Pettycoin and sidechaining

At linux.conf.au 2015 in Auckland, Rusty Russell presented a talk about his personal side-project, Pettycoin. Russell had announced Pettycoin at LCA 2014; at that time it represented an untested concept: a way to attach a separate, Bitcoin-like network to the existing Bitcoin blockchain. Pettycoin's goal was originally to offer a simpler and faster "side network" that periodically reconnected to Bitcoin. In the intervening year, Russell made a lot of progress, but other new innovations in the Bitcoin arena have led him to question parts of the Pettycoin approach and consider a reimplementation.

Russell began with a recap. The problem he set out to solve is that Bitcoin mining is an expensive task, with upfront hardware and ongoing power costs. Those expenses place a lower bound on the transaction fees that accompany every Bitcoin transaction, which in turn means there is an inherent limit to how small a "microtransaction" can be. Pettycoin was envisioned as a Bitcoin-like "adjunct" service optimized for microtransactions with a quick turnaround.

He designed it to function as a bi-directional gateway to the existing Bitcoin network. Small amounts could be removed from the Bitcoin network, converted to Pettycoins, and exchanged as needed; when the transactions were complete, the Pettycoin owners could re-enter the Bitcoin network and receive the correct amount (in Bitcoins) for their Pettycoin balances.

But Pettycoin would also have some distinct properties that differ from how Bitcoin operates. First, it would be limited to small amounts and use a simplified transaction protocol, features that would enable the Pettycoin network to have fast block times (i.e., the average amount of time between new blocks being mined, which corresponds to the wait time required to verify a transaction). Bitcoin's block time is approximately ten minutes, while Russell aimed for ten seconds with Pettycoin. Second, it would have a time-limit "horizon"—after one month, unclaimed Pettycoin transactions would be automatically returned to the Bitcoin network. That lowers the risk of participation by making it hard to permanently lose Bitcoins.

Third, it would require only "partial knowledge" from clients—in other words, although every Bitcoin client has to know every transaction in the Bitcoin blockchain just to participate, it would be sufficient in Pettycoin for someone to know each transaction. That significantly reduces the cost of participating as a client, which also bolsters the idea of offering fast transaction times. Finally, it would offer a payback mechanism to reward participants: each miner that processes a transaction would receive a small percentage of future transaction fees as payment, since the Pettycoin network would not, itself, mine new coins to serve as a reward.

Russell got approval to work on the project during a sabbatical from his day job at IBM, and took six months in mid-2014 to explore the ideas and develop an implementation. When he announced the first working code, though, he ran into a challenge: it was difficult to explain to people what the purpose of the project was. There are a glut of so-called "altcoins" on the Internet: projects that mimic Bitcoin, usually with some superficial change, and often building on Bitcoin software. Examples of altcoins include Litecoin and Dogecoin.

Lacking a better option to publicize the new project, Russell announced its existence on the main altcoin discussion forum, where it gained virtually no attention. In part this was because of the "orders of magnitude of noise" outweighing meaningful discussion on the altcoin forum, he said, and partly it was because no one understood what Pettycoin was meant to be. Either way, it made it considerably harder to get in touch with other developers who might be interested in the project.

But things changed rather suddenly in October, when Adam Back, Greg Maxwell, and others published Enabling Blockchain Innovations with Pegged Sidechains [PDF] (a.k.a., "the sidechains paper"), a white paper that "explained the right way to do this." As described in the paper, sidechains enable the Bitcoin network to be used as backbone resource to which other, independent cryptocurrencies can be attached. They are, in essence, an implementation of the same concept Russell was exploring with Pettycoin.

Russell then took what he termed "a massive detour" to explain sidechains. The concept is, naturally, a rather involved one, and Russell included considerable supplementary information in his slides that he labeled "caveats and notes"—skipping over them during the talk, but leaving them for further perusal. Interested readers would do well to have a look at the talk slides [PDF] for more detail.

The general idea, though, can be described in a few broad strokes. Every Bitcoin transaction is recorded with inputs (payers) and outputs (payees)—except for transactions that correspond to minting new Bitcoins, which have no inputs and, thus, have a dummy input field. A sidechain can be created by specifying a meaningful value in this dummy field—specifically, the transaction record of the start of the sidechain (which, like all Bitcoin transaction records, is hashed). This records the creation of the sidechain in the main Bitcoin network, so it can be verified later; the dummy input field has no effect on the other Bitcoin transactions recorded in the same Bitcoin block.

With the addition of two special functions to the Bitcoin protocol—one that moves Bitcoins from the main network to the sidechain, and one that returns Bitcoins to the main network, sidechain users could use "real" Bitcoins to conduct their transactions, and easily convert them back to the more widely-accepted Bitcoin standard. But, apart from the processing needed to transfer in and out of the Bitcoin network, sidechains are essentially untethered: they can operate according to different rules, experiment, and even implement other kinds of transactions. In short, they could be used to implement many of Pettycoin's ideas. Furthermore, client applications can simultaneously mine Bitcoins and sidechains, since sidechains can be initialized with Bitcoin blocks. Thus, there is no additional "cost" to the Bitcoin network for anyone to implement sidechains.

Sidechains are a new idea, and one that is still undergoing considerable debate in the Bitcoin community—alterations to the Bitcoin protocol are a serious matter. But, Russell said, a significant side-effect of the sidechain paper was that he suddenly found a lot of people interested in discussing his Pettycoin ideas.

The obvious question is whether or not Russell would re-implement Pettycoin as a sidechain project. On that topic, he said he had already learned a number of things from the sidechain paper and from subsequent discussions that would simplify a Pettycoin re-implementation.

For example, he has reconsidered how Pettycoin implements "partial knowledge" support. Sidechains enable some of the partial-knowledge features Russell had defined for Pettycoin, but more robustly. In particular, sidechains allow clients to spot (and, more importantly, to prove) when another client is trying to publish a fraudulent transaction—such as spending the same Bitcoin twice or spending a nonexistent Bitcoin balance—without requiring the client to process the entire historical Bitcoin blockchain.

In the original Pettycoin implementation, clients recorded a back-reference in their transactions—essentially, a pointer to where the Pettycoin balance they were spending came from. Other clients could prove a transaction was fake by looking up the back-reference and showing that it did not contain the balance that the spender claimed it did. Sidechains use a more complicated solution, tracking all unspent transaction balances and accompanying each balance with a proof (namely, a tree of the preceding transactions, which can be verified by checking its hash value). More data is required, but including the proof makes spotting phony transactions simpler and faster.

Russell also decided that Pettycoin's mechanism for paying miners transaction fees was too unpredictable and that his approach to achieving ten-second average block times was flawed (since it requires headers that are an order-of-magnitude larger than Bitcoins and still, in some percentage of blocks, results in extremely long block times).

The upshot, he concluded, is that the Bitcoin world "has moved on" in a significant fashion since Pettycoin was first developed. He will have to make the system more Bitcoin-like, which essentially means he will have to rebase his code on the Bitcoin reference code. On the other hand, he said, the good news is that there is now a well-understood word for what Pettycoin is: a sidechain. And that makes it easier to talk about and to recruit developers with.

Sidechains have the potential to spur enormous innovation in the developer community, since they leverage Bitcoin's advantages (such as decentralization and proof of work) but allow new projects to establish their own rules. Pettycoin will be making a comeback at some point (although Russell did not have a time frame to announce) in the new sidechain world, but it will likely be far from the only experiment worth watching.

[The author would like to thank LCA 2015 for travel assistance to Auckland.]