMile commented 5 years ago

Hi,

I'm switching from using TransactionBuilder to using Psbt. I want to support p2pkh, p2sh and p2wpkh transactions. I was following examples from the repo, can create (and broadcast via 3PBP) a typical Transaction in particular and so far things are working as expected, but I have noticed that creating a transaction for a p2pkh utxo now requires a txHash. The API that I'm using https://www.smartbit.com.au/api isn't returning the hex by default so it's requiring an extra API request. It's not a big deal, but I was wondering if there was a way around this.

junderw commented 5 years ago

I think you are talking about this:

https://github.com/bitcoinjs/bitcoinjs-lib/blob/41bf2cd03d85cd93a40992f5b9fea0af3e107734/test/integration/transactions.spec.ts#L93-L100

hash can be a Buffer of the TX hash, OR it can be a string of the TXID (TX hash and TXID are reverse endian order, but either is fine for hash value)

I think you are talking about the nonWitnessUtxo Buffer, which is the full raw transaction that the input is spending from.

Unfortunately... yes, it is required.

To be 100% honest with you, the old TransactionBuilder was insecure, as you had no way to ensure that you are signing for a specific amount without trusting an outside source. Segwit fixed that problem, and Psbt is set up so that we can store the previous transaction and allow for signing wallets (like hardware wallets) to verify the amounts they are signing.

It is a little bit excessive, but the PSBT protocol requires a nonWitnessUtxo (full raw TX) for any non-segwit input...

It could be possible to allow for removing that requirement, but since that would break the "rules of PSBT" we would need to disable exporting PSBT, so you would need to sign, finalize, and extract with no option to use toBase64 etc.

But this would lower security...

My best advice would be:

  1. Only create p2sh-p2wpkh or p2wpkh wallets going forward.
  2. Legacy users who want p2pkh will have slower wallets (because they need to do 2 round trips)
  3. Maybe talk to support of your favorite block explorer to ask for full TX of p2pkh UTXOs.

Thanks for the question. Many others may have the same and it will help them.

JosipSylo commented 5 years ago

@junderw Thank you for the prompt and detailed explanation.