blind: accept zero-value outputs in verify_tx_amt_proofs by KyrylR · Pull Request #300 · ElementsProject/rust-elements

KyrylR · 2026-10-14T07:50:34Z

This PR adds a condition check to verify_tx_amt_proofs function to filter out outputs that are provably unspendable and with explicit 0 value.

Current Transaction::verify_tx_amt_proofs converts every output into a Pedersen commitment:

rust-elements/src/blind.rs

Lines 1150 to 1187 in 582ea61

    
           for (i, out) in self.output.iter().enumerate() { 
        
               // Compute the value commitments and asset generator 
        
               let out_commit = out 
        
                   .get_value_commit(secp) 
        
                   .map_err(|e| VerificationError::SpentTxOutError(i, e))?; 
        
               out_commits.push(out_commit); 
        
               // rangeproof checks 
        
               if let Some(comm) = out.value.commitment() { 
        
                   let gen = out 
        
                       .get_asset_gen(secp) 
        
                       .map_err(|e| VerificationError::TxOutError(i, e))?; 
        
                   let rangeproof = out 
        
                       .witness 
        
                       .rangeproof 
        
                       .as_ref() 
        
                       .ok_or(VerificationError::RangeProofMissing(i))?; 
        
                   rangeproof 
        
                       .verify(secp, comm, out.script_pubkey.as_bytes(), gen) 
        
                       .map_err(|e| VerificationError::RangeProofError(i, e))?; 
        
               } else { 
        
                   // No rangeproof checks for explicit values 
        
               } 
        
               // Surjection proof checks 
        
               if let Some(gen) = out.asset.commitment() { 
        
                   let surjectionproof = out 
        
                       .witness 
        
                       .surjection_proof 
        
                       .as_ref() 
        
                       .ok_or(VerificationError::SurjectionProofMissing(i))?; 
        
                   if !surjectionproof.verify(secp, gen, &domain) { 
        
                       return Err(VerificationError::SurjectionProofVerificationError(i)); 
        
                   } 
        
               } else { 
        
                   // No surjection proof checks for explicit assets 
        
               } 
        
           }

Explicit zero values have no nonzero commitment, so valid zero-value data outputs cannot pass this path.

The commitment helper already distinguishes unspendable zero outputs from invalid spendable zero outputs:

rust-elements/src/blind.rs

Lines 735 to 742 in 582ea61

    
           if value == 0 { 
        
               // zero values are only allowed if they are provably 
        
               // unspendable. 
        
               if self.script_pubkey.is_provably_unspendable() { 
        
                   return Err(TxOutError::ZeroValueCommitment); 
        
               } 
        
               return Err(TxOutError::NonUnspendableZeroValue); 
        
           }

but the transaction verifier (verify_tx_amt_proofs) propagates the former as an error.

Because of this callers must clone a transaction and filter valid zero outputs before verification.

KyrylR · 2026-10-14T07:51:26Z

+                if !out.witness.rangeproof.is_empty() {
+                    return Err(VerificationError::RangeProofError(
+                        i,
+                        secp256k1_zkp::Error::InvalidRangeProof,
+                    ));
+                }


This check based on the mirrored one in elements:
https://github.com/ElementsProject/elements/blob/2ac51cac13876bf14d3d709b07535b1868eee896/src/confidential_validation.cpp#L374-L379

KyrylR · 2026-10-14T07:51:51Z

+                if out.asset.is_explicit() && !out.witness.surjection_proof.is_empty() {
+                    return Err(VerificationError::SurjectionProofError(
+                        i,
+                        secp256k1_zkp::Error::InvalidSurjectionProof,
+                    ));
+                }


Same with this check:
https://github.com/ElementsProject/elements/blob/2ac51cac13876bf14d3d709b07535b1868eee896/src/confidential_validation.cpp#L399-L404

KyrylR · 2026-10-14T07:54:21Z

+                if out.asset.is_null() {
+                    return Err(VerificationError::TxOutError(i, TxOutError::UnExpectedNullAsset));
+                }


This check is based on the explicit-or-commitment check in elements:
https://github.com/ElementsProject/elements/blob/2ac51cac13876bf14d3d709b07535b1868eee896/src/confidential_validation.cpp#L321-L331

delta1

Mostly looks good but 2 issues

delta1 · 2026-10-14T09:07:41Z

-                .get_value_commit(secp)
-                .map_err(|e| VerificationError::SpentTxOutError(i, e))?;
-            out_commits.push(out_commit);
+            if out.value == Value::Explicit(0) && out.script_pubkey.is_provably_unspendable() {


If an output has out.value == Value::Explicit(0) with a spendable script, it falls through to line 1175 where it maps to SpentTxOutError(i, e), which formats as "Input index {i} spent utxo error: ...".

A spendable zero-value output at index 0 is diagnosed as a corrupt prevout at input 0 which is incorrect

cc https://github.com/ElementsProject/rust-elements/pull/300/changes#r4272012688 (will change to TxOutError)

delta1 · 2026-10-14T09:08:43Z

+
+        assert_eq!(
+            verify_with(0, explicit(0, spk.clone())),
+            Err(VerificationError::SpentTxOutError(0, TxOutError::NonUnspendableZeroValue))


SpentTxOutError is not the correct error variant for this case it should be VerificationError::TxOutError

This predates my changes

This error: VerificationError::SpentTxOutError(0, TxOutError::NonUnspendableZeroValue) in particular is thrown from get_value_commit function

I am not really sure whether it should be Spent or just TxOutError

The rustdoc of those errors does not help either:

/// Spent Txout error SpentTxOutError(usize, TxOutError), /// Current transaction txout error TxOutError(usize, TxOutError),

Will change anyway, following the suggestion

delta1 · 2026-10-14T09:11:00Z

+                    return Err(VerificationError::TxOutError(i, TxOutError::UnExpectedNullAsset));
+                }
+                // An explicit value or asset leaves its proof nothing to prove.
+                if !out.witness.rangeproof.is_empty() {


These checks for non-empty range/surjection proofs are only in the unspendable branch, but they are invalid for any explicit output not just unspendable outputs

Make sense, moved those checks below

apoelstra · 2026-10-14T13:13:56Z

Also, can you split the unit test into a separate commit (after the fix) so it's easy to verify that it fails without the fix?

KyrylR · 2026-10-14T13:15:09Z

Also, can you split the unit test into a separate commit (after the fix) so it's easy to verify that it fails without the fix?

Sure, will do

And reject stray proofs

KyrylR · 2026-10-14T14:35:25Z

Also, can you split the unit test into a separate commit (after the fix) so it's easy to verify that it fails without the fix?

Decided to keep it as one big regression test, let me know if I should split it

KyrylR commented Oct 14, 2026

View reviewed changes

delta1 reviewed Oct 14, 2026

View reviewed changes

blind: accept zero-value outputs in verify_tx_amt_proofs

2089a14

And reject stray proofs

KyrylR force-pushed the feature/zero-value-op-return-verification branch from 5266aac to 52f4674 Compare October 14, 2026 14:34

test: cover output diagnostics and independent proof restrictions

8cbfe53

KyrylR force-pushed the feature/zero-value-op-return-verification branch from 52f4674 to 8cbfe53 Compare October 14, 2026 14:34

KyrylR requested a review from delta1 October 14, 2026 14:35

	for (i, out) in self.output.iter().enumerate() {
	// Compute the value commitments and asset generator
	let out_commit = out
	.get_value_commit(secp)
	.map_err(\|e\| VerificationError::SpentTxOutError(i, e))?;
	out_commits.push(out_commit);

	// rangeproof checks
	if let Some(comm) = out.value.commitment() {
	let gen = out
	.get_asset_gen(secp)
	.map_err(\|e\| VerificationError::TxOutError(i, e))?;
	let rangeproof = out
	.witness
	.rangeproof
	.as_ref()
	.ok_or(VerificationError::RangeProofMissing(i))?;
	rangeproof
	.verify(secp, comm, out.script_pubkey.as_bytes(), gen)
	.map_err(\|e\| VerificationError::RangeProofError(i, e))?;
	} else {
	// No rangeproof checks for explicit values
	}

	// Surjection proof checks
	if let Some(gen) = out.asset.commitment() {
	let surjectionproof = out
	.witness
	.surjection_proof
	.as_ref()
	.ok_or(VerificationError::SurjectionProofMissing(i))?;
	if !surjectionproof.verify(secp, gen, &domain) {
	return Err(VerificationError::SurjectionProofVerificationError(i));
	}
	} else {
	// No surjection proof checks for explicit assets
	}
	}

	if value == 0 {
	// zero values are only allowed if they are provably
	// unspendable.
	if self.script_pubkey.is_provably_unspendable() {
	return Err(TxOutError::ZeroValueCommitment);
	}
	return Err(TxOutError::NonUnspendableZeroValue);
	}

Conversation

KyrylR commented Oct 14, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

delta1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

apoelstra commented Oct 14, 2026

Uh oh!

KyrylR commented Oct 14, 2026

Uh oh!

KyrylR commented Oct 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants