tx: add support for computing an elements transaction discount

As specified in ELIP 0200.

The discount is computed as the difference between the actual tx weight
and the weight if the tx had only non-confidential outputs, i.e. it
makes confidential txs cost the same as non-confidential ones.

include/wally.hpp

@@ -3102,6 +3102,12 @@ inline int tx_get_elements_signature_hash(const TX& tx, size_t index, const SCRI
     return detail::check_ret(__FUNCTION__, ret);
 }
 
+template <class TX>
+inline int tx_get_elements_weight_discount(const TX& tx, uint32_t flags, size_t* written) {
+    int ret = ::wally_tx_get_elements_weight_discount(detail::get_p(tx), flags, written);
+    return detail::check_ret(__FUNCTION__, ret);
+}
+
 template <class TX>
 inline int tx_is_elements(const TX& tx, size_t* written) {
     int ret = ::wally_tx_is_elements(detail::get_p(tx), written);

include/wally_transaction.h

@@ -873,6 +873,20 @@ WALLY_CORE_API int wally_tx_is_coinbase(
     size_t *written);
 
 #ifndef WALLY_ABI_NO_ELEMENTS
+/**
+ * Calculate any applicable transaction weight discount for an Elements transaction.
+ *
+ * :param tx: The transaction to compute the weight discount for.
+ * :param flags: Unused, must be 0.
+ * :param written: Destination for the weight discount.
+ *
+ * .. note:: The discount may be 0 if the transaction has no confidential outputs.
+ */
+WALLY_CORE_API int wally_tx_get_elements_weight_discount(
+    const struct wally_tx *tx,
+    uint32_t flags,
+    size_t *written);
+
 /**
  * Set issuance data on an input.
  *

src/swig_java/swig.i

@@ -997,6 +997,7 @@ static jobjectArray create_jstringArray(JNIEnv *jenv, char **p, size_t len) {
 %returns_array_(wally_tx_get_btc_signature_hash, 8, 9, SHA256_LEN);
 %returns_array_(wally_tx_get_btc_taproot_signature_hash, 14, 15, SHA256_LEN);
 %returns_array_(wally_tx_get_elements_signature_hash, 9, 10, SHA256_LEN);
+%returns_size_t(wally_tx_get_elements_weight_discount);
 %returns_array_(wally_tx_get_hash_prevouts, 4, 5, SHA256_LEN);
 %returns_array_(wally_tx_get_input_blinding_nonce, 3, 4, SHA256_LEN);
 %returns_array_(wally_tx_get_input_entropy, 3, 4, SHA256_LEN);

src/test/test_elements.py

@@ -241,6 +241,18 @@ def test_deterministic_blinding_factors(self):
                         continue # Skip final VBF
                 self.assertEqual(h(out[:o_len]), utf8(expected))
 
+    def test_elements_tx_weights(self):
+        # Test the elements weight discount
+        with open(root_dir + 'src/data/elip200_vectors.json', 'r') as f:
+            JSON = json.load(f)
+        for case in JSON['cases']:
+            tx = pointer(wally_tx())
+            tx_flags = 0x3 # WALLY_TX_FLAG_USE_WITNESS | WALLY_TX_FLAG_USE_ELEMENTS
+            self.assertEqual(WALLY_OK, wally_tx_from_hex(case['tx'], tx_flags, tx))
+            self.assertEqual((WALLY_OK, case['weight']), wally_tx_get_weight(tx))
+            discount = case['weight'] - case['discount_weight']
+            self.assertEqual((WALLY_OK, discount), wally_tx_get_elements_weight_discount(tx, 0))
+
 
 if __name__ == '__main__':
     _, val = wally_is_elements_build()

src/test/util.py

@@ -676,6 +676,7 @@ class wally_psbt(Structure):
     ('wally_tx_get_btc_signature_hash', c_int, [POINTER(wally_tx), c_size_t, c_void_p, c_size_t, c_uint64, c_uint32, c_uint32, c_void_p, c_size_t]),
     ('wally_tx_get_btc_taproot_signature_hash', c_int, [POINTER(wally_tx), c_size_t, POINTER(wally_map), POINTER(c_uint64), c_size_t, c_void_p, c_size_t, c_uint32, c_uint32, c_void_p, c_size_t, c_uint32, c_uint32, c_void_p, c_size_t]),
     ('wally_tx_get_elements_signature_hash', c_int, [POINTER(wally_tx), c_size_t, c_void_p, c_size_t, c_void_p, c_size_t, c_uint32, c_uint32, c_void_p, c_size_t]),
+    ('wally_tx_get_elements_weight_discount', c_int, [POINTER(wally_tx), c_uint32, c_size_t_p]),
     ('wally_tx_get_hash_prevouts', c_int, [POINTER(wally_tx), c_size_t, c_size_t, c_void_p, c_size_t]),
     ('wally_tx_get_length', c_int, [POINTER(wally_tx), c_uint32, c_size_t_p]),
     ('wally_tx_get_signature_hash', c_int, [POINTER(wally_tx), c_size_t, c_void_p, c_size_t, c_void_p, c_size_t, c_uint32, c_uint64, c_uint32, c_uint32, c_uint32, c_void_p, c_size_t]),

src/transaction.c

@@ -1965,6 +1965,49 @@ int wally_tx_get_vsize(const struct wally_tx *tx, size_t *written)
     return ret;
 }
 
+#ifndef WALLY_ABI_NO_ELEMENTS
+int wally_tx_get_elements_weight_discount(const struct wally_tx *tx,
+                                          uint32_t flags, size_t *written)
+{
+    size_t i, n = 0, is_elements = 0;
+
+    if (written)
+        *written = 0;
+
+    if (!tx || flags || !written)
+        return WALLY_EINVAL;
+
+#ifdef BUILD_ELEMENTS
+    if (wally_tx_is_elements(tx, &is_elements) != WALLY_OK)
+        return WALLY_EINVAL;
+
+    if (is_elements) {
+        /* ELIP 0200: Compute the value of confidential outputs as though
+         * they are non-confidential */
+        for (i = 0; i < tx->num_outputs; ++i) {
+            const struct wally_tx_output *output = tx->outputs + i;
+            /* Discount any output proofs */
+            n += varbuff_get_length(output->surjectionproof_len);
+            n += varbuff_get_length(output->rangeproof_len);
+            n -= 2; /* Add 2 bytes to serialize empty proofs */
+            if (output->value_len == WALLY_TX_ASSET_CT_VALUE_LEN) {
+                /* Discount confidential value to an explicit value */
+                n += WALLY_TX_ASSET_CT_VALUE_LEN;
+                n -= WALLY_TX_ASSET_CT_VALUE_UNBLIND_LEN;
+            }
+            if (output->nonce_len == WALLY_TX_ASSET_CT_NONCE_LEN) {
+                /* Discount nonce commitment to an empty commitment */
+                n += WALLY_TX_ASSET_CT_NONCE_LEN;
+                n -= 1; /* Add a byte for the empty commitment */
+            }
+        }
+    }
+    *written = n;
+#endif
+    return WALLY_OK;
+}
+#endif /* WALLY_ABI_NO_ELEMENTS */
+
 static int hash_prevouts(unsigned char *prevouts, size_t inputs_size,
                          unsigned char *bytes_out, size_t len, bool do_free)
 {

src/wasm_package/src/index.d.ts

@@ -606,6 +606,7 @@ export function tx_from_hex(hex: string, flags: number): Ref_wally_tx;
 export function tx_get_btc_signature_hash(tx: Ref_wally_tx, index: number, script: Buffer|Uint8Array, satoshi: bigint, sighash: number, flags: number): Buffer;
 export function tx_get_btc_taproot_signature_hash(tx: Ref_wally_tx, index: number, scripts: Ref_wally_map, values: BigUint64Array|Array<bigint>, tapleaf_script: Buffer|Uint8Array, key_version: number, codesep_position: number, annex: Buffer|Uint8Array, sighash: number, flags: number): Buffer;
 export function tx_get_elements_signature_hash(tx: Ref_wally_tx, index: number, script: Buffer|Uint8Array, value: Buffer|Uint8Array, sighash: number, flags: number): Buffer;
+export function tx_get_elements_weight_discount(tx: Ref_wally_tx, flags: number): number;
 export function tx_get_hash_prevouts(tx: Ref_wally_tx, index: number, num_inputs: number): Buffer;
 export function tx_get_input_blinding_nonce(tx_in: Ref_wally_tx, index: number): Buffer;
 export function tx_get_input_entropy(tx_in: Ref_wally_tx, index: number): Buffer;

tools/wasm_exports.sh

@@ -761,6 +761,7 @@ if [ -z "$DISABLE_ELEMENTS" ]; then
 ,'_wally_tx_elements_output_init' \
 ,'_wally_tx_elements_output_init_alloc' \
 ,'_wally_tx_get_elements_signature_hash' \
+,'_wally_tx_get_elements_weight_discount' \
 ,'_wally_tx_get_input_blinding_nonce' \
 ,'_wally_tx_get_input_entropy' \
 ,'_wally_tx_get_input_inflation_keys' \