From 3e494e5a94368e1ac900509019c294731efb1a0b Mon Sep 17 00:00:00 2001
From: connorslab <82235496+connorslab@users.noreply.github.com>
Date: Wed, 7 Oct 2026 18:51:26 -0600
Subject: [PATCH] policy: Charge a fee penalty for 1-of-N witness keys

---
 src/init.cpp                           |   3 +
 src/policy/policy.cpp                  |  32 +++
 src/policy/policy.h                    |   8 +
 src/policy/settings.h                  |   1 +
 src/test/transaction_tests.cpp         |  37 ++++
 src/validation.cpp                     |  13 ++
 src/wallet/spend.cpp                   |  62 +++++-
 test/functional/mempool_oneofn_cost.py | 266 +++++++++++++++++++++++++
 test/functional/test_runner.py         |   1 +
 9 files changed, 414 insertions(+), 9 deletions(-)
 create mode 100644 test/functional/mempool_oneofn_cost.py

diff --git a/src/init.cpp b/src/init.cpp
index 50c4d691bf67..7cbdf6857082 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -725,6 +725,7 @@ void SetupServerArgs(ArgsManager& argsman, bool can_listen_ipc)
     argsman.AddArg("-bytespersigopstrict", strprintf("Minimum bytes per sigop in transactions we relay and mine (default: %u)", DEFAULT_BYTES_PER_SIGOP_STRICT), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarrier", strprintf("Relay and mine data carrier transactions (default: %u)", DEFAULT_ACCEPT_DATACARRIER), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarriercost", strprintf("Treat extra data in transactions as at least N vbytes per actual byte (default: %s)", DEFAULT_WEIGHT_PER_DATA_BYTE / 4.0), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
+    argsman.AddArg("-oneofnkeypenalty", strprintf("Reduce modified fees by the minrelaytxfee charge for the witness discount on all but one public key in exact 1-of-N multisig scripts. Also affects legitimate matching wallet spends; wallet fee estimates include a conservative allowance (default: %u)", DEFAULT_ONE_OF_N_KEY_PENALTY), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarrierfullcount", strprintf("Apply datacarriersize limit to all known datacarrier methods (default: %u)", DEFAULT_DATACARRIER_FULLCOUNT), ArgsManager::ALLOW_ANY | (DEFAULT_DATACARRIER_FULLCOUNT ? uint32_t{ArgsManager::DEBUG_ONLY} : 0), OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarriersize",
                    strprintf("Maximum size of data in data carrier transactions we relay and mine, in bytes (maximum %s, default: %u)",
@@ -877,6 +878,7 @@ void InitParameterInteraction(ArgsManager& args)
         args.SoftSetArg("-rejecttokens", "0");
         args.SoftSetArg("-subdustfeepenalty", "0");
         args.SoftSetArg("-datacarriercost", "0.25");
+        args.SoftSetBoolArg("-oneofnkeypenalty", false);
         args.SoftSetArg("-datacarrierfullcount", "0");
         args.SoftSetArg("-maxtxlegacysigops", strprintf("%s", std::numeric_limits<unsigned int>::max()));
         args.SoftSetArg("-maxscriptsize", strprintf("%s", std::numeric_limits<unsigned int>::max()));
@@ -1222,6 +1224,7 @@ bool AppInitParameterInteraction(const ArgsManager& args)
     g_script_size_policy_limit = args.GetIntArg("-maxscriptsize", g_script_size_policy_limit);
 
     nBytesPerSigOp = args.GetIntArg("-bytespersigop", nBytesPerSigOp);
+    g_one_of_n_key_penalty = args.GetBoolArg("-oneofnkeypenalty", DEFAULT_ONE_OF_N_KEY_PENALTY);
     nBytesPerSigOpStrict = args.GetIntArg("-bytespersigopstrict", nBytesPerSigOpStrict);
 
     if (!g_wallet_init_interface.ParameterInteraction()) return false;
diff --git a/src/policy/policy.cpp b/src/policy/policy.cpp
index 679c0c967a1f..06a2f46bb3d8 100644
--- a/src/policy/policy.cpp
+++ b/src/policy/policy.cpp
@@ -33,6 +33,7 @@
 #include <vector>
 
 unsigned int g_script_size_policy_limit{DEFAULT_SCRIPT_SIZE_POLICY_LIMIT};
+bool g_one_of_n_key_penalty{DEFAULT_ONE_OF_N_KEY_PENALTY};
 
 CAmount GetDustThreshold(const CTxOut& txout, const CFeeRate& dustRelayFeeIn)
 {
@@ -654,6 +655,37 @@ std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsV
     return ret;
 }
 
+int64_t GetOneOfNExtraWeight(const CScript& script)
+{
+    // Match whole scripts, not fragments of recovery paths or other conditions.
+    // These keys may all belong to a wallet; this does not classify them as data.
+    std::vector<std::vector<unsigned char>> solutions;
+    if (Solver(script, solutions) == TxoutType::MULTISIG && solutions.front()[0] == 1) {
+        size_t key_bytes{0}, largest_key{0};
+        for (size_t i{1}; i + 1 < solutions.size(); ++i) {
+            key_bytes += solutions[i].size();
+            largest_key = std::max(largest_key, solutions[i].size());
+        }
+        return int64_t(key_bytes - largest_key) * (WITNESS_SCALE_FACTOR - 1);
+    }
+    if (const auto multi_a = MatchMultiA(script); multi_a && multi_a->first == 1) {
+        return int64_t(multi_a->second.size() - 1) * 32 * (WITNESS_SCALE_FACTOR - 1);
+    }
+    return 0;
+}
+
+int64_t GetOneOfNTxExtraWeight(const CTransaction& tx, const CCoinsViewCache& view)
+{
+    int64_t extra_weight{0};
+    for (const CTxIn& txin : tx.vin) {
+        if (txin.scriptWitness.IsNull()) continue;
+        const auto& prev_script = view.AccessCoin(txin.prevout).out.scriptPubKey;
+        const auto [script, weight_per_byte] = GetScriptForTransactionInput(prev_script, txin);
+        if (weight_per_byte == 1) extra_weight += GetOneOfNExtraWeight(script);
+    }
+    return extra_weight;
+}
+
 int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& view, const unsigned int weight_per_data_byte)
 {
     int64_t mod_weight{0};
diff --git a/src/policy/policy.h b/src/policy/policy.h
index 954c79f4bd17..d9e95428a44d 100644
--- a/src/policy/policy.h
+++ b/src/policy/policy.h
@@ -64,6 +64,8 @@ static constexpr unsigned int DEFAULT_BYTES_PER_SIGOP{20};
 static constexpr unsigned int DEFAULT_BYTES_PER_SIGOP_STRICT{20};
 /** Default for -datacarriercost (multiplied by WITNESS_SCALE_FACTOR) */
 static constexpr unsigned int DEFAULT_WEIGHT_PER_DATA_BYTE{4};
+/** Default for -oneofnkeypenalty */
+static constexpr bool DEFAULT_ONE_OF_N_KEY_PENALTY{true};
 /** Default for -rejecttokens */
 static constexpr bool DEFAULT_REJECT_TOKENS{true};
 /** Default for -subdustfeepenalty */
@@ -243,6 +245,12 @@ std::pair<CScript, unsigned int> GetScriptForTransactionInput(CScript prevScript
 
 std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsViewCache& view);
 
+/** Policy weight needed to price all but one key in an exact 1-of-N witness script at one vbyte per byte. */
+int64_t GetOneOfNExtraWeight(const CScript& script);
+
+/** Additional key weight across witness inputs, used only to calculate the fee penalty. */
+int64_t GetOneOfNTxExtraWeight(const CTransaction& tx, const CCoinsViewCache& view);
+
 int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& view, const unsigned int weight_per_data_byte);
 
 #endif // BITCOIN_POLICY_POLICY_H
diff --git a/src/policy/settings.h b/src/policy/settings.h
index 03cfc3775da1..b254b4715510 100644
--- a/src/policy/settings.h
+++ b/src/policy/settings.h
@@ -10,5 +10,6 @@ extern unsigned int g_script_size_policy_limit;
 extern unsigned int nBytesPerSigOp;
 extern unsigned int nBytesPerSigOpStrict;
 extern unsigned int g_weight_per_data_byte;
+extern bool g_one_of_n_key_penalty;
 
 #endif // BITCOIN_POLICY_SETTINGS_H
diff --git a/src/test/transaction_tests.cpp b/src/test/transaction_tests.cpp
index f9066a30df8c..ad17f52d3a73 100644
--- a/src/test/transaction_tests.cpp
+++ b/src/test/transaction_tests.cpp
@@ -1423,4 +1423,41 @@ BOOST_AUTO_TEST_CASE(spends_witness_prog)
     }
 }
 
+BOOST_AUTO_TEST_CASE(oneofn_policy_weight)
+{
+    const auto pubkey = GenerateRandomKey().GetPubKey();
+    const auto key = ToByteVector(pubkey);
+    const auto xonly = ToByteVector(XOnlyPubKey{pubkey});
+    for (const int n : {1, 2, 3, 4, 15, 20}) {
+        for (const int threshold : {1, n}) {
+            CScript multi;
+            multi << threshold;
+            for (int i{0}; i < n; ++i) multi << key;
+            multi << n << OP_CHECKMULTISIG;
+            const int64_t expected = threshold == 1 ? (n - 1) * 33 * 3 : 0;
+            BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(multi), expected);
+
+            // Do not infer thresholds inside more complex scripts.
+            CScript prefixed = CScript{} << OP_0 << OP_CHECKSEQUENCEVERIFY << OP_DROP;
+            prefixed.insert(prefixed.end(), multi.begin(), multi.end());
+            BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(prefixed), 0);
+            BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(CScript{multi} << OP_NOP), 0);
+        }
+    }
+    for (const int n : {1, 2, 3, 4, 15, 999}) {
+        for (const int threshold : {1, n}) {
+            CScript multi_a;
+            for (int i{0}; i < n; ++i) multi_a << xonly << (i == 0 ? OP_CHECKSIG : OP_CHECKSIGADD);
+            multi_a << threshold << OP_NUMEQUAL;
+            BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(multi_a), threshold == 1 ? (n - 1) * 32 * 3 : 0);
+            BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(CScript{multi_a} << OP_NOP), 0);
+            multi_a.pop_back();
+            BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(multi_a), 0);
+        }
+    }
+    BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(CScript{}), 0);
+    BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(CScript{} << xonly << OP_CHECKSIG), 0);
+    BOOST_CHECK_EQUAL(GetOneOfNExtraWeight(CScript{} << OP_PUSHDATA1), 0);
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index 26661fbee5aa..c02f426b693b 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -1139,6 +1139,19 @@ bool MemPoolAccept::PreChecks(ATMPArgs& args, Workspace& ws)
         }
     }
 
+    // Apply after the ephemeral zero-fee check: this automatic penalty must not
+    // turn a zero-fee parent into a nonzero-fee transaction for that check.
+    // Keep size accounting unchanged, in particular TRUC and ancestor limits.
+    if (g_one_of_n_key_penalty) {
+        const auto penalty = m_pool.m_opts.min_relay_feerate.GetFee(GetVirtualTransactionSize(GetOneOfNTxExtraWeight(tx, m_view), 0, 0));
+        if (penalty > 0) {
+            m_subpackage.m_changeset->m_to_add.modify(ws.m_tx_handle, [&](CTxMemPoolEntry& e) {
+                e.UpdateModifiedFee(-penalty);
+            });
+            ws.m_modified_fees = SaturatingAdd(ws.m_modified_fees, -penalty);
+        }
+    }
+
     // To avoid rejecting low-sigop bare-multisig transactions, the sigops
     // are counted a second time more accurately.
     if ((nSigOpsCost > MAX_STANDARD_TX_SIGOPS_COST) || (nBytesPerSigOpStrict && GetAccurateTransactionSigOpCost(tx, m_view, STANDARD_SCRIPT_VERIFY_FLAGS) > ws.m_vsize * WITNESS_SCALE_FACTOR / nBytesPerSigOpStrict)) {
diff --git a/src/wallet/spend.cpp b/src/wallet/spend.cpp
index e0344be525aa..bad05e214662 100644
--- a/src/wallet/spend.cpp
+++ b/src/wallet/spend.cpp
@@ -8,10 +8,12 @@
 #include <common/system.h>
 #include <consensus/amount.h>
 #include <consensus/validation.h>
+#include <hash.h>
 #include <interfaces/chain.h>
 #include <node/types.h>
 #include <numeric>
 #include <policy/policy.h>
+#include <policy/settings.h>
 #include <primitives/transaction.h>
 #include <script/script.h>
 #include <script/signingprovider.h>
@@ -87,13 +89,44 @@ static std::optional<int64_t> MaxInputWeight(const Descriptor& desc, const std::
     return {};
 }
 
+// Reserve the undiscounted key weight at the wallet's chosen feerate. This
+// covers the penalty at minrelaytxfee and is conservative at higher feerates.
+// Keep it separate from consensus weight and transaction weight limits.
+static int64_t MaximumOneOfNExtraWeight(const CScript& script_pubkey, const SigningProvider& provider)
+{
+    if (!g_one_of_n_key_penalty) return 0;
+    CScript script{script_pubkey};
+    std::vector<std::vector<unsigned char>> solutions;
+    auto type = Solver(script, solutions);
+    if (type == TxoutType::SCRIPTHASH) {
+        if (!provider.GetCScript(CScriptID{uint160{solutions[0]}}, script)) return 0;
+        type = Solver(script, solutions);
+    }
+    if (type == TxoutType::WITNESS_V0_SCRIPTHASH) {
+        if (!provider.GetCScript(CScriptID{RIPEMD160(solutions[0])}, script)) return 0;
+        return GetVirtualTransactionSize(GetOneOfNExtraWeight(script), 0, 0) * WITNESS_SCALE_FACTOR;
+    }
+    if (type == TxoutType::WITNESS_V1_TAPROOT) {
+        TaprootSpendData spenddata;
+        if (!provider.GetTaprootSpendData(XOnlyPubKey{solutions[0]}, spenddata)) return 0;
+        int64_t extra_weight{0};
+        for (const auto& [leaf, controls] : spenddata.scripts) {
+            if (leaf.second == TAPROOT_LEAF_TAPSCRIPT) {
+                extra_weight = std::max(extra_weight, GetOneOfNExtraWeight(CScript(leaf.first.begin(), leaf.first.end())));
+            }
+        }
+        return extra_weight;
+    }
+    return 0;
+}
+
 int CalculateMaximumSignedInputSize(const CTxOut& txout, const COutPoint outpoint, const SigningProvider* provider, bool can_grind_r, const CCoinControl* coin_control)
 {
     if (!provider) return -1;
 
     if (const auto desc = InferDescriptor(txout.scriptPubKey, *provider)) {
         if (const auto weight = MaxInputWeight(*desc, CTxIn{outpoint}, coin_control, true, can_grind_r)) {
-            return static_cast<int>(GetVirtualTransactionSize(*weight, 0, 0));
+            return static_cast<int>(GetVirtualTransactionSize(*weight + MaximumOneOfNExtraWeight(txout.scriptPubKey, *provider), 0, 0));
         }
     }
 
@@ -106,9 +139,7 @@ int CalculateMaximumSignedInputSize(const CTxOut& txout, const CWallet* wallet,
     return CalculateMaximumSignedInputSize(txout, COutPoint(), provider.get(), wallet->CanGrindR(), coin_control);
 }
 
-/** Infer a descriptor for the given output script. */
-static std::unique_ptr<Descriptor> GetDescriptor(const CWallet* wallet, const CCoinControl* coin_control,
-                                                 const CScript script_pubkey)
+static MultiSigningProvider GetSigningProvider(const CWallet* wallet, const CCoinControl* coin_control, const CScript& script_pubkey)
 {
     MultiSigningProvider providers;
     for (const auto spkman: wallet->GetScriptPubKeyMans(script_pubkey)) {
@@ -117,7 +148,14 @@ static std::unique_ptr<Descriptor> GetDescriptor(const CWallet* wallet, const CC
     if (coin_control) {
         providers.AddProvider(std::make_unique<FlatSigningProvider>(coin_control->m_external_provider));
     }
-    return InferDescriptor(script_pubkey, providers);
+    return providers;
+}
+
+/** Infer a descriptor for the given output script. */
+static std::unique_ptr<Descriptor> GetDescriptor(const CWallet* wallet, const CCoinControl* coin_control,
+                                                 const CScript script_pubkey)
+{
+    return InferDescriptor(script_pubkey, GetSigningProvider(wallet, coin_control, script_pubkey));
 }
 
 /** Infer the maximum size of this input after it will be signed. */
@@ -157,15 +195,19 @@ TxSize CalculateMaximumSignedTxSize(const CTransaction &tx, const CWallet *walle
     for (const auto& txo : tx.vout) weight += GetSerializeSize(txo) * WITNESS_SCALE_FACTOR;
 
     // Add the size of the transaction inputs as if they were signed.
+    int64_t extra_weight{0};
     for (uint32_t i = 0; i < txouts.size(); i++) {
         const auto txin_weight = GetSignedTxinWeight(wallet, coin_control, tx.vin[i], txouts[i], is_segwit, wallet->CanGrindR());
         if (!txin_weight) return TxSize{-1, -1};
         assert(*txin_weight > -1);
         weight += *txin_weight;
+        if (g_one_of_n_key_penalty) {
+            extra_weight += MaximumOneOfNExtraWeight(txouts[i].scriptPubKey, GetSigningProvider(wallet, coin_control, txouts[i].scriptPubKey));
+        }
     }
 
     // It's ok to use 0 as the number of sigops since we never create any pathological transaction.
-    return TxSize{GetVirtualTransactionSize(weight, 0, 0), weight};
+    return TxSize{GetVirtualTransactionSize(weight + extra_weight, 0, 0), weight};
 }
 
 TxSize CalculateMaximumSignedTxSize(const CTransaction &tx, const CWallet *wallet, const CCoinControl* coin_control)
@@ -272,9 +314,6 @@ util::Result<PreSelectedInputs> FetchSelectedInputs(const CWallet& wallet, const
     std::map<COutPoint, CAmount> map_of_bump_fees = wallet.chain().calculateIndividualBumpFees(coin_control.ListSelected(), coin_selection_params.m_effective_feerate);
     for (const COutPoint& outpoint : coin_control.ListSelected()) {
         int64_t input_bytes = coin_control.GetInputWeight(outpoint).value_or(-1);
-        if (input_bytes != -1) {
-            input_bytes = GetVirtualTransactionSize(input_bytes, 0, 0);
-        }
         CTxOut txout;
         if (auto ptr_wtx = wallet.GetWalletTx(outpoint.hash)) {
             // Clearly invalid input, fail
@@ -295,6 +334,11 @@ util::Result<PreSelectedInputs> FetchSelectedInputs(const CWallet& wallet, const
             txout = *out;
         }
 
+        if (const auto input_weight = coin_control.GetInputWeight(outpoint)) {
+            const auto extra_weight = g_one_of_n_key_penalty ? MaximumOneOfNExtraWeight(txout.scriptPubKey, GetSigningProvider(&wallet, &coin_control, txout.scriptPubKey)) : 0;
+            input_bytes = GetVirtualTransactionSize(*input_weight + extra_weight, 0, 0);
+        }
+
         if (input_bytes == -1) {
             input_bytes = CalculateMaximumSignedInputSize(txout, outpoint, &coin_control.m_external_provider, can_grind_r, &coin_control);
         }
diff --git a/test/functional/mempool_oneofn_cost.py b/test/functional/mempool_oneofn_cost.py
new file mode 100644
index 000000000000..72d37a1ec1b2
--- /dev/null
+++ b/test/functional/mempool_oneofn_cost.py
@@ -0,0 +1,266 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Knots developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Price additional 1-of-N witness keys without prohibiting their spends."""
+
+from decimal import Decimal
+
+from test_framework.address import address_to_scriptpubkey
+from test_framework.descriptors import descsum_create
+from test_framework.key import ECKey, ECPubKey, compute_xonly_pubkey, sign_schnorr
+from test_framework.messages import COutPoint, CTransaction, CTxIn, CTxInWitness, CTxOut, COIN
+from test_framework.script import (
+    CScript, OP_CHECKMULTISIG, OP_CHECKSEQUENCEVERIFY, OP_CHECKSIG,
+    OP_CHECKSIGADD, OP_DROP, OP_NUMEQUAL, SIGHASH_ALL, SIGHASH_UNIFIED,
+    UNIFIED_SCRIPT_TYPE_TAPSCRIPT, UnifiedSignatureHash, taproot_construct,
+)
+from test_framework.script_util import PAY_TO_ANCHOR, key_to_p2pkh_script, key_to_p2wpkh_script, script_to_p2sh_script, script_to_p2wsh_script
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import assert_equal
+from test_framework.wallet import MiniWallet
+from test_framework.wallet_util import bytes_to_wif
+
+
+class OneOfNCostTest(BitcoinTestFramework):
+    def add_options(self, parser):
+        self.add_wallet_options(parser, legacy=False)
+
+    def set_test_params(self):
+        self.num_nodes = 2
+        self.setup_clean_chain = True
+        self.wallet_names = []
+        common = ["-testactivationheight=blake2b@1", "-corepolicy=0", "-acceptnonstdtxn=0", "-minrelaytxfee=0.00001000", "-mempooltruc=enforce"]
+        self.extra_args = [common, common + ["-oneofnkeypenalty=0"]]
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_wallet()
+        self.skip_if_no_sqlite()
+
+    @staticmethod
+    def data_key(index):
+        # BPUB stores 31 payload bytes in X and grinds its final byte until
+        # the compressed key is valid. No private key for this point is used.
+        payload = (f"BPUB payload chunk {index:02d}".encode()).ljust(31, b".")
+        for nonce in range(256):
+            encoded = b"\x02" + payload + bytes([nonce])
+            pub = ECPubKey()
+            pub.set(encoded)
+            if pub.is_valid:
+                return encoded
+        raise AssertionError("No valid data key")
+
+    def fund(self, kind, n, threshold=1, payload=False, timelock=False):
+        keys = [self.data_key(i) if payload and i < n - 1 else self.keys[i].get_pubkey().get_bytes() for i in range(n)]
+        info = None
+        if kind == "taproot":
+            ops = []
+            for i, key in enumerate(keys):
+                ops += [key[1:], OP_CHECKSIG if i == 0 else OP_CHECKSIGADD]
+            script = CScript(ops + [threshold, OP_NUMEQUAL])
+            internal = compute_xonly_pubkey(self.keys[-1].get_bytes())[0]
+            info = taproot_construct(internal, [("multisig", script)])
+            spk = info.scriptPubKey
+        else:
+            prefix = [0, OP_CHECKSEQUENCEVERIFY, OP_DROP] if timelock else []
+            script = CScript(prefix + [threshold] + keys + [n, OP_CHECKMULTISIG])
+            spk = script_to_p2sh_script(script) if kind == "legacy" else script_to_p2wsh_script(script)
+            if kind == "nested":
+                spk = script_to_p2sh_script(spk)
+        funding = self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=spk, amount=COIN)
+        self.generate(self.wallet, 1)
+        return dict(kind=kind, n=n, threshold=threshold, script=script, info=info,
+                    outpoint=COutPoint(int(funding["txid"], 16), funding["sent_vout"]), utxo=CTxOut(COIN, spk))
+
+    def spend(self, case, fee=10000):
+        tx = CTransaction()
+        tx.version = case.get("version", 2)
+        tx.vin = [CTxIn(case["outpoint"], nSequence=case.get("sequence", 1))]
+        tx.vout = [CTxOut(case["utxo"].nValue - fee, key_to_p2wpkh_script(self.keys[0].get_pubkey().get_bytes()))]
+        for i in range(case.get("padding_outputs", 0)):
+            tx.vout[0].nValue -= 1000
+            tx.vout.append(CTxOut(1000, CScript([0, (i + 1).to_bytes(20, "big")])))
+        if case.get("anchor", False):
+            tx.vout.append(CTxOut(0, PAY_TO_ANCHOR))
+        tx.wit.vtxinwit = [CTxInWitness()]
+        hash_type = SIGHASH_ALL | SIGHASH_UNIFIED
+        if case["kind"] == "taproot":
+            leaf = case["info"].leaves["multisig"]
+            sighash = UnifiedSignatureHash(None, tx, 0, hash_type, [case["utxo"]], False,
+                                          script_type=UNIFIED_SCRIPT_TYPE_TAPSCRIPT, leaf_script=leaf.script, leaf_ver=leaf.version)
+            sigs = [b""] * case["n"]
+            for i in range(case["n"] - case["threshold"], case["n"]):
+                sigs[i] = sign_schnorr(self.keys[i].get_bytes(), sighash) + bytes([hash_type])
+            control = bytes([leaf.version + case["info"].negflag]) + case["info"].internal_pubkey + leaf.merklebranch
+            tx.wit.vtxinwit[0].scriptWitness.stack = list(reversed(sigs)) + [leaf.script, control]
+        else:
+            witness = case["kind"] != "legacy"
+            sighash = UnifiedSignatureHash(case["script"], tx, 0, hash_type, [case["utxo"]], witness)
+            sigs = [self.keys[i].sign_ecdsa(sighash) + bytes([hash_type]) for i in range(case["n"] - case["threshold"], case["n"])]
+            stack = [b""] + sigs + [case["script"]]
+            if witness:
+                tx.wit.vtxinwit[0].scriptWitness.stack = stack
+                if case["kind"] == "nested":
+                    tx.vin[0].scriptSig = CScript([script_to_p2wsh_script(case["script"])])
+            else:
+                tx.vin[0].scriptSig = CScript(stack)
+        tx.rehash()
+        return tx
+
+    def check_cost(self, case, extra_weight):
+        tx = self.spend(case)
+        results = [node.testmempoolaccept([tx.serialize().hex()])[0] for node in self.nodes]
+        for result in results:
+            assert result["allowed"], (case, result)
+        sigops = 0 if case["kind"] == "taproot" else case["n"] * (4 if case["kind"] == "legacy" else 1)
+        assert_equal(results[0]["vsize"], results[1]["vsize"])
+        assert_equal(results[1]["vsize"], (max(tx.get_weight(), sigops * 20) + 3) // 4)
+        penalty = (extra_weight + 3) // 4  # minrelaytxfee is 1 sat/vbyte
+        assert_equal(results[0]["fees"]["effective-feerate"], Decimal((10000 - penalty) * 1000 // results[0]["vsize"]) / COIN)
+        return tx, results
+
+    def check_wallet(self, wrapper):
+        node = self.nodes[0]
+        name = "oneofn_" + wrapper
+        node.createwallet(name, blank=True, descriptors=True)
+        wallet = node.get_wallet_rpc(name)
+        wifs = [bytes_to_wif(key.get_bytes()) for key in self.keys[:4]]
+        multi = f"multi(1,{','.join(wifs)})"
+        if wrapper == "taproot":
+            # An unowned internal key forces script-path signing.
+            nums = "50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0"
+            desc = f"tr({nums},multi_a(1,{','.join(wifs)}))"
+        else:
+            desc = f"wsh({multi})"
+            if wrapper == "nested":
+                desc = f"sh({desc})"
+        desc = descsum_create(desc)
+        assert_equal(wallet.importdescriptors([{"desc": desc, "timestamp": "now"}])[0]["success"], True)
+        public = wallet.getdescriptorinfo(desc)["descriptor"]
+        address = wallet.deriveaddresses(public)[0]
+        self.wallet.send_to(from_node=node, scriptPubKey=address_to_scriptpubkey(address), amount=COIN)
+        self.generate(self.wallet, 1)
+        options = {"fee_rate": 1, "changeAddress": self.wallet.get_address()}
+        inputs = []
+        if wrapper == "taproot":
+            # TRDescriptor currently assumes key-path satisfaction. Supply the
+            # existing input weight override for this script-only spend; the
+            # wallet must still add the new policy cost to that physical weight.
+            coin = wallet.listunspent()[0]
+            script_size = 4 * 34 + 2
+            input_weight = 41 * 4 + 1 + 66 + 3 + 1 + script_size + 1 + 33
+            inputs = [{"txid": coin["txid"], "vout": coin["vout"], "weight": input_weight}]
+        funded = wallet.walletcreatefundedpsbt(inputs, [{self.wallet.get_address(): Decimal("0.5")}],
+                                             options=options)
+        signed = wallet.walletprocesspsbt(funded["psbt"])
+        assert_equal(signed["complete"], True)
+        analyzed = node.analyzepsbt(signed["psbt"])
+        final = node.finalizepsbt(signed["psbt"])
+        result = node.testmempoolaccept([final["hex"]])[0]
+        assert_equal(result["allowed"], True)
+        assert_equal(analyzed["estimated_vsize"], result["vsize"])
+        penalty = 72 if wrapper == "taproot" else 75
+        assert funded["fee"] * COIN >= result["vsize"] + penalty, (wrapper, funded["fee"], result["vsize"], analyzed)
+        node.sendrawtransaction(final["hex"])
+        self.generate(self.wallet, 1)
+
+    def check_package(self, zero_fee_parent=False):
+        case = self.fund("witness", 15, payload=True)
+        if zero_fee_parent:
+            case.update(version=3, anchor=True)
+        parent_fee = 0 if zero_fee_parent else 10000
+        parent = self.spend(case, fee=parent_fee)
+        child = CTransaction()
+        child.version = parent.version
+        child.vin = [CTxIn(COutPoint(int(parent.hash, 16), 0), nSequence=0xfffffffd)]
+        child.vout = [CTxOut(parent.vout[0].nValue - 10000, address_to_scriptpubkey(self.wallet.get_address()))]
+        child.wit.vtxinwit = [CTxInWitness()]
+        if zero_fee_parent:
+            child.vin.append(CTxIn(COutPoint(int(parent.hash, 16), 1), nSequence=0xfffffffd))
+            child.wit.vtxinwit.append(CTxInWitness())
+        hash_type = SIGHASH_ALL | SIGHASH_UNIFIED
+        pubkey = self.keys[0].get_pubkey().get_bytes()
+        sighash = UnifiedSignatureHash(key_to_p2pkh_script(pubkey), child, 0, hash_type, parent.vout, True)
+        child.wit.vtxinwit[0].scriptWitness.stack = [self.keys[0].sign_ecdsa(sighash) + bytes([hash_type]), pubkey]
+        child.rehash()
+        raw = [tx.serialize().hex() for tx in (parent, child)]
+        if not zero_fee_parent:
+            results = self.nodes[0].testmempoolaccept(raw)
+            assert all(result["allowed"] for result in results), results
+            assert_equal(results[0]["vsize"], parent.get_vsize())
+        assert_equal(self.nodes[0].submitpackage(raw)["package_msg"], "success")
+        assert_equal(self.nodes[0].getmempoolentry(parent.hash)["vsize"], parent.get_vsize())
+        assert_equal(self.nodes[0].getmempoolentry(parent.hash)["fees"]["modified"], Decimal(parent_fee - 347) / COIN)
+        self.generate(self.wallet, 1, sync_fun=self.sync_blocks)
+
+    def run_test(self):
+        self.keys = []
+        for i in range(16):
+            key = ECKey()
+            key.set((100 + i).to_bytes(32, "big"), True)
+            self.keys.append(key)
+        self.wallet = MiniWallet(self.nodes[0])
+        self.generate(self.wallet, 110)
+
+        self.log.info("BPUB-shaped payloads remain spendable at the adjusted fee")
+        bpub = self.fund("witness", 15, payload=True)
+        _, results = self.check_cost(bpub, 14 * 33 * 3)
+        low = self.spend(bpub, fee=results[1]["vsize"] + 5)
+        assert_equal(self.nodes[1].testmempoolaccept([low.serialize().hex()])[0]["allowed"], True)
+        rejected = self.nodes[0].testmempoolaccept([low.serialize().hex()])[0]
+        assert_equal(rejected["reject-reason"], "min relay fee not met")
+        self.log.info(f"BPUB example: vsize remains {results[0]['vsize']}; modified fee is reduced by 347 sat")
+
+        self.log.info("Matching wallet scripts have the same cost; other thresholds and wrappers retain their behavior")
+        for kind, n, threshold, timelock in [
+            ("witness", 1, 1, False), ("witness", 4, 1, False),
+            ("witness", 3, 2, False), ("witness", 15, 2, False),
+            ("nested", 15, 1, False), ("legacy", 4, 1, False),
+            ("taproot", 15, 1, False), ("taproot", 3, 2, False),
+            ("witness", 4, 1, True),
+        ]:
+            case = self.fund(kind, n, threshold, timelock=timelock)
+            extra = (n - 1) * (32 if kind == "taproot" else 33) * 3 if threshold == 1 and kind != "legacy" and not timelock else 0
+            self.check_cost(case, extra)
+
+        self.log.info("A transaction below the new relay fee remains valid in a block")
+        self.nodes[1].sendrawtransaction(low.serialize().hex())
+        self.generatetoaddress(self.nodes[1], 1, self.wallet.get_address(), sync_fun=self.sync_blocks)
+        assert_equal(self.nodes[0].gettxout(bpub["outpoint"].hash.to_bytes(32, "big").hex(), bpub["outpoint"].n), None)
+
+        self.log.info("Package admission uses the same policy cost")
+        self.check_package()
+
+        self.log.info("The fee penalty does not reduce the TRUC child size allowance")
+        script = CScript([1] + [key.get_pubkey().get_bytes() for key in self.keys[:15]] + [15, OP_CHECKMULTISIG])
+        parent = self.wallet.create_self_transfer()["tx"]
+        parent.version = 3
+        parent.vout[0].scriptPubKey = script_to_p2wsh_script(script)
+        parent.rehash()
+        case = dict(kind="witness", n=15, threshold=1, script=script,
+                    utxo=parent.vout[0], outpoint=COutPoint(int(parent.hash, 16), 0),
+                    version=3, sequence=0, padding_outputs=20)
+        child = self.spend(case)
+        # Charging this as extra vsize would exceed TRUC's 1000-vbyte child
+        # limit even though the original transaction fits.
+        assert child.get_vsize() < 1000 < child.get_vsize() + 347
+        raw = [tx.serialize().hex() for tx in (parent, child)]
+        results = self.nodes[0].testmempoolaccept(raw)
+        assert all(result["allowed"] for result in results), results
+        assert_equal(results[1]["vsize"], child.get_vsize())
+        assert_equal(self.nodes[0].submitpackage(raw)["package_msg"], "success")
+        self.generate(self.wallet, 1)
+
+        self.log.info("Descriptor wallets fund and spend under the default cost")
+        for wrapper in ("witness", "nested", "taproot"):
+            self.check_wallet(wrapper)
+
+        self.log.info("The child can pay the penalty for a zero-fee ephemeral parent")
+        # Isolate this penalty from the existing automatic dust-fee penalty.
+        self.restart_node(0, self.extra_args[0] + ["-subdustfeepenalty=0"])
+        self.connect_nodes(0, 1)
+        self.check_package(zero_fee_parent=True)
+
+
+if __name__ == '__main__':
+    OneOfNCostTest(__file__).main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 337d66721045..a2bf9e2213f8 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -103,6 +103,7 @@
     'feature_rdts_ignore_rejects.py',
     'feature_block.py',
     'mempool_ephemeral_dust.py',
+    'mempool_oneofn_cost.py',
     'wallet_conflicts.py --legacy-wallet',
     'wallet_conflicts.py --descriptors',
     'p2p_opportunistic_1p1c.py',