Ownership of a name is proven by holding a token of its category: an update
is accepted when some output carries it. Nothing required that the
certificate be the only such token. Whoever registered a name could mint a
second one in the same transaction, a minting token for instance, sell the
certificate on the market, and later publish an update the resolvers would
accept. The buyer would hold the certificate and lose the name.
A registration now counts only if its category is created by that very
transaction, exactly one output carries it, and that output is an NFT with
no capability and no fungible amount. Nothing meeting this can ever have a
sibling. The same holds for TLD certificates, whose category proves the
right to set a TLD's policy and to co-sign registrations under it.
One definition, in resolver-web.js; bns.js and the TLD snapshot builder call
it. Every valid registration on chipnet already satisfied the rule: the live
registry is the same 71 names and 21 TLDs before and after.
Found while writing the delivery escrow, which had to forbid exactly this.
A resolver that learns about blocklists only after the first scam needs a
release before it can warn anyone. The consumer ships now, pointed at a list
with no entries, so the first real report costs a transaction instead.
A list is an address, named by a BNS name whose bl record holds it. Entries
are RPT (the report), BLK and UBK. A flag counts only when it names a valid
report in the same list for the same name and reason, and only when its
transaction is spent FROM the list address: anyone can pay an address, so
being in its history proves nothing. That spend rule is what lets the
authority change hands later without the resolver learning the difference.
resolveName attaches blocked, blockReason, blockReportTxid and blockedBy to a
flagged name and leaves every other answer untouched. With no subscription it
is the old resolver exactly. A list that cannot be read never stops a name
from resolving. Lists are read from full electrum servers: the project's
beacon-only indexers answer 'no history' for any other address, which would
look like an empty list.
The default list is sirius-blocklist.x, a two-part name because a three-part
one collapses to its parent. Address conversion is dependency-free so this
file stays a single-file drop-in.
A burned certificate used to leave a name in the index forever: listed,
resolvable with its last records, and impossible to update or re-register.
REL is the declared burn. A transaction that spends the certificate from a
beacon transaction, recreates no output of its category and carries the REL
payload removes the name from the index.
The proof is read from an input because a burn leaves no output to read it
from. Resolvers hold only the beacon history, so the spent output must belong
to a beacon transaction; a certificate moved by a plain transfer is anchored
with an UPD first. That keeps the rule a pure function of the snapshot every
client already has.
A released name can be registered again only in a later block than the
confirmed release. Same-block re-registration would be decided by txid order
between a release and a snipe sitting in the mempool together.
This is the first step of ROADMAP-MAINNET.md §9: it puts burn detection in
the resolvers on its own, before any covenant depends on it. Specified in
PROTOCOL-ADDENDUM-release.md; shared resolver and its Ariadne copy here.
