Jeremy Rubin
Latest posts
Grokking DelBrag: Out-of-Band On-Chain Fraud Proofs through Circuit Garbling @ Bitcoin++ Austin
My talk at Bitcoin++ on how DelBrag protocols work, including detailed schematics and timing analysis. Also introduces new concepts of optimistic circuit consistency checks. Get the Slides Here
Delbrag
Delbrag is a paper explaining how garbled circuits can be applied to make BitVM style constructs fraud proofs substantially more efficient, at the cost of increased out-of-band information exchange. Delbrag was originally authored in November, 2024, but wasn’t published sooner as the author procrastinated. Read the full paper.
Taproot Denial of Service Bug
TL;DR: Taproot’s sighash implementation could cause blocks to take 60s or more to validate with specially crafted standard transactions. The patch adds a new cache during validation. patch: https://github.com/bitcoin/bitcoin/pull/24105 Patched: 24.x, 23.x. Unpatched: 22.x I discovered this vulnerability while addressing feedback on BIP-119 (CTV) regarding its denial of service risk mitigations.…
Fun with CSFS I
In this blog series, I’ll write up some fun uses for CSFS I’m aware of. The purpose is to document things that others might not know about. Did I invent these? Maybe. Maybe not. Citations to prior work welcome! Irreplacable Irreusable Addresses You create a taproot that is a NUMS keypath (the NUMS keypath and single tapleaf is so that you learn all the spending info always), and a tapleaf that…
CSFS Re-Keying and Laddering, Deterministic Update Rekeying, & Applications to LN-Symmetry
This is a collab post with Rearden . At Bitcoin++ in Austin this year Rearden showed that there are many ways to realize Lightning Symmetry using various bitcoin upgrade proposals. All of these methods require either an extra signing round-trip for each channel update, or the ability to force the hash of the settlement transaction to be visible with its corresponding update transaction. This can…
Un-FE’d Covenants
Covenants in Bitcoin represent a method to restrict how and where coins can move. Functional Encryption (FE) offers an exciting avenue to implement covenants without native protocol changes. However, FE remains impractical with current cryptographic tools. In this work, we propose a practical implementation using an oracle-assisted model that combines off-chain computation, key management, and a…
FE'd Up Covenants
Covenants are a way of expressing restrictions on Bitcoin. Covenants, while possible to implement as an extension to Bitcoin, do not exist natively. To enable them requires the Bitcoin community to agree upon upgrades such as CTV, CAT, CSFS, and more. This paper serves to demonstrate at a high level how covenants could be introduced to Bitcoin without a soft fork using Functional Encryption and…
Spookchains: Drivechain Analog with Trusted Setup & APO
This post draws heavily from Zmnscpxj’s fantastic post showing how to make drivechains with recursive covenants. In this post, I will show similar tricks that can accomplish something similar using ANYPREVOUT with a one time trusted setup ceremony. This post presents general techniques that could be applied to many different types of covenant. note: I originally wrote this around May 5th, 2022,…
7 Theses on a next step for BIP-119
Warning: this post assumes a great deal of context on CTV is already understood by the reader. If you are not familiar, you may wish to start with utxos.org , the advent calendar , and the BIP-119 text and reference implementation , as those may provide much needed context about what CTV is and why a next step is being discussed. If you only have a little time, minimally I would advise these two…
A Calculus of Covenants
This originally appeared on the mailing list . This is a framework for thinking about covenants. It is most useful for modeling local covenants, that is, covenants where only one coin must be examined, and not multi-coin covenants whereby you could have issues with protocol forking requiring a more powerful stateful prover. It’s the model I use in Sapio. This is from the perspective of a developer…
Sapio Studio Tutorial for CTV Meeting
Other people have followed this tutorial with some success: Common sticking points include: Not building latest sapio binary before starting Not building latest sapio-studio project before starting Not having the correct clang version (>=12) brew installing clang somewhere else (try /opt/homebrew, but also /usr/local/Cellar) Set up a signet node. Build this branch…
London Advancing Bitcoin Tutorial
Other people have followed this tutorial with some success: https://gnusha.org/ctv-bip-review/2022-02-22.log If you’re having a problem, see above log where people have had issues. Common problems include: Not building latest sapio binary Not having the correct clang version (>=12) brew installing clang somewhere else (try /opt/homebrew, but also /usr/local/Cellar) xargs not liking something…
RoadMap or Load o' Crap?
Welcome to day 27 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox I know, I know. God forbid, a roadmap. People hate roadmaps. As I’ve noted before : Bitcoin Eschews Roadmaps and Agendas. I provide this maxim to make clear that this document is by no means an official roadmap, narrative, or prioritization.…
The History and Future of Sapio
Welcome to day 26 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Sapio began as little more than a slide in presentations I would give on what BIP-119 could be with the support of a programming environment. While my conceptions of what could be built with CTV were about on-par with where they are today, the…
Decentralized Autonomous Organizations (DAOs) Will Save Bitcoin
Welcome to day 25 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox The title of this article is a joke. Gotcha! Decentralized Autonomous Organization is pretty much what’s called an orphan initialism . So while DAO doesn’t really mean anything is decentralized, autonomous, or an organization, but the term DAO…
POWSWAP: Oracle Free Bitcoin Hashrate Derivatives
Welcome to day 24 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Today’s post is near and dear to my heart – years ago I put up an interest form for powswap.com , but as I went down the rabbit hole I realized how badly I wanted generic tooling to automate the building of these which is partly what led to…
Derivatives and Options For Bitcoin
Welcome to day 23 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox In today’s post we’re going to talk about derivatives and options. Hoooo Boy! Let’s define an Option: An option is a contract that gives the holder the right to take an action to the detriment of a counterparty. Options can be created for…
NFTs Part Two: Auctions, Royalties, Mints, Generative, Game Items
Welcome to day 22 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox I promised you a few things a few days ago: We’d see how to do royalties in a sale We’d see how to do a Dutch auction We’d see how to do batch mints We’d see how to make generative art and one thing I didn’t In game items Let’d get it done, son.…
Packaging Sapio Applications
Welcome to day 21 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Today’s a bit of a cheat day for me – not really “new” content, but mostly stuff re-packaged 1 from learn.sapio-lang.org . But it belongs in the series, and is it really plagarism if I wrote it myself? So you’ve written a Sapio contract and…
Oracles, Bonds, and Attestation Chains
Welcome to day 20 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Today’s post is going to be a bit lighter weight than yesterday’s. We’ll cover some high level concepts around oracles and then look at some Sapio. The genesis of this line of inquiry was a conversation with Robin Linus that led to a pretty cool…
Part One: Implementing NFTs in Sapio
Welcome to day 19 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox For today’s post we’re going to build out some Sapio NFT protocols that are client-side verifiable. Today we’ll focus on code, tomorrow we’ll do more discussion and showing how they work. I was sick last night (minor burrito oriented food…
Sapio Studio Payment Pool Walkthrough
Welcome to day 18 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Today’s post will be a pretty different format that usual, it’s basically going to be a pictorial walk through of the Sapio Studio , the frontend tool for Sapio projects. As an example, we’ll go through a Payment Pool contract to familiarize…
A Defense of Having Fun (and maybe staying poor)
Welcome to day 17 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox A short story. I want to tell first. I recently made friends with Eugene , this really smart 19 year old Cal dropout, when I was visiting Miami for the NFT bachanal around Art Basel. Eugene just dropped a project he’s been working on, and it’s…
Composability in Sapio Contracts
Welcome to day 16 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Who here has some ERC-20s or 721s 1 ? Anyone? No one? Whatever. The Punchline is that a lotta fuss goes into Ethereum smart contracts being Turing Complete but guess what? Neither ERC-20 nor 721 really have anything to do with being Turing…
Decentralized Coordination Free Mining Pools
Welcome to day 15 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Long time no see. You come around these parts often? Let’s talk mining pools. First, let’s define some things. What is a pool? A pool is a way to take a strongly discontinuous income stream and turn it into a smoother income stream. For example,…
Payment Channels in a CTV+Sapio World
Welcome to day 14 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Lightning Lightning Lightning Everybody loves Lightning. I love Lightining, you love Lightning. We love everyone who works on Lightning. Heck, even Chainalysis loves Lightning these days :(… We all love Lightning. But what if I told you we could…
Payment Pools / Coin Pools
Welcome to day 13 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Payment Pools are a general concept for a technique to share a single UTXO among a group. They’ve been discussed for a couple years 1 , but now that Taproot is active are definitely more relevant! In this post we’ll go through some really simple…
Congestion Control
Welcome to day 12 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Congestion is an ugly word, eh? When I hear it my fake synthesia triggers green slime feeling, being stuck in traffic with broken AC, and ~the bread line~ waiting for your order at a crowded restaurant when you’re super starving. All not good…
Inheritence Schemes for Bitcoin
Welcome to day 11 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox You are going to die. Merry Christmas! Hopefully not any time soon, but one of these days you will shuffle off this mortal coil. When that day comes, how will you give your loved ones your hard earned bitcoin? You do have a plan, right? This…
Building Vaults on Bitcoin
Welcome to day 10 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox A “Vault” is a general concept for a way of protecting Bitcoin from theft through a cold-storage smart contract. While there is not formal definition of what is and is not a Vault, generally a Vault has more structure around a withdrawal than…
Sapio Primer
Welcome to day 9 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox We’re through the basics sections of the Advent calendar ow! Time for some more… specific content on the bleeding edge! This post is your introduction to the world of Sapio . Sapio is the programming framework I’ve been developing for Bitcoin…
Contracting Primitives and Upgrades to Bitcoin
Welcome to day 8 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox In this post we’ll rapid fire roll through a bunch of different smart contract primitives, existing and proposed. For a more thorough reading, links will be provided. BIP-119 CTV CheckTemplateVerify CTV is a general purpose smart contract opcode…
Review of Smart Contract Concepts for Bitcoin
Welcome to day 7 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox In this post we’ll review a concepts for thinking about different types of smart contract capabilities and the implications of their availability. Recursive v.s. Non Recursive Recursive is pretty much just a fancy way of saying “loops”. This is…
What's Smart about Smart Contracts: Bitcoin Maxi Edition
Welcome to day 6 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Now that we’ve established the four pillars of Privacy, Decentralization, Self Custody, and Scalability, let’s get into smart contracts. But first… DOES BITCOIN HAVE SMART CONTRACTS? There is a lot of fuss around if bitcoin has or doesn’t have…
Pillars of Bitcoin: Privacy
Welcome to day 5 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Privacy is foundational to Bitcoin. Fundamentally, we care about censorship resistance so folks can’t stop you from doing activity they can tell you’re doing… but what if they couldn’t tell you were doing anything at all? The more private a…
Pillars of Bitcoin: Decentralization
Welcome to day 4 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Many may have tried, but few have successfully characterized what “being decentralized” means in an objective / quantitative sense. Instead, we’re left with soft “know it when I see it”s. Decentralization may be a pillar of Bitcoin with a lotta…
Pillars of Bitcoin: Self Custody
Welcome to day 3 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox Not your keys, not your coin. A simple maxim often repeated by Bitcoiners, but an important one. Why? That thing about the gold standard you probably heard before: In the existing financial system, your assets aren’t really your assets. Let’s…
Pillars of Bitcoin: Scalability
Welcome to day 2 of my Bitcoin Advent Calendar. You can see an index of all the posts here or subscribe at judica.org/join to get new posts in your inbox This is the first of four posts in an advent mini-series about four fundamental pillars of Bitcoin. I know, I know, a series within a series. What am I, nuts? But it’s important that we begin our journey by setting the stage with a few big…
Day 1: Rubin's Bitcoin Advent Calendar
What says Christmas more than an Advent Calendar to count the days till Santa comes? Honestly, I’m not too sure, I’m a Jew. Happy Hanukkah everyone! But in the spirit of the season, I figured the community would love a series of blog posts (one a day) discussing the future of Bitcoin and Smart Contracts. You can find an index of all the posts here . So here’s how it’s going to work: Today’s the…
CheckSequenceVerify DISCOURAGE_UPGRADABLE_NOPS Defect
The other day I was writing some tests for BIP-119 (shoutout Gloria for the detailed feedback on improving tests). I noticed something peculiar while attempting to write static test vectors for CTV. This peculiar thing led me to discover a minor flaw in Bitcoin’s interpreter – it isn’t going to break anything in the short term, but it has implications for how certain upgrades might be done in the…
Infrastructure Bill: It's Go Time for Radical Self Custody
TL;DR: click here to answer call to action The infrastructure bill draft has been circulating which contains language that would have massive impact for the crypto ecosystem (and Bitcoin) in the United States, and most likely globally. The broad implication of the proposed bill is that many types of service provider would be categorized as brokers, even if fully ‘non custodial’. E.g., a coinjoin…
BIP-118 What Gets Hashed Chart
As a part of my ongoing review of BIP-118 I put together a chart of what gets hashed under the current proposal. Not tightly checked to be free of errors, but I figured such a chart would be helpful for folks evaluating BIP-118. Perhaps the BIPs (generally, incl 34x) could be updated to present the information in such a chart – at least for me it’s much clearer than following a bunch of…
Quantum Proofing Bitcoin with a CAT
I recently published a blog post about signing up to a 5 byte value using Bitcoin script arithmetic and Lamport signatures. By itself, this is neat, but a little limited. What if we could sign longer messages? If we can sign up to 20 bytes, we could sign a HASH160 digest which is most likely quantum safe… What would it mean if we signed the HASH160 digest of a signature? What the what? Why would…
CheckSigFromStack for 5 Byte Values
I recently published a blog post about covenants on Bitcoin. Readers were quick to point out I hadn’t fully explained myself on a claim I made that you can do a form of CheckSigFromStack in Bitcoin today. So I thought it would be worthwhile to fully describe the technique – for the archives. There are two insights in this post: to use a bitwise expansion of the number to use a lamport signature…
Templates, Eltoo, and Covenants, Oh My!
If you’ve been following The Discourse, you probably know that Taproot is merged, locked in, and will activate later this November. What you might not know is what’s coming next… and you wouldn’t be alone in that. There are a number of fantastic proposals floating around to further improve Bitcoin, but there’s no clear picture on what is ready to be added next and on what timeline. No one – core…
Designing Bitcoin Contracts with Sapio
Bitcoin is DeFi Panel
How Taproot Could Improve Bitcoin — If It Gets Adopted
Delegated signatures in Bitcoin within existing rules, no fork required (Connector Outputs)
This originally appeared on the mailing list , and has been edited lightly for some updates in 2025. I’m aware that some folks (I think nullc, sipa, myself… maybe more?) are aware of how to do script delegation in Bitcoin today (without any modifications to Bitcoin), but realized in a conversation with Andrew P that the technique is not widely known. So I figured it made sense to do a brief…