assets: Add shared asset tooling - #1225
Draft
hieblmi wants to merge 4 commits into
Draft
Conversation
hieblmi
force-pushed
the
codex/shared-asset-swapkit
branch
3 times, most recently
from
September 3, 2026 05:32
f805e70 to
c206f0d
Compare
Move the existing server asset HTLC contract into Loop so both sides can derive and spend the same commitment. Freeze the legacy vectors and bind witness construction to verified proofs, prevouts, and input indices. Reserve future policies so Loop Asset Out can choose its contract explicitly instead of inheriting the deposit key path.
hieblmi
force-pushed
the
codex/shared-asset-swapkit
branch
from
September 3, 2026 05:54
c206f0d to
2814bf6
Compare
hieblmi
added
asset loop out
hieblmi
changed the title
hieblmi
force-pushed
the
codex/shared-asset-swapkit
branch
from
September 3, 2026 08:08
a33d139 to
4283082
Compare
Consolidate the remaining deposit and OP_TRUE virtual-packet helpers behind Loop-owned packages. Replace positional sweep assumptions with proof-bound input selection, complete prevout validation, and explicit signature verification.
hieblmi
force-pushed
the
codex/shared-asset-swapkit
branch
from
September 3, 2026 08:12
4283082 to
50595de
Compare
Reject non-block deposit expiries. This prevents BIP68 flags from changing or disabling the intended block delay. Canonicalize OP_TRUE keys, populate and validate every virtual input witness, and reject unsupported addresses and duplicate anchor inputs.
Return the complete anchor Merkle root from proof verification. This lets MuSig2 spends reproduce the output's Taproot tweak.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SwapKit, legacy deposit kit, and generic OP_TRUE virtual-packet sweephelper
LegacyDepositV0policy, pinned by golden script, key, anchor, witness, andvirtual-packet vectors
pulling server-specific code into Loop
this prototype deliberately does not add tap-sdk
Security and correctness boundaries
The shared kit verifies proofs before using them and binds every Bitcoin
spend to the proof's exact anchor outpoint, output value, script, commitment
root, and unique PSBT input. It supplies every prevout to the signer, applies
the required CSV sequence to the matched input without mutating the caller's
PSBT on failure, rejects malformed signer responses, verifies the returned
Schnorr signature, and returns the matched input index to the caller.
The OP_TRUE helper rejects empty, nil, invalid, non-OP_TRUE, mixed-asset,
overflowing, and amount-mismatched proof sets. It derives the network from the
destination address and validates the prepared output and split-root witness
before attaching the asset witness.
Network validation distinguishes shared testnet HRPs by Bitcoin network
magic. Simnet explicitly accepts both btcd's native BIP-0044 coin type 115 and
lnd's testnet-compatible coin type 1 without relying on mutable global state.
Feature state machines remain responsible for trusted proof import,
canonical-chain and confirmation tracking, reorg handling, destination
validation, quote and fee limits, and durable recovery. This PR adds no Asset
Loop Out RPC, funding flow, persistence, or state machine, and does not alter
conventional Loop In or Asset Loop In.
This is prototype infrastructure, not a release or rollout change.
Verification
GOTOOLCHAIN=go1.25.12 go test ./assets/... -count=1GOTOOLCHAIN=go1.25.12 go test -race ./assets/... -count=1GOTOOLCHAIN=go1.25.12 go vet ./assets/...GOTOOLCHAIN=go1.25.12 make buildGOTOOLCHAIN=go1.25.12 go mod verifyGOTOOLCHAIN=go1.25.12 go mod tidy -diffgolangci-lint run -v(zero issues)make commitmsg-lint range=origin/master..HEADgit diff --check origin/master..HEAD