Let's get a closer look at this at this tweet here, although I know I have two

laptops up here so I have to do the right one. There we go.

Okay, so this is why merged mining and Drivechains are such a nasty attack.

Paul is a really awful person to push this. And then we have here, we have even

more intrigue. Merged mine sidechains was Greg Maxwell's biggest mistake. In

fact, the biggest mistake of a lot of people. So there's just so much intrigue

here. My name is Paul Sztorc. I have a background in economics and statistics

particularly. For two and a half years I worked at the Yale economics department

for Bill Nordhaus directly. He won the Nobel Prize a few months ago. While I was

working there, I invented this Bitcoin technology called Truthcoin, which is

later split up into several projects. Augur and Gnosis are Ethereum versions.

There's one called M of AO by Zach Hess. That's its own blockchain. And then

there's a Bitcoin core fork that is called Bitcoin Hivemind. I also started a

cool Bitcoin blog called Truthcoin.info and have a bunch of famous posts up

here that a lot of people seem to enjoy reading. There's one about nothing is

cheaper than proof of work. Cycles back every now and then and we'll get like

seven, ten thousand views in a day when someone links to it. And I presented at

the first three scaling conferences and I was on the program committee for the

fourth one. More succinctly, I'm a really awful person, I suppose. So I was going

to originally give this talk on something kind of really specific and

esoteric, but instead this like thing happened like last week. So I thought

I'd kind of rearrange the talk and it will still be about what I wanted it to

be about, but it will just be in kind of a different order than you're thinking.

So first I'm going to talk about what sidechains are and how they work and

then I'm going to talk right and go right into these critiques because why

should you have to, you know, fight personally through all this technical

specialization when there's already people who will critique the project for

you. And then I'm going to try to maybe at the end sneak in this point that I was

going to make as the entire sidechains presentation before. So, two laptops at

once. Okay, I'm going to use a mouse like an idiot on this one. Okay, here we go. So

what are sidechains? Surprisingly the definition has become quite contentious.

The definition that I use is a little old-fashioned. It's this original

definition about basically saying that hard forks are bad because implementation

changes to the consensus critical parts of Bitcoin must necessarily be handled

very conservatively. But you can do something else instead where you can

kind of build a little compartment that people can opt into and this is a really

good sentence here I think. We propose a new technology peg sidechains which

enables bitcoins and other ledger assets to be transferred between multiple

blockchains. This gives users access to new and innovative cryptocurrency

systems using the assets they already own. So that's great. These are some

slides from Adam back from 2016. He's talking about the things that you can

use sidechains for a little bit more concretely. Basically though the idea is

that Bitcoin will, you can send Bitcoin to a different piece of software and the

Bitcoin money can kind of pretend that it's an altcoin. So it can pretend to be

like Ethereum or Zcash or Bitcoin Cash. This is a meme that I made on my

website when the price of Bitcoin was $6,800 and now I just scroll down. It's a

screenshot of CoinMarketCap and with sidechains there's no real need for

altcoins to exist because you can replicate their features perfectly. So

the least popular altcoin will be on the chopping block. It will probably

collapse and die out. And then the second least popular one will be the new least

popular living one and that one will die out and then they probably just be all

destroyed and something that I call iterative deletion. And so instead in the

sidechain world the different quantities of Bitcoin will be in different pieces

of software on different chains. And so you can see at the bottom here I have

this grand total 21 million coin limit and I have these 4.3 million coins that

have not yet been mined and we have the 16 or so 17 million that are in

circulation and they would be broken up. Not all of them would be on Bitcoin core.

Some of them would be hanging out on other projects and those projects are

free to take risks or be very dumb ideas. So that's the idea and this is a

it's kind of a restatement of this multiple blockchains hard fork

alternative concept. So I actually built this. Actually Cryptex basically did

all the work and he's also at this conference although I don't know. I don't

see him in the room so I guess he's taking advantage. Oh he's over there. So

Cryptex and I we built this and here's three screenshots. You can see this one

is Bitcoin core with a different color scheme but also with a tab that's called

sidechains in the top right. And then you here this is how you add a new sidechain.

You first you write the software and then you paste, excuse me, you paste the

hash of the software here and click this button. These are a little outdated. We've

actually made this a lot better but this is a will give you a basic idea. So

you just kind of click a button and then this sidechain. It's a little more

complicated than that but this is basically it. And then you have this

sidechain that exists in a list and you can send Bitcoin to this piece of

software and it will receive it. And then you can also send Bitcoin away from that

piece of software and get it back from this. This is called Grin but that's a

joke. This isn't actually Grin. It's just an example that we titled Grin which is

a MimboWimbo project of course but that's like an idea. It's an example of

stealing the altcoin technology. Okay. So how does it work? There is a, there's

these two components to Drivechain which is the sidechain technology that

Cryptex and I developed. One is this idea of the hashrate escrow which is like a

container output. It compresses three to six months of sidechain data into a

fixed 32 bytes and I'm going to explain that because it's pretty important. But

then there's this other thing called Blind Merged Mining which replaces the

act of running a sidechain node with the act of just including a single high fee

transaction. So what does all that mean? Well here I have a diagram in the main

chain is in orange and the sidechain is in green below. And the thing is the main

chain full nodes do not and cannot validate the sidechain rules or data. So

because that would, well I'll get to that in a second, but the whole point here is

that these are like optional plugins. So the main chain full node needs to be

able to see perfectly accurate picture of the network regardless of what

happens on the sidechain. But as there's a problem with that which is that to

below to the main chain full node these two histories will look the same. And I

have one where A sends money to B and then B sends money to themselves in the

sidechain. And then it changes owners to E and F. There's a different history where A

sends money to B, sends money to C, sends money to D, and then sends money to a

completely different person, H. And to the main chain these have to look the same.

You just see that A and B went in and E and F came out or that H came out. And you

don't know which one of them is legitimate. But since you are only tracking this net

effect, you can in fact compress it down to one transaction ID which is just 32

bytes. And we basically just cheat and we say these 32 bytes will probably be

correct although there's more to it than that as I'm going to explain. And the thing

is you've compressed it down to 32 bytes and the sidechain full nodes and the

sidechain SPV nodes will be yelling these 32 bytes constantly every block for the

32 months. So they'll be trying to warn everyone which of the 32 bytes are right.

But the only way to know for sure if they're right is to run the sidechain full node and

that is the illegal thing because that cannot be mandatory for our main chain users. And I

have this metaphor that people think is very funny but it's basically like you're trying to

cross this finish line. The 32 bytes are inserted into the main chain and then they

march very slowly across a kind of finish line. And the finish line is very, very, very

far away. It's 13,150 steps away and you can only take one step per block. So this is

very, very rare. 32 bytes, three to six months. And the thing is only one, per sidechain

only one 32 byte train car can advance at a time. So I have a funny video here. It's not

really a video but it's pretty simple and you can just see that only one of these things

will be able to take a step forward at a time because if you try multiple ones at once then

it's a mutual exclusivity. So if one advances the others go backwards. So you don't want to

watch this second from the bottom one. This one will go up a little bit first so I'll go back.

It's time equals ten and then one goes up and another one goes up and the other ones are

forced to go back to the finish line. Miners can also just abstain from moving any of these

or they can just say they don't know what's going on and set them all back. Ultimately you

can only get one to move forward. And I'm going to explain line merge mining in a second

because it's best explained. All this is best explained in the context of the critiques

because again what does it matter what I think, how I think it works. Let's hear from the

skeptics. So the two big critiques are this idea that miners can steal and also this extremely

esoteric Peter Todd point about an increased likelihood of main chain transaction censorship.

So I'm going to refute both of these or try to. Both of them are completely false and they're

both so weird and they have so many weird errors mixed in and just general confusion that I

actually often trip myself up by trying to articulate all of them at once which is why I wrote

this down. And you'll see it's like there's like five things wrong simultaneously with both of

them. So here we go. Now the idea here is that of course I just assume that these 32 bytes will

be right but there's nothing, absolutely no way of demonstrating that. And so why would I do

that? Why wouldn't the 32 bytes just be bytes that immediately reassign all of the Bitcoin to

like Jihan Wu or something. And the act of moving a train car forward, it only costs the

opportunity of moving some other train car forward so that that's not, you know, people are

not really convinced by this and they say, well miners will just take the money. So now I'm

going to respond to that which is that first in five parts and I'm going to read the reason and

then I'm going to put up a little summary. So first it's admittedly true that all SPV proofs,

whether or not they're Drivechain or something else, they have to allow miners to forge a

withdrawal of the funds because SPV proofs are only gated by proof of work. But that's

completely intentional because that's exactly what allows the sidechain to be optional in the

first place. So if we wanted to, we could easily prevent miner theft 100%. We could just force

all main chain full nodes to validate all the sidechain blocks. But that would be the so-called

evil fork or the soft hard fork and it would be a de facto unlimited block size increase for all

users and an unlimited, theoretically unlimited loss of decentralization. So it's like

intentionally we're avoiding this bleak outcome. The only, we have to choose one of three

options. One is mandatory sidechains and evil forks and unlimited loss of

decentralization. And the second one is alt coins whose mere existence violates the 21 million

coin limit through a kind of inflation tax. And then the third one is this sidechains whose

withdrawals only rely on SPV proofs where even miners can steal sort of applies. And so the

people who criticize Drivechain on this basis for its use of SPV security, they probably don't

realize that they're necessarily instead supporting either unlimited loss of full node

decentralization, mandatory sidechains, or else they're supporting an unlimited inflation tax on

bitcoiners via alt coins. So that is the first. Would you prefer that it were mandatory, in

which case it would be perfectly safe, or would you prefer these alt coins hang around and drain

resources from, and attention from bitcoin? Now the second thing is while all SPV proofs are

vulnerable to miner tampering, Drivechain has extra features as I just explained. So the thing

is compressed super low and you have these 32 bytes and they're announced and then forced to

march very slowly, one step per block, across the finish line that is very far away. So even

with 100% hash rate participation in the attack, this takes three months. So new contestants

begin the race at any time. Only one racer can step forward at a time. And whoever crossed the

32 byte finish line first will win. But these sidechain SPV nodes are going to be yelling as

loud as possible what the correct 32 bytes are. So even if there's constant maximum scale

professional tampering, it will all be very, very easy for the user to observe and demonstrate to

others. And investors and users have plenty of time to react to this. And one reaction could be

the UASF to block the tamper 32 byte transaction from ever crossing the finish line when it

finally gets there. And that's much easier than, for example, to SegWit UASF because it

requires no software development, no real life coordination on actions and timing. And if the

UASF fails and if the sidechain was objectively valuable, then the Bitcoin's total transaction

fees and exchange rate should fall, which would punish the very miners who instigated the

tampering. So it's transparent and it harms the miners. There are all these other rules that are

enforced by main chain nodes that make it much harder to steal from the sidechain. Third is

that some sidechains are bad and you actually want to get rid of them. So it's a good thing if

miners have an incentive to evict these people. It's kind of like a city with a large criminal

homeless population or something. Some of the sidechains, if they work correctly, they can

leach off of other sidechains, which is something that I hope to explain. We probably won't have

anywhere near enough time. But the point is you actually want to get rid of these people. And how

can you make sure that only the best sidechains are let in and only the worst ones are kept out?

You give the decision to the people who have the most skin in the game, who get the transaction

fees or who suffer when the Bitcoin price declines. Fourth, the very idea of can and the whole

miners can steal schtick is a complete misrepresentation of the way Bitcoin works. In a

naive sense, the miners can always steal Bitcoin, whether or not it's on Drivechain or main chain

or even in lightning channels. This is because miners just control the contents of the

blockchain. And so the true question has always been, will miners steal anything? And in

answering it, we always rely on these theories about miners' choices and motivations and

behavior. And then we apply those theories to a given design. So I think the purport of this

can language is to imply falsely that Drivechain design puts users' Bitcoins into immediate

risk of just being taken by the miners in the very next block and therefore that I'm assuming

some kind of miner altruism or something. But the truth is that there are features in Drivechain, especially the slow, transparent, high-effort withdrawal process that I assume will

convince the profit-maximizing selfish miners that harvesting the sidechains for their

transaction fees, the ongoing transaction fees and their value-boosting properties, is more

lucrative than just devouring them in one shot. It's like killing the goose that laid the

golden egg. So use of the word can equals does not understand the way Bitcoin works. And

fifth and most importantly, you can only steal funds that the user has deposited to a sidechain. So it's completely, non-sidechain funds are completely unaffected by sidechains,

obviously. And consumer sovereignty is a basic principle of Bitcoin. So users are allowed to

handle their own funds however they like and they're even allowed to destroy them or delete

them. And so you should really just let people make their own mistakes. Now, the second one is

extremely bizarre. And now I see that I'm not going to have a little bit of time to explain how

weird it is. So I'll run through this very quickly. But basically, the argument says that Drivechain increases the risk of transaction censorship on the main chain by giving economic

advantages to large pools, which makes them inevitable in equilibrium. And it simultaneously

makes these large pools less anonymous somehow and more susceptible to coercion, which

eventually affects the main chain users. Now, of course, this is why I invented blind merge

mining, which completely solves this problem. In regular merge mining, a miner needs to run a

full node of everything they collect transaction fees on. But with Blind Merged Mining, this

thing that I invented, you do not need to do that. So the problem is just solved. The full nodes

don't need to run the sidechain software. Instead of exchanging 100% of the fixed network, 100%

of the data that would go across the sidechain full node, they just need a tiny, tiny amount of

data, that mempool data, that's fixed. And let me explain. Let's see, I have a good way of

explaining how this works. Somewhere. Yeah. But I think I just won't, so, because I don't have

time. But even though I solved this with Blind Merged Mining, the complaint is actually complete

nonsense. And I would like to explain why in a lot of detail, but I think I'd rather have the time

for questions. But one reason is that there is a ridiculous magnitude of the argument. So I see at

the top, I'm saying this argument basically says that if Bitmain sells T-shirts on the side,

then eventually all miners will need to sell T-shirts and anyone who can control T-shirts will

control Bitcoin and then Peter Todd admits that that is in fact what he's saying, which is

ridiculous. And the thing is, I have a long couple paragraphs here that I'm not going to get to

read, but the argument ends up contradicting itself because he's saying that every 10 cents of

profit eventually becomes mandatory. But this is a, you know, an inducement of 10 cents is

different from something that's really mandatory. But there's more to it than that, which is that

the argument ends up contradicting itself because it says there'll be main chain transaction

censorship and those main chain transactions pay transaction fees. So including every single

main chain transaction, mining pools are going to end up fighting for that just as hard as they

would fight to, you know, get any other source of profits, the T-shirts for example. So, and

again, I don't have a lot of time for this, but there's a conflation between mining

centralization and node centralization in the hopes that by using the word centralization,

you'll be tricked into thinking they're the same thing even though they're completely different.

And in fact, miners are suppliers and users are customers. So what's good for one will

eventually be something that's bad for the other. So it's actually, I would like to explain a lot

of this more, but I don't have enough time. The other thing is transaction censorship is a

privacy issue. So if you just solve privacy, then you don't have to worry about this at all.

It's really, that's the main focus for anyone who's worried about transaction censorship

should be focused on that. The other thing I do want to mention before I just sprint

through directly to the end is that we probably need the merge mining fees. I don't have time to

explain what this is, but basically it's a security budget over 40 years of fees are zero.

And I've compared it to the USA defense budget and it's on billions per year. And what I would

have explained is that the block subsidy and the transaction fees are completely different

things. And in fact, people have now learned to use altcoins as a medium of exchange and the

fees are low, which means that we currently get about $10 million per year in fees. We get like

$200 a block. And without merge mining, we might, the fee, the total amount of fees might

plausibly never be higher than that. And so it just adds 0.01 cents when priced in billions to

this and then that's not enough. So far from being a threat to Bitcoin, it's possibly the only

savior. And vanilla merge mining can't be stopped. So I don't know exactly what Peter Todd's

argument is because this is like inevitable. And not the Blind Merged Mining part, the vanilla part

is less difficult, even harder to stop. So actually I was going to talk about another thing and then

relate this to my original point, but I kind of basically don't really have time for that. So

oh well. And there we go. So yes, questions. And I'll be here all day. So sorry about that. Yes,

Andreas. Did I start five minutes early? I thought I was, no, I think I was moved to 10

recently. I was. It's okay, Andreas. I can give it to you personally afterwards. Yes.

Yeah, WinMainNet. I don't know. Maybe there's a soft fork this summer. Maybe. I don't know.

I have no idea. You never know. That's a cursed question. Didn't you see Dan Anderson's talk

yesterday? You're not supposed to ask those kind of questions. Those are cursed questions. Okay,

yeah. Sorry that was kind of all rushed and everything, but yes.

Ah, but what are they speculating on? The features, right? Or the properties, the lower fees?

A lot of people, you know, log coins really had a basically nothing market share until Bitcoin

fees went up. So a popular view is that the Bitcoin fees inspired people to switch.

Just for people who do the round trips, you know, a person who buys $20 worth of...

We had Ethereum. I think it's similar, though. I think it's a similar story where people noticed

something about Bitcoin that made them uncomfortable and then they sort of left. So with

Ethereum, they were like, this is like a Turing complete thing. Or there was like concerns about

how the scalability debate would be resolved one way or the other. Some people thought

this is too easy to change. Some people thought this is too hard to change. So I think it's still

a... I guess I would almost flip the question around and say, what else would explain it? I

mean, a lot of people want to make money, right? But so many things don't... There are lots of

things that don't... That could be scams but just don't work. So I could try to sell you monopoly

money and I could say this is all for greed or for speculative value, but it doesn't work, right?

So you need... Somehow you need to like close the loop. I need to convince you to actually buy my

monopoly money. You see what I mean? It's not like... Yes, thanks. That's two minutes, right?

Thank you. Does that answer your question or no? Okay, good.

Yeah, but I have to clarify that I think they just won't steal any money in lightning channels

or mainnet or anything. I just... That's why I think it's just a... Yes, you were saying?

I think it is... Well, I don't know about fundamental, but there are all these assumptions

about... You'd have to say... I would say something like the amount of money if you actually...

It's hard to explain quickly, but we're talking here about this large magnet. I think you're

right that it is, but that's why there's a 13,000 block thing instead of just... The way in Bitcoin

it works is it's just one block and then you're considered on the track to be valid. But this

thing isn't even considered to be valid until after 13,000 blocks. So the magnitudes are different.

That's why one is so difficult, such a difficult trial to try to offset that type of thing. And I

do think that there's... At some point, it jumps a category where it's not just like the longer,

the better. At some point, it's just so long that you just think like, wow, if something like this

is going to happen, it just must be because everyone wants it to happen and that kind of...

Well, there are a couple of things also to say. The reorg, if you do the reorg the right way,

you can steal a ton of money. And if you're going to reorg on that scale,

you can steal on that scale for like 13,000 blocks. That's like the amount of Bitcoin

to turn over per day. It's like a huge amount of money. So it's more than could even...

Yes. No, you're right. The compartments are a weakness here because you want everyone to be

in the same boat and you do not want some people to be stigmatized. But one counterpoint to that

though is that all the sidechains should at least be in the same boat. So if you got one

or two popular sidechains and one kind of stupid sidechain that's like marginally stupid and so

like barely not stupid and just kind of no one knows what they feel about it, you still think

that maybe miners would not want to steal from that one because they'd be like, this will just

cause theft, this will cause fear in the whole sidechain's infrastructure. And I had something

else I was going to say but I can't remember what it was. But you want that to blend together

and then you'd want... I have another great point but I can't remember it. Sorry. All right. So I

think we're almost out of time, I guess. Yep. Okay. So that's the talk. Thank you very much.

I'll be here all day.