tx: add support for computing an elements transaction discount

The discount is computed as the difference between the actual tx weight
and the weight if the tx had only non-confidential outputs, i.e. it
makes confidential txs cost the same as non-confidential ones.

This behaviour is not yet specified by an ELIP so a flags parameter is
used to allow future changes to how the discount is computed.

include/wally.hpp

@@ -3102,6 +3102,12 @@ inline int tx_get_elements_signature_hash(const TX& tx, size_t index, const SCRI
     return detail::check_ret(__FUNCTION__, ret);
 }
 
+template <class TX>
+inline int tx_get_elements_weight_discount(const TX& tx, uint32_t flags, size_t* written) {
+    int ret = ::wally_tx_get_elements_weight_discount(detail::get_p(tx), flags, written);
+    return detail::check_ret(__FUNCTION__, ret);
+}
+
 template <class TX>
 inline int tx_is_elements(const TX& tx, size_t* written) {
     int ret = ::wally_tx_is_elements(detail::get_p(tx), written);

include/wally_transaction.h

@@ -873,6 +873,20 @@ WALLY_CORE_API int wally_tx_is_coinbase(
     size_t *written);
 
 #ifndef WALLY_ABI_NO_ELEMENTS
+/**
+ * Calculate any applicable transaction weight discount for an Elements transaction.
+ *
+ * :param tx: The transaction to compute the weight discount for.
+ * :param flags: Unused, must be 0.
+ * :param written: Destination for the weight discount.
+ *
+ * .. note:: The discount may be 0 if the transaction has no confidential outputs.
+ */
+WALLY_CORE_API int wally_tx_get_elements_weight_discount(
+    const struct wally_tx *tx,
+    uint32_t flags,
+    size_t *written);
+
 /**
  * Set issuance data on an input.
  *

src/swig_java/swig.i

@@ -997,6 +997,7 @@ static jobjectArray create_jstringArray(JNIEnv *jenv, char **p, size_t len) {
 %returns_array_(wally_tx_get_btc_signature_hash, 8, 9, SHA256_LEN);
 %returns_array_(wally_tx_get_btc_taproot_signature_hash, 14, 15, SHA256_LEN);
 %returns_array_(wally_tx_get_elements_signature_hash, 9, 10, SHA256_LEN);
+%returns_size_t(wally_tx_get_elements_weight_discount);
 %returns_array_(wally_tx_get_hash_prevouts, 4, 5, SHA256_LEN);
 %returns_array_(wally_tx_get_input_blinding_nonce, 3, 4, SHA256_LEN);
 %returns_array_(wally_tx_get_input_entropy, 3, 4, SHA256_LEN);

src/test/test_elements.py

@@ -208,7 +208,7 @@ def test_blinding(self):
                          utf8('4e5f3ca8aa2048eeacc8c300e3d63ca92048f407264352bee2fb15bd44349c45'))
         self.assertEqual(wally_ec_scalar_verify(offset, offset_len), WALLY_OK)
 
-    def test_deterministic_blinding_factors(self):
+    def do_test_deterministic_blinding_factors(self):
         # Test vector from:
         # https://github.com/Blockstream/Jade/blob/master/test_data/liquid_txn_ledger_compare.json
         with open(root_dir + 'src/data/liquid_txn_ledger_compare.json', 'r') as f:
@@ -240,6 +240,13 @@ def test_deterministic_blinding_factors(self):
                     if fn in [wally_asset_blinding_key_to_abf_vbf, wally_asset_blinding_key_to_vbf]:
                         continue # Skip final VBF
                 self.assertEqual(h(out[:o_len]), utf8(expected))
+        return tx
+
+    def test_elements_tx(self):
+        tx = self.do_test_deterministic_blinding_factors()
+        # Test the elements weight discount
+        self.assertEqual((WALLY_OK, 10235), wally_tx_get_weight(tx))
+        self.assertEqual((WALLY_OK, 8598), wally_tx_get_elements_weight_discount(tx, 0))
 
 
 if __name__ == '__main__':

src/test/util.py

@@ -676,6 +676,7 @@ class wally_psbt(Structure):
     ('wally_tx_get_btc_signature_hash', c_int, [POINTER(wally_tx), c_size_t, c_void_p, c_size_t, c_uint64, c_uint32, c_uint32, c_void_p, c_size_t]),
     ('wally_tx_get_btc_taproot_signature_hash', c_int, [POINTER(wally_tx), c_size_t, POINTER(wally_map), POINTER(c_uint64), c_size_t, c_void_p, c_size_t, c_uint32, c_uint32, c_void_p, c_size_t, c_uint32, c_uint32, c_void_p, c_size_t]),
     ('wally_tx_get_elements_signature_hash', c_int, [POINTER(wally_tx), c_size_t, c_void_p, c_size_t, c_void_p, c_size_t, c_uint32, c_uint32, c_void_p, c_size_t]),
+    ('wally_tx_get_elements_weight_discount', c_int, [POINTER(wally_tx), c_uint32, c_size_t_p]),
     ('wally_tx_get_hash_prevouts', c_int, [POINTER(wally_tx), c_size_t, c_size_t, c_void_p, c_size_t]),
     ('wally_tx_get_length', c_int, [POINTER(wally_tx), c_uint32, c_size_t_p]),
     ('wally_tx_get_signature_hash', c_int, [POINTER(wally_tx), c_size_t, c_void_p, c_size_t, c_void_p, c_size_t, c_uint32, c_uint64, c_uint32, c_uint32, c_uint32, c_void_p, c_size_t]),

src/transaction.c

@@ -1965,6 +1965,49 @@ int wally_tx_get_vsize(const struct wally_tx *tx, size_t *written)
     return ret;
 }
 
+#ifndef WALLY_ABI_NO_ELEMENTS
+int wally_tx_get_elements_weight_discount(const struct wally_tx *tx,
+                                          uint32_t flags, size_t *written)
+{
+    size_t i, n = 0, is_elements = 0;
+
+    if (written)
+        *written = 0;
+
+    if (!tx || flags || !written)
+        return WALLY_EINVAL;
+
+#ifdef BUILD_ELEMENTS
+    if (wally_tx_is_elements(tx, &is_elements) != WALLY_OK)
+        return WALLY_EINVAL;
+
+    if (is_elements) {
+        /* Compute the value of confidential outputs as though they
+         * are non-confidential */
+        for (i = 0; i < tx->num_outputs; ++i) {
+            const struct wally_tx_output *output = tx->outputs + i;
+            /* Discount any output proofs */
+            n += varbuff_get_length(output->surjectionproof_len);
+            n += varbuff_get_length(output->rangeproof_len);
+            n -= 2; /* Add 2 bytes to serialize empty proofs */
+            if (output->value_len == WALLY_TX_ASSET_CT_VALUE_LEN) {
+                /* Discount confidential value to an explicit value */
+                n += WALLY_TX_ASSET_CT_VALUE_LEN;
+                n -= WALLY_TX_ASSET_CT_VALUE_UNBLIND_LEN;
+            }
+            if (output->nonce_len == WALLY_TX_ASSET_CT_NONCE_LEN) {
+                /* Discount nonce commitment to an empty commitment */
+                n += WALLY_TX_ASSET_CT_NONCE_LEN;
+                n -= 1; /* Add a byte for the empty commitment */
+            }
+        }
+    }
+    *written = n;
+#endif
+    return WALLY_OK;
+}
+#endif /* WALLY_ABI_NO_ELEMENTS */
+
 static int hash_prevouts(unsigned char *prevouts, size_t inputs_size,
                          unsigned char *bytes_out, size_t len, bool do_free)
 {

src/wasm_package/src/index.d.ts

@@ -606,6 +606,7 @@ export function tx_from_hex(hex: string, flags: number): Ref_wally_tx;
 export function tx_get_btc_signature_hash(tx: Ref_wally_tx, index: number, script: Buffer|Uint8Array, satoshi: bigint, sighash: number, flags: number): Buffer;
 export function tx_get_btc_taproot_signature_hash(tx: Ref_wally_tx, index: number, scripts: Ref_wally_map, values: BigUint64Array|Array<bigint>, tapleaf_script: Buffer|Uint8Array, key_version: number, codesep_position: number, annex: Buffer|Uint8Array, sighash: number, flags: number): Buffer;
 export function tx_get_elements_signature_hash(tx: Ref_wally_tx, index: number, script: Buffer|Uint8Array, value: Buffer|Uint8Array, sighash: number, flags: number): Buffer;
+export function tx_get_elements_weight_discount(tx: Ref_wally_tx, flags: number): number;
 export function tx_get_hash_prevouts(tx: Ref_wally_tx, index: number, num_inputs: number): Buffer;
 export function tx_get_input_blinding_nonce(tx_in: Ref_wally_tx, index: number): Buffer;
 export function tx_get_input_entropy(tx_in: Ref_wally_tx, index: number): Buffer;

tools/wasm_exports.sh

@@ -761,6 +761,7 @@ if [ -z "$DISABLE_ELEMENTS" ]; then
 ,'_wally_tx_elements_output_init' \
 ,'_wally_tx_elements_output_init_alloc' \
 ,'_wally_tx_get_elements_signature_hash' \
+,'_wally_tx_get_elements_weight_discount' \
 ,'_wally_tx_get_input_blinding_nonce' \
 ,'_wally_tx_get_input_entropy' \
 ,'_wally_tx_get_input_inflation_keys' \