Proto commits in stacks-network/sbtc

These 52 commits are when the Protocol Buffers files have changed:

2026-10-12

feat: v2 signing scripts for deposits and signer UTXOs (#2138) ## Description Closes https://github.com/stacks-sbtc/sbtc/issues/2142 The commits should be reviewable in manageable chunks. ## Changes - Each signer derives a Bitcoin signing key from its configured public key with an unhardened BIP32 `/0/0` derivation. - The "v2" deposit scripts are a hash lock on the max fee and recipient, followed by the signers' multi-sig script. - The signers' UTXO is not locked in the new format until a Bitcoin activation height is reached. This height is hardcoded on mainnet and configurable on testnets. - Invariant change: from the activation height on, the signers' new UTXO is a script-path output locked by the key set derived from the registry's signer set. The first sweep at activation spends the v1 UTXO and creates a v2 one. - ~Invariant change: there is no DKG after v2 activation, and rotate-keys is only submitted when the configured signer set or threshold differs from the registry, not on crossing the activation height.~ - DKG and v2 signing can coincide. This lets us avoid breaking stacks-core until. - Invariant change: once a threshold of signers agree on the new configuration, they submit a new rotate-keys contract call. They don't all need to agree before the change goes through. - Deposits can be locked in the new format at any time. Both old "v1" and new "v2" script formats are supported. - Invariant change: the registry's aggregate-pubkey field is no longer a public key. For a v2 rotation, it holds 0xFF followed by the Bitcoin block hash. ## Testing Information I tested this on devenv, and everything worked as expected! I did need to patch the demo-cli to produce both v1 and v2 deposits, and those changes aren't here. But yeah, this appears to work ## Checklist - [ ] I have performed a self-review of my code - [x] I have had an AI agent review my code

The documentation is generated from this commit.

2026-10-08

revert: undo protobuf change because it would violate tag-order rule

The documentation is generated from this commit.

2026-10-07

feat: clean up the protobufs given the v2 changes - Remove the StacksTransactionSignRequest.aggregate_key field from the struct and protobufs - Change the RotateKeys.aggregate_key protobuf field into a oneof registry_key field

2026-09-28

feat: add the v2 activation height and registry rotations - Add v2_signing_block_height, which is fixed at an unreachable height on mainnet. After activation the signers skip DKG, and they only rotate the registry when the configured signer set or threshold changes. - Model the registry key field as RegistryKey, which is either a v1 aggregate key or 0xFF followed by the Bitcoin block hash of a v2 rotation. - Drop the aggregate key from Stacks sign requests. After activation and before the first rotation, the signers validate them against the bootstrap signer set.

feat: add independent signature messages - Add BitcoinSignatureRequest, BitcoinSignatureResponse and SchnorrSignature protobuf messages, along with their conversions. - Nothing sends these messages yet, and the event loops ignore them.

2026-04-23

revert any protobuf changes

fetch the signers' transactions from the mempool to get the last fees

2026-04-22

buf fmt

update the protobufs and the conversion impls

2026-02-10

Revert "Add wsts private (#4)" This reverts commit 164856a0432c433d425356ba120987dc3e50360e.

2025-08-19

chore: update wsts dependency (#1789) Update the `WSTS` dependency Closes: #1778 This PR updates the `WSTS` dependency to include numerous security audit fixes and feature additions. No new functionality has been added to `sBTC`, so as long as existing tests pass the new dependency should be working. - [x] I have performed a self-review of my code - [x] My changes generate no new warnings - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules --------- Co-authored-by: Daniel Jordon <djordon@users.noreply.github.com> Co-authored-by: Matteo Almanza <matteojug@gmail.com>

2025-08-02

Revert "chore: update wsts dependency" (#1808) ## Description Reverts stacks-sbtc/sbtc#1789 ## Changes * Undo the WSTS update so that the next sbtc release is less of a breaking change. ## Testing Information ## Checklist - [x] I have performed a self-review of my code

2025-08-01

Revert "chore: update wsts dependency (#1789)" This reverts commit a7496ae6354cdbdce5b5019a6162178f9c06d41a.

2025-07-31

chore: update wsts dependency (#1789) ## Description Update the `WSTS` dependency Closes: #1778 ## Changes This PR updates the `WSTS` dependency to include numerous security audit fixes and feature additions. ## Testing Information No new functionality has been added to `sBTC`, so as long as existing tests pass the new dependency should be working. ## Checklist - [x] I have performed a self-review of my code - [x] My changes generate no new warnings - [x] New and existing unit tests pass locally with my changes - [x] Any dependent changes have been merged and published in downstream modules --------- Co-authored-by: Daniel Jordon <djordon@users.noreply.github.com> Co-authored-by: Matteo Almanza <matteojug@gmail.com>

2025-07-30

feat: make key exchange public key required (#1796) ## Description This builds off of https://github.com/stacks-sbtc/sbtc/pull/1789. The goal here was to make the key exchange public key required during DKG. The issue is that we cannot just require key exchange public key on our existing types, since that wouldn't allow us to read existing shares from the database. So, to solve that issues, we read a protobuf type that is different from the one that is written. This allows us to better separate the relevant WSTS type during DKG from is read from in the database. Let me know if you don't think that going down this route is a good idea. We can keep https://github.com/stacks-sbtc/sbtc/pull/1789 as is or do something else. I don't feel strongly about it. ## Changes * Add new protobuf types that are used when reading from the database. * Make the key exchange public key a required field in `wsts::net::DkgPublicShares`. ## Testing Information I added a unit test that checks the relevant logic of serializing one thing and deserializing another. Also, the existing unit tests should exercise this easily enough. ## Checklist - [x] I have performed a self-review of my code

Add the new protobuf types that represent what is retrieved from the signers database

2025-07-29

update comment for protobuf SignerDkgPublicShares kex_public_key field

2025-07-28

update wsts dependency

2025-04-16

new branch with backups

2025-04-15

wip

2025-04-08

Update the protobufs too

2025-02-20

feat: update validation logic of accepted withdrawal requests (#1394) * Change the request_id field on the AcceptWithdrawalV1 struct to a qualified id * Fixup the copy * Update the logic of AcceptWithdrawalV1::validate to use the withdrawal report. * Allow large protobuf variants * Update the integration tests * We don't care about rejecting votes * cargo fmt and small clean-ups * Fix the unit test

2025-02-18

feat: implement validatation of reject-withdrawal-request contract calls (#1336) * sketch out reject-withdrawal-request validation and implement first two checks call iter not into_iter for lint check check that the withdrawal-request is final on the btc chain use corrent block hash in storage requests and errors use proper chain tip errors create withdrawal-reject integration tests based on the withdrawal-accept tests log error since we don't have good error returns yet clean up error handling disable most reject tests but leave in the ones that are analaguous to the accept ones don't clone if you can copy add some temporary logging use block heights to determine if 6 blocks have passed since the withdrawal request failure to get withdrawal signers or request report should map to RequestMissing remove unused tests; use bitmap mismatch test move QualifiedRequestId into common proto; RejectWithdrawalV1 now has a QualifiedRequestId in both code and proto; deal with fallout fix tests to use QualifiedRequestId for RejectWithdrawalV1 map the DB error to the expected type remove stacks/common.proto since the linter complained it wasn't being used check reject threshold use TestSweepSetup2 to try to fix problems with the signer set length address review comments, though they seem to have made things worse use sweep block height not fake data in TestSweepSetup2 hard wire the correct signing threshold into ReqContext add TestSweep2 reject_withdrawal_request and call it from happy path test use Faker for block height if we haven't swept yet remove eprintln remove TODO comment use ctx.config().signer.public_key() not req_ctx.origin wrap comments; remove commented out code don't map errors; set request_id as i64::MAX not u64::MAX so we don't get a SQL error in the conversion pass db into make_withdrawal_reject2 and use it to get the chain tip; use make_withdrawal_reject2 in reject_withdrawal_validation_bitmap_mismatch so it will have the chain tip in req_ctx; use req_ctx to get chain tip in validate split let into two statements for readability remove Withdrawal token from error variants check to see if withdrawal request has expired in validate; add test for expiry check expired with and without rejection cases add test for not_expired_not_rejected, which tests that validate returns RequestNotRejected get the chain tip directly from the db after failing with RequestNotFinal mine an extra block and show that validate now succeeds remove unused error variants simplify validation failure conditions as per #1363 fail validation if the request is not final, i.e. expired * deal with fallout from changes to TestSweepSetup2 * add new_sweep_setup fn * generate more blocks and verify that test now passes

2025-02-05

refactor: wsts-related cleanup (#1287) * some wsts cleanup/refactor * think that's it * add message support for a specific dkg wstsmessageid * add a dkg wstsmessageid variant * fix merge artifacts * tracing fields * storage mut * lovely cascading changes * remove wstsmessage.txid infavor of id * remove save and prefer trait default impls * remove unused trait methods * logging stuff * rename message ids * remove unneeded allow(deprecated)

rename message ids

remove wstsmessage.txid infavor of id

2025-01-30

add message support for a specific dkg wstsmessageid

think that's it

some wsts cleanup/refactor

2025-01-29

rename wstsmessageid variant

2025-01-28

seems to work

2025-01-23

chore: bump wsts revision (#1262) * Update WSTS dependency * Update the protobufs * Pass in the new DKG threshold parameter

2025-01-22

Add wsts private (#4) * Add in wsts private * Update tests in wsts so that things compile * Update the WSTS dependency in sbtc signer crate * Update the protobufs after wsts changes * Pass in the DKG threshold to wsts state machine

2024-12-15

refactor: remove unused messages (#1128) * Remove the BitcoinTransactionSignAck and BitcoinTransactionSignRequest protobuf messages. Their payload field tags are now reserved. * Remove the internal BitcoinTransactionSignAck and BitcoinTransactionSignRequest structs.

2024-12-09

fix: remove sweep transaction message (#1060) * Change to a more efficient query in get_swept_deposit_requests * Don't use sweep tables in get_pending_accepted_deposit_requests query * Remove the DB trait functions that read from or write to the sweep tables. Remove now unused code * Update the queries to use the bitcoin_tx_inputs instead of the sweep tables * Remove sweep structs and protobufs :( * Drop the sweep tables * Add some indices

2024-12-02

update protobufs for embedded shares

feat: verify all p2p messages (#958) * Filter messages whose peer ID does not match the one recovered from the signature. * Verify the signature after receiving a message * Decode protobufs in a forward compatible way * Update a field name

fix: add integrity protection for all messages (#957) * Add more protobuf conversion, implement ProtoSerializable for SignerMessage * Add a function for verifying ecdsa signatures * Don't go through the wsts::net::Signable trait * Make sign_ecdsa infallible * Tag the messages * No need for OutPointMessage and many Serialize/Deserialize implementations * Don't use regular hashmaps in protobuf structs

2024-12-01

feat: wait for acks from signers after BitcoinPreSignRequest (#956) * WIP * Add an outpoint type * WIP * WIP * Rename the enum * Change the validation output * More refactoring * fake docs * Add documentation * This is unnecessary * Fix up more comments * Add todos for more work for validation * add sighashes tables * fix enum name * add bitcoin_withdrawals_outputs table and new queries * fix tests. add new batch queries * Remove locking and just use an ID for keeping track of the signer in the new WanNetwork * Add some more comments * Fix up after changes * Add code to transform the TerminationHandle into a BroadcastStream. * Add a new function to the MessageTransfer trait, implement it for the types that implement the trait * Add a new function to the Context trait that has a default implementation that combines all streams that a signer may be interested in * Use the new streams in our event loops * Add in an enum variant * Fix up after using the new types * updates after using the new stream * Temporarily ignore some tests * Minor changes in the TxSigner * minor test update * Fix the WSTS bug * Ignore tests that are ignored in later updates * unnecessary * Ignore another test * fix the test * This one can be fixed now * No more aborting * this test is already fixed * Add a new request decider event loop * Add a new signer event type * Make sure to use the right events * Small refactor * Move the sleep to before the chain tip lookup * move it back * revert * cargo fmt * Add in the new event loop and remove unnecessary field from the tx-signer * add integration tests. fix prevout_type type in the query * add block_hash to bitcoin_withdrawals_outputs primary key * address review comments * Comment update * Remove unnecessary cruft * Add a will sign field in case we want to make the query super simple * add prevout_type back * Add some more comments, cargo fmt * Remove the withdrawal check in the prevalidation function * Make sure the people cannot have fees assessments that are greater than the deposit amount * wip * Allow the max-fee to be configurable * Simplify the block observer * fix typo * save txs sighashes on db * recreate wstscoordinato at each sign round * rename BitcoinBlockSbtcRequests, reuse signers_key * Remove the construction version * Add integration tests and test fixtures * add fees to the BitcoinBlockSbtcRequests * fix validation tests * update schemas to remove version * update function name * test the amount fee thingy * bump the timeout * fix test that was randomly failing * add wait timer after sending requests context * re-create coordinator state machine at each signing round * rename SbtcRequestsContextMessage * fix linter warning * fix function naming * Add another test * Another test * Finish adding tests * That was silly * add test * fix typo * get_bitcoin_tx_sighash -> will_sign_bitcoin_tx_sighas * update test * address review comments * change queries signature to accept slices * address review comments * Feat/add is unique implementation for request packages (#888) * add is_unique logic * fix lint warning * add missing import * fix test. address comments. make sighash the pk * fix test * move new tables into new migration file * wait for signers acks after sending bitcoin pre request * Revert "wait for signers acks after sending bitcoin pre request" This reverts commit 468153f8dcb67255e836ccdfe65d4e449fd63993. * wait for signers acks after sending bitcoin pre request * remove function lingering from merge * remove pre_sign_pause * implement BitcoinPreSignAck Payload message * fix clippy warnings * fix some review comments * use the right timeout! * long received acks for a different chain tip * remove unused import * capture Shutdown signal * address review comments --------- Co-authored-by: djordon <dan.jordon@gmail.com>

2024-11-26

Use proto serialization (#880) * feat: add missing proto definitions * chore: buf lint * chore: buf format * feat: add missing proto conversions * chore: remove foresight * feat: use proto serialization * chore: add missing lint directive, nit * chore: nits, add tests placeholder * chore: nit, remove unused encode * fix: sane point conversion * tests: add missing proto conversion tests (#899) * tests: add some proto conversion tests * tests: add missing conversion tests * Add missing proto conversions (#879) * feat: add missing proto conversions * chore: remove foresight * chore: nits, add tests placeholder * fix: sane point conversion * tests: add missing proto conversion tests (#899) * tests: add some proto conversion tests * tests: add missing conversion tests * chore: exchange serialize messages in in_memory network * feat: add missing message, tests * chore: remove recursive error * nit: use derive magic

2024-11-25

Add missing proto definitions (#878) * feat: add missing proto definitions * chore: buf lint * chore: buf format * chore: add missing lint directive, nit * Add missing proto conversions (#879) * feat: add missing proto conversions * chore: remove foresight * chore: nits, add tests placeholder * fix: sane point conversion * tests: add missing proto conversion tests (#899) * tests: add some proto conversion tests * tests: add missing conversion tests

2024-11-14

feat: run blocklist client for deposits that we cannot sign for (#838) * Change the name of the is_accepted column in the deposit_signers table * Update the queries * Update the types

2024-11-11

feat: add protobuf conversion impls (#808) * move stuff out of the mod.rs file * Add conversion impls for crypto module protobufs and some of the id types * Finish the bitcoin types * Finish the conversion for common stacks types * Add tests for conversions * Finish off signer decision types

2024-10-29

feat: validate the public key embedded in the deposit script (#707) * Rename the new signer_public_key column in the deposit_requests table * Add a new can_sign field, and populate it when handling pending deposit requests * We do not need to create so many databases for our transaction signer tests

feat: add wsts protobufs (#727) * Finish the wsts protobuf messages * Add state protobufs for wsts * Compile the WSTS state.proto file

2024-10-23

feat: enable validation for contract calls (#694) * Add a signature_share_threshold column to the DKG shares table * Actually do the validation the stacks transactions

2024-10-14

feat: sign and broadcast Stacks transactions (#617) * Add the transaction id to the stacks transaction sign request object * Make the context types static, since they are. * Sign the stacks transaction in the TxSignerEventLoop * Add functions for signing and broadcasting stacks transactions --------- Co-authored-by: Matteo Almanza <matteo.almanza@algorand.com>

2024-10-02

feat: add bitcoin transaction fee validation (#582) * Use from instead of as _ casts for integers more * Use the crate ScriptPubKey in EncryptedDkgShares script_pubkey field * Switch the config for bitcoin core to use the regtest variables * Add a new trait function to DbRead for checking whether a scriptPubKey is related to the signers * Update the function signature on BitcoinTxInfo. Also update a BitcoinTxInfo's subfield and comment * Fix a lurking bug in a query that fetches the last years worth of scriptPubKeys. It now gets at least one scriptPubKey * Update stacks validation functions to use bitcoin core * Add test helper struct for setting up sweep transactions and making them (hopefully) easier to understand

2024-09-28

Finish adding the transaction protobuf types (#579)

2024-09-26

feat: add more protobuf types part 2 (#577) * Add more common types * Add some request types * Move the bitcoin and generic crypto stuff to their own packages

2024-09-24

feat: start protobuf use for signer communication (#558) * Add a buf yaml * Add some decision protobuf messages * Use buf in CI * Remove the relay stuff * Implement conversion traits for Uint256

2024-05-17

feat: Signer network implementation over gRPC with examples (#159)