MIME-Version: 1.0
References: <CAHUJnBDYDbgr3C158o7c6_XXdG+kqJruFo=od_RmPFk_GS0udw@mail.gmail.com>
 <CAMZUoKmN1Sj=C-asUKCB0hbe-V2fRMsFzNn6kcsJeigbnz3fgQ@mail.gmail.com>
 <YsyX9Hjz4LU5otaT@petertodd.org> <YsycpTbb3IYpQ2I7@petertodd.org>
In-Reply-To: <YsycpTbb3IYpQ2I7@petertodd.org>
From: "Russell O'Connor" <roconnor@blockstream.com>
Date: Mon, 11 Jul 2022 20:21:40 -0400
Message-ID: <CAMZUoKmsCjpcU323_Nbw2UBkcqTmBc9+yd9i=QBZvDX-gdH_hw@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="000000000000a7181f05e390a76a"
Subject: Re: [bitcoin-dev] Security problems with relying on transaction
 fees for security
Precedence: list

--000000000000a7181f05e390a76a
Content-Type: text/plain; charset="UTF-8"

Oops, you are right.  We need the bribe to be the output of the coinbase,
but due to the maturity rule, it isn't really a bribe.

Too bad coinbases cannot take other coinbase outputs as inputs to bypass
the maturity rule.

I guess that means the bribe has to be by leaving transactions in the
mempool.

Also your point about centralization pressure is well taken.

On Mon, Jul 11, 2022 at 5:56 PM Peter Todd <pete@petertodd.org> wrote:

> On Mon, Jul 11, 2022 at 05:36:52PM -0400, Peter Todd via bitcoin-dev wrote:
> > On Mon, Jul 11, 2022 at 04:35:02PM -0400, Russell O'Connor via
> bitcoin-dev wrote:
> > > > What happens after that I'm not sure.
> > > >
> > >
> > > Miners will learn to create anyone-can-spend outputs to bribe other
> miners
> > > to build on their block rather than reorg it.  (Due to the coinbase
> > > maturity, this will require some amount of floating capital.)
> >
> > ...and that's a disaster for mining centralization, because the smaller
> miners
> > need to pay larger bribes than larger miners. Not to mention having to
> keep
> > capital around to do it.
>
> Also, note how from a practical point of view, we'll need to add a new
> type of
> tx that's only valid in a specific block, or other miners will just reorg
> those
> anyone-can-spend outputs to steal them. It's not all that trivial to
> actually
> do that... you'd have to have a signature that commits to the non-segwit
> part
> of the coinbase outputs. Ugh.
>
> --
> https://petertodd.org 'peter'[:-1]@petertodd.org
>

--000000000000a7181f05e390a76a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Oops, you are right.=C2=A0 We need the bribe to be th=
e output of the coinbase, but due to the maturity rule, it isn&#39;t really=
 a bribe.</div><div><div><br></div><div>Too bad coinbases cannot take other=
 coinbase outputs as inputs to bypass the maturity rule.</div><div><br></di=
v></div><div>I guess that means the bribe has to be by leaving transactions=
 in the mempool.</div><div><br></div><div>Also your point about centralizat=
ion pressure is well taken.</div><div><br></div><div class=3D"gmail_quote">=
<div dir=3D"ltr" class=3D"gmail_attr">On Mon, Jul 11, 2022 at 5:56 PM Peter=
 Todd &lt;<a href=3D"mailto:pete@petertodd.org">pete@petertodd.org</a>&gt; =
wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0=
px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Mon, J=
ul 11, 2022 at 05:36:52PM -0400, Peter Todd via bitcoin-dev wrote:<br>
&gt; On Mon, Jul 11, 2022 at 04:35:02PM -0400, Russell O&#39;Connor via bit=
coin-dev wrote:<br>
&gt; &gt; &gt; What happens after that I&#39;m not sure.<br>
&gt; &gt; &gt;<br>
&gt; &gt; <br>
&gt; &gt; Miners will learn to create anyone-can-spend outputs to bribe oth=
er miners<br>
&gt; &gt; to build on their block rather than reorg it.=C2=A0 (Due to the c=
oinbase<br>
&gt; &gt; maturity, this will require some amount of floating capital.)<br>
&gt; <br>
&gt; ...and that&#39;s a disaster for mining centralization, because the sm=
aller miners<br>
&gt; need to pay larger bribes than larger miners. Not to mention having to=
 keep<br>
&gt; capital around to do it.<br>
<br>
Also, note how from a practical point of view, we&#39;ll need to add a new =
type of<br>
tx that&#39;s only valid in a specific block, or other miners will just reo=
rg those<br>
anyone-can-spend outputs to steal them. It&#39;s not all that trivial to ac=
tually<br>
do that... you&#39;d have to have a signature that commits to the non-segwi=
t part<br>
of the coinbase outputs. Ugh.<br>
<br>
-- <br>
<a href=3D"https://petertodd.org" rel=3D"noreferrer" target=3D"_blank">http=
s://petertodd.org</a> &#39;peter&#39;[:-1]@<a href=3D"http://petertodd.org"=
 rel=3D"noreferrer" target=3D"_blank">petertodd.org</a><br>
</blockquote></div></div>

--000000000000a7181f05e390a76a--