policy: Charge a fee penalty for 1-of-N witness keys

[connorslab]

BPUB encodes 31 payload bytes into each valid compressed public key, then reveals them in a P2WSH 1-of-N multisig script. Its largest script uses fourteen payload keys and one signing key. A public-key validity check cannot distinguish those keys from wallet keys. See the encoder and script construction.

This draft adds a default fee penalty for that structure, rather than rejecting it as nonstandard. The purpose is to increase the cost of the current BPUB encoding while allowing legitimate matching multisig spends to pay the additional fee. It is a fee-based alternative to the rejection approaches discussed in #422 and #435.

Behavior

-oneofnkeypenalty=1 is the default. For each input, match only a complete script of either form:

• P2WSH or P2SH-P2WSH: 1 <key1> ... <keyN> N CHECKMULTISIG.
• Tapscript: <key1> CHECKSIG <key2> CHECKSIGADD ... 1 NUMEQUAL.

Calculate the weight corresponding to the witness discount on all but one key: 3 * 33 * (N - 1) for compressed multisig keys, or 3 * 32 * (N - 1) for Tapscript keys. Sum across inputs, round up to virtual bytes, and charge that amount at the node's minrelaytxfee. Subtract the charge from the transaction's modified fee, which feeds relay fee checks and fee-based mempool/mining selection. The transaction's actual fee, weight, vsize, and size-limit accounting do not change.

For a single BPUB-style 1-of-15 P2WSH input, this is 347 additional satoshis at a 1 sat/vB minimum relay rate. This is a fixed penalty at the configured minimum rate, not a multiplier on the prevailing market feerate.

Spending compatibility

There is no new key-count limit or data-carrier classification. Legitimate 1-of-N wallets incur the same penalty; the policy cannot infer why their keys were chosen. Other thresholds, complex recovery scripts, non-witness multisig, and key-path spends receive no new penalty. Block validity is unchanged. -oneofnkeypenalty=0 disables the penalty; -corepolicy also disables it unless explicitly overridden.

The charge is applied after the existing ephemeral zero-fee check. It does not tighten TRUC or ancestor-size limits. A package child can cover it where existing package policy permits. It does not fix the separate dust-fee interaction addressed by #438.

Wallet funding reserves a conservative allowance at its selected feerate, including for explicitly supplied input weights. This may overestimate the penalty at rates above minrelaytxfee, or when a different Taproot path is used. The existing Taproot estimator still assumes key-path spending; script-path funding needs an appropriate input weight. Already signed or externally constructed transactions may need a fee adjustment.

Limits of this approach

This is deliberately a narrow draft, not a general BPUB filter. An encoder can avoid the match by changing the threshold to 2-of-N or changing the script structure, including adding a wrapper. No durable increase in the cost of adapted encodings is claimed. The review question is whether this limited default penalty is useful enough to justify its cost to legitimate 1-of-N users.

Validation

• Unit tests cover both script forms, threshold boundaries, malformed scripts, and nonmatching wrappers.
• Functional coverage includes valid payload-derived keys, sufficient and insufficient fees, the opt-out, P2WSH/P2SH-P2WSH/Tapscript and legacy spends, package fee accounting, a TRUC child near its size limit, and a zero-fee ephemeral parent sponsored by its child.
• Descriptor-wallet funding and spending are tested at the minimum relay rate. A transaction below the new relay fee is mined by the opt-out node and accepted by the default node.
• Targeted transaction, wallet-spend, and PSBT unit suites, plus multisig descriptor and unified-signature functional regressions.

One commit. No generated files, manpages, or shell completions.