The Perpetual One-Way Peg - NADO 12

Aaron van Wirdum Live from Utrecht, this is the Van Wirdum Sjorsnado.

Ruben Somsen Hello.

Sjors Provoost Oh my god, who's there?

Ruben Somsen A burglar.

Aaron van Wirdum We have another...

Sjors Provoost Entity.

Aaron van Wirdum We have another Van Wirdum Sjorsnado with Extra Somsen today.

Ruben Somsen That's right.

Aaron van Wirdum Ruben, welcome.

Sjors Provoost Welcome back.

Ruben Somsen Yeah, glad to be back.

Aaron van Wirdum Guys, first of all, congratulations. As of yesterday, we are the number one. In the world of most new corona cases. Well done. Even better than the White House? Yes, we're number one. Oh, that's amazing. Does anyone want to thank their parents, Ruben?

Ruben Somsen I just hope my parents will be safe in these trying times.

Aaron van Wirdum Sjors. I know you're happy with this.

Sjors Provoost No, I mean, I could say I told you so, but...

Aaron van Wirdum Yeah, you kind of did, didn't we? Like last week, that was basically... Who could have predicted this, right? I don't know. I guess Sjors could have. Okay, let's talk Bitcoin. Oh, do you want to add something about Corona, Sjors?

Sjors Provoost No, we'll see what happens.

Aaron van Wirdum We'll see what happens. Guys, I forgot to mention something.

Sjors Provoost Oh my God.

Aaron van Wirdum I have amazing news.

Ruben Somsen Tell me.

Aaron van Wirdum Actually, Sjors, you already know the news.

Sjors Provoost I know.

Aaron van Wirdum Ruben.

Ruben Somsen What's the news?

Aaron van Wirdum The Van Wirdum Sjorsnado has its own feed now.

Ruben Somsen Wow.

Aaron van Wirdum Its own RSS feed and it showed up in my podcast app.

Ruben Somsen Excellent.

Aaron van Wirdum So, I'm now subscribed to the Van Wirdum Sjorsnado. If you're listening and if you want to hear it for all our episodes, then you can subscribe to the Van Wirdum Sjorsnado.

Ruben Somsen I'll be subscribing for sure. It's actually exactly what I was asking you guys for, like what I was missing. I just wanted to be able to subscribe to your podcast specifically. So great.

Aaron van Wirdum That's two subscribers already, Sjors, me and Ruben. That's excellent. We're on the roll.

Sjors Provoost I was already subscribed. It's free. Another related news is that we have had our first swap cast.

Aaron van Wirdum Oh yeah, that's true.

Sjors Provoost Because we actually featured on the Unhashed podcast.

Ruben Somsen That's right. Yeah. So sometimes we're getting technical issues or whatever and unable to record. And then what we do is we look at other... podcast or something where maybe I appear or one of the other guys and we broadcast that. So in this case, I came onto your show. So I asked you guys, maybe we can put that on the Unhashed podcast. So our Unhashed podcast listeners were also able to listen to the last episode. And probably, you know, if, I don't know, a couple of weeks from now, we run into issues again, maybe I'll be asking you to air this episode. Maybe it'll be number two. Yeah. And

Sjors Provoost if you need an extra motivation to check that out, we actually re-edited the audio. So it's going to be a little bit better than the original.

Ruben Somsen That's correct.

Sjors Provoost Check it out.

Aaron van Wirdum All right. I wanted to mention that. Let's talk Bitcoin, Ruben. We're going to discuss another of your proposals.

Ruben Somsen That's right.

Aaron van Wirdum It's your sidechain proposal, which I'm sure has a very compelling name, which I'm forgetting right now.

Ruben Somsen Yeah, so it's actually kind of tricky because the word sidechain is very overloaded. So I'm not entirely certain whether or not I should be calling it a sidechain.

Aaron van Wirdum Right.

Ruben Somsen So generally speaking, these days I call it a blind merge mine chain. And it actually is kind of a combination of two mechanisms. So one is blind merge mining, which is some kind of process. where you somehow create another blockchain via Bitcoin. And the second one is called the perpetual one-way peg, which is kind of a method of creating a token on the chain without having some kind of speculation aspect where there's going to be a pump and dump, some kind of shit coin, avoiding all of that.

Aaron van Wirdum Yeah. And I say, first of all, the reason why you're probably not super comfortable calling it a sidechain is because the idea behind the sidechain is essentially that you move, bitcoins or coins or something back to bitcoins from Bitcoin to an alternative chain where alternative rules apply and then you can move it back to the Bitcoin blockchain

Ruben Somsen that's right

Aaron van Wirdum and that last step that's actually not possible in your proposal

Ruben Somsen that last step is not entirely possible there is some hope that maybe the token that's on there is not going to be too far from being worth one Bitcoin so you can trade it back and forth but that is not guaranteed at all

Aaron van Wirdum yeah that's kind of the theory which we'll get into in a bit yeah Okay, so it's not quite a sidechain, but it has some similar properties. Most obviously, this alternative chain can have alternative rules. So Bitcoin has all sorts of rules, like a block is found once every 10 minutes and all of the other rules. And then with this... Merge mine chain, this alternative chain, you can have other rules. For example, you can have more privacy or you can have more smart contracting types of capabilities or what are some other nifty benefits you see in a chain like this?

Sjors Provoost Or you can even have the same rules, but it's just going to be cheaper because you do a bunch of transactions on the side chain and then occasionally you make a block and that's represented as just one transaction on the Bitcoin side.

Aaron van Wirdum Yeah, cheaper transactions, that's an option. What are other benefits you foresee for something like this? Let's talk about that.

Ruben Somsen So, I mean, this is, I guess it goes into kind of the use cases. So I would say that this kind of chain, so it can be literally any chain, right? So everything that altcoins are doing can kind of be done on these blind merged mined chains, except the one difference here is that it's not going to be a store of value. If you want to store a value, you got to use Bitcoin. But anything else, anything that's not storing value, you can do with these chains. And then the question kind of becomes, well, what non-store of value use cases are there for other chains? And a couple of things have come to mind, mainly colored coins. So that would be the main use case, I think. Any person who wants to create some kind of token, USD tether, for instance, can issue these on a separate chain. And that is preferable to issuing them on top of the Bitcoin blockchain because on the Bitcoin blockchain, presumably fees are going to be high. You're going to have to compete for block space. But here you have your kind of your separate chain with your separate block space. So it's sort of scalable in that sense.

Aaron van Wirdum Could you have like a different monetary policy on a chain like this?

Ruben Somsen Well, the idea is generally that you don't really have a token that is being issued on this chain. So if you want some monetary policy on there, you kind of have to issue a token on there. And if you issue a token on there, you're going to reintroduce speculation. So I would say that's kind of a separate thing.

Aaron van Wirdum Okay.

Ruben Somsen So no, not really.

Aaron van Wirdum Okay, so let's get into how it works.

Sjors Provoost Yeah, especially, I guess we want to start with blind merge mining.

Aaron van Wirdum Yeah, there's two aspects of it. One you just mentioned is one of them is blind merge mining. The other is proof of burn.

Ruben Somsen Perpetual one-way peg.

Aaron van Wirdum Right, okay. So yeah, merge mining first.

Ruben Somsen Yes, yeah. So I guess... Very, very broadly, there are multiple ways of doing blind merge mining. And one we're going to be talking about here is kind of a fee bidding method of doing blind merge mining.

Aaron van Wirdum So what is merged or merged mining at all or blind or not?

Ruben Somsen So yeah, the original merge mining concept is kind of to ask Bitcoin miners to add a hash. off some other blockchain while they're hashing Bitcoin's proof of work. The word blind kind of adds to it that you don't really need the miners to figure out which blocks to add because the original method of regular merge mining, the issue was that the miners wouldn't be just checking Bitcoin. They would be checking all these other coins as well. And there were some concerns with that, that you're maybe overloading miners with too much work, making it more expensive to become a Bitcoin miner. So the blind part is kind of important in the sense that it allows anyone to create a block, not just miners. And miners still have to mine it, but through some mechanism, you're kind of compensating them for that.

Aaron van Wirdum Yeah, and to be clear, when you mean block here, you mean a block on this alternative chain, on this new chain. Yeah, so... like any blockchain it consists of blocks and these blocks are hashed and each hash so each block is then included in the Bitcoin blockchain and users of this merged mine sidechain they actually check the Bitcoin blockchain to figure out what their own blockchain is in a way i'm calling it their own it's you know they're probably also Bitcoin users or but you know they're they're They're using the Bitcoin blockchain to figure out what the sidechain looks like.

Ruben Somsen That's right.

Sjors Provoost Concretely, if you're using transactions in this example, as a sidechain user, you're checking the Bitcoin blockchain and you're looking for a specific kind of transaction. And in that specific kind of transaction, you see a hash. and then you take a note of that hash, and then you start syncing your sidechain blockchain, and as soon as you see that hash that you were expecting, you're like, okay, this is a valid sidechain block. If you see a different hash, you just ignore it.

Ruben Somsen That's correct.

Aaron van Wirdum Yeah. Well, you're skipping ahead a bit now, Sjors, because that was...

Sjors Provoost I'd like to.

Aaron van Wirdum Yes, well...

Ruben Somsen It's good. But it was a good explanation. Like, that's basically how you construct a blockchain.

Aaron van Wirdum Okay, so where is this hash included then in the Bitcoin blockchain? Right.

Ruben Somsen So the mechanism I came up with is kind of an alternative proposal to what Paul Sztorc proposed. He had an idea to do blind merged mining, which is related to his drive chains idea, which was basically a soft fork that would designate a space in Bitcoin's Coinbase to put a hash. And then anyone could kind of pay Bitcoins to miners to add their specific hash. to that Coinbase transaction. The downside to this proposal was that it would require soft fork. It was very specific to drive chains. It was not really a general method. And the method that I came up with...

Aaron van Wirdum Hang on. So in drive chain, this hash that we discussed that forms the merge mine side chain that is included in the Coinbase transaction, which is the transaction that a miner includes in his block to pay himself the block subsidy and the fees.

Ruben Somsen That's right.

Aaron van Wirdum So it's included in that hash. That's what Paul Sztorc suggested.

Ruben Somsen That's right.

Aaron van Wirdum And you have a different idea.

Ruben Somsen Yes.

Aaron van Wirdum It still uses a hash, but it's included somewhere else.

Ruben Somsen Exactly, yeah. So my method kind of generalizes that to something that is doable without a specific soft fork. It still requires the soft fork, but now we're using SIGHASH ANYPREVOUT. Just as an FYI, OP_CTV can also be used for this. So either one of those. proposals, if it makes it into Bitcoin as a soft fork, it enables what I'm about to talk about.

Aaron van Wirdum Yes, ANYPREVOUT, sorry, ANYPREVOUT we have discussed in episode?

Sjors Provoost Not yet. Coming soon, maybe.

Aaron van Wirdum Oh. But we did discuss CTV, or did we?

Sjors Provoost No, we've mentioned it.

Aaron van Wirdum Oh, okay. Passing, okay. All right. So, okay. Also future episode.

Ruben Somsen So I think it's fine to kind of keep that aspect about it high level, because it's not... integral to the idea. It's just what you got to know is that we create this string of transactions, one transaction after the other. With one input, one output, you're just moving a single Satoshi over every time. We use a relative time lock of one block, meaning that only one transaction per block gets into the Bitcoin blockchain. And we use that as a framework for other people to attach a hash to. So what anyone can do is take one of these transactions, add their own inputs and outputs. And with that, include a hash of a block they want to mine. And through replace by fee RBF, people can actually outbid each other for the privilege of being the one to add their secondary input and output and add that hash. And so what we've created is a kind of a fee bidding mechanism that kind of exploits or utilizes RBF to allow anyone to include their hash and therefore create a block on this other chain.

Aaron van Wirdum right so what we have here is we've created at the at a point where we're basically launching this chain we create a whole series of transactions that all refer to the previous one right and all of these are unconfirmed they're broadcast somehow, but they cannot be included in the blockchain yet because of the time lock. Am I saying that right?

Ruben Somsen It's a relative time lock of one block, meaning they can be included one at a time. And their fee is also zero. So somebody has to add an input and output and pay some kind of fee in order to have it appear in the blockchain.

Aaron van Wirdum So if we do this before we launch the sidechain or at the point where we launch the sidechain, then how many of these transactions do we create at that? point in time

Ruben Somsen yeah so there it is you can create an unlimited amount of transactions but everybody has to be aware of these transactions and know them so it is some kind of like upfront cost I don't know exactly what it comes down to but you could just create 100 years worth of these transactions and ensure that the blockchain will live for 100 years and then somewhere before it is 100 years you would have to have a hard fork in order to extend the chain beyond that so so it puts a limit on there but it's not It's not super, it's not really something that's practically going to be an issue.

Sjors Provoost And so this is where the magic of SIGHASH ANYPREVOUT comes in, right? Because you're saying you've pre-generated all these transactions. Yeah. And so the astute listener would say, well, they all have a hash. So how can I change anything in that long chain? Because I would break the chain. Right. Well, you can do that because SIGHASH ANYPREVOUT allows you. to not refer to a specific transaction ID, but instead refer to a specific output script. And so you can start adding inputs to that transaction and outputs to the transaction as long as that one specific output script is still there.

Ruben Somsen Yeah, that's exactly right. Yeah,

Aaron van Wirdum so to put it in layman's terms. Usually, a transaction refers to the previous transaction basically as a whole. Through this soft fork, you can have a transaction that refers to a small part of a previous transaction, and thereby you can change that previous transaction in certain ways. You can add stuff to it.

Ruben Somsen Yeah, that's exactly right. Thanks to SIGHASH ANYPREVOUT, it's kind of possible to do something like this.

Aaron van Wirdum I think you mentioned this, so sorry for asking again, but does this require... ANYPREVOUT, or would it just improve it? Because it sounds like it would really require it.

Ruben Somsen So either you have SIGHASH ANYPREVOUT, or you use OP_CTV.

Aaron van Wirdum Okay, one of the two you really need.

Ruben Somsen And there is a third method that Sjors kind of challenged me on, so I have to rethink that, but I think it's still possible.

Aaron van Wirdum He challenged you on that before we started recording, to be clear.

Ruben Somsen That's right. But I think it's still possible where you basically just create all these transactions ahead of time with a secret key. And then the person who creates it throws away the key afterwards, ensuring that these transactions can only be spent in one way. You will need kind of a different mechanism to include the hash because you can no longer. You no longer want to be able to change the transactions. You would have to have like a second output and then somebody should spend that second output to add the hash to it. So it would be possible. But the downside of that is it's kind of a trusted setup, right? Because there's somebody who has a key that they created all these transactions with. You hope that he threw away the key, but you're not certain whether or not he did. Although the downside is not that severe. So actually I'm not that opposed to trying it out before I get one of these soft forks. Because the worst thing that can happen is that the chain just halts because some unexpected transaction happens. And then it requires some kind of hard fork to get it started again, but nobody loses any value. So it's not terrible.

Aaron van Wirdum Okay, let's assume ANYPREVOUT for now. So we've got this chain of transactions that are unconfirmed for now, and they're confirmed one block at a time, and this means a new block is found. But there is some sort of bidding process going on with RBF.

Ruben Somsen That's right.

Aaron van Wirdum Which... the reason someone would be willing to outbid someone else with a block is because that block would pay him more in the new coins that are on the sidechain which are in turn mining fees that users of this alternative chain are paying to have their transactions included in this alternative chain.

Ruben Somsen Yeah, that's right. So it is very similar to how Bitcoin works. And obviously that's not a coincidence because it's really kind of emulating proof of work here. So the fees on, just like in Bitcoin, all the fees go to miners and that's what incentivizes miners to actually go and do all this hashing and create a block here. The miners, the blind Merge Mine miners, they take the fees from this blind Merge Mine chain and they utilize that to put in the hash in the Bitcoin blockchain and they pay roughly the equivalent of whatever they're being paid in these fees to the Bitcoin miners. So what it does, and that's kind of important to note, is that... Essentially, we are outsourcing the mining of this other chain to the Bitcoin miners because we're paying Bitcoin fees. And these Bitcoin miners will be competing over those Bitcoin fees through proof of work. So indirectly, it's still proof of work. But we're utilizing Bitcoin as a kind of step in between.

Aaron van Wirdum Right. I'm thinking of 51% attacks. Could this system be 51% attacks in some way? Say you're willing to pay more fees in a competing block in the next Bitcoin block, or does the sidechain have these rules? I'm just calling it a sidechain.

Ruben Somsen Sure.

Aaron van Wirdum Does the sidechain have a sort of rule that it can't be 51% attacks compared to the Bitcoin blockchain? Because that's how it would... benefit from the Bitcoin security, right? I guess.

Ruben Somsen Yeah. So I think it's always kind of a spurious claim to say that you're getting security from the Bitcoin blockchain, but there does seem to be, to some degree, that does seem to be happening. So just like to be very clear and practical about this, there is a way, like the difference with proof of work mining is that it's not a process where randomly a winner is selected. It's a process where whoever pays the most gets to create a block. So if you want to stop this chain, you could literally do so by just paying higher fees and creating a block that just contains nothing or even just an invalid block that's fine too that would just be ignored. But in doing so, what's interesting is that the fees will start to accumulate on the sidechain. Let's call it a sidechain. So this kind of creates fee pressure where for the next block, if you want to keep censoring it, you got to pay even more. For the next block, you got to pay even more. So there is this kind of like pressure where at the end of the day, it becomes quite similar to what Bitcoin does.

Aaron van Wirdum Right. So, but that's a censorship 51% attack.

Ruben Somsen Yes.

Aaron van Wirdum What about double spend 51% attack? I'm guessing that...

Ruben Somsen Like a reorg or...

Aaron van Wirdum Yeah. Yeah. I guess that wouldn't be possible without actually re-orging the Bitcoin blockchain.

Ruben Somsen So it is possible, but it would be a slow process. So that's kind of interesting. So let's say you want to just do a two-block re-org off the sidechain. So what happens is that you have to put a block that has a lower block height, you have to put that into the Bitcoin blockchain, the hash of that block. So what that means is for the longest sidechain, the longest chain, on the side chain, there's no block basically occurring, right? Because there's not as older block, it's not the longest chain. So basically nothing happens. For 10 minutes, there's no new block. And then another block gets created. And then another block gets created. And now that shorter chain becomes the longer chain. So basically the longest chain halts while you're re-orging the chain. And that's... very unique to this proposal. And I think at the end of the day, that actually kind of ends up being a security benefit because it means that if you're a hundred blocks into the future, you know it's going to literally take a thousand minutes at least to reorg those blocks.

Sjors Provoost Well, but you can't do anything in those thousand minutes, except... Make a phone call.

Ruben Somsen Yeah, so the chain halts during that time, but that is also when the sidechain fees start to rise because people can't get their transactions in, which makes it even more difficult for that reorg to occur. There is an interesting mechanism there that seems to work out pretty well, but I do think it requires more deep thought and maybe just some experimentation to kind of see how it works out in practice.

Sjors Provoost I guess another way to look at it is that if you want to annoy this sidechain, if we call it that way. We can edit it in post production. There's only one Bitcoin block or one Bitcoin transaction available every Bitcoin block where you can decide the next sidechain block. And so you can DOS that particular Bitcoin transaction for every sidechain block. And you can DOS it in different ways, right? You can create empty blocks on the main chain for the sidechain, or you can... Fork off a very old sidechain block or you can just put complete garbage in it. Yeah Yeah, but yeah, but as long as the fees on the sidechain represents some real value, they'll accumulate and eventually it'll get expensive for you to do this.

Ruben Somsen That's right, yeah.

Sjors Provoost But perhaps not prohibitively. Yeah. That's interesting.

Ruben Somsen Yeah, but it is kind of similar to how in Bitcoin you could like 51% attack and create these bogus blocks all the time. But in Bitcoin, it's very obvious how expensive that is. And here, especially when you think about a low value sidechain, It's maybe not as obvious whether or not that's going to work out. And that's definitely a thing, right? Because with Bitcoin, we also have the benefit of having a block reward where every new block creates a new Bitcoins and that also moves things forward. And that's going to be different in this chain where we don't actually introduce a new coin, a new token. There are no coins being generated. So really everything has to come from fees. So that's not going to be exactly the same as Bitcoin.

Aaron van Wirdum There's no subsidy.

Ruben Somsen There's no subsidy.

Aaron van Wirdum Okay, so that's the merged mine.

Ruben Somsen Yes.

Aaron van Wirdum I think that's pretty clear to me. Is it to you, Sjors?

Sjors Provoost Almost, but I have one more advanced question. What is in this scaffold of transactions that we're talking about? Because like we said, we pre-generate a whole series of transactions for the next 10 years, and they each have one input and one output, and those will stay the same forever, but we can add inputs and outputs later to commit to blocks, et cetera. What is in these initial... inputs and outputs, and why can't I shuffle them around and do mean things with them?

Ruben Somsen Right. So... This is actually a covenant. So a covenant is basically an enforcement of how an output is going to be spent.

Aaron van Wirdum But Bitcoin doesn't have covenants.

Ruben Somsen Bitcoin doesn't have covenants yet. But with ANYPREVOUT, actually, we'll be kind of incidentally introducing the equivalent to the OP_CTV covenants, which is something that Jeremy Rubin has been working on. And essentially what it is, is this is with OP_CTV, I guess it's easier to explain. It's basically a hash in the output. that determines what the next transaction is that is allowed to spend that output and what we do here is instead of the hash we actually put the signature in the output ahead of time so normally what you have is you have a you have a pub key or a pub key hash and then when you spend it you you create the signature for that pub key hash and what we do here is we actually have in the outputs the pub key hash plus the signature And it's all there already. So it's already predetermined how it's going to be spent. But this is only possible with a SIGHASH ANYPREVOUT because the signature kind of refers back to the transaction itself. And that will be kind of a circular reference. So with ANYPREVOUT, because you don't have to sign the transaction itself, the transaction that you're spending, or at least not the TXID, you don't have that issue. So it becomes possible to do a covenant like that.

Sjors Provoost But the signature in transaction one refers to transaction two. Yeah. And the signature in transaction two. refers to transaction three because the signature is in the output now.

Ruben Somsen That's right.

Sjors Provoost Yeah, this is quite mind-boggling.

Ruben Somsen That's right. Yeah, it is. It is a little, it's a little bit of a hack. And I guess we're going to have to wait and see kind of what the final version of ANYPREVOUT becomes. But it seems like this will be possible. It is less efficient than OP_CTV because with OP_CTV, it's literally a hash and here it's a signature. So a signature is kind of double the data roughly and you need to do a signature check. Just one little side note that's kind of funny is that the signature doesn't need to be secure. in the sense that it doesn't really matter what the private key is. So the most efficient way of doing it is actually using the generator G as the pub key that you're signing the signature with. And it doesn't matter because you're already committed to what transaction you're signing. So the fact that it's G and everybody knows it is kind of irrelevant.

Sjors Provoost Doesn't something have to increment? Because otherwise all these transactions would be identical and I could still swap them out. Or is the recursion creating different hashes all the time?

Ruben Somsen The recursion should be creating different hashes all the time, yeah.

Aaron van Wirdum so okay so I didn't get any of that but I think we can move on anyways right like the smart the smart listeners maybe got something out of that the dumber ones We still get the gist. I get the gist. I think that's good enough.

Ruben Somsen That's the important part.

Aaron van Wirdum I agree. I agree. Okay. All right. So then the other part is burning.

Ruben Somsen That's right.

Aaron van Wirdum Getting coins from the main chain, essentially, to the side chain.

Ruben Somsen Yeah. Because what we've described so far is just basically an altcoin that happens to be mined instead of like with proof of work or proof of stake or whatever nonsense you want to think of, that happens to be mined through this kind of blind merged mining process. But we don't want to create an altcoin. We want some kind of... chain that is useful for Bitcoin without creating the secondary token that's going to be speculative that people are going to pump and dump on because that's what always happens if you create a token even if your intentions are good it doesn't matter

Aaron van Wirdum but then how do we get rich Ruben how do we get rich

Ruben Somsen well indirectly you get rich because if this sidechain is popular The idea is we have a method called the perpetual one-way peg where people burn their Bitcoins, they destroy their Bitcoins.

Aaron van Wirdum That sounds like the opposite of getting rich.

Ruben Somsen It is getting rich because everybody who doesn't burn their Bitcoins gets... Their token gets more scarce if you go from 21 million to 20 million.

Aaron van Wirdum We're luring people into this sidechain.

Ruben Somsen Maybe.

Aaron van Wirdum And we keep our coins.

Ruben Somsen That's right. Yeah. So anyone who doesn't move into this. But that's the interesting part. Indirectly, you're benefiting from this activity as a Bitcoiner. And that's actually where all the speculative value goes. Well, it's not really speculative value, but all the value, I would say.

Sjors Provoost Because you said the maximum value of whatever is on that chain with this mechanism would be one-on-one.

Ruben Somsen That's right, because you can always burn a Bitcoin and receive a sidechain token through this mechanism. So it will never be worth more than one Bitcoin.

Sjors Provoost But I'm more worried about the minimum value.

Aaron van Wirdum Hang on, hang on. Because I interrupted you in the middle of your actual explanation. Let's get back to the actual explanation.

Ruben Somsen I already forgot what I was trying to say.

Aaron van Wirdum You want to get coins from the main chain to the sidechain.

Ruben Somsen Yes.

Aaron van Wirdum So you've got to burn coins on Bitcoin. How do you burn coins on Bitcoin, first of all?

Sjors Provoost Please don't burn Bitcoins.

Ruben Somsen So that's the funny thing, right? Like I think it's fine to burn Bitcoin, but I think everybody's intuition is it's a terrible thing to burn Bitcoin. So we'll definitely have to get back to that. But yeah.

Aaron van Wirdum To be perfectly clear for those who don't know this, burning Bitcoin just mean you make them unspendable.

Ruben Somsen Yeah.

Aaron van Wirdum Right?

Ruben Somsen You destroy them, I would say. Like not even unspendable. It's just, yeah, they're gone.

Aaron van Wirdum So how do you do that?

Sjors Provoost There are two ways to utterly destroy Bitcoin. I mean, you can destroy it.

Aaron van Wirdum Three ways, actually.

Sjors Provoost You can destroy it in a way that it's obvious to people and you can destroy it in a way that's provable to nodes.

Aaron van Wirdum It's both obvious, right?

Sjors Provoost So obvious to people means you're sending it to an address called 1vanwirdum, which you know for sure does not have a private key. So it's obvious to humans that this stuff is worthless, but a node has no way to know, so it keeps track of it anyway. Right.

Aaron van Wirdum And then the other way is what you're proposing, right, Ruben? So explain that.

Ruben Somsen Yeah, so the other way would be via OP_RETURN. So OP_RETURN is an opcode that is generally used to kind of add data to the Bitcoin blockchain, but it can also be used to, if you put... If you create an OP_RETURN output and you put your bitcoins in there, your bitcoins are gone. They're not going to go to the UTXO sets and nobody's going to look at them again. And for that reason, actually, like the UTXO set is not like the number of the number of coins that were minted up until now. It's a lower number because we already had a bunch of coins burned through OP_RETURN.

Aaron van Wirdum Yeah. OK, so you're sending coins to this OP_RETURN address.

Ruben Somsen Yes.

Aaron van Wirdum This OP_RETURN address that includes a bunch of data and this data specifies which. address on the sidechain should get the coins and you should have the private key of this address on the sidechain and then everyone who's running the sidechain software notices this OP_RETURN on the Bitcoin blockchain and then attributes this newly generated side coin sidechain coins to this address and that's how you move coins from Bitcoin to the sidechain, correct?

Ruben Somsen Yes, but I think there's actually a simpler way of doing it. So that would definitely be one way of doing it. But I think probably the way that I would like to go with is to have the people who are creating these sidechains, the blocks on the Bitcoin blockchain, have them destroy the tokens. And that means that in the Coinbase transaction on the sidechain, they can claim whatever tokens they burned. And I think that's going to be the easiest mechanism. And then they can choose for themselves what kind of key to use on the sidechain because they're the ones who are creating the block.

Aaron van Wirdum But that means there can only be one new user of the sidechain per 10 minutes? That

Ruben Somsen means that, well, so the thing you're forgetting is that... This is putting coins into the blockchain, into the sidechain. But that doesn't mean that that's the limit of the number of users, right? Because you can use atomic swaps to swap back and forth between the chain. So you really only need one person to kind of add more coins when there are not enough coins because there's a high demand. And then anything after that is just people trading these tokens on the sidechain for Bitcoin and vice versa.

Aaron van Wirdum Right, that makes a lot of sense, of course. Okay, so then... Then the big question is value, right? That's what you want to get to.

Sjors Provoost Because we've decided the maximum value of this. Well, because you can arbitrarily burn more Bitcoin, you can always keep that price below one Bitcoin.

Aaron van Wirdum It wouldn't make any sense that the sidechain coin ever becomes worth more than a Bitcoin. Because if you have a Bitcoin, you can always burn it to become a sidechain coin. But if you have a sidechain coin, you can't burn it to get a Bitcoin. The sidechain coin just has less options than Bitcoin, so it will never be worth more than a Bitcoin.

Ruben Somsen And just to add to that, yes. And to add to that, I would say that for that reason, this is never going to be store of value. If you want to store value, use Bitcoin. This is not a token that you're going to be using for having your wealth there and maybe like some kind of privacy coin or something like a Mimble Wimble where you can add privacy to the chain, but it's never going to be store of value privacy like Bitcoin is.

Aaron van Wirdum And more than that, this is why you're not going to have enriched altcoin founders.

Ruben Somsen That's correct.

Aaron van Wirdum That's not going to be possible under this scenario.

Sjors Provoost Yeah. So I would like to call this proof of pain.

Aaron van Wirdum Yes.

Sjors Provoost The reason for that is really when you think about when you're burning a Bitcoin and you look at the other side at the sidechain and you might say, oh, well, a Bitcoin was burned. Therefore, this thing must be worth a Bitcoin. But if you look at it as a sort of a collateral. Then the question is, what is on the other side of the collateral? Well, it's burned Bitcoin. So it's a bit like I give you a token that says this is worth the price of my burnt down house. So I'm going to burn my house and I'm going to give you a token. So I burned a house and I'm giving you a token. But is that token really worth a house? I don't think it is.

Aaron van Wirdum Why would it be worth anything? I guess that's the main question. Why would this sidechain coin have any value at all if you can't exchange it for Bitcoin?

Ruben Somsen Why would you even want a token there in the first place?

Sjors Provoost Well, if there's nothing left on the other side. Because you've just burned the whatever thing of value there was.

Ruben Somsen Yeah. So I think you can make roughly kind of the same analogy for Bitcoin, right? Where you can say like, well, you're burning all this electricity, right? And the electricity is gone. And now you have these numbers on this other chain. Like, well, what's the point? And the point is, well... Bitcoin enables something that we didn't have before, right? So I guess the argument would be, well, what is this enabling that is useful, that is worth destroying value for? And the answer is basically block space and whatever that block space you can, whatever you can use it for. So the idea is that you need some kind of native token on on any chain that you're creating to pay for fees you could theoretically you could try to pay out of band to miners but that gets really messy so you know small tangents theoretically possible in practice not really so the question really is is that is that block space useful for something and that comes down to the questions well what is this chain going to be used for well clearly it's not going to be used for storing value like I said So what else can you use it for? Well, the first is colored coins, right? So if you want to issue tokens, you want to create all kinds of tokens for all kinds of nonsense that people are doing these days. USD Tether would be a good example of something that is pretty useful. And let's say you want to create USD Tether and then you want to be able to trade it for Bitcoin.

Aaron van Wirdum But the reason USD Tether is useful is because it's guaranteed, or at least in theory, to be exchangeable for a dollar. But that wouldn't even be true here either. There's no guarantee to be exchangeable for anything.

Ruben Somsen No, so I'm saying...

Aaron van Wirdum And it doesn't even have speculative value because you know for a fact that it's not going to be worth more than Bitcoin. Which I would argue is the only reason altcoins have value. It's because people hope that it's going to rise in value faster than Bitcoin. So now you've created an altcoin that doesn't have the only benefit of altcoins. So what are we doing there, Ruben?

Sjors Provoost Let's take a step back here because the example of Tether... is something you could do without the whole peg thing, at least initially and naively. So what one could do is you create this new side chain, quote unquote. And this side chain, basically it has its own rules and somebody with actual money issues USD tether and says, okay, hereby declare that this 1 million tether exists. And there is otherwise no interaction with the Bitcoin blockchain other than creating these blocks and the mechanism we described. And then the fees that you're paying you would actually pay real, well, real quote unquote dollar tethers to the miner. And the Bitcoin miner could then estimate, well, okay, I've gotten this many dollar tethers, so I'm willing to spend this much in Bitcoin fees to do this. So then you're not burning any Bitcoin and then it makes me feel a lot better.

Ruben Somsen Yeah, that's right. So that's entirely possible as well. And I think that's reasonable. I think it depends on the use case. And the goal that I have for this is that I want to create a chain where there is not some kind of IOU structure involved. So with USDTether, you have the problem that this chain will stop. working once the USD tether stops working once the peg is broken. And depending on your use case, this may or may not be important. So maybe for USD tether, it could be fine, like what you're describing. I think that's a valid use case as well. And I would actually think that people should probably pursue that. But I do think there are other use cases that are maybe not... directly something like that like let's say you know let's talk about something silly like you know rare pepes or crypto kitties right like let's say you want to issue crypto kitties rare pepes so these are just tokens that are not really worth anything they become worth something like where you got to start somewhere you got to have a chain first with some kind of token to pay for block space and only then can you create new tokens on that chain and and then your rare pepe [unclear] something and then maybe you pay the miners in rare pepes I don't know that's possible right

Sjors Provoost that's what I was thinking you can just pay the miners in rare pepes and that actually puts a nice monetary value on the pepes because you have the market somewhere where people just trade them directly but you also have the transaction fees and if the miners don't believe if think the market is rigged well then nobody's going to be mining

Ruben Somsen so I think it's fine if the chain transitions into that and if that means that this this this token that I envision is just Very few people burn the Bitcoins and you only have like, you know, a thousand Satoshis in there or something, I don't know. And that's what's being used to kind of bootstrap the chain. And then eventually people switch over to paying fees in rare Pepe's. Like, I don't have a problem with that. I think that's absolutely fine. And the thing is like, the token is just for block space. And it's just kind of a way to have a token you start with and you pay. And it doesn't have to be worth a lot, but it'll probably be worth something. Just one person has to put one Bitcoin in and that's going to be sufficient to kind of lubricate the whole system and pay for fees. Once you pay for fees, the miners get the token back. The token gets sold to the markets. Other people buy the token again and they pay for fees again. And it kind of becomes this cycle, basically.

Aaron van Wirdum That's pretty interesting. Yeah. I would mention another benefit, which is right now a lot of altcoiners and altcoin founders, they claim that they're in it for the technology. Yeah. And the technology is going to introduce this great new possibilities in the world that we've never seen before and they're not in it for money at all like that's not why they're in it they're in it for the technology yeah now with something like this you could very easily make the argument look everything you want to do you can do here and you can do it more securely because you're levering the security from the Bitcoin blockchain The only downside is that you can't become rich by speculation. Hey, but you didn't care about that, right? Yeah. So it sort of destroys that narrative. Like there's really nothing left for them. No excuse left for them to create their own pump and dump coins.

Sjors Provoost I think you mentioned plausible deniability in an earlier podcast with the police and bag comparison.

Ruben Somsen That's right. Yeah. So it's kind of like how currently if you want to create some new chain with some new technology. you have to create some kind of token because it cannot function without it. And this kind of gives you an alternative way of doing it. And so what this does is it basically no longer gives you an excuse to create your own token. You can't just say like, oh, you know, I have this new chain. So I guess I'll create a new token. I'm sorry. Oh, people are speculating on, well, that wasn't my intention, but okay. You now have an alternative. So yeah, that removes your plausible deniability. Now you actually have an alternative. And the question then becomes like, why aren't you doing that? I'll give you one example. Actually, there's the Tari blockchain that Monero is using currently. You know, maybe they haven't seen this proposal yet, but they are creating basically a merged mine chain for Monero. And they're creating yet another token on there called Tari or something. And now the question is, well, why don't you just burn some Monero and do it that way? So you remove the speculation because all they want to use it for is colored coins. So that would be one, you know, to give a call, call somebody out. I guess it would be that one.

Sjors Provoost Yes, but we just described that with the Rare Pepe example and with the USD Tether example, so either a token that's backed or something that's new and speculative, you can still speculate with it because you just don't use any native token that's related to Bitcoin. You just use the token that you issued. So is speculation really going to go away?

Aaron van Wirdum Somehow I don't think so, Sjors.

Ruben Somsen Yeah. Somehow. Obviously, yeah, these colored coins that you're creating can then be used to speculate on. But I think it probably separates the technology of the chain from the speculation, right? So now it's just going to be the token. It's like, well, this is some token that in the future is going to be worth lots of money because the people behind this token are going to do great things, blah, blah, blah. You know, that kind of ICO nonsense. that becomes separated from, you know, this chain is amazing because it's Turing complete and you can do smarter contracts than Bitcoin and therefore it's going to go up in value. Like that gets completely separated. And, you know, it's funny because the actual, the original claim of the Ethereum was that they were going to create a chain. that was going to do all these amazing things that Bitcoin couldn't do, but it wasn't going to be a store of value. It wasn't going to be competing with Bitcoin. You know, that was not the point. The Ether was just a gas to pay for these contracts. And actually, that is what this is. And that is what Ethereum is not. So anything that doesn't require store of value doesn't require a token. So theoretically, that should remove value from the coins that do pretend that their token is needed.

Sjors Provoost So perhaps this could be used for Ethereum 2B.

Ruben Somsen 2B, like the B version of it. I guess you could port over Ethereum and do it without a token. Yeah, that's right.

Sjors Provoost Interesting, interesting. Is that all we've got?

Aaron van Wirdum I've learned something today, Sjors, you?

Sjors Provoost Yeah, I've definitely learned a few things today.

Aaron van Wirdum Okay, well, thank you everyone for listening to the Van Wirdum Sjorsnado Special Somsen Edition. There you go.