Bulletproofs Rules


These rules apply to all ringCT types that use bulletproofs.


L & R Length

The Length of the L & R fields must be the same, they must both be equal to \( 6 + log_2(firstPower2AboveNumbOuts) \).1

Where firstPower2AboveNumbOuts is the first power of 2 above or equal to the amount of outputs in the transaction, so:

If outputs = 3, firstPower2AboveNumbOuts = 4.

If outputs = 8, firstPower2AboveNumbOuts = 8.

Number Of Bulletproofs

There must only be one bulletproof in a transaction.2

Max Outputs

The amount of outputs in the transaction must not be more 16 3

At Least One Output

There must be at least one element of V, which is constructed from the outPKs which must have the same number of elements as the outputs.4

Canonical Encoding

taux, mu, a, b, t must all be fully reduced scalars5.

All the elements of V, L, R and A, T1, T2 and S must all be valid, canonically encoded points.6

The Bulletproof Must Be Valid

The bulletproof must pass verification. 7