Liana x Payjoin Tracking Issue

[spacebear21]

Starting a dedicated tracking issue to keep track of action items and blockers for Payjoin support in Liana

• have Liana update to 1.85.0 MSRV
• Receiver PR [WIP] Payjoin receiver wizardsardine/liana#2011
• Upgrade lianad draft PR to 1.0-rc WIP - Payjoin POC - DO NOT MERGE wizardsardine/liana#1806
• Split changes into smaller PRs that can be merged individually as spelled out in Payjoin integration wizardsardine/liana#1822
• Unresolved UI issues:
• Expecting difficulties w.r.t. hardware signers for PSBTs containing foreign inputs, see https://docs.google.com/presentation/d/1BZooMjRR5SseIxelsxrXPtK5JU995bprfU41XHlGL30/edit?slide=id.p#slide=id.p

[benalleng]

Here are some brief notes from our call on Thursday with the Liana devs.

• To avoid address reuse risk while still keeping wtihin standard payjoin UX a payjoin should be displayed in the recently tagged as a payjoin but not showing the bip21 to be copied again after initial generation

• At the time of expiry should an address be treated as used or simply updated with an expired tag and then can be used as a normal receive or fallback address

• liana-cli also needs some consideration as there are no visual queues to rely on in the UI to guide the user in those cases

• We should probably start with integrating the receiver first

• Address QR code includes index, some wallets are known to poorly handle unknown parameters (e.g. BlueWallet)

• As some hardware wallets refuse to accept PSBTs that have foreign inputs we need to consider how to address preventing or explaining why signing is not possible in those cases

  • Bitbox outright refuses to sign; Ledger, Specter, Coldcard display a warning.
  • At signing time (but not before), Liana knows which signer is linked so it can display a "Payjoin not supported" message or similar, and wait for input from another device (e.g. in the case of multi-sig) or perhaps prompt to broadcast the fallback in situations where signing would be impossible.

• Avoid any hard-coded relay directories so any changes do not require a new binary

Issue to be opened

• How can we track a possible double spend if the counterparty spends an input after the final PSBT has been broadcast to the mempool? They believe it is ultimately a problem with how electrum works as it cannot track external inputs easily. TBD on linking that issue here

[DanGould]

Address QR code includes index

What is meant by this?

As some hardware wallets refuse to accept PSBTs that have foreign inputs we need to consider how to address preventing or explaining why signing is not possible in those cases

• Bitbox outright refuses to sign; Ledger, Specter, Coldcard display a warning.

What have they said in response to our notification that this behavior presents us a problem?

[benalleng]

What is meant by this?

This was a specific liana implementation detail that was added for support of another hardware wallet (can't remember exactly which one). They already have taken steps to remove this from their codebase.

What have they said in response to our notification that this behavior presents us a problem?

They seemed to put forward the idea to simply disable the payjoin option for the signers that are incapable of payjoin as the bitbox specifically connects only via usb so liana is able to tell when the bitbox is the signing wallet in question. Since most other wallets only give warnings the are still able to sign.

[DanGould]

By they I meant the hardware vendors. Have they been contacted yet? If not please do

[benalleng]

BitBoxSwiss/bitbox02-firmware#1761 I opened it as a question first as I want to confirm with the team that it is the case the bitbox cannot sign with external inputs