Bulletproofs+ Rules


These rules apply to all ringCT types that use bulletproofs+.


L & R Length

The Length of the L & R fields must be the same, they must both be equal to \( 6 + log_2(firstPower2AboveNumbOuts) \).1

Where firstPower2AboveNumbOuts is the first power of 2 above or equal to the amount of outputs in the transaction, so:

If outputs = 3, firstPower2AboveNumbOuts = 4.

If outputs = 8, firstPower2AboveNumbOuts = 8.

Number Of Bulletproofs

There must only be one bulletproof in a transaction.2

Max Outputs

The amount of outputs in the transaction must not be more than 16 3

Canonical Encoding

r1, s2, d1 must all be canonically encoded, reduced, scalars.4 All the points of V, L and R must be canonically encoded and A1, B and A must canonically encoded points.5

At Least One Output

There must be at least one element of V, which is constructed from the outPKs which must have the same number of elements as the outputs.6

The Bulletproof Must Be Valid

The bulletproof must pass verification. 7