Abstract: In this report we examine merge mining on the Bitcoin blockchain. In the last year or so, on average each Bitcoin block mined contains around two commitment hashes from other blockchains somewhere in the coinbase transaction, indicating that most miners are conducting multiple forms of merge mining. Currently over 90% of the Bitcoin hashrate appears to be engaging in merge mining of one type or another. There has been considerable growth in merge mining over the last few years and this may be of limited concern to some, due to the small potential security risks and increased mining centralisation pressure. Most of these risks could be mitigated away by blind merge mining, if these newer schemes are adopted.
What is merge mining?
Merged mining, sometimes called auxiliary proof of work, is the process of mining two or more chains at the same time. Essentially the same proof of work can be used as assurance on multiple systems. This involves a parent chain and a child chain, when the child chain essentially inherits some of the security characteristics of the parent. We first talked about this concept in our 2017 piece “The Litecoin vs. Dogecoin hash-rate wars of 2014 and implications for Bitcoin vs. Bitcoin Cash”.
This report will focus on situations where Bitcoin is the parent chain and a commitment hash from another chain is located somewhere inside the Bitcoin blockchain. In these cases no change is required to Bitcoin, which does not need to be aware of the other system. However, the other chain needs to be structured to accept and receive the Bitcoin block header as evidence of the work. Miners can then receive two types of rewards for producing valid blocks, the normal Bitcoin reward and a reward for mining on the alternative chain.
Regular vs blind merge mining
It is also important to explain and identify two theoretical types of merge mining: regular merge mining and blind merge mining. Regular merge mining is conducted by Bitcoin miners, while blind merge mining can normally be conducted by anyone, who then pays Bitcoin miners in fees.
Characteristics of regular vs blind merge mining
| Regular merge mining | Blind merge mining | |
Who conducts the mining? | The activity is conducted by Bitcoin miners | Anyone can conduct the merge mining, these third party agents then pay transaction fees in Bitcoin to the miners |
| Validity | Miners are incentivised to check the validity of blocks in both chains | Miners typically only check the validity of blocks in the parent chain and are not concerned about the child chain |
| Mining incentives | Miners are rewarded in the native token of each chain | Miners are rewarded in Bitcoin for the work and do not lose any rewards if there is an issue on the child chain |
Blind merge mining is often thought of as superior to regular merge mining from a security perspective, as blind merge mining can prevent risks from the child chain impacting the parent. For example, in some systems a bug or issue in the child chain could cause a cessation of block production or a blockchain re-organisation in the parent chain. Another potential problem with regular merge mining is that validation costs in a child chain could be prohibitively expensive (for example, due to large block sizes), which could cause mining centralisation in the parent chain. Unfortunately, as far as we are aware, currently merged mining is primarily conducted the regular way, and blind merge mining is relatively rare.
Examples of blind merge mining systems include two competing proposals: an earlier proposal from Paul Sztorc’s (who identified many of the theoretical problems with merge mining), BIP301, and a more recent upgraded proposal, which avoids a “specific” softfork, from Ruben Somsen. Veriblock can also be considered as a blind merge mining scheme, although its usage of Bitcoin blockspace makes the mechanism somewhat controversial.
In this report, we are interested in the regular merge mining. Cases where the alternative chain commitment hash is inside the block header or coinbase transaction and not just in any transaction. The reason we have chosen to do this is because looking for evidence of hashes of alternative chains in the coinbase transaction is far easier than looking in all transactions. In addition to this regular merge mining may be more significant from a security point of view, as we explained above. Therefore the prevalence of regular merge mining may be interesting.
Where is the commitment hash located?
As for where the miners include these hashes from alternative chains, they must be in a specific location to avoid any doubt over which commitment is the true one. There is limited choice available for such commitments, the block header space is pretty much all used up and therefore the coinbase transaction is used. We have identified two spaces within the coinbase transaction for the alternative chain commitments:
- As an OP_Return coinbase output
- In the coinbase scriptsig
In this report we have attempted to assess the prevalence of merge mining in these two parts of the coinbase transaction over time.
Coinbase outputs
We scanned the entire blockchain history, from 2009 to October 2020 and counted the frequency of zero value outputs in the coinbase transaction, almost all of these are OP_Return outputs. As Figure 1 below illustrates, the prevalence of these outputs has accelerated dramatically in recent years. In 2020 YTD, on average there are 2.3 OP_Return outputs in each Bitcoin coinbase transaction, while prior to 2017 the number was effectively zero.
As we explained back in March 2018, the SegWit upgrade works by adding the merkle root of the witness merkle tree in the coinbase transaction. This commitment is very similar to many of the commitments for alternative merge mined chains, as they both use OP_Return outputs. SegWit is therefore included in the chart below and adoption has reached almost 100%. SegWit cannot really be considered an alternative chain, however from 2018 onwards, even excluding SegWit, OP_Return outputs have become increasingly prevalent in the coinbase transaction. This may indicate that regular merge mining is becoming increasingly popular.
Figure 1 – Number of zero value outputs in the Bitcoin coinbase transaction (Average over 1,000 block periods)
(Source: BitMEX Research)
As the chart illustrates, with the exception of SegWit, we have identified the RSK blockchain as the primary cause of this growth and highlighted it in red. We were able to identify these due to the presence of an RSK related tag in the output. At some point in 2019 other OP_Return outputs started emerging, however we have not yet been able to identify and tag these projects. In Figure 2 below, we look at adoption of RSK in more detail. The chart shows how adoption of the RSK chain among Bitcoin miners is now at the 40% to 50% level.
Figure 2 – Proportion of Bitcoin blocks with an RSK commitment in the coinbase transaction (Average over 1,000 block periods)
(Source: BitMEX Research)
As Figure 3 below illustrates, the frequency of these OP_Return outputs is not uniform across mining pools, with some pools adopting the merge mining and others not. For example, HuoBi and Binance have very low adoption of RSK, however their coinbase outputs contain extra OP_Returns, presumably from other projects. On the other hand, SlushPool has very high adoption of RSK at 88%, but not many other OP_Return outputs. Recently the Binance pool appears to have adopted RSK and therefore RSK merge mining is set to increase further.
Figure 3 – Average number of zero value outputs in the Bitcoin coinbase transaction by mining pool (Data since block 500,000)
(Source: BitMEX Research)
(Note: Mining pools ordered by the number of blocks found. Mining pool determined using data from ForkMonitor)
Merge mining in the coinbase scriptsig
The other location for the commitment hash is the coinbase scriptsig, the specification for this type of merge mining is outlined here. This scheme describes a methodology for embedding a merkle root of multiple alternative chain commitments into the coinbase scriptsig. This system therefore saves blockspace by avoiding the need for multiple commitment hashes in the event of multiple merged mined chains. Namecoin, the first merged mined coin and the first alternative coin after Bitcoin, uses this scheme.
As above, we scanned the entire Bitcoin blockchain from 2009 to October 2020, looking for evidence for this type of merge mining. As Figure 4 below illustrates, based on our analysis, merge mining using this scheme appears to have started towards the end of 2011. Adoption then picked up quite quickly towards around 75% of the hashrate, before falling to near zero in the 2016 period. Since then adoption of this merge mining scheme has picked up again and now stands at around 85%.
Figure 4 – Proportion of Bitcoin blocks with auxiliary proof of work in the coinbase scriptsig (Average over 1,000 block periods)
(Source: BitMEX Research)
As for the significant changes in the popularity of this merge mining scheme across Bitcoin’s history, we are unable to provide concise explanations. It may relate to various software bugs in Namecoin which may have caused declines in adoption by the miners in various periods or by changes in the popularity of various mining pools over time. Figure 5 below shows the price of Namecoin over the period, which seems to correlate with usage of this merge mining scheme to some extent, this may also partly explain the changes in adoption by the Bitcoin miners. The recovery in 2017 may therefore be driven by the ICO price bubble, combined with the release of Namecoin Core, which is based on current Bitcoin Core (rather than a very old version of Bitcoin), which may have made merge mining easier.
Figure 5 – Namecoin price (US$)
(Source: Coinmarketcap.com)
As Figure 6 below illustrates, in the last few years most of the mining pools have adopted this merge mining scheme. The only significant outliers among the major pools are Antpool, which at 71% has lower adoption than its peers and BitFury, which never seemed to adopt the scheme.
Figure 6 – Percentage of merge mining commitments in the coinbase scriptsig (Data since block 500,000)
(Source: BitMEX Research)
(Note: Mining pools ordered by the number of blocks found. Mining pool determined using data from ForkMonitor)
Conclusion
We were surprised to discover how popular merge mining has become among Bitcoin miners in recent years. In particular how miners are not only using one scheme, but adopting multiple systems and potentially using multiple pieces of software, which could in theory go wrong and cause issues. Each coinbase transaction contains commitment hashes to many alternative blockchain systems, sometimes as many as four or five. Given the high level of adoption among Bitcoin miners, this could cause additional security concerns to some. For example, complex or resource intensive merge mining schemes, which miners may need to run in order to remain economically competitive, could increase mining centralisation pressure. In addition to this, it is possible that bugs or chain re-organisations in these alternative blockchains could cause issues for the main chain, however, as long as software systems are implemented well, this risk should be minimal.
The blind merge mining schemes mentioned above appear to mitigate away most of these security risks and therefore adoption of these newer systems may be desirable. However, it is unclear if there is any significant incentive to upgrade to these blind systems. At least for now, we have seen no evidence these alternative merge mined chains make up a significant proportion of block rewards, therefore it is likely the security risks associated with merge mining are somewhat limited in practise. At the same time we have not seen any evidence that merge mining is causing problems for Bitcoin. However, it is worth carefully monitoring the situation, in our view.