From 055ccd79b82774ce1b35aef2002553e39461a308 Mon Sep 17 00:00:00 2001 From: pasta Date: Tue, 29 Sep 2026 21:11:48 -0500 Subject: [PATCH] docs: clarify that shared registration consent is per share, not per funding input Consensus requires a consent signature from every share in a shared ProRegTx's table, but funding inputs are not tied to any share. A wallet can therefore sign its inputs into a registration whose table has no share for it, and the transaction is valid. The release notes said "every participant consents", which suggested otherwise, and the shared_register_prepare help went straight from shared_combine to signrawtransactionwithwallet without a step to check the table. Say "share owner" where consent is meant, state that inputs are not tied to shares, and tell each participant to find its own share in the decoded table before signing its funding inputs. Co-Authored-By: Claude Opus 5.5 (1M context) --- doc/release-notes-7437.md | 13 +++++++++---- src/rpc/evo.cpp | 5 +++++ 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/doc/release-notes-7437.md b/doc/release-notes-7437.md index bb2c175e9dea..caea5381b477 100644 --- a/doc/release-notes-7437.md +++ b/doc/release-notes-7437.md @@ -9,10 +9,12 @@ together with DIP-0026 multi-party payouts as part of the v24 hard fork - A version 3 (extended addresses) ProRegTx may carry a collateral share table: 2 to 8 participants fund the masternode collateral atomically in one registration, each recording an immutable amount, refund script and share owner key, plus an updatable - reward script. Every participant consents by signing a digest that binds the + reward script. Every share owner consents by signing a digest that binds the exact funding inputs, all outputs, the share table, the penalty terms and the - registrar configuration. The early-period penalty must be below the smallest - share and must be zero when no early period is configured. + registrar configuration. Consent is tied to the shares in the table, not to + the funding inputs: signing an input into a registration neither requires nor + creates a share for its owner. The early-period penalty must be below the + smallest share and must be zero when no early period is configured. - The shared collateral is paid to the 7-byte template script `04445348437551` (`0x04 "DSHC" OP_DROP OP_TRUE`). From activation, an output paying this exact script is valid only as the collateral of a valid shared @@ -49,7 +51,10 @@ together with DIP-0026 multi-party payouts as part of the v24 hard fork - `protx shared_register_prepare` builds an unsigned shared registration from a caller-supplied funding transaction. The result echoes the decoded terms and carries a `warning` when `earlyPenalty` is zero, since any participant can - then force an early exit at no cost beyond the transaction fee. + then force an early exit at no cost beyond the transaction fee. Before signing + its funding inputs with `signrawtransactionwithwallet`, each participant should + confirm that the share table (`proRegTx.shares` in `decoderawtransaction`) + holds its share with its own amount and addresses. - `protx shared_sign` signs a shared registration, dissolution or shared registrar update with every share owner key the wallet holds. It returns the decoded terms being consented to (for a dissolution, including the outputs) diff --git a/src/rpc/evo.cpp b/src/rpc/evo.cpp index b5cf967b15a5..ffb820e119ce 100644 --- a/src/rpc/evo.cpp +++ b/src/rpc/evo.cpp @@ -2159,6 +2159,11 @@ static RPCHelpMan protx_shared_register_prepare() "and any change outputs; the consent digest binds all of them. Every share owner must sign the\n" "returned consent hash via \"protx shared_sign\"; combine with \"protx shared_combine\", then have the\n" "funding inputs signed (signrawtransactionwithwallet) and broadcast with sendrawtransaction.\n" + "\nIMPORTANT: consent is required from each share in the table, not from each funding input; an input\n" + "is not tied to any share. Before signing its funding inputs, each participant should check the\n" + "share table (\"proRegTx\" in decoderawtransaction, or \"terms\" from shared_sign) for its own share,\n" + "with its own amount and addresses. Signing inputs into a table without that share gives the\n" + "contribution to the other shares.\n" "\nIMPORTANT: once the registration confirms, every participant should create a zero-penalty\n" "standby dissolution (\"protx shared_dissolve false false\") and store\n" "the returned hex with their refund-key backup, separately from the share owner key. It becomes\n"