diff --git a/doc/release-notes-7437.md b/doc/release-notes-7437.md index bb2c175e9dea..caea5381b477 100644 --- a/doc/release-notes-7437.md +++ b/doc/release-notes-7437.md @@ -9,10 +9,12 @@ together with DIP-0026 multi-party payouts as part of the v24 hard fork - A version 3 (extended addresses) ProRegTx may carry a collateral share table: 2 to 8 participants fund the masternode collateral atomically in one registration, each recording an immutable amount, refund script and share owner key, plus an updatable - reward script. Every participant consents by signing a digest that binds the + reward script. Every share owner consents by signing a digest that binds the exact funding inputs, all outputs, the share table, the penalty terms and the - registrar configuration. The early-period penalty must be below the smallest - share and must be zero when no early period is configured. + registrar configuration. Consent is tied to the shares in the table, not to + the funding inputs: signing an input into a registration neither requires nor + creates a share for its owner. The early-period penalty must be below the + smallest share and must be zero when no early period is configured. - The shared collateral is paid to the 7-byte template script `04445348437551` (`0x04 "DSHC" OP_DROP OP_TRUE`). From activation, an output paying this exact script is valid only as the collateral of a valid shared @@ -49,7 +51,10 @@ together with DIP-0026 multi-party payouts as part of the v24 hard fork - `protx shared_register_prepare` builds an unsigned shared registration from a caller-supplied funding transaction. The result echoes the decoded terms and carries a `warning` when `earlyPenalty` is zero, since any participant can - then force an early exit at no cost beyond the transaction fee. + then force an early exit at no cost beyond the transaction fee. Before signing + its funding inputs with `signrawtransactionwithwallet`, each participant should + confirm that the share table (`proRegTx.shares` in `decoderawtransaction`) + holds its share with its own amount and addresses. - `protx shared_sign` signs a shared registration, dissolution or shared registrar update with every share owner key the wallet holds. It returns the decoded terms being consented to (for a dissolution, including the outputs) diff --git a/src/rpc/evo.cpp b/src/rpc/evo.cpp index b5cf967b15a5..ffb820e119ce 100644 --- a/src/rpc/evo.cpp +++ b/src/rpc/evo.cpp @@ -2159,6 +2159,11 @@ static RPCHelpMan protx_shared_register_prepare() "and any change outputs; the consent digest binds all of them. Every share owner must sign the\n" "returned consent hash via \"protx shared_sign\"; combine with \"protx shared_combine\", then have the\n" "funding inputs signed (signrawtransactionwithwallet) and broadcast with sendrawtransaction.\n" + "\nIMPORTANT: consent is required from each share in the table, not from each funding input; an input\n" + "is not tied to any share. Before signing its funding inputs, each participant should check the\n" + "share table (\"proRegTx\" in decoderawtransaction, or \"terms\" from shared_sign) for its own share,\n" + "with its own amount and addresses. Signing inputs into a table without that share gives the\n" + "contribution to the other shares.\n" "\nIMPORTANT: once the registration confirms, every participant should create a zero-penalty\n" "standby dissolution (\"protx shared_dissolve false false\") and store\n" "the returned hex with their refund-key backup, separately from the share owner key. It becomes\n"