ZIP: Unassigned
Title: Explicit Fees
Owners: Daira-Emma Hopwood <daira-emma@electriccoin.co>
        Kris Nuttycombe <kris@electriccoin.co>
        Jack Grigg <jack@electriccoin.co>
Credits: Simon Liu
Status: Draft
Category: Consensus
License: MIT
Discussions-To: <https://github.com/zcash/zips/issues/803>
Pull-Request: <https://github.com/zcash/zips/pull/919>

Terminology

The key word "MUST" in this document is to be interpreted as described in BCP 14 1 when, and only when, it appears in all capitals.

The character § is used when referring to sections of the Zcash Protocol Specification 2.

Abstract

This proposal adds an explicit fee field to the v6 transaction format. Instead of fees being implicit in the difference between the input value and output value of the transaction, all value transfers, including fee transfers to miners, will be explicit and committed to via the txid.

Motivation

When it comes to fee selection, it should be very hard to make mistakes. The current transparent fee computation (inherited from Bitcoin) — input value less output value — is prone to user error. It is very easy to forget to add an output for a change address, make a calculation error 5, mix up units etc.

In addition, when signing a transaction with a hardware wallet, using an implicit fee means that the hardware wallet must recompute the fee on its own and cannot simply display the value being committed to.

Finally, this change will make it possible for light clients to determine the fee paid by a transaction without needing to download and inspect transparent inputs to the transaction.

Requirements

There must not be any potentially error-prone calculations needed to compute the fee for a given transaction. That is, the fee must be obvious from the encoding of the transaction.

Specification

Transaction Format

The following field is added to the v6 transaction format 6.

Bytes Name Data Type Description
8 fee uint64 The fee to be paid by this transaction, in zatoshis.

Consensus Rules

The following changes are to be made to the Zcash Protocol Specification 2.

In § 3.4 ‘Transactions and Treestates’ 3 (last modified by ZIP 236 7), add the following consensus rule and note:

  • [NU7 onward] For v6 and later transactions, the remaining value in the transparent transaction value pool, in zatoshis, MUST be equal to the value of the transaction’s fee field.

Non-normative note: The effect of these rules is that the fee field of v6 and later coinbase transactions will always be zero.

In § 7.1 ‘Transaction Encoding and Consensus’ 4, add:

[NU7 onward] fee MUST be in the range \(\{ 0 .. \mathsf{MAX\_MONEY} \}\) .

Signature Hash

The transaction signature hashing algorithm defined in ZIP 244 is to be modified for v6 transactions as follows:

Section T.1: header_digest 8 is specified in draft-txv6-sighash 9 to read:

A BLAKE2b-256 hash of the following values

T.1a: version             (4-byte little-endian version identifier including ``fOverwintered`` flag)
T.1b: version_group_id    (4-byte little-endian version group identifier)
T.1c: consensus_branch_id (4-byte little-endian consensus branch id)
T.1d: lock_time           (4-byte little-endian ``nLockTime`` value)
T.1e: expiry_height       (4-byte little-endian block height)
T.1f: fee                 (8-byte little-endian fee value)

The personalization field of this hash is set to:

"ZTxIdHeadersHash"

Reference implementation

TBD

References

1 Information on BCP 14 — "RFC 2119: Key words for use in RFCs to Indicate Requirement Levels" and "RFC 8174: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words"
2 Zcash Protocol Specification, Version 2024.5.1 [NU6] or later
3 Zcash Protocol Specification, Version 2024.5.1 [NU6]. Section 3.4: Transactions and Treestates
4 Zcash Protocol Specification, Version 2024.5.1 [NU6]. Section 7.1.2: Transaction Consensus Rules
5 Bitcoin Forum post by @Voiceeeeee, March 8, 2017. "PLEASE HELP.. I sent a transaction with a 2.5 BTC transaction fee"
6 ZIP 230: Version 6 Transaction Format
7 ZIP 236: Blocks should balance exactly
8 ZIP 244: Transaction Identifier Non-Malleability. Section T.1: Header Digest
9 ZIP draft: Version 6 Transaction Signature Validation