Bulletproofs Rules

Introduction

These rules apply to all ringCT types that use bulletproofs.

Rules

L & R Length

The Length of the L & R fields must be the same, they must both be equal to \( 6 + log_2(firstPower2AboveNumbOuts) \).¹

Where firstPower2AboveNumbOuts is the first power of 2 above or equal to the amount of outputs in the transaction, so:

If outputs = 3, firstPower2AboveNumbOuts = 4.

If outputs = 8, firstPower2AboveNumbOuts = 8.

Number Of Bulletproofs

There must only be one bulletproof in a transaction.²

Max Outputs

The amount of outputs in the transaction must not be more 16 ³

At Least One Output

There must be at least one element of V, which is constructed from the outPKs which must have the same number of elements as the outputs.⁴

Canonical Encoding

taux, mu, a, b, t must all be fully reduced scalars⁵.

All the elements of V, L, R and A, T1, T2 and S must all be valid, canonically encoded points.⁶

The Bulletproof Must Be Valid

The bulletproof must pass verification. ⁷