11 May 2024
These next few years are as existential for bitcoin as the Blocksize Wars.
Back then it was about who got to decide what bitcoin was, now it’s about what bitcoin is.
To most of us, bitcoin was always a tool for freedom - freedom to transact with who you wanted without trusting any third-party who could prevent you from doing so. But this is now a question.
While Bitcoin’s price skyrocketed, developers focused on building tools to ensure this goal was met - building a robust, stable foundation in Bitcoin Core, building out the Lightning network to enable cheaper payments with better privacy than “tell everyone everything you’re doing”, exploring (and implementing) tons of ideas for other scaling from sidechains to statechains to timeout trees to Ark to…
Sadly, all the ideas for making bitcoin (or any cryptocurrency) actually useful for transacting trend towards having some untrusted party in the flow of funds - whether its a rollup or sidechain with one or ten chain operators, mobile lightning with an LSP, a statechain operator, ASP, etc, we just haven’t cracked building cryptocurrency payment rails without an (untrusted!) party being involved.
With regulators cracking down and more and more participants in the bitcoin ecosystem only interested in a 21M coins limit and seeing any form of non-KYC payment rails as hostile to the value of their investment, these centralized parties are increasingly going to be targets, and over the past few months we’ve even seen proactive closures to avoid regulatory scrutiny.
While there may have been a chance at clarifying (US) regulations that an untrusted party in the flow of funds isn’t required to perform the usual slate of KYC nonsense that strangles the traditional finance world, we squandered it expending all of crypto’s political capital pushing for securities reform to ensure token issuance is (maybe) legal rather than trying to ensure people can meaningfully transact without the entire world learning what they’re doing.
Worse, with mining (pools) as centralized as ever and relatively little desire to change from most miners, every layer of bitcoin is centralized and ripe for regulatory capture. While Sv2 or p2pool revival has a chance at improving this, the push for increased expressiveness on bitcoin and the MEVil that may come along with it may all but close the door to decentralized mining.
With where bitcoin is today its hard not to see a bleak vision of the future. Building a system that enables trustless global transacting was always going to be an uphill battle, but I always anticipated most bitcoiners would remain focused on this goal. Instead, today, the bitcoin community is focused on petty squabbles and infighting.
Sadly I don’t have any great solutions here. If bitcoiners want to preserve what we’ve built and fight for it the focus needs to be on drastic improvements to default wallet privacy across the ecosystem, aggressive investment in regulatory change (and not through lobbyists focused on securities regulation for crypto token issuance), and operation of scalability solutions across the world, not just in the US. Sadly, all of these areas are horribly underinvested in, and invested in at only a tiny fraction of the amount of energy that has gone into other areas of bitcoin.
16 Apr 2024
As the systems built on bitcoin become increasingly expressive, the use-cases for bitcoin grow exponentially. While this is incredibly exciting, the one major concern both proponents and detractors of increased expressiveness can agree on is the risk of “MEV”.
Sadly, there has been very little in the way of a clear definition of “MEV” in the context of bitcoin, and the standard definition of the term is so broad as to be entirely useless in discussions of protocol risk.
The term “MEV” (or “Miner Extractable Value”) originated with the ethereum community and means, broadly, all the value that miners/stakers can extract when building blocks. This includes both in-band protocol fees and block subsidy, but also any out-of-band fees they accept directly from transactors, value they can extract by reordering or creating their own transactions, exploiting smart contracts, or even reorging the blockchain!
This is such a broad term that saying we’re “concerned about MEV” is somewhat useless - are we concerned that miners are extracting the block subsidy they’re entitled to? Obviously not. Worse, the ethereum community’s concerns with MEV partially overlap the concerns of the bitcoin community, but certainly aren’t the same.
Still, to understand the risks of MEV in bitcoin it’s useful to learn from the history of ethereum. As block building on ethereum has become increasingly specialized to extract the maximum possible MEV, a few effects have emerged:
First, and most concerningly, there are only a very, very small handful of companies who have invested sufficient capital (in the form of hiring world-class engineers) to be competitive at selecting and creating the most profitable set of transactions for the next block. From the point of view of censorship resistance on the network, this is incredibly damning - when only a few companies do, or could, select nearly all the transactions which can enter the blockchain, any hope of censorship resistance is lost.
Second, those trading on decentralized exchanges, and more broadly those using protocols that have an undefined counterparty, often find their counterparty replaced with the block’s transaction selector, to some loss in value. This comes in many forms, but commonly simply by the transaction selector arbitraging prices between decentralized and centralized exchanges, taking the price difference for themselves as profit. This impacts the quality of the experience for users of more expressive contracts on ethereum.
Bitcoin, as a system and community, largely seeks to maximize censorship resistance through decentralized transaction selection over any other goals. Sadly, today, bitcoin’s transaction selection is also highly centralized in the form of pools. Luckily, there’s no strong financial incentive for this, only historical technical reasons. While this allows us to massively re-decentralize bitcoin with only technical tweaks to the mining software stack, any financial disincentives to adopting such technology would absolutely destroy bitcoin’s long-term censorship resistance. So much so, that I’d argue that if we end up in the same place as ethereum is today, we should simply give up on bitcoin’s censorship resistance axiom as we simply will not achieve it in any reasonable way.
Thus, the first class of MEV (the resulting centralization pressure) is also a substantial potential issue for bitcoin. The second issue (degraded execution quality and usability), much less so. In fact, given bitcoin’s axiom of censorship resistance above all else, I’d argue trading transaction execution quality for any marginal censorship resistance gain would be worth it, at least at the level of the overall bitcoin system.
Some Bitcoiners have taken to calling this centralization MEV risk MEVil (or “MEV that is evIL”). Specifically, MEV which results in a financial incentive for miners to employ sophisticated technology in order to ensure the transactions they include in the next block have the maximal value is MEVil. This can come in the form of changing the order of transactions in a block or creating new ones, but it does not include cases where an open market might bid on creating specific transactions using Replace-By-Fee (or “RBF”). Further, because there is likely to be reasonable long-term decentralization of hash power, we do not include multi-block censorship attacks - such attacks require some amount of miner coordination and require miners be willing to forgo profit now for greater profit later, risking their competition claiming the profit for themselves.
Many developers working on increasing expressiveness in bitcoin have concluded that MEV is inevitable on bitcoin and we should simply prepare ourselves for it. However, I think this stems from a focus on the broad definition of “MEV”, rather than the more practical definition of MEVil. MEVil is not inevitable on bitcoin, however avoiding it does require engineers building expressive bitcoin systems consider the impacts of their work carefully.
Here, it’s useful to consider some examples of things which fit the broad definition of MEV, and how they do or do not introduce MEVil:
MEV is often raised when discussing systems which may result in transactions which can be profitably replaced. For example, an output on chain which can be claimed by anyone without specific private key material or a trade in a decentralized exchange which executes at an incorrect price. In these examples it may be possible for anyone, including miners, to create a new transaction which claims some value directly or indirectly. While this is obviously MEV (after all, this value should flow to miners somehow), it is unlikely to create MEVil. Thanks to bitcoin’s ten minute block time and public mempool, anyone has a chance to bid (by paying a higher mining fee) for the ability to claim this value. This allows miners to extract this value while remaining entirely passive and not implementing any custom or advanced logic to monitor for or create these claims. Over the past few years we’ve seen a handful of examples of these kinds of in-mempool bidding wars, including notably funds sent to insecurely generated private keys. This also implies that miners which receive transactions via any form of private relay should ensure they submit such transactions to the public mempool, ensuring others can bid to replace them and increase the miner’s revenue.
A popular scheme a number of groups are working on building are “rollups” on bitcoin. These are sidechain systems where the transaction data for the sidechain is embedded in the bitcoin blockchain itself. Because these systems can have arbitrarily expressible smart contracts, they are likely to have the potential for advanced MEV extraction similar to what we see on ethereum today. However, in most cases, such systems do not create MEVil in bitcoin. In most rollup systems there is a single or small group of “sequencers” which select the transactions that enter the rollup as well as their order. Thus, the sequencers have the exclusive ability to extract MEV and bitcoin miners are not able to use their transaction selection or ordering power to influence the rollup‘s transactions.
Some rollup systems, referred to as “based rollups”, however, give bitcoin miners the ability to directly select and order rollup transactions. This runs substantial risk of creating MEVil, and in fact if we see deployment of large-scale naive based rollups I believe bitcoin may suffer a terrible fate. Still, based rollup developers have a few easy tricks which can substantially reduce MEVil risk. First of all, based rollups can remove the ability for miners to order rollup transactions by randomizing the order keyed using the bitcoin block hash. Thus, for miners to influence the order of rollup transactions they must be willing to fully discard valid bitcoin blocks, forgoing potentially substantial profit. Secondly, based rollup developers can randomize transaction ordering across multiple blocks, ensuring single bitcoin miners cannot censor rollup transactions, further reducing their ability to materially extract MEVil. While this may delay rollup transaction confirmation times somewhat, I’d strongly encourage rollup developers to consider whether there is a genuine material difference between users waiting for six confirmations and users waiting for seven, eight, or nine confirmations.
I’d also encourage developers, Bitcoiners, and everyone to vote with their feet - if a rollup system introduces material MEVil risk to bitcoin, simply use an alternative system - if you don’t, the utility of that system is going to eventually be ruined by increased bitcoin miner centralization anyway. In this case, centralized and federated rollups are much more clearly safe, and based rollups or ones with a “force-inclusion” mechanism should be carefully considered before using them!
Another common example raised as MEV on bitcoin is the inclusion of nonstandard transactions or, more broadly, any transactions which reach a miner outside of the public mempool. While this indeed introduces strong centralization pressure for larger miners to offer this as a service, which is absolutely MEVil, we have not yet seen material demand or revenue from such transactions. Indeed, as mentioned above, miners have an incentive to ensure transactions received via private relay reach the public mempool where possible to allow for public RBF bidding. While there is certainly demand for nonstandard transaction inclusion as a novelty, it is unclear if this market will grow in the long term. Further, Bitcoin Core can, should, and generally does allow any transaction as standard, with restrictions only for transactions representing denial-of-service attacks or when the inclusion of a transaction makes Bitcoin Core unable to accurately calculate competitive block templates. As Bitcoin Core continues to improve, the demand for any nonstandard transactions will continue to decline, thus reducing the profit potential of any MEVil extraction.
More recently, out of band payments to miners have become popular again, allowing individuals to pay large pools for the inclusion of their transaction(s) using payments outside of the normal bitcoin transaction fee. This can create substantial MEVil but only if the out-of-band payment is offered directly to a single or group of miners. Any kind of out of band fee payment which is easily claimable by any miner does not contribute to MEVil-induced centralization, and thus open protocols for this are important. Further, while out of band fees have been commonly available on bitcoin before, they have never represented a substantial portion of miner revenue, and with technologies like Lightning and RBF (very slowly) becoming more popular in consumer bitcoin wallets, the need for out of band payments should further decrease.
Finally, some individual coins on chain have developed collector value. Notably, coins freshly mined in coinbase outputs in certain blocks (especially after difficulty or block subsidy adjustments) have often been valued at higher than their Bitcoin amount. While this has negative implications on fungibility, the extraction of such additional value can also be considered a form of MEVil. After all, claiming this value may require additional investment in human capital to evaluate and participate in “rare sats” marketplaces. The long-term value of these collectors items remains unclear, and valuing them is, correctly, often considered antisocial by Bitcoiners who care about the long-term sustainability and performance of the bitcoin system. Luckily, such “rare sats” that (may) have material value only occur in very few blocks (currently those every 4 years after subsidy adjustments), reducing the total impact it can have on miners.
While there are many risks on the horizon which may introduce MEVil in bitcoin, thus substantially risking the long-term censorship resistance (and therefore value) of bitcoin, there is no reason yet to fear that such an outcome is inevitable. Indeed, while MEV on bitcoin is inevitable and here today, “MEV” is a largely useless term for describing our censorship resistance and centralization concerns. Engineers developing, and users selecting, platforms which add additional expressivity to bitcoin must carefully consider the risk of MEVil these systems may introduce. Opting to build or use systems which introduce MEVil to bitcoin must thus be avoided, and considered antisocial, or the long term value in these systems and the bitcoin system itself may be destroyed.