Standardizing an exposure classification for existing outputs (pre-BIP)

The recent proposals in BIP 360 and BIP 361 have highlighted a significant gap in the Bitcoin Improvement Proposals regarding the clarification of which existing outputs are considered exposed. To address this, a new draft has been proposed that aims to standardize the definitions of output exposure levels across different scenarios. This is particularly crucial as discrepancies in these definitions can lead to variations in reported estimates of exposed supply, which currently range from approximately 25% to over 34%. The variability in these numbers is largely attributed to differences in how tools classify outputs under various conditions such as whether Pay-to-Taproot (P2TR) counts as exposed at rest or how outputs from spent addresses are treated.

The draft introduces a structured approach to classifying output exposure with four distinct categories: EXPOSED_AT_REST, EXPOSED_ON_SPEND, NOT_EXPOSED, and UNDETERMINED. This classification includes an assignment table for each output type and implements a fail-closed rule, which errs on the side of higher exposure in cases where data does not clearly distinguish between two levels. This conservative approach ensures that outputs are not mistakenly classified in a less exposed category than they should be.

Among the more controversial aspects of this proposal are the criteria for what constitutes EXPOSED_AT_REST. For instance, a reused, spent-from P2PKH address that still holds a balance would be classified at the same level of exposure as P2PK, based on their identical risk profiles to an adversary. Additionally, the draft asserts that P2TR outputs are considered at rest regardless of the internal key's nature, drawing on discussions from the BIP-360 changes thread that influenced this clear-cut stance (discussion on BIP-360 changes).

The author has made available a Python reference implementation along with test vectors, all accessible via GitHub repository, to facilitate further examination and testing of the draft. While this initiative could potentially evolve into a formal BIP, the proposer is seeking feedback on whether the framework for exposure classification is robust enough in practical applications and whether it should remain an implementation detail rather than becoming a standardized part of the BIP suite. This feedback will be crucial in determining the next steps for this proposal.