BIP: 300
  Layer: Consensus (soft fork)
  Title: Hashrate Escrows (Consensus layer)
  Author: Paul Sztorc <truthcoin@gmail.com>
          CryptAxe <cryptaxe@gmail.com>
  Comments-Summary: No comments yet.
  Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0300
  Status: Draft
  Type: Standards Track
  Created: 2017-08-14
  License: BSD-2-Clause
  Post-History: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-May/014364.html

Abstract

BIP-300 enables a new type of L2, where "withdrawals" (the L2-to-L1 txns) are governed by proof-of-work -- instead of a federation or fixed set of pubkeys.

BIP-300 emphasizes slow, transparent, and auditable withdrawals that are easy for honest users to get right and hard for dishonest miners to abuse. The main design goal for BIP-300 is partitioning -- users can ignore BIP-300 txns if they wish; it makes no difference to L1 if the user validates all, some, or none of them. The second design goal is security -- users of the L2 should feel confident that, if the L2 network is paying a lot of fees, then miners will want to keep it around, and the withdrawals will therefore be processed accurately.

Once BIP-300 has established a "bridge" between L1 and these L2s, users can swap coins in and out instantly, only using BIP-300 for final settlement. This setup allows Bitcoin to process all the transactions in the world, of any shape or size, regardless of blocksize, node software, tech stack, or decentralization level -- all without altering L1 at all.

Motivation

BIP-300 allows us to achieve strong privacy, planetary scale, and hundreds of billions of dollars in annual mining revenues, all with a security model that is much stronger than that of the Lightning Network.

The original motivation stretches back to Reid Hoffman, who wrote in 2014: "Sidechains allow developers to add features and functionality to the Bitcoin universe without actually modifying the Bitcoin Core code...Consequently, innovation can occur faster, in more flexible and distributed ways, without losing the synergies of a common platform with a single currency."

See drivechain.info for more information.

Specification

Overview

BIP-300 consists of six new blockchain messages:

• M1. "Propose New Sidechain"
• M2. "ACK Proposal"
• M3. "Propose Bundle"
• M4. "ACK Bundle"
• M5. Deposit -- a transfer of BTC from-main-to-side
• M6. Withdrawal -- a transfer of BTC from-side-to-main

Nodes organize this data into a few caches, mainly these two:

• D1. "The Sidechain List"
• D2. "The Withdrawal List"

D1 (The Sidechain List)

D1 is a list of active sidechains. D1 is populated via M1 and M2. Fields #9 and #10 are updated via M5 and M6.

D2 (The Withdrawal List)

Withdrawals are transactions that remove coins "from" L2 (i.e., from the BIP-300 locked UTXO), and place them back on L1. Each BIP-300 withdrawal can pay out up to 6,000 withdrawals, and only one withdrawal can succeed at a time (per L2). Therefore, since all L2 users share the same large withdrawal-event, on L1 we call these withdrawals "bundles".

D2 is driven by M3, M4, M5, and M6. Those messages enforce the following principles:

1. The database has a canonical order (first come first serve).
2. From one block to the next, every "Blocks Remaining" field decreases by 1.
3. When "Blocks Remaining" reaches zero, the bundle is removed.
4. From one block to the next, the value in "ACKs" may either increase or decrease, by a maximum of 1 (see M4).
5. If a bundle's "ACKs" reach 13150 or greater, it "succeeds" and its corresponding M6 message can be included in a block.
6. If the M6 of a bundle is paid out, it is also removed.
7. If a bundle cannot possibly succeed ( 13150 - "ACKs" > "Blocks Remaining" ), it is removed immediately.

M1 -- Propose Sidechain

New sidechains are proposed with M1, and ACKed with M2.

M1 is a coinbase OP Return output containing the following:

    1-byte - OP_RETURN (0x6a)
    4-byte - Message header (0xD5E0C4AF)
    N-byte - The serialization of the sidechain.
      1-byte nSidechain
      4-byte nVersion
      x-byte title
      x-byte description
      32-byte hashID1
      20-byte hashID2

M1 is invalid if:

• It would add a duplicate entry to D1.
• There is already an M1 in this block.
• The sidechain serialization does not parse.

Otherwise:

• A new entry is added to D1, whose initial Activation Status is (age=0, fails=0).

M2 -- ACK Sidechain Proposal

M2 is a coinbase OP Return output containing the following:

    1-byte - OP_RETURN (0x6a)
    4-byte - Message header (0xD6E1C5BF)
    32-byte - the sha256D hash of sidechain's serialization

M2 is ignored if it doesn't parse, or if it is for a sidechain that doesn't exist.

M2 is invalid if:

• An M2 is already in this block.
• It tries to ACK two different M1s for the same slot.

Otherwise:

• The sidechain is "ACK"ed and does NOT get a "fail" for this block. (As it otherwise would.)

A sidechain fails to activate if:

• If the slot is unused: during the next 2016 blocks, it accumulates 1008 fails (i.e., 50% hashrate threshold).
• If the slot is in use: during the next 26,300 blocks, it accumulates 13,150 fails (i.e., 50% hashrate threshold).

( Thus we can overwrite a used sidechain slot. BIP-300 sidechains are already vulnerable to one catastrophe per 13150 blocks (the invalid withdrawal), so this slot-overwrite option does not change the security assumptions. )

Otherwise, the sidechain activates (Active is set to TRUE).

Withdrawing in Bundles

Sidechain withdrawals take the form of "bundles" -- named because they "bundle up" many individual withdrawal-requests into a single rare L1 transaction.

On the L2 side, individual withdrawal requests are periodically combined into a single CoinJoin-like withdrawal bundle. This bundle is hashed in a particular way (on both L2 and L1) -- this "blinded hash" commits to its own L1 fee, but (notably) it does not commit to its first tx-input (in that way, it is like BIP-118).

This hash is what L1 miners will slowly ACK over 3-6 months, not the M6 itself (nor any sidechain data, of course).

A bundle will either pay all its withdrawals out (via M6), or fail (and pay nothing out for anyone).

M3 -- Propose Bundle

M3 is a coinbase OP Return output containing the following:

    1-byte - OP_RETURN (0x6a)
    4-byte - Commitment header (0xD45AA943)
    32-byte - The bundle hash, to populate a new D2 entry
    1-byte - nSidechain (the slot number)

M3 is ignored if it does not parse, or if it is for a sidechain that doesn't exist.

M3 is invalid if:

• This block already has an M3 for that nSidechain.
• A bundle with this hash is already in D2.
• A bundle with this hash already paid out.
• A bundle with this hash was rejected in the past.

Otherwise: M3 adds an entry to D2, with initial ACK score = 1 and initial Blocks Remaining = 26,299. (Merely being added to D2, does count as your first upvote.)

M4 -- ACK Bundle(s)

Once a bundle is in D2, how can we give it enough ACKs to make it valid?

M4 is a coinbase OP Return output containing the following:

    1-byte - OP_RETURN (0x6a)
    4-byte - Commitment header (0xD77D1776)
    1-byte - Version
    n-byte - The "upvote vector" -- describes which bundle-choice is "upvoted", for each sidechain.

The M4 message will be invalid (and invalidate the block), if:

• It tries to upvote a bundle that doesn't exist. (For example, trying to upvote the 7th bundle on sidechain 2, when sidechain 2 has only three bundles.)
• There are no bundles at all, from any sidechain.

If M4 is NOT present in a block, then it is treated as an "abstain" for all sidechains.

If M4 is present and valid: each withdrawal-bundle that is ACKed, will gain one upvote.

Each sidechain always has two "virtual bundles" -- an "abstain" bundle (0xFF), and an "alarm" bundle (0xFE). Abstain leaves the ACK count unchanged, and alarm reduces all ACK counts of all bundles by 1.

Any bundle which fails to receive a vote, is downvoted (and loses 1 ACK). If a sidechain has no pending bundles, then it is skipped over when M4 is created and parsed.

Examples

To upvote the 7th bundle on sidechain #1, and upvote the 4th bundle on sidechain #2, the upvote vector would be { 07, 04 }. And M4 would be [0x6A,D77D1776,00,0006,0003].

If block 900,000 has D2 of...

...and then D2 wants to become:

... then M4 would have been [0x6A,D77D1776,00,0000,0001].

Saving Space

The version number allows us to shrink the upvote vector in many cases. Version 0x00 omits the upvote vector entirely (i.e., 6 bytes for the whole M4) and sets this block's M4 equal to the previous block's M4. Version 0x01 uses 1 byte per sidechain, and can be used while all ACKed withdrawals have an index <256 (i.e., 99.99%+ of the time). Version 0x02 uses 2 bytes per sidechain, but it always works, even in astronomically unlikely cases (such as when >1 sidechains have >256 bundle candidates). Version 0x03 omits the upvote vector, and instead upvotes only those withdrawals that are leading their rivals by at least 50 votes.

For example, an upvote vector of { 2 , N/A, 1 } would be represented as [0x6A,D77D1776,01,01,00]. It means: "upvote the second bundle in sidechain #1; and the first bundle in sidechain #3" (iff sidechains #2 has no bundles proposed).

An upvote vector of { N/A, N/A, 4 } would be [0x6A,D77D1776,01,03].

M5 -- Deposit BTC (from L1 to L2)

Finally, we describe Deposits (M5) and Withdrawals (M6). These are not coinbase outputs, they are txns on L1.

We call a transaction "M5" if it spends from the escrow output and increases the quantity of coins. Conversely, we call a transaction "M6" if it spends from the escrow output and decreases the quantity of coins. See here.

Every time a deposit/withdrawal is made, the old UTXO is spent and a single new UTXO is created. (Deposits/Withdrawals never cause UTXO bloat.) At all times, the specific treasury UTXO ("CTIP") of each sidechain is cached in D1 (above).

Every M5 is valid, as long as:

• It has exactly one OP_DRIVECHAIN output -- this becomes the new CTIP.
• The new CTIP has more coins in it, than before.

M6 -- Withdraw BTC (from L2 to L1)

M6 is invalid if:

• The blinded hash of M6 does NOT match one of the approved bundle-hashes. (In other words: M6 must first be approved by 13,150 upvotes.)
• The first output of M6 is NOT an OP_DRIVECHAIN. (This OP_DRIVECHAIN becomes the new CTIP. In other words: all non-withdrawn coins are paid back to the sidechain.)
• The second output is NOT a zero-value OP_RETURN script of exactly 10 bytes, of which 8 bytes are a serialized Bitcoin amount.
• The txn fee of M6 is NOT exactly equal to the amount of the previous bullet point.
• There are additional OP_DRIVECHAIN outputs after the first one.

Else, M6 is valid -- and the funds are withdrawn.

(The point of the latter two bullet points, is to allow the bundle hash to cover the L1 transaction fee.)

OP_DRIVECHAIN

This proposal adds a single new opcode, OP_DRIVECHAIN, which has strict semantics for usage. OP_NOP5 (0xb4) is redefined as OP_DRIVECHAIN if and only if the entire script is OP_DRIVECHAIN followed by a single-byte push and OP_TRUE (exactly 4 bytes). The single-byte push contains the sidechain number. Note that this is not a "script number", and cannot be OP_1..OP_16 or any other kind of push; it is also unsigned, and must not be padded even if over sidechain number 127. The final OP_TRUE is to ensure this change remains a softfork: without it, sidechain numbers 0 and 128 would cause the legacy script interpreter to fail.

If an OP_DRIVECHAIN input is spent, the additional rules for M5 or M6 (see above) must be enforced.

<h2>Backward compatibility</h2>


This soft fork can be deployed without modifying Bitcoin Core at all (i.e., via <a href="https://bip300cusf.com/" target="_blank">CUSF</a>).


<h2>Deployment</h2>


This BIP deploys when/if >51% hashrate runs <a href="https://github.com/LayerTwo-Labs/bip300301_enforcer/" target="_blank">the enforcer client</a>.

Ideally, a critical mass of users would also run the enforcer client -- this would strongly dissuade miners from ever de-activating it.


<h2>Reference Implementation</h2>


The enforcer is <a href="https://github.com/LayerTwo-Labs/bip300301_enforcer/" target="_blank">here</a>.

Also, several example L2s are <a href="https://releases.drivechain.info/" target="_blank">here</a>.


<h2>Copyright</h2>


This BIP is licensed under the BSD 2-clause license.