How to preserve the value of coins after a fork.
5 messages, 30 Dec 2015. Started by Emin Gün Sirer.
Emin Gün Sirer (2), Peter Todd (2), Nick ODell
Ittay Eyal and I just put together a writeup that we're informally calling Bitcoin-United for preserving the value of coins following a permanent fork:
http://hackingdistributed.com/2015/12/30/technique-to-unite-bitcoin-factions/
Half of the core idea is to eliminate double-spends (where someone spends a UTXO on chain A and the same UTXO on chain B, at separate merchants) by placing transactions from A on chain B, and by taking the intersection of transactions on chain A and chain B when considering whether a payment has been received.
The other half of the core idea is to enable minting of new coins and collection of mining fees on both chains, while preserving the 21M maximum. This is achieved by creating a one-to-one correspondence between coins on one chain with coins on the other.
Given the level of the audience here, I'm keeping the description quite terse. Much more detail and discussion is at the link above, as well as the assumptions that need to hold for Bitcoin-United.
The high bit is that, with a few modest assumptions, it is possible to create a cohesive coin in the aftermath of a fork, even if the core devs are split, and even if one of the forks is (in the worst case) completely non-cooperative. Bitcoin-United is a trick to create a cohesive coin even when there is no consensus at the lowest level.
Bitcoin-United opens up a lot of new, mostly game-theoretic questions: what happens to native clients who prefer A or B? What will happen to the value of native-A or native-B coins? And so on.
We're actively working on these questions and more, but we wanted to share the Bitcoin-United idea, mainly to receive feedback, and partly to provide some hope about future consensus to the community. It turns out that it is possible to craft consensus at the network level even when there isn't one at the developer level.
Happy New Year, and may 2016 be united, - egs & ittay
Note how transaction malleability can quickly sabotage naive notions of this idea.
Equally, if this looks like it might ever be implemented, rather than using a hard fork, using a forced soft-fork to deploy changes becomes attractive.
On 30 December 2015 12:08:36 GMT-08:00, "Emin Gün Sirer via bitcoin-dev" <bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (64 lines)
>Ittay Eyal and I just put together a writeup that we're informally >calling >Bitcoin-United for preserving the value of coins following a permanent >fork: > > >http://hackingdistributed.com/2015/12/30/technique-to-unite-bitcoin-factions/ > >Half of the core idea is to eliminate double-spends (where someone >spends a >UTXO on chain A and the same UTXO on chain B, at separate merchants) by >placing transactions from A on chain B, and by taking the intersection >of >transactions on chain A and chain B when considering whether a payment >has >been received. > >The other half of the core idea is to enable minting of new coins and >collection of mining fees on both chains, while preserving the 21M >maximum. >This is achieved by creating a one-to-one correspondence between coins >on >one chain with coins on the other. > >Given the level of the audience here, I'm keeping the description quite >terse. Much more detail and discussion is at the link above, as well as >the >assumptions that need to hold for Bitcoin-United. > >The high bit is that, with a few modest assumptions, it is possible to >create a cohesive coin in the aftermath of a fork, even if the core >devs >are split, and even if one of the forks is (in the worst case) >completely >non-cooperative. Bitcoin-United is a trick to create a cohesive coin >even >when there is no consensus at the lowest level. > >Bitcoin-United opens up a lot of new, mostly game-theoretic questions: >what >happens to native clients who prefer A or B? What will happen to the >value >of native-A or native-B coins? And so on. > >We're actively working on these questions and more, but we wanted to >share >the Bitcoin-United idea, mainly to receive feedback, and partly to >provide >some hope about future consensus to the community. It turns out that it >is >possible to craft consensus at the network level even when there isn't >one >at the developer level. > >Happy New Year, and may 2016 be united, >- egs & ittay > > >------------------------------------------------------------------------ > >_______________________________________________ >bitcoin-dev mailing list >bitcoin-dev@lists•linuxfoundation•org >https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
- -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
On Wed, Dec 30, 2015 at 3:16 PM, Peter Todd <pete@petertodd•org> wrote:
Quoted text (3 lines)
> Note how transaction malleability can quickly sabotage naive notions of > this idea. >
Bitcoin-United relies on a notion of transaction equivalence that doesn't involve the transaction hash at all, so it should be immune to malleability issues and compatible with segwit.
From the post, two transactions are equal if they "consume the same inputs and result in the same outputs, not counting the miner fee. Simple pay-to-pubkey-hash and pay-to-script-hash transactions are straightforward. Multikey transactions are evaluated for equivalency by their inputs and outputs, so it is allowable for a 2-out-of-3 payment to be signed by one set of two keys on Dum and another set of two keys on Dee, as long as the transaction consumes the same coins and produces the same outputs. Not that we'll ever encounter such a case, but making this point helps pedagogically with getting across the notion of transaction equivalence. What counts are the consumed inputs and the destination and amounts of the outputs."
But you're right, if a naive implementation were to just use the transaction hash, the result would be a mess.
- egs
On 30 December 2015 12:22:43 GMT-08:00, "Emin Gün Sirer" <el33th4x0r@gmail•com> wrote:
Quoted text (13 lines)
>On Wed, Dec 30, 2015 at 3:16 PM, Peter Todd <pete@petertodd•org> wrote: > >> Note how transaction malleability can quickly sabotage naive notions >of >> this idea. >> > >Bitcoin-United relies on a notion of transaction equivalence that >doesn't >involve the transaction hash at all, so it should be immune to >malleability >issues and compatible with segwit. >
From the post, two transactions are equal if they "consume the same
Quoted text (16 lines)
>inputs >and result in the same outputs, not counting the miner fee. Simple >pay-to-pubkey-hash and pay-to-script-hash transactions are >straightforward. >Multikey transactions are evaluated for equivalency by their inputs and >outputs, so it is allowable for a 2-out-of-3 payment to be signed by >one >set of two keys on Dum and another set of two keys on Dee, as long as >the >transaction consumes the same coins and produces the same outputs. Not >that >we'll ever encounter such a case, but making this point helps >pedagogically >with getting across the notion of transaction equivalence. What counts >are >the consumed inputs and the destination and amounts of the outputs."
You seem to not be familiar with how multisig transactions on Bitcoin work - 99.9% of the time theyre hidden behind p2sh and there is no way to know what keys are involved. Equally, multisig is just one of many complex scripts possible.
Look into what a segwit transaction hashes - that's a better notion of non-malleable transaction. But even then lots of transactions are malleable, and its easy to trigger those cases intentionally by third parties.
Most likely any Bitcoin United scheme would quickly diverge and fail; much simpler and more predictable to achieve convincing consensus, e.g. via proof of stake voting, or Adam Bank's extension blocks suggestions. (or of course, not trying to force controversial forks in the first place)
Emin,
I have two technical criticisms of your proposal, and one economic criticism.
Quoted text (1 line)
>Unified miners would make sure that they mine transactions on Dum first, then on Dee. Recall that Dee miners can always just take Dum transactions and stick them in their blocks.
This seems to contradict a later section that says that users can use Dee natively, without paying fees necessary to get a transaction into Dum. You can't have this both ways - either you can get a transaction into Dee without getting it into Dum first, or you can't.
Quoted text (1 line)
>Such an attack would be quite visible, and it would leave Dum vulnerable. Unified clients could counter this launching a 51% counterattack on Dum.
What if some other group that wants to hurt both Dum and Dee were to make a false-flag attack against Dee? Mutually assured destruction doesn't work if you can't accurately attribute attacks.
Quoted text (1 line)
>This would create some gentle pressure to explicitly unify the two chains (by merging Dee and Dum at some compromise and doing away with Unified)
I don't think a compromise would be reachable at that point - suppose one had a market cap of 1.2 billion, and the other had a market cap of 0.8 billion. How would the coins on the unified chain be distributed? You could give each chain an equal number of coins, but that's not fair to the people holding the more valuable coins. You could give each chain a number of coins proportional to the market cap, but that invites price manipulation. In any case, if you had a way of reaching compromise, why not use it instead of creating two chains?
Overall, I think this proposal is a bad idea.
Quoted text (1 line)
>You seem to not be familiar with how multisig transactions on Bitcoin work - 99.9% of the time theyre hidden behind p2sh and there is no way to know what keys are involved. Equally, multisig is just one of many complex scripts possible.
That doesn't end up mattering, though, as I understand his proposal. The unified client would just see that both validly spend an output with a scriptPubKey of OP_HASH160 0xabcdef... OP_EQUAL.
On Wed, Dec 30, 2015 at 1:32 PM, Peter Todd via bitcoin-dev <bitcoin-dev@lists•linuxfoundation•org> wrote:
Quoted text (59 lines)
> -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > > > On 30 December 2015 12:22:43 GMT-08:00, "Emin Gün Sirer" <el33th4x0r@gmail•com> wrote: >>On Wed, Dec 30, 2015 at 3:16 PM, Peter Todd <pete@petertodd•org> wrote: >> >>> Note how transaction malleability can quickly sabotage naive notions >>of >>> this idea. >>> >> >>Bitcoin-United relies on a notion of transaction equivalence that >>doesn't >>involve the transaction hash at all, so it should be immune to >>malleability >>issues and compatible with segwit. >> > >From the post, two transactions are equal if they "consume the same >>inputs >>and result in the same outputs, not counting the miner fee. Simple >>pay-to-pubkey-hash and pay-to-script-hash transactions are >>straightforward. >>Multikey transactions are evaluated for equivalency by their inputs and >>outputs, so it is allowable for a 2-out-of-3 payment to be signed by >>one >>set of two keys on Dum and another set of two keys on Dee, as long as >>the >>transaction consumes the same coins and produces the same outputs. Not >>that >>we'll ever encounter such a case, but making this point helps >>pedagogically >>with getting across the notion of transaction equivalence. What counts >>are >>the consumed inputs and the destination and amounts of the outputs." > > You seem to not be familiar with how multisig transactions on Bitcoin work - 99.9% of the time theyre hidden behind p2sh and there is no way to know what keys are involved. Equally, multisig is just one of many complex scripts possible. > > Look into what a segwit transaction hashes - that's a better notion of non-malleable transaction. But even then lots of transactions are malleable, and its easy to trigger those cases intentionally by third parties. > > Most likely any Bitcoin United scheme would quickly diverge and fail; much simpler and more predictable to achieve convincing consensus, e.g. via proof of stake voting, or Adam Bank's extension blocks suggestions. (or of course, not trying to force controversial forks in the first place) > > -----BEGIN PGP SIGNATURE----- > > iQE9BAEBCgAnIBxQZXRlciBUb2RkIDxwZXRlQHBldGVydG9kZC5vcmc+BQJWhD9N > AAoJEMCF8hzn9Lncz4MH/0JPGVc2JLtD5q0I2w0vqmBqsoSzSueCtnKa2K1Ea10g > w9I4uhK7+cgfCLbofJznVHMChXu0uCxtWwqSj++uJx238TEupcu951gUhFfuPOeH > Egye8jmDkDFiB1P40kUSVk9N64Zt3kWLk4xSsfjawVHz/WWpM24Fn8k/bmI7JiLl > nmVwoBdRsTKffM/1dr8ix4U8YPSmJ7W+jAByNHUpSgc1R73YylqNT95pF8QD35df > dQwSK9DIc+2N4CKnp22xLvYeCivFjeS2Fm4kbcKQwMjcqlJ1mWghP/c8q/lzhaGN > Ac15/pgeHp8dPP8c81zkN9ps14rrnXoHnrzjiY+TwKY= > =FfK1 > -----END PGP SIGNATURE----- > > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev