From 57447ea4c978746b91ebfa6a2573c39c2fd72716 Mon Sep 17 00:00:00 2001
From: Satoshi Otomakan <satoshiotomakan8@gmail.com>
Date: Mon, 16 Dec 2024 18:23:03 +0100
Subject: [PATCH] [BTC]: Add Babylon Unbonding UTXO

---
 rust/Cargo.lock                               |  1 +
 rust/chains/tw_bitcoin/Cargo.toml             |  1 +
 .../tw_bitcoin/src/babylon/conditions.rs      | 47 ++++++------
 .../src/babylon/covenant_committee.rs         | 33 +++++++++
 rust/chains/tw_bitcoin/src/babylon/mod.rs     |  4 +-
 .../tw_bitcoin/src/babylon/spending_data.rs   | 55 ++++++++++++++
 .../{claims/mod.rs => spending_info.rs}       | 43 +++++------
 .../tw_bitcoin/src/babylon/tx_builder/mod.rs  | 10 +++
 .../src/babylon/tx_builder/output.rs          | 45 ++++-------
 .../tw_bitcoin/src/babylon/tx_builder/utxo.rs | 68 ++++++++++++-----
 .../tw_bitcoin/src/modules/tx_builder/mod.rs  |  6 +-
 .../src/modules/tx_builder/output_protobuf.rs | 20 ++---
 .../src/modules/tx_builder/utxo_protobuf.rs   | 74 ++++++++++++++++---
 .../src/script/standard_script/claims.rs      | 11 ++-
 rust/frameworks/tw_utxo/src/signature.rs      |  1 +
 .../src/spending_data/standard_constructor.rs |  2 +-
 .../standard_transaction/builder/utxo.rs      | 29 ++++++--
 rust/tw_keypair/src/schnorr/public.rs         | 11 ++-
 src/proto/BitcoinV2.proto                     | 26 +++++--
 19 files changed, 351 insertions(+), 136 deletions(-)
 create mode 100644 rust/chains/tw_bitcoin/src/babylon/covenant_committee.rs
 create mode 100644 rust/chains/tw_bitcoin/src/babylon/spending_data.rs
 rename rust/chains/tw_bitcoin/src/babylon/{claims/mod.rs => spending_info.rs} (76%)

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 4afa179ffc6..3b6ce25bf99 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -1788,6 +1788,7 @@ name = "tw_bitcoin"
 version = "0.1.0"
 dependencies = [
  "bitcoin",
+ "itertools",
  "lazy_static",
  "secp256k1",
  "serde",
diff --git a/rust/chains/tw_bitcoin/Cargo.toml b/rust/chains/tw_bitcoin/Cargo.toml
index 8cb164c5a89..ce4101b5407 100644
--- a/rust/chains/tw_bitcoin/Cargo.toml
+++ b/rust/chains/tw_bitcoin/Cargo.toml
@@ -5,6 +5,7 @@ edition = "2021"
 
 [dependencies]
 bitcoin = { version = "0.30.0", features = ["rand-std", "serde"] }
+itertools = "0.10.5"
 lazy_static = "1.4.0"
 secp256k1 = { version = "0.27.0", features = ["global-context", "rand-std"] }
 serde = { version = "1.0", features = ["derive"] }
diff --git a/rust/chains/tw_bitcoin/src/babylon/conditions.rs b/rust/chains/tw_bitcoin/src/babylon/conditions.rs
index 0eaaee159b4..b06048ef871 100644
--- a/rust/chains/tw_bitcoin/src/babylon/conditions.rs
+++ b/rust/chains/tw_bitcoin/src/babylon/conditions.rs
@@ -3,7 +3,8 @@
 // Copyright © 2017 Trust Wallet.
 
 use tw_coin_entry::error::prelude::*;
-use tw_hash::{H256, H32};
+use tw_hash::H32;
+use tw_keypair::schnorr;
 use tw_utxo::script::standard_script::opcodes::*;
 use tw_utxo::script::Script;
 
@@ -19,15 +20,15 @@ const FINALITY_PROVIDERS_QUORUM: u32 = 1;
 pub fn new_op_return_script(
     tag: &H32,
     version: u8,
-    staker_xonly: &H256,
-    finality_provider_xonly: &H256,
+    staker_key: &schnorr::XOnlyPublicKey,
+    finality_provider_key: &schnorr::XOnlyPublicKey,
     locktime: u16,
 ) -> Script {
     let mut buf = Vec::with_capacity(71);
     buf.extend_from_slice(tag.as_slice());
     buf.push(version);
-    buf.extend_from_slice(staker_xonly.as_slice());
-    buf.extend_from_slice(finality_provider_xonly.as_slice());
+    buf.extend_from_slice(staker_key.as_slice());
+    buf.extend_from_slice(finality_provider_key.as_slice());
     buf.extend_from_slice(&locktime.to_be_bytes());
 
     let mut s = Script::new();
@@ -42,9 +43,9 @@ pub fn new_op_return_script(
 /// ```txt
 /// <StakerPK> OP_CHECKSIGVERIFY  <TimelockBlocks> OP_CHECKSEQUENCEVERIFY
 /// ```
-pub fn new_timelock_script(staker_xonly: &H256, locktime: u16) -> Script {
+pub fn new_timelock_script(staker_key: &schnorr::XOnlyPublicKey, locktime: u16) -> Script {
     let mut s = Script::with_capacity(64);
-    append_single_sig(&mut s, staker_xonly, VERIFY);
+    append_single_sig(&mut s, staker_key, VERIFY);
     s.push_int(locktime as i64);
     s.push(OP_CHECKSEQUENCEVERIFY);
     s
@@ -59,16 +60,16 @@ pub fn new_timelock_script(staker_xonly: &H256, locktime: u16) -> Script {
 /// <CovenantThreshold> OP_NUMEQUAL
 /// ```
 pub fn new_unbonding_script(
-    staker_xonly: &H256,
-    covenants_xonly: Vec<H256>,
+    staker_key: &schnorr::XOnlyPublicKey,
+    covenants_keys: &[schnorr::XOnlyPublicKey],
     covenant_quorum: u32,
 ) -> SigningResult<Script> {
     let mut s = Script::with_capacity(64);
-    append_single_sig(&mut s, staker_xonly, VERIFY);
+    append_single_sig(&mut s, staker_key, VERIFY);
     // Covenant multisig is always last in script so we do not run verify and leave
     // last value on the stack. If we do not leave at least one element on the stack
     // script will always error.
-    append_multi_sig(&mut s, covenants_xonly, covenant_quorum, NO_VERIFY)?;
+    append_multi_sig(&mut s, covenants_keys, covenant_quorum, NO_VERIFY)?;
     Ok(s)
 }
 
@@ -83,29 +84,29 @@ pub fn new_unbonding_script(
 /// <CovenantThreshold> OP_NUMEQUAL
 /// ```
 pub fn new_slashing_script(
-    staker_xonly: &H256,
-    finality_providers_xonly: Vec<H256>,
-    covenants_xonly: Vec<H256>,
+    staker_key: &schnorr::XOnlyPublicKey,
+    finality_providers_keys: &[schnorr::XOnlyPublicKey],
+    covenants_keys: &[schnorr::XOnlyPublicKey],
     covenant_quorum: u32,
 ) -> SigningResult<Script> {
     let mut s = Script::with_capacity(64);
-    append_single_sig(&mut s, staker_xonly, VERIFY);
+    append_single_sig(&mut s, staker_key, VERIFY);
     // We need to run verify to clear the stack, as finality provider multisig is in the middle of the script.
     append_multi_sig(
         &mut s,
-        finality_providers_xonly,
+        finality_providers_keys,
         FINALITY_PROVIDERS_QUORUM,
         VERIFY,
     )?;
     // Covenant multisig is always last in script so we do not run verify and leave
     // last value on the stack. If we do not leave at least one element on the stack
     // script will always error.
-    append_multi_sig(&mut s, covenants_xonly, covenant_quorum, NO_VERIFY)?;
+    append_multi_sig(&mut s, covenants_keys, covenant_quorum, NO_VERIFY)?;
     Ok(s)
 }
 
-fn append_single_sig(dst: &mut Script, xonly: &H256, verify: bool) {
-    dst.push_slice(xonly.as_slice());
+fn append_single_sig(dst: &mut Script, key: &schnorr::XOnlyPublicKey, verify: bool) {
+    dst.push_slice(key.as_slice());
     if verify {
         dst.push(OP_CHECKSIGVERIFY);
     } else {
@@ -117,10 +118,10 @@ fn append_single_sig(dst: &mut Script, xonly: &H256, verify: bool) {
 /// successfully execute script.
 /// It validates whether threshold is not greater than number of keys.
 /// If there is only one key provided it will return single key sig script.
-/// Note: It is up to the caller to ensure that the keys are unique.
+/// Note: It is up to the caller to ensure that the keys are unique and sorted.
 fn append_multi_sig(
     dst: &mut Script,
-    mut covenants_xonly: Vec<H256>,
+    covenants_xonly: &[schnorr::XOnlyPublicKey],
     covenant_quorum: u32,
     verify: bool,
 ) -> SigningResult<()> {
@@ -137,9 +138,7 @@ fn append_multi_sig(
         return Ok(());
     }
 
-    // Sort the keys in lexicographical order bytes.
-    covenants_xonly.sort();
-    for (i, covenant_xonly) in covenants_xonly.into_iter().enumerate() {
+    for (i, covenant_xonly) in covenants_xonly.iter().enumerate() {
         dst.push_slice(covenant_xonly.as_slice());
         if i == 0 {
             dst.push(OP_CHECKSIG);
diff --git a/rust/chains/tw_bitcoin/src/babylon/covenant_committee.rs b/rust/chains/tw_bitcoin/src/babylon/covenant_committee.rs
new file mode 100644
index 00000000000..2a562f090a3
--- /dev/null
+++ b/rust/chains/tw_bitcoin/src/babylon/covenant_committee.rs
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// Copyright © 2017 Trust Wallet.
+
+use itertools::Itertools;
+use std::cmp;
+use tw_keypair::schnorr;
+use tw_utxo::signature::BitcoinSchnorrSignature;
+
+pub struct CovenantCommittee;
+
+impl CovenantCommittee {
+    /// Sort the keys in lexicographical order bytes.
+    pub fn sort_public_keys(pks: &mut [schnorr::XOnlyPublicKey]) {
+        pks.sort_by(Self::cmp_pk);
+    }
+
+    /// Sort the signatures by corresponding public keys in lexicographical order bytes.
+    pub fn sort_signatures<'a, I>(sigs: I) -> Vec<BitcoinSchnorrSignature>
+    where
+        I: IntoIterator<Item = &'a (schnorr::XOnlyPublicKey, BitcoinSchnorrSignature)>,
+    {
+        sigs.into_iter()
+            // Sort the elements by public keys.
+            .sorted_by(|x, y| Self::cmp_pk(&x.0, &y.0))
+            .map(|(_pk, sig)| sig.clone())
+            .collect()
+    }
+
+    fn cmp_pk(pk1: &schnorr::XOnlyPublicKey, pk2: &schnorr::XOnlyPublicKey) -> cmp::Ordering {
+        pk1.as_slice().cmp(pk2.as_slice())
+    }
+}
diff --git a/rust/chains/tw_bitcoin/src/babylon/mod.rs b/rust/chains/tw_bitcoin/src/babylon/mod.rs
index 5774b28239e..7744e692b64 100644
--- a/rust/chains/tw_bitcoin/src/babylon/mod.rs
+++ b/rust/chains/tw_bitcoin/src/babylon/mod.rs
@@ -2,6 +2,8 @@
 //
 // Copyright © 2017 Trust Wallet.
 
-pub mod claims;
 pub mod conditions;
+pub mod covenant_committee;
+pub mod spending_data;
+pub mod spending_info;
 pub mod tx_builder;
diff --git a/rust/chains/tw_bitcoin/src/babylon/spending_data.rs b/rust/chains/tw_bitcoin/src/babylon/spending_data.rs
new file mode 100644
index 00000000000..d2c22c35022
--- /dev/null
+++ b/rust/chains/tw_bitcoin/src/babylon/spending_data.rs
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// Copyright © 2017 Trust Wallet.
+
+use crate::babylon::covenant_committee::CovenantCommittee;
+use tw_keypair::schnorr;
+use tw_memory::Data;
+use tw_utxo::script::standard_script::claims;
+use tw_utxo::script::Script;
+use tw_utxo::signature::BitcoinSchnorrSignature;
+use tw_utxo::spending_data::{SchnorrSpendingDataConstructor, SpendingData};
+
+#[derive(Clone, Debug)]
+pub struct BabylonUnbondingPath {
+    unbonding_script: Script,
+    control_block: Data,
+    /// Signatures signed by covenant committees. Sorted by covenant committees public keys.
+    covenant_committee_signatures: Vec<BitcoinSchnorrSignature>,
+}
+
+impl BabylonUnbondingPath {
+    pub fn new(
+        unbonding_script: Script,
+        control_block: Data,
+        covenant_committee_signatures: &[(schnorr::XOnlyPublicKey, BitcoinSchnorrSignature)],
+    ) -> Self {
+        let covenant_committee_signatures =
+            CovenantCommittee::sort_signatures(covenant_committee_signatures);
+        BabylonUnbondingPath {
+            unbonding_script,
+            control_block,
+            covenant_committee_signatures,
+        }
+    }
+}
+
+impl SchnorrSpendingDataConstructor for BabylonUnbondingPath {
+    fn get_spending_data(&self, sig: &BitcoinSchnorrSignature) -> SpendingData {
+        // User's signature is always first.
+        // Then, covenant committee signatures sorted by their public keys.
+        // For more info, see [`babylon::conditions::new_unbonding_script`].
+        let unbonding_sigs: Vec<_> = std::iter::once(sig.clone())
+            .chain(self.covenant_committee_signatures.iter().cloned())
+            .collect();
+
+        SpendingData {
+            script_sig: Script::default(),
+            witness: claims::new_p2tr_script_path(
+                &unbonding_sigs,
+                self.unbonding_script.clone(),
+                self.control_block.clone(),
+            ),
+        }
+    }
+}
diff --git a/rust/chains/tw_bitcoin/src/babylon/claims/mod.rs b/rust/chains/tw_bitcoin/src/babylon/spending_info.rs
similarity index 76%
rename from rust/chains/tw_bitcoin/src/babylon/claims/mod.rs
rename to rust/chains/tw_bitcoin/src/babylon/spending_info.rs
index c5868aba97b..a8a67d5b055 100644
--- a/rust/chains/tw_bitcoin/src/babylon/claims/mod.rs
+++ b/rust/chains/tw_bitcoin/src/babylon/spending_info.rs
@@ -3,6 +3,7 @@
 // Copyright © 2017 Trust Wallet.
 
 use crate::babylon::conditions;
+use crate::babylon::covenant_committee::CovenantCommittee;
 use bitcoin::hashes::Hash;
 use lazy_static::lazy_static;
 use tw_coin_entry::error::prelude::*;
@@ -29,36 +30,28 @@ pub struct StakingSpendInfo {
 
 impl StakingSpendInfo {
     pub fn new(
-        staker: &schnorr::PublicKey,
+        staker: &schnorr::XOnlyPublicKey,
         staking_locktime: u16,
-        finality_provider: &schnorr::PublicKey,
-        covenants: &[schnorr::PublicKey],
+        finality_provider: schnorr::XOnlyPublicKey,
+        mut covenants: Vec<schnorr::XOnlyPublicKey>,
         covenant_quorum: u32,
     ) -> SigningResult<StakingSpendInfo> {
-        let staker_xonly = staker.x_only().bytes();
-        let covenants_xonly: Vec<_> = covenants.iter().map(|pk| pk.x_only().bytes()).collect();
-        let fp_xonly: Vec<_> = vec![finality_provider.x_only().bytes()];
-
-        let timelock_script = conditions::new_timelock_script(&staker_xonly, staking_locktime);
-        let unbonding_script = conditions::new_unbonding_script(
-            &staker_xonly,
-            covenants_xonly.clone(),
-            covenant_quorum,
-        )
-        .context("Invalid number of covenants")?;
-        let slashing_script = conditions::new_slashing_script(
-            &staker_xonly,
-            fp_xonly,
-            covenants_xonly,
-            covenant_quorum,
-        )
-        .context("Invalid number of finality providers")?;
+        let fp_xonly = [finality_provider];
+
+        CovenantCommittee::sort_public_keys(&mut covenants);
+
+        let timelock_script = conditions::new_timelock_script(&staker, staking_locktime);
+        let unbonding_script =
+            conditions::new_unbonding_script(&staker, &covenants, covenant_quorum)
+                .context("Invalid number of covenants")?;
+        let slashing_script =
+            conditions::new_slashing_script(&staker, &fp_xonly, &covenants, covenant_quorum)
+                .context("Invalid number of finality providers")?;
 
         // IMPORTANT - order and leaf depths are important!
-        let internal_pubkey =
-            bitcoin::key::UntweakedPublicKey::from_slice(&staker_xonly.as_slice())
-                .tw_err(|_| SigningErrorType::Error_invalid_params)
-                .context("Invalid stakerPublicKey")?;
+        let internal_pubkey = bitcoin::key::UntweakedPublicKey::from_slice(staker.as_slice())
+            .tw_err(|_| SigningErrorType::Error_invalid_params)
+            .context("Invalid stakerPublicKey")?;
         let spend_info = bitcoin::taproot::TaprootBuilder::new()
             .add_leaf(2, timelock_script.clone().into())
             .expect("Leaf added at a valid depth")
diff --git a/rust/chains/tw_bitcoin/src/babylon/tx_builder/mod.rs b/rust/chains/tw_bitcoin/src/babylon/tx_builder/mod.rs
index 1dc8b33389e..f8f07bee437 100644
--- a/rust/chains/tw_bitcoin/src/babylon/tx_builder/mod.rs
+++ b/rust/chains/tw_bitcoin/src/babylon/tx_builder/mod.rs
@@ -2,5 +2,15 @@
 //
 // Copyright © 2017 Trust Wallet.
 
+use tw_keypair::schnorr;
+
 pub mod output;
 pub mod utxo;
+
+pub struct BabylonStakingParams {
+    pub staker: schnorr::XOnlyPublicKey,
+    pub staking_locktime: u16,
+    pub finality_provider: schnorr::XOnlyPublicKey,
+    pub covenants: Vec<schnorr::XOnlyPublicKey>,
+    pub covenant_quorum: u32,
+}
diff --git a/rust/chains/tw_bitcoin/src/babylon/tx_builder/output.rs b/rust/chains/tw_bitcoin/src/babylon/tx_builder/output.rs
index 7950b7e0ee2..cc1efe97d59 100644
--- a/rust/chains/tw_bitcoin/src/babylon/tx_builder/output.rs
+++ b/rust/chains/tw_bitcoin/src/babylon/tx_builder/output.rs
@@ -3,6 +3,7 @@
 // Copyright © 2017 Trust Wallet.
 
 use crate::babylon;
+use crate::babylon::tx_builder::BabylonStakingParams;
 use tw_coin_entry::error::prelude::*;
 use tw_hash::H32;
 use tw_keypair::schnorr;
@@ -14,39 +15,25 @@ pub const VERSION: u8 = 0;
 
 /// An extension of the [`OutputBuilder`] with Babylon BTC Staking outputs.
 pub trait BabylonOutputBuilder: Sized {
-    fn babylon_staking(
-        self,
-        staker: &schnorr::PublicKey,
-        staking_locktime: u16,
-        finality_provider: &schnorr::PublicKey,
-        covenants: &[schnorr::PublicKey],
-        covenant_quorum: u32,
-    ) -> SigningResult<TransactionOutput>;
+    fn babylon_staking(self, params: BabylonStakingParams) -> SigningResult<TransactionOutput>;
 
     fn babylon_staking_op_return(
         self,
         tag: &H32,
-        staker: &schnorr::PublicKey,
-        finality_provider: &schnorr::PublicKey,
+        staker_key: &schnorr::XOnlyPublicKey,
+        finality_provider_key: &schnorr::XOnlyPublicKey,
         staking_locktime: u16,
     ) -> TransactionOutput;
 }
 
 impl BabylonOutputBuilder for OutputBuilder {
-    fn babylon_staking(
-        self,
-        staker: &schnorr::PublicKey,
-        staking_locktime: u16,
-        finality_provider: &schnorr::PublicKey,
-        covenants: &[schnorr::PublicKey],
-        covenant_quorum: u32,
-    ) -> SigningResult<TransactionOutput> {
-        let spend_info = babylon::claims::StakingSpendInfo::new(
-            staker,
-            staking_locktime,
-            finality_provider,
-            covenants,
-            covenant_quorum,
+    fn babylon_staking(self, params: BabylonStakingParams) -> SigningResult<TransactionOutput> {
+        let spend_info = babylon::spending_info::StakingSpendInfo::new(
+            &params.staker,
+            params.staking_locktime,
+            params.finality_provider,
+            params.covenants,
+            params.covenant_quorum,
         )?;
         let merkle_root = spend_info.merkle_root()?;
 
@@ -54,7 +41,7 @@ impl BabylonOutputBuilder for OutputBuilder {
             value: self.get_amount(),
             script_pubkey: conditions::new_p2tr_script_path(
                 // Using an unspendable key as a P2TR internal public key effectively disables taproot key spends.
-                &babylon::claims::UNSPENDABLE_KEY_PATH.compressed(),
+                &babylon::spending_info::UNSPENDABLE_KEY_PATH.compressed(),
                 &merkle_root,
             ),
         })
@@ -63,15 +50,15 @@ impl BabylonOutputBuilder for OutputBuilder {
     fn babylon_staking_op_return(
         self,
         tag: &H32,
-        staker: &schnorr::PublicKey,
-        finality_provider: &schnorr::PublicKey,
+        staker_key: &schnorr::XOnlyPublicKey,
+        finality_provider_key: &schnorr::XOnlyPublicKey,
         staking_locktime: u16,
     ) -> TransactionOutput {
         let op_return = babylon::conditions::new_op_return_script(
             tag,
             VERSION,
-            &staker.x_only().bytes(),
-            &finality_provider.x_only().bytes(),
+            staker_key,
+            finality_provider_key,
             staking_locktime,
         );
         TransactionOutput {
diff --git a/rust/chains/tw_bitcoin/src/babylon/tx_builder/utxo.rs b/rust/chains/tw_bitcoin/src/babylon/tx_builder/utxo.rs
index c22ac329b9a..6c15718c60f 100644
--- a/rust/chains/tw_bitcoin/src/babylon/tx_builder/utxo.rs
+++ b/rust/chains/tw_bitcoin/src/babylon/tx_builder/utxo.rs
@@ -3,9 +3,13 @@
 // Copyright © 2017 Trust Wallet.
 
 use crate::babylon;
-use crate::babylon::claims::UNSPENDABLE_KEY_PATH;
+use crate::babylon::spending_data;
+use crate::babylon::spending_info::UNSPENDABLE_KEY_PATH;
+use crate::babylon::tx_builder::BabylonStakingParams;
 use tw_coin_entry::error::prelude::*;
 use tw_keypair::schnorr;
+use tw_utxo::signature::BitcoinSchnorrSignature;
+use tw_utxo::spending_data::SpendingDataConstructor;
 use tw_utxo::transaction::standard_transaction::builder::UtxoBuilder;
 use tw_utxo::transaction::standard_transaction::TransactionInput;
 use tw_utxo::transaction::UtxoToSign;
@@ -14,29 +18,27 @@ use tw_utxo::transaction::UtxoToSign;
 pub trait BabylonUtxoBuilder: Sized {
     fn babylon_timelock_path(
         self,
-        staker: &schnorr::PublicKey,
-        staking_locktime: u16,
-        finality_provider: &schnorr::PublicKey,
-        covenants: &[schnorr::PublicKey],
-        covenant_quorum: u32,
+        params: BabylonStakingParams,
+    ) -> SigningResult<(TransactionInput, UtxoToSign)>;
+
+    fn babylon_unbonding_path(
+        self,
+        params: BabylonStakingParams,
+        covenant_committee_signatures: &[(schnorr::XOnlyPublicKey, BitcoinSchnorrSignature)],
     ) -> SigningResult<(TransactionInput, UtxoToSign)>;
 }
 
 impl BabylonUtxoBuilder for UtxoBuilder {
     fn babylon_timelock_path(
         self,
-        staker: &schnorr::PublicKey,
-        staking_locktime: u16,
-        finality_provider: &schnorr::PublicKey,
-        covenants: &[schnorr::PublicKey],
-        covenant_quorum: u32,
+        params: BabylonStakingParams,
     ) -> SigningResult<(TransactionInput, UtxoToSign)> {
-        let spend_info = babylon::claims::StakingSpendInfo::new(
-            staker,
-            staking_locktime,
-            finality_provider,
-            covenants,
-            covenant_quorum,
+        let spend_info = babylon::spending_info::StakingSpendInfo::new(
+            &params.staker,
+            params.staking_locktime,
+            params.finality_provider,
+            params.covenants,
+            params.covenant_quorum,
         )?;
 
         let control_block = spend_info.timelock_control_block()?.serialize();
@@ -52,4 +54,36 @@ impl BabylonUtxoBuilder for UtxoBuilder {
             &merkle_root,
         )
     }
+
+    fn babylon_unbonding_path(
+        self,
+        params: BabylonStakingParams,
+        covenant_committee_signatures: &[(schnorr::XOnlyPublicKey, BitcoinSchnorrSignature)],
+    ) -> SigningResult<(TransactionInput, UtxoToSign)> {
+        let spend_info = babylon::spending_info::StakingSpendInfo::new(
+            &params.staker,
+            params.staking_locktime,
+            params.finality_provider,
+            params.covenants,
+            params.covenant_quorum,
+        )?;
+
+        let unbonding_control_block = spend_info.unbonding_control_block()?.serialize();
+        let spending_data_ctor =
+            SpendingDataConstructor::schnorr(spending_data::BabylonUnbondingPath::new(
+                spend_info.unbonding_script().clone(),
+                unbonding_control_block,
+                covenant_committee_signatures,
+            ));
+
+        let merkle_root = spend_info.merkle_root()?;
+        self.p2tr_script_path_with_spending_data_ctor(
+            // Babylon Staking or Unbonding output was created using an unspendable internal public key,
+            // that means taproot key spends is disabled.
+            &UNSPENDABLE_KEY_PATH,
+            spend_info.unbonding_script().clone(),
+            &merkle_root,
+            spending_data_ctor,
+        )
+    }
 }
diff --git a/rust/chains/tw_bitcoin/src/modules/tx_builder/mod.rs b/rust/chains/tw_bitcoin/src/modules/tx_builder/mod.rs
index d46415c4637..9858d654bf3 100644
--- a/rust/chains/tw_bitcoin/src/modules/tx_builder/mod.rs
+++ b/rust/chains/tw_bitcoin/src/modules/tx_builder/mod.rs
@@ -28,10 +28,10 @@ impl BitcoinChainInfo {
     }
 }
 
-fn parse_schnorr_pk(bytes: &Cow<[u8]>) -> SigningResult<schnorr::PublicKey> {
-    schnorr::PublicKey::try_from(bytes.as_ref()).into_tw()
+fn parse_schnorr_pk(bytes: &Cow<[u8]>) -> SigningResult<schnorr::XOnlyPublicKey> {
+    schnorr::XOnlyPublicKey::try_from(bytes.as_ref()).into_tw()
 }
 
-fn parse_schnorr_pks(pks: &[Cow<[u8]>]) -> SigningResult<Vec<schnorr::PublicKey>> {
+fn parse_schnorr_pks(pks: &[Cow<[u8]>]) -> SigningResult<Vec<schnorr::XOnlyPublicKey>> {
     pks.iter().map(parse_schnorr_pk).collect()
 }
diff --git a/rust/chains/tw_bitcoin/src/modules/tx_builder/output_protobuf.rs b/rust/chains/tw_bitcoin/src/modules/tx_builder/output_protobuf.rs
index 32166bb07d2..ddea5f1d760 100644
--- a/rust/chains/tw_bitcoin/src/modules/tx_builder/output_protobuf.rs
+++ b/rust/chains/tw_bitcoin/src/modules/tx_builder/output_protobuf.rs
@@ -3,6 +3,7 @@
 // Copyright © 2017 Trust Wallet.
 
 use crate::babylon::tx_builder::output::BabylonOutputBuilder;
+use crate::babylon::tx_builder::BabylonStakingParams;
 use crate::modules::tx_builder::{parse_schnorr_pk, parse_schnorr_pks, BitcoinChainInfo};
 use std::marker::PhantomData;
 use std::str::FromStr;
@@ -166,18 +167,19 @@ impl<'a, Context: UtxoContext> OutputProtobuf<'a, Context> {
             .try_into()
             .tw_err(|_| SigningErrorType::Error_invalid_params)
             .context("stakingTime cannot be greater than 65535")?;
-        let finality_provider = &parse_schnorr_pk(&staking.finality_provider_public_key)
+        let finality_provider = parse_schnorr_pk(&staking.finality_provider_public_key)
             .context("Invalid finalityProviderPublicKeys")?;
-        let covenant_committees = parse_schnorr_pks(&staking.covenant_committee_public_keys)
+        let covenants = parse_schnorr_pks(&staking.covenant_committee_public_keys)
             .context("Invalid covenantCommitteePublicKeys")?;
 
-        self.prepare_builder()?.babylon_staking(
-            &staker,
-            staking_locktime,
-            &finality_provider,
-            &covenant_committees,
-            staking.covenant_committee_quorum,
-        )
+        self.prepare_builder()?
+            .babylon_staking(BabylonStakingParams {
+                staker,
+                staking_locktime,
+                finality_provider,
+                covenants,
+                covenant_quorum: staking.covenant_quorum,
+            })
     }
 
     pub fn babylon_op_return(
diff --git a/rust/chains/tw_bitcoin/src/modules/tx_builder/utxo_protobuf.rs b/rust/chains/tw_bitcoin/src/modules/tx_builder/utxo_protobuf.rs
index 3760fe9c8d5..154545072bd 100644
--- a/rust/chains/tw_bitcoin/src/modules/tx_builder/utxo_protobuf.rs
+++ b/rust/chains/tw_bitcoin/src/modules/tx_builder/utxo_protobuf.rs
@@ -3,6 +3,7 @@
 // Copyright © 2017 Trust Wallet.
 
 use crate::babylon::tx_builder::utxo::BabylonUtxoBuilder;
+use crate::babylon::tx_builder::BabylonStakingParams;
 use crate::modules::tx_builder::public_keys::PublicKeys;
 use crate::modules::tx_builder::script_parser::{StandardScript, StandardScriptParser};
 use crate::modules::tx_builder::{parse_schnorr_pk, parse_schnorr_pks, BitcoinChainInfo};
@@ -17,6 +18,7 @@ use tw_proto::BitcoinV2::Proto;
 use tw_utxo::context::UtxoContext;
 use tw_utxo::script::Script;
 use tw_utxo::sighash::SighashType;
+use tw_utxo::signature::BitcoinSchnorrSignature;
 use tw_utxo::transaction::standard_transaction::builder::UtxoBuilder;
 use tw_utxo::transaction::standard_transaction::TransactionInput;
 use tw_utxo::transaction::transaction_parts::OutPoint;
@@ -60,9 +62,11 @@ impl<'a, Context: UtxoContext> UtxoProtobuf<'a, Context> {
                 BuilderType::babylon_timelock_path(ref timelock) => {
                     self.babylon_timelock_path(timelock)
                 },
+                BuilderType::babylon_unbonding_path(ref unbonding) => {
+                    self.babylon_unbonding_path(unbonding)
+                },
                 BuilderType::None => SigningError::err(SigningErrorType::Error_invalid_params)
                     .context("No Input Builder type provided"),
-                _ => todo!(),
             },
             ScriptType::script_data(ref script) => self.custom_script(script.to_vec()),
             ScriptType::receiver_address(ref address) => self.recipient_address(address),
@@ -148,15 +152,51 @@ impl<'a, Context: UtxoContext> UtxoProtobuf<'a, Context> {
             .context("stakingTime cannot be greater than 65535")?;
         let finality_provider = parse_schnorr_pk(&timelock.finality_provider_public_key)
             .context("Invalid finalityProviderPublicKeys")?;
-        let covenant_committees = parse_schnorr_pks(&timelock.covenant_committee_public_keys)
+        let covenants = parse_schnorr_pks(&timelock.covenant_committee_public_keys)
+            .context("Invalid covenantCommitteePublicKeys")?;
+
+        self.prepare_builder()?
+            .babylon_timelock_path(BabylonStakingParams {
+                staker,
+                staking_locktime,
+                finality_provider,
+                covenants,
+                covenant_quorum: timelock.covenant_quorum,
+            })
+    }
+
+    pub fn babylon_unbonding_path(
+        &self,
+        unbonding: &Proto::mod_Input::BabylonStakingUnbondingPath,
+    ) -> SigningResult<(TransactionInput, UtxoToSign)> {
+        let staker =
+            parse_schnorr_pk(&unbonding.staker_public_key).context("Invalid stakerPublicKey")?;
+        let staking_locktime: u16 = unbonding
+            .staking_time
+            .try_into()
+            .tw_err(|_| SigningErrorType::Error_invalid_params)
+            .context("stakingTime cannot be greater than 65535")?;
+        let finality_provider = parse_schnorr_pk(&unbonding.finality_provider_public_key)
+            .context("Invalid finalityProviderPublicKeys")?;
+        let covenants = parse_schnorr_pks(&unbonding.covenant_committee_public_keys)
             .context("Invalid covenantCommitteePublicKeys")?;
 
-        self.prepare_builder()?.babylon_timelock_path(
-            &staker,
-            staking_locktime,
-            &finality_provider,
-            &covenant_committees,
-            timelock.covenant_committee_quorum,
+        let sighash_ty = self.sighash_ty()?;
+        let covenant_signatures = unbonding
+            .covenant_committee_signatures
+            .iter()
+            .map(|pk_sig| parse_schnorr_pubkey_sig(pk_sig, sighash_ty))
+            .collect::<SigningResult<Vec<_>>>()?;
+
+        self.prepare_builder()?.babylon_unbonding_path(
+            BabylonStakingParams {
+                staker,
+                staking_locktime,
+                finality_provider,
+                covenants,
+                covenant_quorum: unbonding.covenant_quorum,
+            },
+            &covenant_signatures,
         )
     }
 
@@ -204,7 +244,7 @@ impl<'a, Context: UtxoContext> UtxoProtobuf<'a, Context> {
 
     pub fn prepare_builder(&self) -> SigningResult<UtxoBuilder> {
         let OutPoint { hash, index } = parse_out_point(&self.input.out_point)?;
-        let sighash_ty = SighashType::from_u32(self.input.sighash_type)?;
+        let sighash_ty = self.sighash_ty()?;
 
         if self.input.value < 0 {
             return SigningError::err(SigningErrorType::Error_invalid_utxo_amount)
@@ -253,6 +293,10 @@ impl<'a, Context: UtxoContext> UtxoProtobuf<'a, Context> {
             .into_tw()
             .context("Expected a valid ecdsa secp256k1 public key")
     }
+
+    fn sighash_ty(&self) -> SigningResult<SighashType> {
+        SighashType::from_u32(self.input.sighash_type)
+    }
 }
 
 pub fn parse_out_point(maybe_out_point: &Option<Proto::OutPoint>) -> SigningResult<OutPoint> {
@@ -270,3 +314,15 @@ pub fn parse_out_point(maybe_out_point: &Option<Proto::OutPoint>) -> SigningResu
         index: out_point.vout,
     })
 }
+
+pub fn parse_schnorr_pubkey_sig(
+    pubkey_sig: &Proto::PublicKeySignature,
+    sighash_ty: SighashType,
+) -> SigningResult<(schnorr::XOnlyPublicKey, BitcoinSchnorrSignature)> {
+    let pk = parse_schnorr_pk(&pubkey_sig.public_key)?;
+    let sig = schnorr::Signature::try_from(pubkey_sig.signature.as_ref())
+        .tw_err(|_| SigningErrorType::Error_invalid_params)
+        .context("Invalid signature")?;
+    let btc_sign = BitcoinSchnorrSignature::new(sig, sighash_ty)?;
+    Ok((pk, btc_sign))
+}
diff --git a/rust/frameworks/tw_utxo/src/script/standard_script/claims.rs b/rust/frameworks/tw_utxo/src/script/standard_script/claims.rs
index 02533f44c22..c4af0e61208 100644
--- a/rust/frameworks/tw_utxo/src/script/standard_script/claims.rs
+++ b/rust/frameworks/tw_utxo/src/script/standard_script/claims.rs
@@ -94,17 +94,22 @@ pub fn new_p2tr_key_path(sig: Vec<u8>) -> Witness {
 /// (_witness_).
 ///
 /// ```txt
-/// <sig>
+/// <sig1>
+/// <sig2>
+/// ...
+/// <sigN>
 /// <payload>
 /// <control_block>
 /// ```
 pub fn new_p2tr_script_path(
-    sig: &BitcoinSchnorrSignature,
+    sigs: &[BitcoinSchnorrSignature],
     payload: Script,
     control_block: Vec<u8>,
 ) -> Witness {
     let mut w = Witness::new();
-    w.push_item(Script::from(sig.serialize()));
+    for sig in sigs {
+        w.push_item(Script::from(sig.serialize()));
+    }
     w.push_item(payload);
     w.push_item(Script::from(control_block));
     w
diff --git a/rust/frameworks/tw_utxo/src/signature.rs b/rust/frameworks/tw_utxo/src/signature.rs
index 573fb7b08e0..c13e97612e0 100644
--- a/rust/frameworks/tw_utxo/src/signature.rs
+++ b/rust/frameworks/tw_utxo/src/signature.rs
@@ -49,6 +49,7 @@ impl BitcoinEcdsaSignature {
     }
 }
 
+#[derive(Clone, Debug)]
 pub struct BitcoinSchnorrSignature {
     sig: H512,
     sighash_ty: u8,
diff --git a/rust/frameworks/tw_utxo/src/spending_data/standard_constructor.rs b/rust/frameworks/tw_utxo/src/spending_data/standard_constructor.rs
index 1553fdc3e93..8b96ad5987a 100644
--- a/rust/frameworks/tw_utxo/src/spending_data/standard_constructor.rs
+++ b/rust/frameworks/tw_utxo/src/spending_data/standard_constructor.rs
@@ -74,7 +74,7 @@ impl SchnorrSpendingDataConstructor for P2TRScriptPath {
         SpendingData {
             script_sig: Script::default(),
             witness: claims::new_p2tr_script_path(
-                sig,
+                &[sig.clone()],
                 self.payload.clone(),
                 self.control_block.clone(),
             ),
diff --git a/rust/frameworks/tw_utxo/src/transaction/standard_transaction/builder/utxo.rs b/rust/frameworks/tw_utxo/src/transaction/standard_transaction/builder/utxo.rs
index a8590915a0b..a1d7e05fb8c 100644
--- a/rust/frameworks/tw_utxo/src/transaction/standard_transaction/builder/utxo.rs
+++ b/rust/frameworks/tw_utxo/src/transaction/standard_transaction/builder/utxo.rs
@@ -288,11 +288,31 @@ impl UtxoBuilder {
     }
 
     pub fn p2tr_script_path(
-        mut self,
+        self,
         internal_pubkey: &schnorr::PublicKey,
         payload: Script,
         control_block: Data,
         merkle_root: &H256,
+    ) -> SigningResult<(TransactionInput, UtxoToSign)> {
+        let spending_data_ctor =
+            SpendingDataConstructor::schnorr(standard_constructor::P2TRScriptPath {
+                payload: payload.clone(),
+                control_block,
+            });
+        self.p2tr_script_path_with_spending_data_ctor(
+            internal_pubkey,
+            payload,
+            merkle_root,
+            spending_data_ctor,
+        )
+    }
+
+    pub fn p2tr_script_path_with_spending_data_ctor(
+        mut self,
+        internal_pubkey: &schnorr::PublicKey,
+        payload: Script,
+        merkle_root: &H256,
+        spending_data_constructor: SpendingDataConstructor,
     ) -> SigningResult<(TransactionInput, UtxoToSign)> {
         // Construct the leaf hash.
         let script_buf = bitcoin::ScriptBuf::from_bytes(payload.to_vec());
@@ -319,12 +339,7 @@ impl UtxoBuilder {
                 // We use the full (revealed) script as scriptPubkey here.
                 script_pubkey: payload.clone(),
                 signing_method: SigningMethod::Taproot,
-                spending_data_constructor: SpendingDataConstructor::schnorr(
-                    standard_constructor::P2TRScriptPath {
-                        payload,
-                        control_block,
-                    },
-                ),
+                spending_data_constructor,
                 // Taproot ScriptPath input should be signed with a non-tweaked private key.
                 spender_public_key: internal_pubkey.compressed().to_vec(),
                 amount,
diff --git a/rust/tw_keypair/src/schnorr/public.rs b/rust/tw_keypair/src/schnorr/public.rs
index 751b7d5ee65..b51e5732d36 100644
--- a/rust/tw_keypair/src/schnorr/public.rs
+++ b/rust/tw_keypair/src/schnorr/public.rs
@@ -33,6 +33,7 @@ impl PublicKey {
     pub fn x_only(&self) -> XOnlyPublicKey {
         let (x_only_pubkey, _parity) = self.public.x_only_public_key();
         XOnlyPublicKey {
+            bytes: H256::from(x_only_pubkey.serialize()),
             public: x_only_pubkey,
         }
     }
@@ -64,12 +65,17 @@ impl<'a> TryFrom<&'a [u8]> for PublicKey {
 }
 
 pub struct XOnlyPublicKey {
+    pub(crate) bytes: H256,
     pub(crate) public: secp256k1::XOnlyPublicKey,
 }
 
 impl XOnlyPublicKey {
     pub fn bytes(&self) -> H256 {
-        H256::from(self.public.serialize())
+        self.bytes
+    }
+
+    pub fn as_slice(&self) -> &[u8] {
+        self.bytes.as_slice()
     }
 }
 
@@ -97,8 +103,9 @@ impl<'a> TryFrom<&'a [u8]> for XOnlyPublicKey {
             value
         };
 
+        let bytes = H256::try_from(x_only_slice).map_err(|_| KeyPairError::InvalidPublicKey)?;
         let public = secp256k1::XOnlyPublicKey::from_slice(x_only_slice)
             .map_err(|_| KeyPairError::InvalidPublicKey)?;
-        Ok(XOnlyPublicKey { public })
+        Ok(XOnlyPublicKey { bytes, public })
     }
 }
diff --git a/src/proto/BitcoinV2.proto b/src/proto/BitcoinV2.proto
index 5c79bc469a6..96f7e8856cc 100644
--- a/src/proto/BitcoinV2.proto
+++ b/src/proto/BitcoinV2.proto
@@ -26,6 +26,14 @@ message PublicKeyOrHash {
     }
 }
 
+// Public key and corresponding signature.
+message PublicKeySignature {
+    // Public key bytes. Type of the public key depends on the context.
+    bytes public_key = 1;
+    // Signature 64-length byte array.
+    bytes signature = 2;
+}
+
 // Bitcoin transaction out-point reference.
 message OutPoint {
     // The hash of the referenced transaction (network byte order, usually needs to be reversed).
@@ -137,21 +145,27 @@ message Input {
         repeated bytes covenant_committee_public_keys = 4;
         // Retrieved from global_parameters.covenant_quorum.
         // Specifies the quorum required by the covenant committee for unbonding transactions to be confirmed.
-        uint32 covenant_committee_quorum = 5;
+        uint32 covenant_quorum = 5;
     }
 
     // Unbonding path can be used to on-demand unlock `Staking Output` before the timelock expires.
     message BabylonStakingUnbondingPath {
         // User's public key.
         bytes staker_public_key = 1;
+        // Finality provider's public key chosen by the user.
+        bytes finality_provider_public_key = 2;
+        // Staking Output's lock time.
+        // Must be expired to be spent.
+        uint32 staking_time = 3;
         // Retrieved from global_parameters.covenant_pks.
         // Babylon nodes that can approve Unbonding tx or Slash the staked position when acting bad.
-        repeated bytes covenant_committee_public_keys = 2;
+        repeated bytes covenant_committee_public_keys = 4;
         // Retrieved from global_parameters.covenant_quorum.
         // Specifies the quorum required by the covenant committee for unbonding transactions to be confirmed.
-        uint32 covenant_committee_quorum = 3;
-        // Signatures signed by covenant committees. There should be at least `covenant_committee_quorum` signatures.
-        repeated bytes covenant_committee_signatures = 4;
+        uint32 covenant_quorum = 5;
+        // Signatures signed by covenant committees. There should be at least `covenant_quorum` signatures.
+        // Public keys can be either compressed (33 bytes) or x-only (32 bytes).
+        repeated PublicKeySignature covenant_committee_signatures = 6;
     }
 }
 
@@ -237,7 +251,7 @@ message Output {
         repeated bytes covenant_committee_public_keys = 4;
         // Retrieved from global_parameters.covenant_quorum.
         // Specifies the quorum required by the covenant committee for unbonding transactions to be confirmed.
-        uint32 covenant_committee_quorum = 5;
+        uint32 covenant_quorum = 5;
     }
 
     // Creates an OP_RETURN output used to identify the staking transaction among other transactions in the Bitcoin ledger.