Date: Sat, 18 Dec 2021 01:00:14 +0000
To: Jeremy <jlrubin@mit.edu>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <BPaAFvgTqtCsxcAr1W_jlvWkHOaRi41GCfdHsblFGmqBVKR20qC18xk89Wh28Cmaf2YGUlN_N9_g9S_ij3bZbhsD_0qaDMcvqV1GdScVoTs=@protonmail.com>
In-Reply-To: <CAD5xwhjDBD38Xt=p=AW7XU3OCh0_9nb=-7neXuLcd-VAXJBE-Q@mail.gmail.com>
References: <CAD5xwhjDBD38Xt=p=AW7XU3OCh0_9nb=-7neXuLcd-VAXJBE-Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] [Bitcoin Advent Calendar] Oracles, Bonds,
	and Attestation Chains
Precedence: list

Good morning Jeremy,

> Today's post is pretty cool: it details how covenants like CTV can be use=
d to improve on-chain bitcoin signing oracles by solving the timeout/rollov=
er issue and solving the miner/oracle collusion issue on punishment. This i=
ssue is similar to the Blockstream Liquid Custody Federation rollover bug f=
rom a while back (which this type of design also helps to fix).
>
> https://rubin.io/bitcoin/2021/12/17/advent-20/
>
> It also describes:
> - how a protocol on top can make 'branch free' attestation chains where i=
f you equivocate your funds get burned.
> - lightly, various uses for these chained attestations
>
> In addition, Robin Linus has a great whitepaper he put out getting much m=
ore in the weeds on the concepts described in the post, it's linked in the =
first bit of the post.

Nice, bonds are significantly better if you can ensure that the bonder cann=
ot recover their funds.
Without a covenant the best you could do would be to have the bonder risk l=
oss of funds on equivocation, not have the bonder actually definitely lose =
funds.

We should note that "equivocate" is not "lie".
An oracle can still lie, it just needs to consistently lie (i.e. not equivo=
cate).

As an example, if the oracle is a signer for a federated sidechain, it coul=
d still sign an invalid sidechain block that inflates the sidecoin supply.
It is simply prevented from later denying this by signing an alternative va=
lid sidechain block and acting as if it never signed the invalid sidechain =
block.
But if it sticks to its guns, then the sidechain simply stops operation wit=
h everyone owning sidecoins losing their funds (and if the oracle already e=
xited the sidechain, its bond remains safe, as it did not equivocate, it on=
ly lied).

Regards,
ZmnSCPxj