path: root/10/f24238c7e6e58427307d9e0e2d0303f7c89188

Return-Path: <roconnor@blockstream.io>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
	[172.17.192.35])
	by mail.linuxfoundation.org (Postfix) with ESMTPS id 06C29AA6
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 28 Jun 2017 22:50:18 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from mail-vk0-f44.google.com (mail-vk0-f44.google.com
	[209.85.213.44])
	by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 62AAC15A
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 28 Jun 2017 22:50:16 +0000 (UTC)
Received: by mail-vk0-f44.google.com with SMTP id r126so41279656vkg.0
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 28 Jun 2017 15:50:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=blockstream-io.20150623.gappssmtp.com; s=20150623;
	h=mime-version:in-reply-to:references:from:date:message-id:subject:to
	:cc; bh=sslkWykf26tgnP+tK51inn0BGtCle7OXguHwUA5piz4=;
	b=nwNzn5dyUSaji4Id057ZmZos3XoyETydOs7Hy1UQwqA053G2NksF0jw+oGX4BhVB7n
	v9EhM5H48MmgDoKAuWC9912Iw8IT3tBD2n7/dKQOxb/3k6G34eJD48cJlZHUjdKngJeL
	KvJFi95p29w09D5wvUap/+4tBeMWPF3K3x+SaAO4NKrJsyB3GXynvYH3PBh+Qv76YYRa
	VZSX/9js7SU6dFcbLbcgvhaVRtHYJojSuA0xPKiUE0CRPvnN3SKrMy82Iryo8Qnc14g3
	+cn6Vmi97zIzSlXX+wuQ9HtgdrJr9eNOZx7t7wpCq7V3zFq2gSSRRKCUu2UFD3eEJp3A
	VS9A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=1e100.net; s=20161025;
	h=x-gm-message-state:mime-version:in-reply-to:references:from:date
	:message-id:subject:to:cc;
	bh=sslkWykf26tgnP+tK51inn0BGtCle7OXguHwUA5piz4=;
	b=q10c9dwpFwBn0t6Uw/1nXvYKKR76zkZc2oFSno1BMTSpcrAgXiAJm8qwms029cAbw8
	IDdX4KsjocG+Q8VvX1Q3fXyJZogibsfTJ60fPHX1+r/Qgk1NYT4GBrANaDU1Z/ee6wXn
	gvLMzZJeBrLvHSkootPGfXbG2KtejvgROxMZcbfH90tI91X/dJh/DHFjQhU2gnv/6kIH
	atTH0p45Wl3UFl78t/9GgFYHS1atApIXxO3vRpY26z8F7Sd0/3D4E3y/JtrA5YcVwGWs
	fTOdEnCnGNJ497toZzxo++W8eHx2F76OiiKN/h7bfDVMboHknxSWZzo1xBWcUK59LBaW
	cHFA==
X-Gm-Message-State: AKS2vOzqaT6b4v1jZkQjoZiQ58GR/EvmjXHgyb/Gp8Tpkb/mZNJDHiLz
	l9dyfZWwAxBKll/70Lg/+WvFirpf62V6
X-Received: by 10.31.181.136 with SMTP id e130mr7297336vkf.69.1498690215308;
	Wed, 28 Jun 2017 15:50:15 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.176.74.89 with HTTP; Wed, 28 Jun 2017 15:49:54 -0700 (PDT)
In-Reply-To: <2f2e6b7c-2d47-518a-5a8f-0b5333607aac@gmail.com>
References: <CAGL6+mHQ_vMc2JYVqwfP89WOZdUF2WDtWfh7ccL1PQve=nC+zQ@mail.gmail.com>
	<OozQK1_gWeExd5578AYH_dHnSKSvx63FJc2rIBBcaJF4f07qzsR8rr-ka5epwMFCjqDuidAWZiZqqlvn4xvSuUpDY0KkV014VQs6_E3Rp_A=@protonmail.com>
	<2f2e6b7c-2d47-518a-5a8f-0b5333607aac@gmail.com>
From: "Russell O'Connor" <roconnor@blockstream.io>
Date: Wed, 28 Jun 2017 18:49:54 -0400
Message-ID: <CAMZUoKmKxJvVECh8ofdn=6N1tZ2M_4EAAFcWvpOeUYVp5DDyDw@mail.gmail.com>
To: Paul Sztorc <truthcoin@gmail.com>
Content-Type: multipart/alternative; boundary="001a11439808e98a5c05530d01b9"
X-Spam-Status: No, score=-1.4 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID, HTML_MESSAGE, RCVD_IN_DNSWL_NONE,
	RCVD_IN_SORBS_SPAM autolearn=no version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	smtp1.linux-foundation.org
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] BIP: OP_BRIBVERIFY - the op code needed for Blind
 Merge Mined drivechains
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Jun 2017 22:50:18 -0000

--001a11439808e98a5c05530d01b9
Content-Type: text/plain; charset="UTF-8"

I haven't really been following the drivechain discussion; I have found the
documentation about how drivechains are supposed to work scattered and
difficult to follow. So, without advocating for or against this proposal,
I'd also suggest that adding an opcode is not the best way to implement
this bribe.

The problem I see is that to send a bribe one must first post a transaction
to a script that uses the OP_BRIBE code that fixes the critical hash (and
the sidechain id), and then a second transaction is needed to pay the bribe
to the miner.

I suggest instead to use a 0 output value with some currently non-standard
OP_RETURN output script that specifies the critical hash (and the sidechain
id), similar to ZmnSCPxj's idea.  The difference is that I we would
soft-fork a rule that says that such an output is only legal when a miner
places the same critical hash suitably in their coinbase output.

OP_RETURN outputs are prunable from the UTXO set.  The special bribe output
can be fixed to 0 value because the bribe will be paid using the
transaction's fees.  To perform a bribe, a user creates and signs a
transaction containing one (or more) of these special bribe outputs.  The
fee of this transaction constitutes the bribe, and any change the user has
can be sent back to themselves.  This way only a single transaction is
required to make a bribe.  I didn't really understand the bribe refund
mechanism, but I think the fact that the bribe can be done in a single
transaction this way alleviates any need for bribe refunds.

Hopefully I have understood the goal of this proposal.


On Wed, Jun 28, 2017 at 6:20 PM, Paul Sztorc via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> Hi ZmnSCPxj,
>
> It seems that, in your version, the "bribers" would react to the scheme
> in inefficient ways, particularly when the mainchain's tx-fee-rate (ie
> fee per Kb) is low.
>
> In short, there would be many bribe-attempts (each of which would take
> up space in mainchain blocks), almost all of which would be unsuccessful.
>
> In turn, miners would likely react to this, and try to improve the state
> of affairs by offering users the privilege of occupying transaction slot
> #2 (ie, the one right after the coinbase). Users would need to trust
> miners for this, which introduces a cost friction which is pure
> deadweight loss. And, it might be easier for larger/older miners to be
> trustworthy than smaller/newer ones.
>
> Your way is actually very similar to mine. Mine _forces_ the bribe to be
> in the earliest txn (the coinbase) and to only occur once. Yours doesn't
> do anything to refund the briber, if the sidechain (but not the
> mainchain) reorganizes (as it can easily do, if an older sidechain
> parent is extended while the mainchain proceeds normally). This creates
> additional risk.
>
> I think mine is also much more space-efficient. Even if ours each had
> exactly one h* per sidechain per block, it seems that I only require one
> hash to be communicated (plus an indicator byte, and a ~2 byte counter
> for the ratchet), whereas you require two. Since its overhead per
> sidechain per block, it actually might really add up.
>
> Thanks,
> Paul
>
>
>
> On 6/28/2017 4:26 AM, ZmnSCPxj via bitcoin-dev wrote:
> > Good morning.
> >
> > I still do not see what this does that cannot be done by:
> >
> > OP_RETURN <sidechain-id> <sidechain-block-id>
> >
> > A transaction with such an output would allow sidechain-miners to bribe
> > mainchain-miners by paying a transaction fee if the transaction
> > containing this OP_RETURN is included in a block and committed to by a
> > mainchain-miner in the Merkle tree root.
> >
> > It would not require a softfork.
> >
> > --
> >
> > I have an alternate proposal that sidechains and altcoins that want to
> > do "blinded" merge mining can use without a softfork:
> >
> > 1.  Encode a block header as a simple cons-pair, with the head as the
> > block and the tail as the parent cons-pair.
> > 1.1.  This can be encoded as a 32-byte hash of the block including its
> > header, and the 32-byte hash of the parent cons-pair.
> > 1.2.  This is now the actual "chain" in the sidecoin/altcoin blockchain.
> > 2.  When a sidechain-node wants to know the consensus, it downloads
> > mainchain-blocks and looks for OP_RETURN's.
> > 2.1.  Starting with its genesis cons-pair hash (equivalent to the empty
> > list) as the current cons-pair, it scans each OP_RETURN transaction.
> > 2.1.1.  If an OP_RETURN is 64-byte and has the parent cons-pair equal to
> > the current cons-pair, look for the side block indicated and confirm its
> > correctness.  If correct, update the current cons-pair for the hash of
> > the OP_RETURN data.
> > 2.2.  When reaching the latest mainchain block, the current cons-pair is
> > now the sidecoin/altcoin latest block.
> > 2.3.  Note that if multiple OP_RETURN in a block match the current
> > cons-pair, the first one is considered the correct chain.  This property
> > means that the sidechain/altchain can only have a chainsplit if the
> > mainchain has a chainsplit.
> > 3.  When a sidechain-miner wants to create a side-block, it generates a
> > new cons-pair and creates an OP_RETURN transaction for it, paying a
> > mainchain-miner to include it in the next mainchain-block.
> > 3.1.  The sidechain-miner risks that its competitors will outbid it and
> > get its OP_RETURN earlier in a mainchain-block (or earlier in the order
> > of transactions).  It can mitigate this risk by updating itself to
> > become a mainchain-miner, it can then keep its OP_RETURN transaction
> > private and put it earlier in the block, ensuring it will "win" the
> > sidechain-consensus if it wins the mainchain-consensus.
> >
> > Regards,
> > ZmnSCPxj
> >
> > -------- Original Message --------
> > Subject: [bitcoin-dev] BIP: OP_BRIBVERIFY - the op code needed for Blind
> > Merge Mined drivechains
> > Local Time: June 28, 2017 8:37 AM
> > UTC Time: June 28, 2017 12:37 AM
> > From: bitcoin-dev@lists.linuxfoundation.org
> > To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
> >
> > <pre>
> >   BIP: <BIP number>
> >   Layer: Consensus (Soft fork)
> >   Title: OP_BRIBEVERIFY
> >   Author: Chris Stewart <chris@suredbits.com>
> >   Status: Draft
> >   Type: Standards Track
> >   Created: 2017-06-27
> > </pre>
> >
> >
> > ==Abstract==
> >
> > This BIP describes a new opcode, OP_BRIBEVERIFY, for the Bitcoin
> > scripting system that allows for a user to bribe a miner to include a
> hash
> > in the coinbase transaction's output.
> >
> >
> > ==Summary==
> >
> > BRIBEVERIFY redefines the existing NOP4 opcode. When executed, if the
> given
> > critical hash is included at the given vout index in the coinbase
> > transaction
> > the script evaluates to true. Otherwise, the script will fail.
> >
> > This allows sidechains to be merged mined against
> > bitcoin without burdening bitcoin miners with extra resource
> requirements.
> >
> > ==Motivation==
> >
> > The current political climate of bitcoin is extremely contentious. Many
> > community members
> > have different visions of what bitcoin is. This op code is meant to
> > enable [http://www.truthcoin.info/blog/blind-merged-mining/ Blind Merge
> > Mining].
> > This enables sidechains in Bitcoin. With OP_BRIBEVERIFY, sidechains
> > miners can
> > bribe bitcoin miners to to include their block hash in the bitcoin
> > blockchain. If their block
> > is included in the coinbase transaction's vout, it is assumed that block
> > is a mined block on the sidechain.
> >
> > This will allow various factions of the community to realize their
> > vision on their own separate
> > blockchain that is interoperable with the bitcoin blockchain. This
> > allows those factions to use
> > bitcoin as a 'reserve currency' for their own network.
> >
> >
> > ===Commitment Structure===
> >
> > A new block rule is added which requires that the miner's coinbase
> > reward be at index 0 in the coinbase transaction's output vector.
> >
> > It also fixes the witness commitment output to be at index 1 of the
> > coinbase transaction's output vector.
> >
> > This is needed so we can reliably tell what vout corresponds to what
> > drivechain. For instance, the mimblewimble sidechain
> > could correspond to index 2 of the vector outputs on the coinbase
> > transaction.
> >
> > The commitment is recorded in a <code>scriptPubKey</code> of the
> > coinbase transaction. It must be at least 34 bytes in size
> >    1-byte - OP_RETURN (0x6a)
> >    1-byte - Push the following 32 bytes (0x20)
> >   32-byte - block hash
> >
> > the 35th byte and onward have no consensus meaning.
> >
> > ===OP_BRIBEVERIFY op code===
> >
> > This op code reads two arguments from the stack. The stack top is
> > expected to be a sidechain id for which this user attempting to blind
> > merge mine for.
> > The next element on the stack is expected to be a block hash. This op
> > code looks into the coinbase transaction's output vector at the given
> > index (which is derived from the sidechain id) and checks
> > to see if the hash in the block matches the hash inside of the
> > BRIBEVERIFY program. If the hashes match, the OP_BRIBEVERIFY acts as an
> > OP_NOP. If the
> > comparison between the two hashes fail, the script fails.
> >
> > ===BRIBEVERIFY program===
> >
> > A standard BRIBEVERIFY program has the format:
> >   1-byte - Push the following 32 bytes (0x20)
> >  32-byte - block hash
> >   1 byte - Push operation? (needed if number can't be encoded as OP_0 -
> > OP_16)
> >   1 byte - sidechain id
> >   1 byte - OP_BRIBEVERIFY op code
> >
> > ==Detailed Specification==
> >
> > Refer to the reference implementation, reproduced below, for the precise
> > semantics and detailed rationale for those semantics.
> >
> >
> >  case OP_NOP4:
> >  {
> >     //format: block_hash sidechain_id OP_BRIBEVERIFY
> >     if (!(flags & SCRIPT_VERIFY_BRIBEVERIFY)) {
> >         // not enabled; treat as a NOP4
> >         if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS) {
> >             return set_error(serror, SCRIPT_ERR_DISCOURAGE_
> UPGRADABLE_NOPS);
> >         }
> >         break;
> >     }
> >
> >     if (stack.size() < 2)
> >         return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
> >
> >     const CScriptNum scriptNumSidechainId(stacktop(-1),fRequireMinimal);
> >     uint8_t nSidechainId;
> >     if (!checker.CheckSidechainId(scriptNumSidechainId,nSidechainId)) {
> >         return set_error(serror, SCRIPT_ERR_UNKNOWN_SIDECHAIN);
> >     }
> >
> >     // Check block hash
> >     bool fHashCritical =
> > checker.CheckCriticalHash(stacktop(-2),nSidechainId);
> >     if (!fHashCritical) {
> >         return set_error(serror, SCRIPT_ERR_UNSATISFIED_BRIBE);
> >     }
> >     break;
> >  }
> >
> >
> >
> > https://github.com/Christewart/bitcoin/blob/
> 94b6f33f2278c42d4d8758a3c8ffe2078e4ec933/src/script/interpreter.cpp#L427
> >
> > https://github.com/drivechain-project/bitcoin/pull/13
> >
> > ==Deployment==
> >
> > TODO
> >
> > ==Credits==
> >
> > Credit to Paul Sztorc for the original idea of Blind Merge Mined
> sidechains.
> >
> > Credit to CryptAxe for writing the foundational layer of software for
> > drivechains so I could implement OP_BRIBEVERIFY.
> >
> >
> > ==References==
> >
> > Blind Merge Mined Sidechains -
> > http://www.truthcoin.info/blog/blind-merged-mining/
> > Mailing list discussion -
> > https://lists.linuxfoundation.org/pipermail/bitcoin-dev/
> 2017-May/014408.html
> >
> > ==Copyright==
> >
> > This document is placed in the public domain.
> >
> >
> > _______________________________________________
> > bitcoin-dev mailing list
> > bitcoin-dev@lists.linuxfoundation.org
> > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
> >
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--001a11439808e98a5c05530d01b9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div>I haven&#39;t really been following the drivecha=
in discussion; I have found the documentation about how drivechains are sup=
posed to work scattered and difficult to follow. So, without advocating for=
 or against this proposal, I&#39;d also suggest that adding an opcode is no=
t the best way to implement this bribe.<br></div></div><div><br>The problem=
 I see is that to send a bribe one must first post a transaction to a scrip=
t that uses the OP_BRIBE code that fixes the critical hash (and the sidecha=
in id), and then a second transaction is needed to pay the bribe to the min=
er.<br><br>I suggest instead to use a 0 output value with some currently no=
n-standard OP_RETURN output script that specifies the critical hash (and th=
e sidechain id), similar to ZmnSCPxj&#39;s idea.=C2=A0 The difference is th=
at I we would soft-fork a rule that says that such an output is only legal =
when a miner places the same critical hash suitably in their coinbase outpu=
t.<br><br>OP_RETURN outputs are prunable from the UTXO set.=C2=A0 The speci=
al bribe output can be fixed to 0 value because the bribe will be paid usin=
g the transaction&#39;s fees.=C2=A0 To perform a bribe, a user creates and =
signs a transaction containing one (or more) of these special bribe outputs=
.=C2=A0 The fee of this transaction constitutes the bribe, and any change t=
he user has can be sent back to themselves.=C2=A0 This way only a single tr=
ansaction is required to make a bribe.=C2=A0 I didn&#39;t really understand=
 the bribe refund mechanism, but I think the fact that the bribe can be don=
e in a single transaction this way alleviates any need for bribe refunds.<b=
r><br></div><div>Hopefully I have understood the goal of this proposal.<br>=
</div><div><br></div></div><div class=3D"gmail_extra"><br><div class=3D"gma=
il_quote">On Wed, Jun 28, 2017 at 6:20 PM, Paul Sztorc via bitcoin-dev <spa=
n dir=3D"ltr">&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" =
target=3D"_blank">bitcoin-dev@lists.linuxfoundation.org</a>&gt;</span> wrot=
e:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-l=
eft:1px #ccc solid;padding-left:1ex">Hi ZmnSCPxj,<br>
<br>
It seems that, in your version, the &quot;bribers&quot; would react to the =
scheme<br>
in inefficient ways, particularly when the mainchain&#39;s tx-fee-rate (ie<=
br>
fee per Kb) is low.<br>
<br>
In short, there would be many bribe-attempts (each of which would take<br>
up space in mainchain blocks), almost all of which would be unsuccessful.<b=
r>
<br>
In turn, miners would likely react to this, and try to improve the state<br=
>
of affairs by offering users the privilege of occupying transaction slot<br=
>
#2 (ie, the one right after the coinbase). Users would need to trust<br>
miners for this, which introduces a cost friction which is pure<br>
deadweight loss. And, it might be easier for larger/older miners to be<br>
trustworthy than smaller/newer ones.<br>
<br>
Your way is actually very similar to mine. Mine _forces_ the bribe to be<br=
>
in the earliest txn (the coinbase) and to only occur once. Yours doesn&#39;=
t<br>
do anything to refund the briber, if the sidechain (but not the<br>
mainchain) reorganizes (as it can easily do, if an older sidechain<br>
parent is extended while the mainchain proceeds normally). This creates<br>
additional risk.<br>
<br>
I think mine is also much more space-efficient. Even if ours each had<br>
exactly one h* per sidechain per block, it seems that I only require one<br=
>
hash to be communicated (plus an indicator byte, and a ~2 byte counter<br>
for the ratchet), whereas you require two. Since its overhead per<br>
sidechain per block, it actually might really add up.<br>
<br>
Thanks,<br>
Paul<br>
<div class=3D"HOEnZb"><div class=3D"h5"><br>
<br>
<br>
On 6/28/2017 4:26 AM, ZmnSCPxj via bitcoin-dev wrote:<br>
&gt; Good morning.<br>
&gt;<br>
&gt; I still do not see what this does that cannot be done by:<br>
&gt;<br>
&gt; OP_RETURN &lt;sidechain-id&gt; &lt;sidechain-block-id&gt;<br>
&gt;<br>
&gt; A transaction with such an output would allow sidechain-miners to brib=
e<br>
&gt; mainchain-miners by paying a transaction fee if the transaction<br>
&gt; containing this OP_RETURN is included in a block and committed to by a=
<br>
&gt; mainchain-miner in the Merkle tree root.<br>
&gt;<br>
&gt; It would not require a softfork.<br>
&gt;<br>
&gt; --<br>
&gt;<br>
&gt; I have an alternate proposal that sidechains and altcoins that want to=
<br>
&gt; do &quot;blinded&quot; merge mining can use without a softfork:<br>
&gt;<br>
&gt; 1.=C2=A0 Encode a block header as a simple cons-pair, with the head as=
 the<br>
&gt; block and the tail as the parent cons-pair.<br>
&gt; 1.1.=C2=A0 This can be encoded as a 32-byte hash of the block includin=
g its<br>
&gt; header, and the 32-byte hash of the parent cons-pair.<br>
&gt; 1.2.=C2=A0 This is now the actual &quot;chain&quot; in the sidecoin/al=
tcoin blockchain.<br>
&gt; 2.=C2=A0 When a sidechain-node wants to know the consensus, it downloa=
ds<br>
&gt; mainchain-blocks and looks for OP_RETURN&#39;s.<br>
&gt; 2.1.=C2=A0 Starting with its genesis cons-pair hash (equivalent to the=
 empty<br>
&gt; list) as the current cons-pair, it scans each OP_RETURN transaction.<b=
r>
&gt; 2.1.1.=C2=A0 If an OP_RETURN is 64-byte and has the parent cons-pair e=
qual to<br>
&gt; the current cons-pair, look for the side block indicated and confirm i=
ts<br>
&gt; correctness.=C2=A0 If correct, update the current cons-pair for the ha=
sh of<br>
&gt; the OP_RETURN data.<br>
&gt; 2.2.=C2=A0 When reaching the latest mainchain block, the current cons-=
pair is<br>
&gt; now the sidecoin/altcoin latest block.<br>
&gt; 2.3.=C2=A0 Note that if multiple OP_RETURN in a block match the curren=
t<br>
&gt; cons-pair, the first one is considered the correct chain.=C2=A0 This p=
roperty<br>
&gt; means that the sidechain/altchain can only have a chainsplit if the<br=
>
&gt; mainchain has a chainsplit.<br>
&gt; 3.=C2=A0 When a sidechain-miner wants to create a side-block, it gener=
ates a<br>
&gt; new cons-pair and creates an OP_RETURN transaction for it, paying a<br=
>
&gt; mainchain-miner to include it in the next mainchain-block.<br>
&gt; 3.1.=C2=A0 The sidechain-miner risks that its competitors will outbid =
it and<br>
&gt; get its OP_RETURN earlier in a mainchain-block (or earlier in the orde=
r<br>
&gt; of transactions).=C2=A0 It can mitigate this risk by updating itself t=
o<br>
&gt; become a mainchain-miner, it can then keep its OP_RETURN transaction<b=
r>
&gt; private and put it earlier in the block, ensuring it will &quot;win&qu=
ot; the<br>
&gt; sidechain-consensus if it wins the mainchain-consensus.<br>
&gt;<br>
&gt; Regards,<br>
&gt; ZmnSCPxj<br>
&gt;<br>
&gt; -------- Original Message --------<br>
&gt; Subject: [bitcoin-dev] BIP: OP_BRIBVERIFY - the op code needed for Bli=
nd<br>
&gt; Merge Mined drivechains<br>
&gt; Local Time: June 28, 2017 8:37 AM<br>
&gt; UTC Time: June 28, 2017 12:37 AM<br>
&gt; From: <a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin=
-dev@lists.<wbr>linuxfoundation.org</a><br>
&gt; To: Bitcoin Protocol Discussion &lt;<a href=3D"mailto:bitcoin-dev@list=
s.linuxfoundation.org">bitcoin-dev@lists.<wbr>linuxfoundation.org</a>&gt;<b=
r>
&gt;<br>
&gt; &lt;pre&gt;<br>
&gt;=C2=A0 =C2=A0BIP: &lt;BIP number&gt;<br>
&gt;=C2=A0 =C2=A0Layer: Consensus (Soft fork)<br>
&gt;=C2=A0 =C2=A0Title: OP_BRIBEVERIFY<br>
&gt;=C2=A0 =C2=A0Author: Chris Stewart &lt;<a href=3D"mailto:chris@suredbit=
s.com">chris@suredbits.com</a>&gt;<br>
&gt;=C2=A0 =C2=A0Status: Draft<br>
&gt;=C2=A0 =C2=A0Type: Standards Track<br>
&gt;=C2=A0 =C2=A0Created: 2017-06-27<br>
&gt; &lt;/pre&gt;<br>
&gt;<br>
&gt;<br>
&gt; =3D=3DAbstract=3D=3D<br>
&gt;<br>
&gt; This BIP describes a new opcode, OP_BRIBEVERIFY, for the Bitcoin<br>
&gt; scripting system that allows for a user to bribe a miner to include a =
hash<br>
&gt; in the coinbase transaction&#39;s output.<br>
&gt;<br>
&gt;<br>
&gt; =3D=3DSummary=3D=3D<br>
&gt;<br>
&gt; BRIBEVERIFY redefines the existing NOP4 opcode. When executed, if the =
given<br>
&gt; critical hash is included at the given vout index in the coinbase<br>
&gt; transaction<br>
&gt; the script evaluates to true. Otherwise, the script will fail.<br>
&gt;<br>
&gt; This allows sidechains to be merged mined against<br>
&gt; bitcoin without burdening bitcoin miners with extra resource requireme=
nts.<br>
&gt;<br>
&gt; =3D=3DMotivation=3D=3D<br>
&gt;<br>
&gt; The current political climate of bitcoin is extremely contentious. Man=
y<br>
&gt; community members<br>
&gt; have different visions of what bitcoin is. This op code is meant to<br=
>
&gt; enable [<a href=3D"http://www.truthcoin.info/blog/blind-merged-mining/=
" rel=3D"noreferrer" target=3D"_blank">http://www.truthcoin.info/<wbr>blog/=
blind-merged-mining/</a> Blind Merge<br>
&gt; Mining].<br>
&gt; This enables sidechains in Bitcoin. With OP_BRIBEVERIFY, sidechains<br=
>
&gt; miners can<br>
&gt; bribe bitcoin miners to to include their block hash in the bitcoin<br>
&gt; blockchain. If their block<br>
&gt; is included in the coinbase transaction&#39;s vout, it is assumed that=
 block<br>
&gt; is a mined block on the sidechain.<br>
&gt;<br>
&gt; This will allow various factions of the community to realize their<br>
&gt; vision on their own separate<br>
&gt; blockchain that is interoperable with the bitcoin blockchain. This<br>
&gt; allows those factions to use<br>
&gt; bitcoin as a &#39;reserve currency&#39; for their own network.<br>
&gt;<br>
&gt;<br>
&gt; =3D=3D=3DCommitment Structure=3D=3D=3D<br>
&gt;<br>
&gt; A new block rule is added which requires that the miner&#39;s coinbase=
<br>
&gt; reward be at index 0 in the coinbase transaction&#39;s output vector.<=
br>
&gt;<br>
&gt; It also fixes the witness commitment output to be at index 1 of the<br=
>
&gt; coinbase transaction&#39;s output vector.<br>
&gt;<br>
&gt; This is needed so we can reliably tell what vout corresponds to what<b=
r>
&gt; drivechain. For instance, the mimblewimble sidechain<br>
&gt; could correspond to index 2 of the vector outputs on the coinbase<br>
&gt; transaction.<br>
&gt;<br>
&gt; The commitment is recorded in a &lt;code&gt;scriptPubKey&lt;/code&gt; =
of the<br>
&gt; coinbase transaction. It must be at least 34 bytes in size<br>
&gt;=C2=A0 =C2=A0 1-byte - OP_RETURN (0x6a)<br>
&gt;=C2=A0 =C2=A0 1-byte - Push the following 32 bytes (0x20)<br>
&gt;=C2=A0 =C2=A032-byte - block hash<br>
&gt;<br>
&gt; the 35th byte and onward have no consensus meaning.<br>
&gt;<br>
&gt; =3D=3D=3DOP_BRIBEVERIFY op code=3D=3D=3D<br>
&gt;<br>
&gt; This op code reads two arguments from the stack. The stack top is<br>
&gt; expected to be a sidechain id for which this user attempting to blind<=
br>
&gt; merge mine for.<br>
&gt; The next element on the stack is expected to be a block hash. This op<=
br>
&gt; code looks into the coinbase transaction&#39;s output vector at the gi=
ven<br>
&gt; index (which is derived from the sidechain id) and checks<br>
&gt; to see if the hash in the block matches the hash inside of the<br>
&gt; BRIBEVERIFY program. If the hashes match, the OP_BRIBEVERIFY acts as a=
n<br>
&gt; OP_NOP. If the<br>
&gt; comparison between the two hashes fail, the script fails.<br>
&gt;<br>
&gt; =3D=3D=3DBRIBEVERIFY program=3D=3D=3D<br>
&gt;<br>
&gt; A standard BRIBEVERIFY program has the format:<br>
&gt;=C2=A0 =C2=A01-byte - Push the following 32 bytes (0x20)<br>
&gt;=C2=A0 32-byte - block hash<br>
&gt;=C2=A0 =C2=A01 byte - Push operation? (needed if number can&#39;t be en=
coded as OP_0 -<br>
&gt; OP_16)<br>
&gt;=C2=A0 =C2=A01 byte - sidechain id<br>
&gt;=C2=A0 =C2=A01 byte - OP_BRIBEVERIFY op code<br>
&gt;<br>
&gt; =3D=3DDetailed Specification=3D=3D<br>
&gt;<br>
&gt; Refer to the reference implementation, reproduced below, for the preci=
se<br>
&gt; semantics and detailed rationale for those semantics.<br>
&gt;<br>
&gt;<br>
&gt;=C2=A0 case OP_NOP4:<br>
&gt;=C2=A0 {<br>
&gt;=C2=A0 =C2=A0 =C2=A0//format: block_hash sidechain_id OP_BRIBEVERIFY<br=
>
&gt;=C2=A0 =C2=A0 =C2=A0if (!(flags &amp; SCRIPT_VERIFY_BRIBEVERIFY)) {<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0// not enabled; treat as a NOP4<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0if (flags &amp; SCRIPT_VERIFY_DISCOUR=
AGE_<wbr>UPGRADABLE_NOPS) {<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return set_error(serror=
, SCRIPT_ERR_DISCOURAGE_<wbr>UPGRADABLE_NOPS);<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0}<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0break;<br>
&gt;=C2=A0 =C2=A0 =C2=A0}<br>
&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0if (stack.size() &lt; 2)<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return set_error(serror, SCRIPT_ERR_I=
NVALID_STACK_<wbr>OPERATION);<br>
&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0const CScriptNum scriptNumSidechainId(stacktop(<wbr=
>-1),fRequireMinimal);<br>
&gt;=C2=A0 =C2=A0 =C2=A0uint8_t nSidechainId;<br>
&gt;=C2=A0 =C2=A0 =C2=A0if (!checker.CheckSidechainId(<wbr>scriptNumSidecha=
inId,<wbr>nSidechainId)) {<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return set_error(serror, SCRIPT_ERR_U=
NKNOWN_SIDECHAIN);<br>
&gt;=C2=A0 =C2=A0 =C2=A0}<br>
&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0// Check block hash<br>
&gt;=C2=A0 =C2=A0 =C2=A0bool fHashCritical =3D<br>
&gt; checker.CheckCriticalHash(<wbr>stacktop(-2),nSidechainId);<br>
&gt;=C2=A0 =C2=A0 =C2=A0if (!fHashCritical) {<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0return set_error(serror, SCRIPT_ERR_U=
NSATISFIED_BRIBE);<br>
&gt;=C2=A0 =C2=A0 =C2=A0}<br>
&gt;=C2=A0 =C2=A0 =C2=A0break;<br>
&gt;=C2=A0 }<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; <a href=3D"https://github.com/Christewart/bitcoin/blob/94b6f33f2278c42=
d4d8758a3c8ffe2078e4ec933/src/script/interpreter.cpp#L427" rel=3D"noreferre=
r" target=3D"_blank">https://github.com/<wbr>Christewart/bitcoin/blob/<wbr>=
94b6f33f2278c42d4d8758a3c8ffe2<wbr>078e4ec933/src/script/<wbr>interpreter.c=
pp#L427</a><br>
&gt;<br>
&gt; <a href=3D"https://github.com/drivechain-project/bitcoin/pull/13" rel=
=3D"noreferrer" target=3D"_blank">https://github.com/drivechain-<wbr>projec=
t/bitcoin/pull/13</a><br>
&gt;<br>
&gt; =3D=3DDeployment=3D=3D<br>
&gt;<br>
&gt; TODO<br>
&gt;<br>
&gt; =3D=3DCredits=3D=3D<br>
&gt;<br>
&gt; Credit to Paul Sztorc for the original idea of Blind Merge Mined sidec=
hains.<br>
&gt;<br>
&gt; Credit to CryptAxe for writing the foundational layer of software for<=
br>
&gt; drivechains so I could implement OP_BRIBEVERIFY.<br>
&gt;<br>
&gt;<br>
&gt; =3D=3DReferences=3D=3D<br>
&gt;<br>
&gt; Blind Merge Mined Sidechains -<br>
&gt; <a href=3D"http://www.truthcoin.info/blog/blind-merged-mining/" rel=3D=
"noreferrer" target=3D"_blank">http://www.truthcoin.info/<wbr>blog/blind-me=
rged-mining/</a><br>
&gt; Mailing list discussion -<br>
&gt; <a href=3D"https://lists.linuxfoundation.org/pipermail/bitcoin-dev/201=
7-May/014408.html" rel=3D"noreferrer" target=3D"_blank">https://lists.linux=
foundation.<wbr>org/pipermail/bitcoin-dev/<wbr>2017-May/014408.html</a><br>
&gt;<br>
&gt; =3D=3DCopyright=3D=3D<br>
&gt;<br>
&gt; This document is placed in the public domain.<br>
&gt;<br>
&gt;<br>
</div></div><div class=3D"HOEnZb"><div class=3D"h5">&gt; __________________=
____________<wbr>_________________<br>
&gt; bitcoin-dev mailing list<br>
&gt; <a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@l=
ists.<wbr>linuxfoundation.org</a><br>
&gt; <a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-=
dev" rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.<wb=
r>org/mailman/listinfo/bitcoin-<wbr>dev</a><br>
&gt;<br>
______________________________<wbr>_________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.=
<wbr>linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.<wbr>org=
/mailman/listinfo/bitcoin-<wbr>dev</a><br>
</div></div></blockquote></div><br></div>

--001a11439808e98a5c05530d01b9--