Chained JoinSplits

[ebfull]

PourTxs should be able to anchor to an incremental merkle tree produced by a previous PourTx.

This ticket is about both:

• making sure that chained pours are verified correctly by consensus checks;
• supporting construction of chained pours in the RPC interface.

[daira]

@ebfull is this implemented?

[ebfull]

This is not implemented and needs to be implemented for 1.0. It won't be that hard.

[ebfull]

I want to implement this after #788 lands.

[ebfull]

The interaction of this feature with the existing RPC design is a bit tricky.

The current design is mostly stateless; you have a transaction, you use zcrawpour to "add" a JoinSplit to it, and you have almost total control over the JoinSplit being added. In this spirit, cryptographic binding is implemented statelessly -- we throw away the private key instead of returning it from the API. The anchor selection routine diverges from this slightly; we don't offer users a way to choose the treestate they build on top of.

In order to retain that design but offer this feature in the API, we have to let users of zcrawpour specify arbitrary inputs and outputs. The pain point here is how vpub_old and vpub_new are exposed.

My idea is to stop offering vpub_old and vpub_new and just infer them from the deficit or surplus of funds from the inputs and outputs. This also avoids the problem of misusing the RPC by specifying vpub_old and vpub_new incorrectly -- we have a consensus rule which requires that they are not both nonzero.

The rest of the approach is just a somewhat-tricky algorithm for efficiently chaining all the inputs together.

[ebfull]

The alternative approach is to figure this mess out when we are working on the payment API, and leave the existing API the same way it is. I've already implemented the consensus rules for it, so I'm pretty happy with going that route.

[ebfull]

I would prefer this be reviewed as-is by at least two engineers on the team.

[ebfull]

(Referring to #973)

[daira]

What approach does #973 use for vpub_old/new?

[daira]

Oh, it doesn't change the RPC. Yes that's fine.