You’re overestimating the blockspace savings from CISA. A P2TR keypath input weighs 57.5 vB. 41 vB of that is from data that every input still needs: outpoint (36 vB), nSequence (4 vB), scriptSig length indicator (1 vB). The witness stack only contributes 66 WU.
So, assuming the CISA-compatible output had the same structure (which is reasonable) and we could just drop the whole witness stack for all but one input, the average vsize per input would asymptotically converge from 57.5 vB (one input tx) towards 41 vB as inputs grow in count on the transaction. The maximum savings would therefore be up to 28.7% of the input weight of the transaction, outputs and header remain unaffected. It’s not clear to me how that would get anyone 70–90% fee reductions.
Hard-forking in a manner as described would invalidate any pre-signed transactions created for future broadcast. For example that would destroy funds held in time-locked vaults based on pre-signed transactions for which the keys have been destroyed.
To clarify in case a reader is confused, 28.7% of the input weight is a much lesser percentage of the total weight of the transaction, depending on the ratio of inputs to outputs (in size/weight).
Savings is basically 16.5 vB for every input except 1. Let's take a big coinjoin like 100 in, 100 out. You save 16.5 x 99 so 1633.5, but the original full size was 10.5 + 43 x 100 + 57.5 x 100 = 10060.5, so your percentage savings is 16.2%.
(That's already very close to the asymyptotic best, so I don't think you can get above like 16.5% however big the tx is, and for smaller transactions the savings can be a lot lower).
reply
28.7% would be the theoretical limit for a massive consolidation tx. But consolidation is harmful to privacy, at least in the usual case of a single owner, as it signals common ownership of all the inputs.
reply
28.7% would be the theoretical limit for a massive consolidation tx.
28.7% of the inputs. You cannot get 28.7% savings for the whole transaction. That's what I was trying to clarify.
reply
By massive consolidation tx I mean a tx where the total weight of the tx is dominated by the weight of the inputs. E.g. hundreds of inputs and a single output. For such a transaction you can approach the 28.7% savings limit.
reply
oh! like a 1 output tx. yes good point, sorry. (i was focusing on coinjoin as the likely reason for a huge transaction).
reply
Further to that of course: coinjoin aside, just considering "batching" - that is by far the main concept in people's head when they think about CISA.
You're still very right to raise it though, for a very unusual class of consolidation tx, it is indeed possible to get that much higher (but still small!) saving.
reply
It could benefit large coinjoins like WabiSabi, with hundredths of inputs.
reply
In WabiSabi you have hundreds of outputs as well, 43 vB each in the case of Taproot. So the maximum savings there would be around 16%.
reply
Apologies for the confusion, what I meant is that upgrading from Legacy P2PKH would yield such a fee reduction, thus exchanges and other users would be highly incentivized to finally upgrade to both Segwit and Taproot.
It seems I also overestimated the upper bound of reductions. Going from P2PKH->Taproot + CISA would yield a 72% reduction in fees
reply
Ah, I see what you mean.
reply