Quote from: o_e_l_e_o on November 02, 2022, 03:10:07 PM

I wouldn't use multi-sig for this at all. Instead I would use SIGHASH_ALL | SIGHASH_ANYONECANPAY.

Essentially, Alice creates a transaction which contains her 0.1 mBTC input and a 0.2 mBTC output to the society. She signs it with SIGHASH_ALL | SIGHASH_ANYONECANPAY. This signs her input and the output (meaning they cannot be changed), but allows the addition of further inputs (but not further outputs). She then passes this transaction to Bob. Bob cannot broadcast it as it stands, because the outputs are higher than the inputs and so it is invalid. However, Bob can then add his own 0.1 mBTC input to the transaction, which would make it valid, and can then be broadcast.

Brilliant idea!

Imagine if instead of using MuSig to aggregate signatures (since that doesn't work in M-of-N configurations), we make a transaction with a large number of outputs, but a comparatively smaller number of inputs from people who are signing with SIGHASH_ALL | SIGHASH_ANYONECANPAY.

Granted, tx size would still be a problem and this kind of signing wouldn't solve that, but imagine if there was a side network hat operated almost exactly like the Bitcoin network but it has more lax fee calculation for transactions with many outputs - so it becomes like a "discount".

In particular, if somebody broadcasts a L1 transaction that has a timelock, that will have priority over transactions which don't have such a time lock. And longer locks would have priority over shorter ones. Whereas on the side chain these transactions would be confirmed instantly, on the mainnet they are still listed with unconfirmed status, but they will confirm eventually.

Sure, that scheme would work by making an endless trail of unconfirmed transactions which are used on the side network, but the timelock prevents them from moving them back to L1 for a set period of time, so that there is always liquidity for the network to run with.

Which means:

A bunch of large, invalid (because outputs > inputs) transactions with SIGHASH ALL, ANYONECANPAY are broadcasted - this is an interactive process. The side network gets a list of all the outputs, and then constructs smaller raw transactions, that it requests those who are sending inputs to there right now to sign. Anyone who doesn't respond within an interval, is excluded. In this way, it guarantees that participating network users will always sign their transactions