Wraith: replace bonds with UTXO ownership proof and outpoint banning (must precede the ghost-pay deletion)

[defenwycke]

Audited at f3736bc33.

The coupling

Round bonds are escrowed in the Ghost Pay L2:

/// Per-participant bond escrowed in ghost-pay L2 at registration. — tier.rs

This is not theoretical. cargo test -p wraith-coordinator fails on bond_e2e_real_ghostpay_full_lifecycle with "ghost-pay binary not found". Wraith's anti-DoS mechanism cannot be tested, let alone run, without the binary we are deleting.

Ordering is therefore fixed: bond replacement must land before ghost-pay is removed, not after.

Why bonds can go

The bond exists solely to punish register-then-refuse-to-sign, which kills a round for everyone. The standard alternative needs no escrow:

• Prove control of the input UTXO at registration.
• Ban a disrupting outpoint for a cooldown period.

Honest participants pay nothing. An attacker must make an on-chain transaction to obtain a fresh UTXO per attack — real cost, paid to miners, scaling with how hard they push. This also satisfies the standing decision that participation must not require a bond.

Blocker: there is no ownership proof today

bins/wraith-coordinator/src/api/session_inputs.rs validates the bond, enrolment and input arithmetic, but does not verify that the submitter controls the UTXO. Without that, banning is unsafe — anyone could register someone else's coin to get it banned, or disrupt rounds for free.

Fix, in order

1. Add ownership proof at registration (sign the session id with the input's key).
2. Add the ban list and cooldown.
3. Delete the bond subsystem — bond.rs (657), bond_ledger_http.rs (521), bond_resolution.rs (231), bond_e2e.rs (1,144) — about 2,553 lines.
4. Only then remove ghost-pay.

[defenwycke]

Scope grows: the ownership proof needs a chain lookup first

The fix list above starts at "add ownership proof at registration (sign the session id with the input's key)". That is not sufficient on its own, because the coordinator never checks the input UTXO against the chain.

TxInputRef (bins/wraith-coordinator/src/inputs.rs:46) carries txid, vout, value_sats and scriptpubkey_hex — every field wallet-asserted. The comment at line 51 says:

Coordinator will validate this against the on-chain UTXO at /sign time; for B/4a we just store what the wallet supplied.

It never does. There is no gettxout or getrawtransaction anywhere in bins/wraith-coordinator/src. The only chain contact is GhostdBroadcaster, which broadcasts and nothing else.

So a signature over a wallet-supplied scriptPubKey proves nothing about the real outpoint. An attacker registers someone else's outpoint with a scriptPubKey they control, signs for it happily, refuses to sign the round, and the ban lands on the victim's coin — the exact unsafety this issue flags, reintroduced one layer down.

Two other things fall out of the same hole: value_sats is unverified, so the round arithmetic is unverified; and nothing confirms the input is still unspent at registration.

What lands first

A UtxoSource trait in the shape of the existing Broadcaster / BondLedger (mock for tests, real impl over the bitcoind RPC connection the coordinator already configures via --ghostd-url), backed by gettxout. One call gives existence, value, scriptPubKey and unspent-ness — everything registration needs, and no -txindex required since it reads the UTXO set.

Registration then takes value and scriptPubKey from the chain rather than from the wallet, and the ownership proof is verified against the chain-derived scriptPubKey.

Revised order:

0. UtxoSource + gettxout at registration.
1. Ownership proof, verified against the chain-derived scriptPubKey.
2. Ban list and cooldown.
3. Delete the bond subsystem (~2,553 lines).
4. Only then remove ghost-pay.

Considered and rejected: connector outputs

Connector Vaults (Luke Childs, 2026) make a presigned chain inert without a fresh controller signature on a small companion UTXO, and give stateless revocation by spending it. Attractive for anti-DoS, but a connector is a second input the participant controls in the same transaction — in a CoinJoin that links them to their own mixed output, which is what the blind signature exists to prevent. It also does not prove control of the mixed input, which is the actual gap. Where it does apply here is the master spec's §8 delayed-fast-exit template, which is specified as presigned execution/revocation pairs; that is a separate design note.

[defenwycke]

Correction: ghost-pay's bond endpoints exist and always did

This issue says:

ghost-pay has NO /api/v1/wraith/bond/verify (or deposit/escrow) endpoint — coordinator's GhostPayBondLedger … calls a route that doesn't exist; runs on MockBondLedger only.

That is wrong, and it changes what removing ghost-pay involves. bins/ghost-pay/src/main.rs routes all four:

/api/v1/wraith/bond/escrow    → wraith_bond_escrow
/api/v1/wraith/bond/verify    → wraith_bond_verify
/api/v1/wraith/bond/resolve   → wraith_bond_resolve
/api/v1/wraith/bond/:bond_id  → wraith_bond_snapshot

They are fully implemented against real storage — verify_bond_core reads ghost_storage::queries::find_bond_for_session and returns NotBonded / AmountMismatch / AlreadyResolved / Verified in the same order as MockBondLedger; resolve_bond_core writes refunded / slashed status and is idempotent. Roughly 266 lines, plus a bonds table.

bond_e2e_real_ghostpay_full_lifecycle failed with "ghost-pay binary not found" — the binary was not built, not the endpoints missing. The coupling was real, which if anything strengthens the ordering this issue argues for.

What has landed

Steps 0–3 are done on feat/wraith-phase0:

bc7a024b4	Step 0 — UtxoSource + gettxout; registration verifies existence, value, scriptPubKey and unspent-ness instead of believing the request
62f0487f7	Step 1 — BIP-322 ownership proof over ownership_challenge(session_id, txid, vout), checked against the chain's scriptPubKey
97532bbe5	Step 2 — outpoint cooldown (1 hour, in-memory) applied by the no-sign sweep
bb438d61b	Step 3 — bond subsystem deleted, net −3,520 lines

cargo test -p wraith-coordinator now runs to completion: bond_e2e was the failing binary that had been hiding router.rs and gossip.rs.

Also landed alongside: #701 (two participants could register the same outpoint), which had to be settled before banning — otherwise an attacker registers a coin they do not own and gets someone else's banned.

What is left before ghost-pay can go

The Wraith side no longer touches it. What remains is ghost-pay's own surface, which is deployed and so changes on its own footing:

• delete the four /api/v1/wraith/bond/* routes and their handlers (~266 lines);
• drop ghost-storage's bond queries and the bonds table;
• drop GHOST_PAY_BOND_LEDGER_TOKEN and the BOND_LEDGER_TOKEN the installer generates for it.