Episode 112: Interview: Peter Todd Critiquing Drivechain の全文書き起こし

that actually there were two elements to the block stream side chain there was both escarole so the ability to send bitcoin into an address and the ability to send it to an address that is escrowed while it's on the side chain and then withdraw from that address when side chain coins are sent back into bitcoin but also a fraud proof so why do we also need a fraud proof well the fraud proof is so that the escrow isn't just blind trust in particular the term block stream came up with to describe this type of escrow is a dynamic multi-membership system based on proof of work and what that really means is we just trust miners go hold the money and in that model if miners want to go spend that money they're going to have to go hold the money and money in a way that maybe the you know quote unquote owners of the money you don't want they're screwed there's nothing they can do about it the idea with fraud proofs is that somehow you would create a system where you could prove that a transfer was fraudulent and frankly block stream just hand waved around this they kind of said well fraud proofs would be good we're not sure how to actually do this yet but we should do more research and figure out how to make that happen what i'm told from block stream insiders who are around at this time is they thought this would be an easy thing to do or at least feasible and it turned out to be basically impossible so they gave up on the idea of merge mine side chains and that's why block stream liquid is a clear trusted centralized federation when i looked into liquid there are surprising details that i think hint at the desire for something like a fraud proof because there's a subset of the federation that can withdraw bitcoin out of the block stream multi-sig address on the bitcoin block chain but they can also only withdraw to specific addresses and they include hardware well hsms i gotta point out though like like what you're describing there's not actually something directly enforced in bitcoin all right there's no mechanism in bitcoin that prevents the members of the escrow from doing what they want with that money where the security feature comes in is block stream building in hsm solutions or at least claiming they do i mean there's no way for us external to actually verify any of this is done but that's what they claim they did right because an open source hsm is a contradiction well i mean it's not even that it's just it's impossible to know what other people what other hard where other people are running without trusting someone else to go tell you if i were in block streams case or if i was any of the signatory you know escrow agents in the liquid side chain absolutely i would want to be running this kind of hardware because i don't want to be in a position where i can steal money you know that's actually a very dangerous thing to do because someone who hacks you can go do that so i'm sure they've done what they can to avoid this problem but fundamentally it is a different trust model in bitcoin yeah exactly what i'm describing is there's additional complexity that they've designed to overcome the weaknesses of this model yes and i think the key thing to say is all of this additional complexity all this additional security that is implemented in trusted hardware and drive chains in theory want to have a different trust model and the trust model revolves around minor hash rate escrow and instead of a fraud proof or a complicated non-consensus hardware security module there's a concept of delaying withdrawals from the side chain well i got a point i mean the delaying thing isn't the fundamental idea here fundamental idea here is that rather than put money in an address that any one miner could take you require many different blocks to approve of a particular withdrawal you know one way to talk about is its minor vote it's not that one miner can steal from the side chain it's that miners would need to collaborate not necessarily okay do go on that seems like a big problem well it depends on how big the when you what what we really are talking about here is it's not that anyone who can create a block can withdraw it's that over a certain period of time at least a certain amount of hash power has to agree the problem is when you say something like one minor this isn't necessarily true right because we're talking in a world of mining pools yeah and you know a good example here is given that there are two mining pools that collectively have 51 of the hash power i mean to be exact things like 60 system if drive chains existed now those two mining pools would have been could do whatever they wanted with money tied up in drive chains and how long would it take for 60 percent of the hash rate to drain a drive pain paul stark's proposal um that would be that they could go do this after i think it would work to be like yeah three months or six months i think it was six um in total i see but you know something like that it's a couple months anyway and so this was a known issue with the drive chain proposal which is outlined in bips 300 and 301 what is paul's refute or like what is his argument how does how does he handle this or is that not even the argument that actually to be honest i was a little misled by was this idea that there would be blind merge mining and my conception of how drive chains worked until i actually looked into it more carefully was the blind merge mining was a mechanism why people could go pay money you know in terms of transaction fees to influence how the drive chains operated and paul's drive change proposal does have blind merge mining but where i was wrong or my understanding was wrong was i assumed that the blind merge mining would also be related to the voting and it turns out that's not true you know drive chains is purely a minor hash power vote there's no mechanism to influence it other than by being you know by having control of hash power and that's just it and i think paul's

refutation is basically saying well i mean obviously minors would go do the right thing they have other incentives at play here they have reputation you know they have potential fee revenue but you know my argument there is that if you're not doing the right thing then you're not doing the right thing you're not doing the right thing and i'm not doing the right thing and i'm not doing the right thing and i'm not doing the right thing you know that's your bottom line um i think it's just kind of the fact that takes a lot of time it's a mind Argentina obviously argument there is not so much that those statements are clearly wrong it's that in environments where any of this is happening and drive chains are actually working mining has to either be very centralized or you know it's likely that drive chains will fail in nasty ways in which case the drama of this failure will cause problems in bitcoin itself and when you say for this to work mining would have to be very centralized are you imagining a single huge mining pool and they're too corporate and don't want to be like sued by the drive chain developers or something like that yeah i mean that's the kind of scenario you need for drive chains to reliably work on the other hand if you look at the other possible scenario where there's a lot of different mining pools out there they aren't necessarily all run competently from bitcoin's point of view that's totally fine like it's great if there's you know a thousand mining pools and like if not all of them are run competently it doesn't actually matter for bitcoin because bitcoin's incentives are extremely strong and bitcoin works very well even if you know mining pools don't necessarily cooperate with each other and so on the problem is in that scenario it's likely that drive chains will suffer all kinds of issues first and foremost being getting your money out because miners have to approve of a drive chain withdrawal and there's no other mechanism if they were implanted tomorrow i'd say the most likely failure mode would actually be people's money would get stuck and the price of the coin on drive chain would become decoupled from bitcoin and start crashing because people realize oh shoot there is no way i could get my money out paul has made the argument that drive chains through blind merge mining could be a massive source of miner revenue because a drive chain would likely want so there would be a drive chain transaction in every block and the fee revenue for this would create a long-term incentive for miners to keep the chain yeah i'd say that's clearly false and the problem is that drive chains have no ability to have a block size limit without a block size limit there's no reason to pay other than trivial fees you know there's just no mechanism without block size limits for fees to actually amount to anything and that's what we see on other coins you know other coins that are not running into block size limits just don't have not you know anything beyond trivial fees that's exactly what would happen and unfortunately there's until you had a block size limit to drive chains i don't see a way around that and i don't think paul has articulated a way around that other otherwise other than saying well obviously miners would get together and say the fee revenue has to be high right it was set high transaction rate and then they would have to pay for it and then they would have to pay for the transaction fees but that's assuming a cartel right the only way to artificially increase transaction fees in the absence of a of a fixed limit on block size is by getting a cartel together and saying yeah we're not going to allow miners to undercut us i guess another aspect of the drive chain fee conversation is that if blind merge mining was merged as well as the drive chain bit then i could run a bitcoin node and i could run a drive chain node and i could be a quote-unquote drive chain node and i could be a quote-unquote drive chain node and i by constructing drive chain blocks and then offering that block through whatever mechanism as a bitcoin transaction to miners and giving them a fee to mine that block so i would be a drive chain miner paying bitcoin miners to mine yeah it doesn't work that way um in fact it works the opposite way so assuming for sake of arguments that somehow there is significant fee revenue what actually happens is opposite where you have a real cash flow problem if you're trying to be a drive chain miner a blind drive chain miner because you're trying to be a drive chain miner because you get this money coming in in the form of drive chain fees which is not the same thing as bitcoin and you now have to go pay out bitcoin fees you need a big war chest of money be able to go do this you as a small entity will never be able to go pull this off because you're going to lock up your money for a very long period of time without any any reason to think you know any guarantees that you'll ever get it back i guess what i'm thinking is i i see that issue obviously because the withdrawal from the drive chain is uncertain because under paul's proposal you need miners to all out of the drive chain because you're going to lock up your money for a very long period of time the withdrawal transaction and it takes three months but what i'm getting at is wouldn't the bitcoin mining pool be the natural producer of drive chain blocks well now we have a centralization problem all over again right because why do they have to share the drive chain coins with me in exchange for bitcoin they can just take the drive chain coins yeah honestly i think the blind merge mining thing was just kind of an add-on paul made to try to make it a more plattable idea like i don't think there's any reason to think it will actually work it makes much more sense for mining pools to directly mine drive chains but in that environment you're really forcing mining pools to install a ton more software to use a lot more

bandwidth to you know use a lot more disk space and i think the key thing being to get themselves involved in a lot more complexity and that adds a lot of overhead every single new piece of software you have to install and manage is expensive and that's more centralization of mining absolutely you know we would really we're working very hard to make it possible to have decentralized mining pools apparently luke jr is uh working on this i might have maybe said a little more than i should have but uh i've heard that those rumors and uh there's something called braid pool um which exists there's also p2 pool um which for technical reasons doesn't work very well right now although i personally used to use p2 pool back when i was mining bitcoin and these ideas work quite well i mean you run a bitcoin node you install this extra piece of software which isn't very hard you point your hash power at it and you are actually acting as an agent of a mining pool directly you are the one constructing blocks and if you get lucky your block is found it really was your block and this enormously decentralizes block production it's extremely good thing to have it will avoid a lot of issues issues around censorship aml kyc and bitcoin etc but that's completely incompatible with drive chains because it's already hard enough to convince people to run one piece of software let alone you know 50 there's no way i in my i in my basement with a relatively small hash power operation am i going to make money off drive chains it's just not going to happen but if drive chains are big and are profitable i will kind of be forced to because it's the only way i can compete with other other miners i think you've articulated quite well the sort of fee issue of a quote-unquote drive chain miner who receives drive chain fees and has to pay out bitcoin to mine blocks and that this would logically create a low price for this drive chain token because it it might be uncertain when or if you could convert it to a drive chain token to bitcoin but what if the drive chain token actually did have value such that it was significant enough for a a miner to be interested in well then we're not talking about a drive chain anymore we're talking about a thing with a separate token i guess what i'm getting at is all pointed out to me that litecoin and other bitcoin fort and are being merged mine even now and there have even been cases when a bug in this sort of merged mine chain software with uh with a block template and you know and basically a mining pool lost out on a on a block subsidy a block reward and so what i'm wondering is if there is any economic value on the drive chain is mev also a concern on top of all of these other things or is that just a small potatoes for the audience uh you're talking about minor extractable value and the fact is i mean that's that is a a concern regardless of uh drive changer you know merge mining so on but fortunately in there really haven't been very many opportunities for mev because the sort of protocols that create those opportunities for the most part don't exist on bitcoin there are some small exceptions but they're pretty insignificant at this point and we've been careful to avoid creating those incentives in bitcoin mev is a bad thing we you know you do not want mev to exist that causes endless problems in ethereum and bitcoin we want to avoid that now that's not to say it's impossible for people to go create these problems but you know this is why you go and argue that hey you drive chains aren't a good idea you know certain types of exchanges on top of bitcoin aren't a good idea etc and you just avoid creating environments where it becomes a bigger problem it sounds like you've looked deeper into drive chains found more to be concerned about well i mean you know i got to point out too i mean as part of his article i looked deep into enough to go find some really stupid cryptographic mistakes too you know the particular way that blind merge mining works is actually kind of busted it may not be worth getting into in this this discussion but you know i was actually quite surprised to see the um particular you know these kinds of mistakes getting made and you know i wrote that up on my blog post but i think the fact that i seem to be the first person to notice this really says that very few competent people have ever bothered looking at drive chains i think people kind of read the summary and say yeah that's that's a silly idea you know and then they go work on something more important i appreciate the summary of your research into drive chains it sounds like paul is probably not going to be contracting you for more time i guess i was personally interested in the concept you know in a sort of naive way because there is this idea of scaling bitcoin somehow somehow taking transaction taking data moving it off chain and somehow anchoring it the goal of drive chains is something that lots of people want the problem is drive changes don't work and you know there's lots of ideas we've had that we would really like to go work and then someone goes and point some holes in it and we realize yeah that isn't possible you know i personally i mean i had my own um idea that was in competition with fidelity bonded banking and lightning is just endlessly better than my idea so yeah nobody's using my idea and that's fine lightning was just better in order to avoid this conversation being a total downer do you have any sense of where scaling is going to come from or what projects currently seem more of investigating and lightning and rgb those are the two main approaches that get really good scaling as part of what you know where i say lightning i'm also talking about extensions to lightning such as arc is you know a recent one that's come out um you know you get all kinds of things like channel factories coin pools etc etc maybe the way i could go put it is lightning's approach is to say let's go use justice

to prevent people from doing something bad and there's many many different variants of that idea and then the rgb approach is saying let's go have people who actually want to go and validate a coin for themselves validate the coin for themselves and you kind of call it difference between active security and passive security active security like lightning where you go do something in response to someone doing something bad so that that never happens in the first place and passive security where you go and validate and you get yourself in a position where you know that this math proof if you will was true and the only trick there was scaling is figuring out how to split up the math proofs and that potentially um with zero knowledge proofs can go very very far you know we may be in a position in the future where we can extend zero knowledge proofs to bitcoin itself and that would allow you to split up the consensus so that not everyone would have to validate the whole consensus rather i could go and prove to you that a coin i had without proving to you the full data is actually real and in that environment well block size can be a lot bigger i see because you've moved data off chain there's just a proof i haven't really moved it off chain what i've done is i've changed the meaning of what on chain means right like right now to validate a bitcoin block you have to have the whole thing with certain types of zero knowledge proofs we can go modify that and potentially get to the point where you can go and validate the whole data and then you can go and validate the whole data and then you you're only having to validate part of the chain and then collectively we validate the whole thing is this the sort of scheme that is driving something like utrixo uh i wouldn't say directly i think utrixo is doing something a lot simpler and less ambitious than what i described but you know some of these techniques have overlap certainly like utrixo has the idea of applying merkle trees to consensus and a lot of the stuff i just described that is part of how it would work but i don't think there's there's a strong overlap you know like this more of a spiritual connection well i really appreciate your thoughts on these questions and is there anything you'd like to say anything you'd like to point people to well i think the number one thing i'd say to people and i'm surprised at how many people haven't taken this advice is actually download a lightning wallet and try it you know there's a lot of bitcoiners who go endlessly theorize about the stuff but never actually use lightning what's your favorite bitcoin wallet phoenix is the most obvious one i think these days um it's straightforward it works very well you know has good routing and it's non-custodial with phoenix you are actually on your phone having a real lightning channel and you do hold those coins so yeah certainly if you haven't already try phoenix well great advice from peter todd actually we've been looking for a lightning wallet to sort of without nuance recommend and that sounds like the correct choice phoenix is great option well thank you so much peter i really appreciate your time thanks for having me on i hope you enjoyed that interview if you have any questions please feel free to ask them in the comments section below and i'll see you next time feedback please reach out bitcoin dad pod at protonmail.com at bitcoin dad pod on weapon x i'm also a noster if you can find me and we have an elements chat room maintained by chris at jupiter broadcasting where we have ongoing discussions remember this is a listener supported podcast we don't have any sponsors or ads so if you think that you got some value out of the conversation and you want to support ongoing production please boost in and be sure to include a message we read all of those messages and they mean a lot to us thanks for listening this has been your bitcoin dad see you next time