Merged Mining and Decentralization
In this article we analyze the benefits and risks of merged mining, and we highlight the potential of blind merged mining to create a fairer mining market. We begin with an informal presentation of the basics of mining and merged mining, and then delve into mining incentives with the goal of creating a useful taxonomy. Finally we show how blind merged mining protects the Bitcoin mining incentives in the long term. The article was illustrated with images created using Midjourney.
Mining Basics
Mining is a method to protect a blockchain ledger from double spends. A consensus rule establishes that the only way to extend the chain with a new block is to perform an amount of computational work. The amount of work required is proven by a succinct message called proof of work (PoW). The message also contains the block header so the PoW is attached to each block. The miners are the parties that extend the blockchain by working and proving the work of a new block. The amount of work that needs to be proven depends on the current blockchain difficulty which adapts automatically to keep the block rate constant. The blockchain data structure is actually a tree, where miners can potentially extend the tree from any block, creating a new branch. Nakamoto consensus suggests that honest miners should select the branch to extend among all available branches as the one with the highest cumulative work, measured by the accumulated work proven by each branch. This suggestion is not part of the block validity checks (often called consensus rules), and any miner is free to choose differently, but assuming all other miners follow the suggestion, it is the best interest of any miner to follow it also. The suggestion to extend the longest chain is called an “honesty rule”, but it should not be confused with consensus rules enforced by code. With this honesty rule all miners are economically incentivized to extend the same branch, called the honest chain. Although the relation between honesty and rationality is not perfect in Nakamoto Consensus, both are wonderfully correlated.
Nakamoto Consensus is not the only consensus protocol that uses proof of work and mining, GHOST and DECOR are other examples. In the next section, we analyze merged mining, a family of consensus protocols based on reusing the mining work.
Merged Mining
Merged mining is a method to reuse the work spent in securing one PoW blockchain (called parent, primary or main chain) to secure one or more additional secondary blockchains. While the work is reused, the proofs are not. The miners must create different proofs for each secondary blockchain, as each blockchain may require different amounts of work to be proven. Merged mining is not a consensus protocol in itself, but it can be used to secure a blockchain that uses Nakamoto Consensus, or any other PoW consensus protocol. The merged mined blockchain does not need to use the same consensus protocol as the parent chain. For example, Rootstock uses DECOR, which is a variant of Nakamoto Consensus. In the following section we study merged mined sidechains.
Sidechains
Sidechains are blockchains that extend Bitcoin functionality using BTC as their main currency. Bitcoin Merged mining was the first method proposed in 2012 to secure Bitcoin sidechains. When miners are merged mining a sidechain, they earn transaction fees from sidechain users. Since sidechains cannot mint new bitcoins, they cannot provide a block subsidy, and setting aside dapp-originated MEV (explained later), the transaction fees are the main incentive to merge-mine sidechain blocks.
Under the efficient market hypothesis, on the long run any new sustained mining revenue will translate into an increase of Bitcoin hashrate. In other words, almost all mining revenue goes to the Bitcoin security budget. Merged miners that earn more than the rest are encouraged to expand their business by buying additional ASICs, and they are able to do it faster than the remaining miners, driving up the total hashrate.
Some people speculate that sidechain merged mining can become the main contributor to the Bitcoin security budget before hyper-bitconization happens. Merged mined sidechains could fill the security gap between the reduced subsidy that comes with a halving, and higher value per Bitcoin that may or may not materialize with the halving. Merged mining could be the catalyst Bitcoin needs to actually cross this gap unharmed by undesired incentives such as fee sniping, reorgs, double-spends and longer confirmation times.
Although merged mining is not perfect, the is a fear we should quickly dispel: merged mining does not incentivize miners to reorganize or revert the Bitcoin chain. The merged mined chains are completely independent and could suffer from a reorg without affecting Bitcoin in any way. There is no anchoring or checkpointing mechanism in merged mining.
Merged mining can be used in an attempt to secure other blockchains unrelated to Bitcoin, but this will probably fail as it did in the past with CoiledCoin, because of the misalignment of incentives. Bitcoin sidechains, on the contrary, increase the value of Bitcoin by making it more accessible, usable and scalable, keeping incentives aligned in the short and long terms. Therefore in this article we focus on the merged mining of Bitcoin sidechains only.
While currently mining is a highly specialized industry, there are still participants that mine own their own. We focus on these “solo” miners in the next section.
Solo Merged Mining
Solo miners are miners that have very little hashrate (i.e. <0.01%) but they do not join any public mining pool. They run their own Bitcoin full nodes, their own mining pool software, and host their own ASICs, without sharing resources with any other miner. They represent the ideal of Bitcoin decentralization. However, due to the economies of scale, solo miners are at a disadvantage compared to large miners having their own pool and small miners participating in large mining pools.
Solo miners cannot share the costs of network connectivity, blockchain client operation, systems monitoring, accounting, security, data center space rental or electricity. All these ongoing costs, plus initial investments, must be borne in full. Often solo miners do not move, so they cannot benefit from locating their miners in places where electricity is cheap, or where there are tax benefits or where they can receive credits for balancing the electrical grid. Generally they host their miners in their own homes.
Solo miners cannot take advantage of reduced reward variance by sharing rewards in mining pools, and therefore they have much higher uncertainty on their return of investment. The majority of the months, they don’t mine blocks. Solo mining is not a reliable business.
It is sometimes argued that solo mining contributes to censorship resistance, as transactions that may be excluded by large regulated pools can be included by unregulated or disobedient solo miners. However, this is not the case, as they contribute with too little hashrate to confirm these transactions in a reasonable time. Currently small independent mining pools are the main contributors to Bitcoin’s censorship-resistance.
Solo mining can be a kind of hobby, a learning experience, a philosophical stance, a tribute to Bitcoin or cypherpunk ethos, an act of nostalgia for the one-CPU-one-vote times, but it’s not a rational business activity anymore. Therefore, we can’t use it in cost analysis arguments.
Solo mining could become important in case of a global catastrophe breaks or bans mining pools. And in that event, sidechains will be the least problem. Solo mining can be a backup system, but it is not currently important for the health of the network. Therefore, arguments against merged mining based on the increased costs of solo mining are too weak.
If you’re a solo miner, you can run all sidechain nodes or simply ignore sidechains. It up to your hobby preferences. The cost of running sidechain software is (and may continue being) much lower than the money solo miners waste by not sharing or optimizing any of the remaining resources (i.e. rack space, refrigeration, connectivity, security).
Mining Pool Centralization
The main argument against merged mining is that it can lead to Bitcoin mining pool centralization by incentivizing miners to group into fewer and stronger mining pools, putting out-of-business the weaker or smaller mining pools. Note that this argument does not focus on the sidechains (i.e. if it leads to secure sidechains or not), but only on the effect on the Bitcoin blockchain and its miners. The simplest counterargument is that whatever a large mining pool needs to do to support a sidechain, a smaller pool (or a solo miner) can outsource at a low enough cost and still get all the revenue.
We show an example: let’s assume the cost of running all relevant sidechain nodes is 1 BTC/month (27K USD at today’s rate) and the merged mining net revenue is 10% for all merged miners. A “small” mining pool having 0.02% of the hashrate has an income of 5.4 BTC/month, and a net revenue of 0.54 BTC/month (14.5K USD). It clearly cannot bear the cost of running sidechain nodes because it ceases to be profitable. Also assume that “big” mining pools having 0.1% or more of the hashrate can bear the cost and be profitable. We can easily see that if 5 miners join forces and share the costs of running the sidechain nodes, then they become profitable.
Imagine a company “Sidehost” that runs sidechain nodes, and allows clients to query for block templates. The smaller pools pay them a fixed fee per month to get them. Let’s assume that Sidehost takes a cut of 10% from the income and spends the rest on sidechain infrastructure (1 BTC/month). This means that it takes only 6 miners to use this service to make the service profitable. Each miner would pay 0.183 BTC/month, so small miners are profitable too. This scheme is more cost-effective than running their own sidechain nodes, so small mining pools can outcompete the bigger ones easily. Since 1.2% of the hashrate are smaller mining pools, there are 60 small pools in this situation, which means that there could be 10 different profitable companies providing the same service than Sidehost. If each pool checks the best block template with 3 companies to avoid being lied about the best chain, each company can serve 18 clients, and the cost for the mining pool will be still be 0.183 BTC/month.
While for many this argument may be strong enough, we’ll go deeper into sidechain and mining economics to present a more compelling argument.
Fee Side-channels
Each merged-mined sidechain creates a fee payment side-channel to Bitcoin miners. But fee side-channels are not the only source of additional revenue, merged miners can also generate revenue in the form of MEV (Maximum Extractable Value). MEV can take many forms, malignant and benign, be transparent or obscure. Good MEV is the revenue miners can get without violating the honest strategy expected by the protocol designers, and without creating an unfair market (more on this later). Bad MEV is, conversely, the one that incentivizes dishonest behavior. Bitcoin is already exposed to MEV even without sidechains. There is both good MEV (transaction fee collection) and bad MEV (fee sniping). Fee sniping is the incentive to reorganize the chain to steal other blocks’ transaction fees. To distinguish between Bitcoin intrinsic MEV from sidechain MEV we call the former endogenous, and the later exogenous. As mentioned before, exogenous incentives can be key to the security of Bitcoin, although they bring some new risks that must be addressed. We’ll show some naive examples related to exogenous incentives that are easier to analyze, but are nevertheless equivalent to realistic MEV incentives.
The T-Shirt
One of the examples of MEV, originally brought up by Paul Sztorc, is that mining pools could sell branded T-shirts. Probably no bitcoiner would think this activity distorts mining incentives. It doesn’t make mining much more profitable or the mining game unfair. Paying miners to do something unrelated to mining (i.e. buying and selling T-shirts) is not a problem. Next, we analyze a more debatable revenue.
The Cookies
Another example is a mining company “SweetHash” that sells cookies made with the heat generated by ASICs. Let’s assume for a moment that this is very difficult to do, because it needs a special oven that channels the heat around the cookies. It’s so difficult that only SweetHash has managed to do it at scale. Does it make the mining game unfair? First, nobody can stop SweetHash from cooking. It is impossible to detect cooking only by looking at the blocks published in the network. This side-business makes SweetHash more profitable than the rest of the miners, and allows it to buy more ASICs quicker than the rest. SweetHash drives up the hashrate and increases the security of the network, which is good for everybody. But since nobody else knows how to make cookies with ASIC heat, this is a trade secret, and makes the mining market unfair. In the next section we present a third example, much more controversial.
The Transaction Stealer
Let’s assume there is an public mining pool “StealPool” that has a proprietary algorithm that is capable of detecting fee sniping opportunities on-the-fly, grab the desired transactions and reorganize the chain when convenient. Also, the algorithm is defensive: it engages in selfish mining when the fees collected in a block are excessively high and it is convenient not to allow others to snip the fees. The additional profit is distributed among the miners contributing to the pool. In this case, all rational miners will sooner or later join the pool to get the higher profit. StealPool will become too big and centralized, without any benefit for the network.
The 3 examples are different: in the T-shirt case, the side-revenue does not change the mining game significantly. In cookies case, it incentives the centralization of mining. In the transaction stealer case, the side-revenue incentivizes the centralization of mining pools. The centralization of mining is much worse (and harder to prevent) than the centralization of mining pools.
In the next section we’ll show that if sidechains become so big to affect mining incentives, they could incentivize mining pool centralization, but never contribute to mining centralization. Then, we show how the centralization incentives can be prevented.
Side-Businesses
Let’s shed some light into the matter of side-businesses. As we showed, not all side-revenue pushes towards centralization. There is a spectrum of influence. We shouldn’t care about any revenue stream that is not strictly related to the miner’s operation. For example, selling T-shirts has nothing to do with mining. A very popular mining pool would sell more T-shirts to bitcoiners than a solo miner, because of the popularity of the brand, but the business won’t move the needle in miner revenue, the pool won’t be able to outcompete Nike. On the contrary, the heat emitted by the Bitcoin ASICs is a by-product of mining, and re-using the heat (or not) could affect mining incentives. And this is not an exogenous incentive, but rather a property of Bitcoin’s original design.
We’ll call “side-revenue” to any revenue stream that strongly improves by using a by-product of an existing mining operation. For example, harnessing and redirecting that excess heat is not just a theoretical possibility, it is used to heat homes and warm greenhouses. Although no one has found any use for the horrible noise that ASIC fans make, maybe one day somebody will find out how. These are endogenous revenue streams, because they derive from the original Bitcoin design. We call exogenous revenue to any side-revenue stream that derives from merged mining.
From the side-revenue streams (exogenous or endogenous) we must still make another distinction. We should separate the streams that involve trade secrets, patents or secret algorithms, from those where all the information regarding production is public. Some bitcoin community members refer to the former side-revenue streams as “unfair”, and the latter as “fair”. We’ll use these terms. Unfair side-revenues are revenues that turn mining into an unfair market. A fair market is one that operates with a high degree of competition and minimal barriers to entry, where all participants have equal opportunities to enter, compete, and transact without discrimination or unfair advantages. Information Transparency is essential. If mining revenue depends on bribes, exclusivity contracts, monopolies, or trade secrets, this is clearly unfair.
Fair revenue streams can only be made more profitable by investing talent, capital, lowering costs, establishing the operation to certain geography or jurisdiction, or creating an economy of scale. But these strategies are standard business practices, and there are books written about how to optimize a business. While fair markets may rely on special commercial agreements, they don’t rely on trade secrets and high barriers to entry. We assume freedom to transact and create mining operations worldwide.
Fair revenue streams keep the mining market fair.
The case of ASICBoost
We present now the case of ASICBoost. It was a technology that could have turned the mining market unfair, but didn’t. We’ll briefly describe what it is.
For a Proof-of-Work function to be perfect, it must be progress-free, optimization-free (sometimes called shortcut-free) and approximation-free. But Bitcoin PoW was never perfect. Since the genesis of Bitcoin there was a slight shortcut in the Bitcoin mining function. We speculate that nobody knew about it before 2014, so we assume that it was really discovered in 2014. That year, a utility patent was filed describing the inner workings of this technique. Eighteen months later, as the patent law dictates, the patent was published by the patent office: the technique is currently known as ASICBoost.
If anyone was using this technique before the publication of the patent, this technique was a trade secret and it created an unfair mining market. The publication brought fairness back to the mining industry.
If a patent is commercially licensed for a certain industry, and the license is offered to anyone without any restriction of any kind, then it wouldn’t affect the fairness of that industry. There are hundreds of patents involved in Bitcoin ASIC design and manufacturing that bitcoiners do not even know about, and this doesn’t make the mining game essentially unfair. Happily the ASICBoost patent was put into a defensive patent license (DPL) by Blockstream. DPR is a special license that allows anyone to use it as long as they license their own patents with the same DPL license. The end result was that the ASICBoost patent in DPL lowered the barrier to entry to the mining business significantly. It made Bitcoin more fair than before!
In general, for unfair mining side-revenue streams, we may be able to detect that a miner has an advantage, or we may be completely blind of it! For example, ASICBoost has two possible implementations: overt ASICBoost, which involves changing the nVersion field, leaves a clear fingerprint. But covert ASICBoost, which involves reordering transactions in a block, is impossible to detect. That makes it more dangerous.
Maximum Extractable Value (MEV)
There are side revenue streams that lie in the middle of the spectrum between full openness and trade secrets. For these side revenue streams, everyone knows the profit depends on secret optimizations, but no block producer knows if he is using the best possible optimizations. MEV is widespread in Turing-complete blockchains that hosts AMMs and other kinds of DEXes. For example, the revenue that a block producer can extract from DEX arbitrage (one type of benign MEV) depends on the algorithm used in bots, and the computational resources invested in running those algorithms. The bots must search and detect the arbitrage opportunities before the other searchers, and submit them as quickly as possible to block producers. While some developers have published arbitrage bots, the best algorithms are trade secrets. Some clever algorithms even involve symbolic execution to find MEV using formal proofs.
Clearly the published algorithms are suboptimal because there is an incentive for secrecy. The proposer-builder separation in Ethereum attempts to restore fairness, but since it’s not really trustless, the results are unsatisfying.
There are many examples of benevolent MEV that we’ll present next.
Optimally Scheduling Transactions
The Rootstock community has proposed adding parallel transaction processing to its sidechain, specified in RSKIP-144. This proposal lets block producers choose the best possible scheduling of transactions in a block. By using several concurrent threads miners minimize the execution time and at the same time they maximize the collected fees. The underlying idea is that if block producers invest resources in finding better schedules, they can fit more transactions in blocks, which drives the transaction cost down. At the same time, they lower the non-mining nodes processing time, lowering the orphan block rate, and the blockchain synchronization time. It seems to be a win-win situation for the ecosystem. However, if one block producer has a more efficient scheduling algorithm than the rest, he will receive higher revenue from mining. There is an incentive to keep the best possible scheduling algorithm private. To counteract this incentive the Rootstock sidechain performs fee smoothing, which distributes the reward of a block among all miners.
But not all MEV is benign. In DEXes, sandwich attacks and front-running can boost miner revenue at the expense of increasing users’ trading fees. There is a real risk that the merged mining of a DeFi-enabled sidechain creates an unfair game for Bitcoin miners, if mitigations are not applied. Doing nothing does not improve Bitcoin’s position against this threat. Blaming the miners, or the sidechain developers, or anyone else doesn’t help either. Bitcoin is based on economic incentives and merged mining incentives have existed since the inception of Bitcoin, even praised by Satoshi. Therefore, we better fix the incentives.
Sidechains Today
A sidechain is a blockchain that allows bitcoins to flow from and to the Bitcoin blockchain, without requiring a new token taking the function of money (i.e. being a collateral). Currently there are two true Bitcoin sidechains: Rootstock and Liquid. Rootstock consensus is based on merged mining. Bitcoin miners produce Rootstock blocks. On the contrary, Liquid block production is delegated to a predefined set of functionaries. Therefore the discussion about merged mining relates to Rootstock and all future merged mined chains, but not to Liquid.
Bitcoin is not currently protected from MEV, neither endogenous nor exogenous. Bitcoin is already exposed to MEV by its own design. Fortunately, Rootstock does not currently interfere with Bitcoin incentives and the Rootstock community is actively researching techniques to allow Bitcoin solo miners to be as competitive as large mining pools when performing merged mining. But other new sidechains communities may not be equally interested in decentralization and bring new centralization risks.
There are many potential risks: security bugs in the sidechain node, regulatory issues related to the sidechain purpose, additional costs of reviewing the security of every new sidechain node release or excessive resource consumptions by the sidechain node. So whether you love the idea of sidechains or you hate it, Bitcoin’s original design is permeable to MEV. Therefore, it is normal, reasonable, rational, smart and predictable that Bitcoin users and developers debate how to improve the status-quo.
BMM is the only existent proposals that could improve the current situation, so it’s natural that honest, well-intentioned people discuss them in twitter, forums and conferences. There is no need to panic, no need to rush, but there is a need for an open debate.
In the following section we’ll discuss how Bitcoin is currently not immune to external incentives, and how BMM sidechains represent the least disturbing mining incentive one can create.
Incentives Here, There and Everywhere
Nobody can prevent people from creating external incentives that affect Bitcoin miners, even without sidechains. Bitcoin mining is not a closed system. Another blockchain can establish incentives (and also bribes) to change Bitcoins miners’ rational choices, by embedding a Bitcoin SPV client in a smart contract, or by using a Bitcoin blockchain oracle.
There is more. In a previous article we introduced the concept of cross-chain crypto-economic consensus rules. These are economic incentives established by other sidechain consensus that “cross” into Bitcoin and affect its consensus incentives. Cross-chain incentives can be benign or malign. We give several examples.
Rootstock Incentives
Bitcoin miners can lie in their block timestamps up to 2 hours (on average) because a block timestamp is loosely restricted. In merged mining proofs, Rootstock requires that the Rootstock block timestamp is not too far from the Bitcoin block timestamp. Since Rootstock timestamps have a narrower validity interval, and the distance to the Bitcoin timestamps is limited to 10 minutes at most, this sidechain rule establishes a benign incentive for Bitcoin miners not to lie in their Bitcoin block timestamps, at the risk of losing the Rootstock block reward.
We now analyze the incentives of another (not yet launched) Bitcoin sidechain.
Botanix Incentives
An example of a cross-chain incentive (although not equally benign) may be introduced by the upcoming Botanix sidechain. This sidechain chooses a series of PoS leaders for high rate sidechain block production based on the hash digest of a Bitcoin block. The chain of selected leaders ends with the following Bitcoin block being mined. The chosen leader is given a slot to create a sidechain block, and receives sidechain block fees. Therefore, Bitcoin miners would prefer being chosen as sidechain leaders as many times as possible until the next Bitcoin block is mined. There is an incentive for a Bitcoin miner to discard a found Bitcoin block if its hash does not lead to a beneficial leader schedule. A beneficial schedule would be one in which the miner is appointed leader many times (or several consecutive times, which sometimes provides certain MEV opportunities based on manipulating price oracles). As it is designed today, Botanix can potentially incentivize discarding blocks (simular to Block Withholding Attacks) and therefore the lowering of the Bitcoin hashrate, contrary to Rootstock!
Since whether to publish the block or not depends on a complex algorithm, only the mining pools having efficient block discarding algorithms would be more profitable, leading to mining pool centralization.
Botanix could adopt many protections to mitigate this undesired incentive, such as choosing hundreds of leaders for each Bitcoin block hash (making much harder to find a beneficial schedule), or by smoothing block fees over several consecutive blocks, as Rootstock does. It could also adopt a Proposer-Builder separation (PBS) to cancel any MEV, but this is not currently part of its design.
The Lightning Network and Stacks Incentives
The Lightning Network, with all its benefits, incentivizes miners to steal from channels and censor punishment transactions. Of course, this form of MEV may be considered negligible compared to others because miners would need to be an actual channel counterparty or actively collaborate in secret with every channel counterparty complicit in a theft.
The Stacks blockchain, which is not a sidechain but aims to be one, encourages Bitcoin miners to censor certain Bitcoin transactions to prevent competition in staking.
Trying to discourage merged mining proposals doesn’t provide any protection against malign incentives. It just keeps the Bitcoin network wide open to harmful incentives without getting any of the benefits of sidechains.
In the next section, we finally show how to mitigate all centralization risks of merged mining.
Blind Merged Mining
In merged mining, miners compete to create a Bitcoin block that has a sidechain block id stamped in a unique position. How they create the sidechain block (which transactions they add and in which order) is not part of the merge mining protocol, yet miners must perform such task for each sidechain. They are both the builders of a sidechain block, and the proposers of such blocks.
With Blind Merged Mining (BMM), miners do not need to be block builders. Both miners and a new group of sidechain block builders participate in an auction process where block builders compete to get their block ids stamped in Bitcoin blocks created by the Bitcoin miners. These block builders are a new set of actors that participate in the sidechain ecosystem and their sole role is to try to build the best blocks in terms of extractable value.
With BMM, instead of miners requiring to run sidechain nodes, they only need to run the Bitcoin core node, and participate in periodic BMM auctions in which builders bid to get their blocks proposed.
From the point of view of the mining pool operator, supporting sidechains becomes both simpler and cheaper. Instead of reviewing every new release of the sidechain node for potential vulnerabilities, they only need to review the BMM soft-fork code (be it BIP-301 or a similar one) at the time it is included to Bitcoin core, and then they can forget about sidechain nodes and their complexities forever. Instead of needing to be aware of all the potential sidechains that are created or destroyed, they only need to check for Bitcoin node upgrades. Instead of running multiple nodes with unknown resource requirements, they only need to run the bitcoin core node.
Amazingly, with BMM they retain most (in fact, almost all) of the MEV revenue that could be extracted by running the sidechain nodes. If a MEV opportunity is discovered by more than one block builder, they will compete fiercely in the auction process, until the winning bid is almost as high as the MEV value extracted. BMM levels the playing again, in a way that is not susceptible to secret recipes on how to find MEV. Finding MEV is outsourced to parties that know better.
As long as there is builder competition, it becomes explicit which revenue opportunities exist for Bitcoin miners and how they can capture them. By removing hidden advantages and trade secrets, it removes any political struggle in the community or lobby to the mining pools to choose what sidechains they should run. It is clear that by removing complexity, BMM also makes the system more transparent. This is the topic of the next section.
BMM and Transparency
The fee side-channels are invisible in Bitcoin blocks. This apparent lack of transparency of mining incentives may make some bitcoiners uncomfortable. In practice, all monetary incentives coming from sidechain transaction fees can be computed easily by inspecting sidechain blocks, but not without certain amount of work. With BMM all incentives (both fees and MEV) can be made transparent and available in realtime right from the Bitcoin network. Each published bid represents the sidechain contribution to the security budget. This allow the community and researchers to have a much deep upstanding of the health of the network.
Incentives Summary
The following table show the different incentives that affect mining revenue and their characterization in terms of centralization. The mining centralization column indicates whether the activity incentivizes one group of miners to control all the hashrate. The mining pool centralization column, whether the activity contributes to a single pool operator to collect the majority of the hashrate.
(*) Whether sidechain fees can reach dangerous levels of MEV depends on how popular the sidechain is and how the sidechain consensus distributes the fees among the miners. Rootstock performs fee smoothing and limits the gas price paid by transactions to prevent high block fees being paid to a single miner and therefore the risk is mitigated.
(**) Rootstock performs fee smoothing to avoid a single miner receiving a significant revenue boost from improved transaction scheduling, mitigating the risk.
BMM has not been ever implemented in a prdocution blockchain, however, a quite similar concept is already deployed and working on Ethereum. In the next section we compare both systems.
BMM vs PBS in Ethereum
In Ethereum ecosystem, there is a quite centralized system called flashbots that decouples block building from block proposing, using a priority gas auction, where builders bid by rising the transaction gas price. The system implements what is known as Proposer-Builder Separation (PBS). The block proposers are similar to the Bitcoin miners in BMM. A second group of actors called searchers (or block builders) look for MEV opportunities. Searchers create profitable transaction bundles and send them to block proposers through relayers.
What is important is that Ethereum cannot currently do PBS in a fully trustless manner, because the relayers can see the content of the bundle. However, BMM doesn’t have this problem. Ethereum does not have the capability to enforce that the transaction list of a block starts with a bundle that won an auction. BMM, on the contrary, can enforce that sidechain blocks contain exactly the set of transactions specified in a winning auction. Also, not all Ethereum block producers can participate in an auction, because only one producer is selected for each slot. Therefore Ethereum PBS needs additional actors called Relayers that sends the winning bundle to the actual proposer, still more trusted actors. In BMM, on the contrary, proof-of-work based block production guarantees that anyone can produce the next block (by chance), making the auction system possible.
PBS has only one benefit over BMM: In PBS, searchers can pay to the proposers using the revenue generated by the bundles they create, which means they don’t need to advance payments. In BMM, block builders need to pay for the full cost of merged mining a sidechain block beforehand, so they need working capital. This may be a centralizing force within the builders, but does not have a centralization effect on Bitcoin miners.
Note that instead of implementing a single BMM system for Bitcoin, each sidechain can implement its own internal PBS system. However, this is much more costly, complex, error prone and risky.
Until now we assumed that all our sidechains will use BIP-301 BMM, but BIP-301 only works with slow sidechains, which is a huge drawback. We give alternatives in the following section.
Proposals for BMM with Fast Block Rates
There is one limitation to BMM: sidechains with average block rates higher than Bitcoin cannot make use of BMM as it is currently proposed. They would need to either slow down to match Bitcoin block rate, or adopt a leader election mechanism like Bitcoin-NG. Therefore, a sidechain community may still choose to keep their fast block rates and not use BMM. This is not ideal, since most existing altcoins have higher block rates, and sidechains are meant to outcompete altcoins. We need a BMM proposal better than BIP-301. Our research team has been exploring other solutions.
One idea is that miners individually rent short periods (seconds) of hashrate on-demand to the highest bidder (we call this Rented Merged Mining, or RMM). This idea has several problems. First, it’s unclear how the hashrate buyer verifies that the miner is delivering the rented hashrate in such a short period of time. Statistical measurement needs longer periods.
An alternative idea is that block builders buy individual mining pools shares (blocks solved at a lower difficulty), streaming payments for shares over direct payment channels (we call this Single Share Merged Mining or SHMM). Both RMM and SHMM have downsides: mining pools must expose a communication endpoint for builders to rent hashrate (or buy shares), and only large mining pools will be chosen by block builders as they can deliver shares/hashrate faster. Also each miner would conduct its own auction process, and price information will not be efficiently communicated from miner to miner.
The Bidchain
Another idea is to create a sidechain specifically to manage blind merged mining bidding. We’ll call this the Bidchain. The Bidchain would have a fast average block rate (i.e. a block every 15 seconds on average) and UTXO commitments, but it would be lightweight: a block would be limited to holding one transaction per sidechain representing the highest bid.
What two-way-peg (2WP) mechanism should the Bidchain use? It could be a hashrate escrow or a federated peg. If it uses a hashrate escrow, it would need to support transfer transactions to let block builders swap bitcoins in and out of the Bidchain fast without waiting for long withdrawals (which could take months).
Assuming the Bidchain uses the Bitcoin transactions format, and there are 10 sidechains, one bid per sidechain and 10 bitcoin transfers per Bidchain block, then the Bidchain would consume 2 Megabytes every 10 minutes, representing only a 50% Bitcoin block size increase, although Bitcoin full nodes other than miners would not need to download or process the Bidchain.
Since the Bidchain has a specific use case to carry out ephemeral auctions, we can apply aggressive pruning methods to it. For the Bidchain state, we can apply a strict UTXO cleaning rule: a UTXO is destroyed automatically after one year, so the size of the Bidchain state will always be capped, and we discourage the use of the Bidchain for other uses such as DeFi or savings. Also, the Bidchain length would be limited: every year, bidchain nodes could automatically vote and agree on a new Bidchain checkpoint, that functions as the a genesis block. The checkpoint would need to have at least 50% of the cumulative work of the Bitcoin blockchain during a full year, confirming the checkpoint. Bidchain mining software would automatically stamp their checkpoint votes in the Bitcoin coinbase transactions to leave a transparent audit trail, similar to what they do in a hashrate escrow. If the checkpoint gets enough votes, then all Bidchain blocks previous the checkpoint would be discarded. This would make the Bidchain size also capped.
Although the idea of the Bidchain is superior to the other two ideas presented, it has some downsides: first, it represents a de-facto block size increase for miners (albeit very limited, and not for the remaining non-miner full nodes). Second, incentives must be carefully designed to prevent reorgs on the Bidchain due to the lack of subsidy, possibly using fee smoothing. Third, the two-way-peg mechanism must be secured by a hashrate escrow for the Bidchain to be fully decentralized. A federated Bidchain could work, but it would be less attractive as a backbone of the sidechain ecosystem. Securing the pegged bitcoins using a hashrate escrow is not a problem as the total TVL in the Bidchain can also be capped. It doesn’t need to rise above the maximum cumulative value that can be paid in bids over the period required to perform a Bitcoin swap with the main chain (i.e. 30 minutes). For example, assuming the sidechain revenue per time interval equals Bitcoin, then the maximum TVL required to be available in the Bidchain would be 18.75 BTC (or 500K USD at today’s price). Assuming that the Bidchain handles 10 sidechains with such MEV volume, then the total TVL of the Bidchain wouldn’t exceed 5M USD. The risk that 51% of the Bitcoin miners steal 5M USD from the hashrate escrow is very low.
An alternative 2WP mechanism is the minpeg, which is a federated peg where functionaries are dynamically chosen from the set of miners according to their hashrate. Every 15 days the funds are migrated to a new multisig according to the newest hashrate distribution.
Regulatory Risks related to Merged Mining
Until now we analyzed all technical and game-theoretic elements related to blind merged mining, but we’ve not considered legal risks. Bitcoin miners normally perform three simple tasks: they choose transactions to include in blocks, they verify them, and they perform work to propose them to the network. Whether or not this is a legal or illegal, regulated or unregulated activity will depend on the jurisdiction. Currently, mining is banned in Qatar, Saudi Arabia and China.
Bitcoin is a blockchain with mostly a single purpose: value transfer. It is not crazy to think that in the future miners could face criminal charges if they include a transaction originating from a government censored address, or be punished if they fail to identify the origin and destination of transactions. But other merged mined blockchains could introduce new regulatory risks, simply for activities that are already illegal. Mining a Bitcoin sidechain whose only objective is to host porn images as NFTs could be illegal in many countries, making the mining market unfair. However, with BMM, miners’ job is independent of the content or purpose of each sidechain: they only sell a “proof-of-work on demand” to the highest bidder. Therefore, BMM reduces regulatory risks for miners of the Bitcoin ecosystem.
Final words
In this article we presented the benefits of Blind Merged Mining from the point of view of the security of Bitcoin mining. We showed that not only it doesn’t lead to miner centralization or mining pool centralization, but on the contrary it fixes existent problematic incentives. BMM brings a more auspicious future for Bitcoin and its sidechains.
We also sketched three new proposals to overcome the limitations of BIP-301 regarding sidechain block rate, including a new lightweight sidechain we called the Bidchain.
We hope that this article shreds light in the obscure debate surrounding sidechains and merged mining. There is a widespread expectation that sidechains will bring enormous value to Bitcoin, and while consensus decisions must not be rushed, it’s a good time to clear misconceptions about merged mining and foster an open debate on sidechains and, eventually, hashrate escrows.
