Standardizing an exposure classification for existing outputs (pre-BIP)

The discussion revolves around the complexities and nuances of Bitcoin improvement proposals (BIPs) concerning wallet security and key exposure. A significant focus is placed on different levels of exposure that various public-key scripts or addresses might have depending on how they are used or interpreted by tools and software in the cryptocurrency ecosystem. For instance, a reused Pay-to-Public-Key-Hash (P2PKH) address that has been previously spent from but still holds coins is generally flagged by some tools as "exposed on spend." This classification arises because, to an external observer or attacker, such an address behaves like a Pay-to-Public-Key (P2PK) since the public key is revealed once it has been used for a transaction.

Additionally, Pay-to-Taproot (P2TR) addresses present another complexity. While these addresses might be seen as secure because a key-path spend does not reveal the internal key, they are considered exposed at rest by certain draft guidelines. This is because the output key necessary to transact is already visible on the blockchain, making it potentially accessible to attackers without further actions from the owner.

There's also a debate regarding Pay-to-Script-Hash (P2SH) and Pay-to-Witness-Script-Hash (P2WSH) where if the script itself has never been revealed publicly, or if keys are transmitted off-chain via an extended public key (xpub), tools and services may vary in their treatment of such cases—either including them as exposed or not. This inconsistency leads to a broad range of reported figures for what percentage of the supply is exposed, ranging significantly from about 25% to over 34%.

These technical disparities underscore the need for a unified source of truth or standard that can guide tool developers and ensure consistency across warnings and classifications of wallet outputs. The conversation suggests that while implementing these standards isn't necessarily challenging, the lack of agreement among tools on what to base their classifications on prevents progress. The dialogue hints at a broader industry requirement for collaborative efforts to establish shared protocols or definitions that could then be referenced in ongoing BIP discussions, particularly those like BIP 360 and BIP 361 which deal with related issues.