To: Chris Stewart <chris@suredbits.com>
References: <CAGL6+mHQ_vMc2JYVqwfP89WOZdUF2WDtWfh7ccL1PQve=nC+zQ@mail.gmail.com>
	<2f2e6b7c-2d47-518a-5a8f-0b5333607aac@gmail.com>
	<lYqi6yZAdUknHWs2DvSaM3h1tf3EVLngILZV9gbVBm5JVI96RvBGZaPBEFYNzt0QBkjdJ614BTsWjUkmuuqSd7RPFx-ihUL6SIXocqyW_ss=@protonmail.com>
	<98d35291-5948-cb06-c46a-9d209276cee2@gmail.com>
	<GDZ42AMqaETJGYZovJzkVZkxZE3UmCQ8q5fFTAajV6sX2LHFol6iEYahkY_sMrPv5m11lHZvuKXmD_PwXa5_S7x18vcP1FkQr0ZBROxj6HE=@protonmail.com>
	<CAGL6+mEeuhQp3TiLFOOAWO_wcRZXsfASKNT4364SSNzER6_xgw@mail.gmail.com>
	<hvQJ5M9JSIbEjJuabefPJi_DBqDTTXYnJ1xEg7_rBozOBrI8WDzL6zwn9Zt7au5QHc3P3DPNYDBrsQCTkSB6lOFWPJ8UuY_W4GyIzQ-Qvfs=@protonmail.com>
	<CAMZUoK==7OATOJ=46CYJWkq=WAXnJ8-JjvL25E1ijhnRbqj_Jg@mail.gmail.com>
	<CAGL6+mHErvPbvKxrQkJ=DdTuzH-4Fsxh8JnnzVY16m2x6zeJFQ@mail.gmail.com>
	<CAGL6+mE9TF=LeNwN2a6Ky+B=jqmW=1HqGOj6bPq2G3Aq8+FZAw@mail.gmail.com>
	<7fc82c47-c03a-f489-55c2-b7d6830c1a74@gmail.com>
	<CAGL6+mEepScU-ZjrprQZo4hN5J05pGd63CapHWc3XNVAf43s1g@mail.gmail.com>
From: Paul Sztorc <truthcoin@gmail.com>
Message-ID: <918a1b0c-65e6-a67f-c0d5-c4e6170d2e70@gmail.com>
Date: Thu, 13 Jul 2017 16:45:13 -0400
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
	Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <CAGL6+mEepScU-ZjrprQZo4hN5J05pGd63CapHWc3XNVAf43s1g@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-US
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] BIP: OP_BRIBVERIFY - the op code needed for Blind
 Merge Mined drivechains
Precedence: list

On 7/13/2017 4:22 PM, Chris Stewart wrote:
> In general though, I'm still unclear of what purpose the 'Ratchet'
> serves. Can you either link to documentation about it or write
> something up quick?
>
> -Chris

In Bitcoin, new coins are held for 100 blocks. One result of this is
that the coins can't be spent until there is at least 100 blocks worth
of evidence that they actually are in the longest chain, and are
unlikely to be orphaned.

In BMM, we are concerned about exactly this. For example, imagine that I
bribe you $20 to find my side:block (and, in that block I earn $20.50
worth of side:BTC tx fees), which you do. But then, moments later, you
(or some other miner) orphans the block! So I don't get my $20.50, but
you still keep my $20!

And yet, we want the mainchain to validate as little as possible about
each sidechain. We want a "light touch". So we force the h* to be
accompanied by the modulus of its sidechain block number (we call it
"BlockMod"). The sidechain has a new rule that requires h* to be
included AND that the BlockMod be accurate, in order for the sidechain
block to meet the "synthetic" difficulty requirement. The mainchain has
a new rule forcing each new BlockMod to be in range [-X000,+1] relative
to the old BlockMod (ie, "no skipping ahead, but you can reorg by
starting a new chain from up to a=3D-X000 blocks ago" ... likely values o=
f
X might be 2 or 4). And finally, BMM has a new rule that the bribe isn't
paid unless the sidechain block in question has been buried by [for
example] 100 sidechain blocks.

Hope that helps,
Paul