In this article, we discuss and analyze various consensus models for a decentralized Bitcoin sidechain that doesn’t require the use of Bitcoin derivatives in the form of pegs, implementing instead a free market for transaction fees on the sidechain.
Intro: Why have a sidechain for asset tokenization?
Before moving on to the details of the sidechain consensus, it’s worth highlighting once again why a Bitcoin sidechain for asset tokenization is a good idea in the first place.
Asset tokenization over a blockchain is a solution to the current over-centralization of the financial system. Today, all securities are owned by entities acting as Central Security Depository for a particular jurisdiction (e.g. Cede and Co. in the U.S., which basically owns all publicly traded stock in the U.S.) resulting in massive distortions like naked short selling, censorship, and market over-regulation. The current system sometimes misallocates privileges, always charges unnecessary costs, and requires unnecessary intermediaries which also hinder a free market competition of regulators and arbiters.
Sequentia is meant to be a dedicated solution for asset tokenization, allowing direct trades of BTC for financial assets, like securities or stablecoins, with several distinct advantages:
- It won’t require a BTC derivative (e.g. pegged BTC like wBTC on Ethereum or LBTC on Liquid) which is a centralizing factor in any currently existing blockchain
- It won’t require a specific currency, or “gas token” to pay for transaction fees. Any token can be used as long as it’s accepted by blocksigners (e.g. paying fees in USDt while transferring USDt)
- It will enable the use of BTC as the monetary standard to exchange financial assets. Today, BTC can be widely used to directly buy many goods and services but still doesn’t see any actual adoption in the world of financial markets.
- As a result, it will enable the use of BTC as a risk-hedge asset and store of value in DEXs.
In the following paragraphs, we will describe various proposals of different consensus for Sequentia sidechains.
Before that, it’s important to note that Sequentia is going to be built as a fork of Elements, the same codebase used by Blockstream Liquid. Below we describe the three key differences to current implementations of Elements: Sequentia is peg-less, anchors to Bitcoin, and replaces the federation with an alternative consensus with the goal of reaching more decentralization (fair distribution of the role of block creator).
Peg-less sidechain
One of the key differences to current implementations of Elements is the removal of a native token to pay for fees (the BTC derivative LBTC in the case of Liquid). Users can attempt to pay transaction fees with any token among those available in their wallet. The fee economy becomes a free market where block creators have incentives to accept any token as long as it has a recognized value in the market and sufficient liquidity. Simultaneously, the game theory for this mechanism may lead to the rejection of illiquid tokens, constituting an effective spam filter.
Network participants that need to calculate the fee value may query price data from a centralized exchange or DEX oracles. Block creators may cross-check the trading volume of tokens currently in the mempool against BTC, build the block that will collect the highest possible value of tokens that can reliably be exchanged for BTC, and automatically atomic swap all of these tokens for BTC, as soon as the block reward is spendable. Therefore, block creators could receive a passive income composed solely of BTC. Tokens such as stablecoins might be good candidates for transaction fees given the relative stability in price until the coinbase of the sidechain block is unlocked.
Bitcoin anchoring
Cross-chain operations such as direct trade of BTC for sidechain tokens need to be as fast and reliable as possible, which implies that the operation must always be consistent with its counterpart in the other blockchain; a chain reorganization happening on one chain only without being reflected on the other, would not be admissible.
If Sequentia block X is linked to Bitcoin block Y, the block X+1 is necessarily linked to a Bitcoin block at a height equal or higher to Y. If a chain reorganization happens on Bitcoin, it should reflect on the sidechain, while the sidechain itself should be structured in a way that it avoids chain reorganizations.
This goal can be achieved in several ways, the design chosen for Sequentia uses a mechanism called “Bitcoin anchoring” combined with immediate finality of sidechain blocks, but a merged-mining mechanism where a Bitcoin block always corresponds to a single sidechain block (and vice versa) is also feasible, including a Blind Merged Mining version which we will detail in the next paragraphs.
No federated consensus
As a further improvement towards decentralization, Sequentia wants to distinguish itself from the most well-known Elements blockchain currently in the market, Liquid, by opening up the mechanism for the selection of block creators, in such a way that it is determined by purely economic incentives rather than by a specific entity or an association of defined entities.
The first and so far chosen design of Sequentia (see docs.sequentia.io) implements a staking system as a market-oriented mechanism to distribute the role of block creator on the network. Such a system grants proper skin-in-the-game incentives securing the chain from malicious behaviors. It also increases the chances for blocksigners to remain anonymous (the tokens that must be staked can be bought on a DEX), thus preventing attacks more effectively, especially on the scale of a State-sponsored attack.
The trade-off here is the introduction of a complex consensus system with a token. Therefore it’s worth exploring other ideas and technologies to see if any alternative mechanism of decentralized block creation is viable. We have analyzed different models that proved not adequate although we also encountered one pretty convincing idea, the BMM model that we temporarily will call, for the sake of simplicity, Sequentia BMM. As we will see, there are interesting trade-offs compared to the stake-based consensus of Sequentia.
To better understand the proposed model we will review several technologies and designs of different consensus systems, in particular:
- blocksigners stake BTC directly;
- the stake is represented by non-fungible bitcoins;
- the merge-mining model;
- Spacechains;
- a Blind Merge Mining model without the perpetual one-way peg.
1. Bitcoin proof-of-stake
If you introduce a hybrid consensus using both Bitcoin Proof-of-Work and a Proof-of-Stake like it’s done in Sequentia, why not just use BTC directly for the staking mechanism? You may use a locktime and OP_RETURNS to mark some output as a stake for Sequentia, and then run a VRF function to randomly select the block creator from among the stakers (weighted for the size of their stake) and co-signers for each round of block creation. The stakers will link their Sequentia public key into the BTC stake, which is retrieved by Sequentia nodes since they require you to run a Bitcoin node anyway (for the Bitcoin anchoring and leader selection).
The biggest problem with this solution is that Bitcoin holders don’t necessarily perceive themselves to have an economic stake in the chain, so the calculation of the cost of attacking the sidechain, from the point of view of malicious actors, might be almost zero since they just need to label their BTC holdings (those that they wouldn’t spend or invest anyway) as a “stake” through a specific transaction. For example, a big service or exchange like Coinbase might have enough reserves always available in a wallet to be able to tolerate the long locktime required to perform continuous 50+1 attacks. It’s questionable if this “centralizing” issue can be mitigated by enforcing very long locktimes on the staked BTC. In fact, very long locktimes might just discourage smaller holders to stake, while still having major Bitcoin holders attacking the sidechain at their will. In general, it’s not a good idea to have a staking mechanism to govern block creation where the value of the stake isn’t affected at all by the status of the network; that being said, of course, in Sequentia’s case one may assume that the value of the Sequentia network itself will affect the value of Bitcoin over the locktime timeframe. While that may be an appropriate assumption to make in the long-term, Sequentia’s effect on the value of Bitcoin will definitely not be self-evident during the inception and initial stages of the network. Such a bootstrapping problem could potentially be solved by having a large number of BTC already staked by a distributed set of participants before the network is even launched, but such a solution is of very questionable practical feasibility.
In traditional Proof-of-Stakes, the attacker needs to hold native tokens issued within the network and therefore lose value in case the network suffers an effective attack. Such attacks might be, for example, censoring transactions, enforcing a chain stall, deceiving SPV nodes, or presenting forks and double spends to new nodes synching the chain (even if it’s not possible to deceive other fullnodes already synching the chain up to date, the result can still be catastrophic without replay protection). This solution is therefore not very convincing.
2. Proof of Stakes with “numbered” bitcoins (abstract tokens)
There’s a way to represent the stake in Bitcoin directly, while maintaining the skin-in-the-game incentives to preserve the sidechain, although the bitcoins in question may (at least temporarily) lose their fungibility in the process. If you mark an output with a defined quantity of bitcoins (or satoshis) in a way that a Sequentia node can identify it as a minimum amount of stake (not much different to how the Ordinals protocol numbers each satoshi) the result is that you would create non-fungible bitcoins representing shares of the Sequentia network. The difference between this solution and issuing a token on the sidechain for staking purposes is only that the non-fungible bitcoins have a floor price (the BTC price). However, their price will likely reflect a premium based on the expected earnings from staking (transaction fees paid in the Sequentia network). This premium paid to hold and stake these bitcoins is what guarantees that stakers maintain the skin-in-the-game according to the game theory mechanics.
The “numbering” mechanism can be designed in a way that a single output represents a minimum unit required for the staking mechanism. If this output is disaggregated in multiple outputs (e.g. those satoshis are being separated) it loses its property of being identifiable by Sequentia nodes as a stake of the sidechain. It’s like “burning” the non-fungible essence of the bitcoins so that those previously staked retrieve their full fungibility and lose their premium value. The weight over the network of the remaining bitcoins staked by all the other users in the network will then increase.
The problem with this solution is that such a complex workaround tries to avoid a native sidechain token just to create what is, in fact, another token, issued on Bitcoin. In fact, non-fungible bitcoins from a legal and business perspective can still be effectively considered a token that can be sold in the market. However, we may see an advantage in creating a floor price for the token: it reduces the amount of speculation that can be performed on it. For example, rational short sellers would not bet that the token’s price will fall below Bitcoin’s price. However, the effectiveness of the floor price is significant only if a proper amount of bitcoins is used to define the minimum quantity of a certain share of the total capacity of block creation (the abstract token). This means that depending on the value of the network over a long period, that fixed quantity of bitcoins may become irrelevant at a certain point. Therefore, even if this proposal looks more viable than some alternatives, it’s uncertain if it’s worth the effort required.
However, other proposals can be analyzed by employing solutions that have been theorized and discussed for quite some time already in the Bitcoin space.
3. Merged-mining
With merged-mining, Bitcoin mining pools create sidechain blocks. For Sequentia, this introduces both practical and theoretical issues. The simplest, practical one is just that such a network is difficult to bootstrap. Initially, not many (maybe not even one) of the Bitcoin miners will merge-mine the sidechain blocks. Which means a very high risk of centralization. Alongside this, there’s a theoretical issue: Bitcoin mining pools don’t have a stake in the sidechain unless their profits are really on the scale of those from Bitcoin mining, which might never be the case. In that scenario, there are not enough economic incentives to prevent a possible attack on the sidechain, like the double spending of a single big USDt transaction whose value is higher than the eventual profits from the entire sidechain over a long time.
In general, all merged-mining models (including the BMM used for the Spacechain, see the next paragraph) don’t inherit the exact same security of the Bitcoin network. In fact, a bitcoin miner faces some costs with the specific purpose of collecting block rewards. Any kind of attack or censorship, like mining empty blocks rather than standard transactions, implies mining costs without the corresponding reward, which implies a huge loss. Moreover, if such an attack is sustained over a long period to harm the network, it may put in danger the stake miners have in the Bitcoin network, which can’t be easily liquidated (their business, their employees, their machines, years of efforts, dedication, etc.). A malicious behavior should somehow guarantee a higher return than the value of that stake.
The same scheme of good incentives we see in the Bitcoin network applies in a similar way to a Proof-of-Stake but doesn’t apply to merged-mining models, where the hashrate cost is unrelated to the sidechain profits (at least initially) and (again, at least initially) on a completely different scale.
4. The Spacechain model
The most controversial part of Ruben Somsen’s Spacechain is the practice of burning bitcoins, but Sequentia doesn’t need that due to the free market for transaction fees, so from the idea of Spacechain we can consider only the way in which blocks are committed on the Bitcoin blockchain. Spacechain uses a very different variation of the better-known merged-mining mechanism, one which is also much easier to bootstrap, called Blind Merged Mining, originally introduced by Paul Sztorc, although again in a very different way, with BIP301.
Users can spend an ‘anyone-can-spend’ transaction output in Bitcoin, taking a snapshot of the newly created sidechain block (its hash) and including it inside Bitcoin transactions. The use of the Bitcoin blockchain for that purpose can’t be considered “Bitcoin-tainting”, unlike RGB or Taproot Assets, since you would require a single BTC transaction per block for an entire block of sidechain transactions. The advantage compared to merged-mining is that you don’t require the participation of Bitcoin miners, which results in a network that is far easier to bootstrap and with higher security.
Some malicious mining pool could potentially censor the transactions usued to seal the hash of the sidechain block inside Bitcoin. The cost of such an attack can be very little in the early days of the network, although there is no clear economic incentive that could explain that behaviour. However, as soon as the sidechain becomes popular and starts generating value, boycotting the sidechain would represent an opportunity-cost to Bitcoin miners, which would otherwise grab the more enticing sidechain fees.
Unfortunately, the original idea of BMM (BIP301) and other models close to that idea don’t work unless a soft fork happens on Bitcoin (like checktemplateverify or sighash_noinput, more recently called sighash_anyprevout). The good news is that some proof of concepts of the Spacechain launcher have been developed by its ideator Ruben Somsen (2022) and by Supertestnet (2023) without requiring a soft fork, and this leads us to one last design that appears more promising.
5. Blind Merged Mining model
The idea here is that of a Blind Merged Mining sidechain without any permanent one-way-peg nor any other BTC peg or derivative required. Each sidechain block hash is written inside a new Bitcoin transaction, spending a UTXO in a single BTC address used recursively each time a new Bitcoin block is issued. That address is an anyone-can-spend output with scriptPubKey: (empty) and scriptSig: OP_TRUE. Any user can spend that output, but miners will likely include in the Bitcoin block only the transaction paying higher fees, which is likely the one proposed by the sidechain block creator since only the sidechain block creator is compensated by earning the transaction fees on the sidechain.
A BMM sidechain would see a sequence of anyone-can-spend Bitcoin transactions always paying the same address. The consensus behind Spacechain assumes that a sidechain block can be mined only if the hash of the sidechain block is written in the transaction paying that specific address. A proposed sidechain block is ignored if its hash is not included in a Bitcoin transaction paying straight back into that anyone-can-spend address (ACSA).
Multiple sidechains (or “shards”) are possible, each one would have its address, each one with its sequence of ACSA transactions. From a UI/UX perspective, a single Bitcoin wallet would show every chain in a similar way to how Metamask shows a different network. The user would be able to select an ACSA just like you can currently select the network (e.g. Ethereum or Binance) on Metamask, while you will be able to view a token (besides BTC by default) by adding its contract address.
The idea of multiple shards (Sequentia1, Sequentia2, etc.) is not mandatory, but it can help with scaling. Also, nothing prevents experimenting with this consensus model together with the alternatives discussed above, in a sort of ecosystem made of many shards. All shards would be extremely interoperable in terms of atomic swap and other HTLCs, including the opening/closure of Lightning Network channels since they all “anchor” to Bitcoin blocks. Therefore cross-chain contracts may have 1 block confirmation time. Some shards can be single-purpose, like a shard for USDT and another for USDC, so you could expect fees to be paid in a single asset in a particular sidechain. A Sequentia sidechain could also represent the “sigchain” or “sealchain” for RGB single seals in order to minimize the Bitcoin congestion and scale (note that the notion of sigchain has been introduced by Maxim Orlovsky here).
Trade-offs between a PPoS and BMM
We have briefly described the design of the BMM shard that we temporarily refer to as Sequentia BMM to distinguish it from the original Sequentia which uses a staking mechanism that is inspired by the Pure Proof of Stake model (PPoS). Next, we will try to summarize the trade-offs of the two solutions.
A characteristic of Sequentia BMM that can’t be arbitrarily changed by developers through a consensus rule is the block frequency, which must be equal to or lower than Bitcoin’s block frequency. This might imply some friction, especially in user experience. In fact, the sidechain is not envisioned for monetary transactions with a single, highly liquid cryptocurrency, such as Bitcoin on the mainchain, for which a proper network of lightning channels can take place. On the contrary, most tokenized assets wouldn’t be suitable for extensive use of the Lightning Network, due to their low liquidity. Although USDt or other stablecoins can run over lightning, we can hardly imagine most stock tokens or coupons of the next-door laundry company running over Lightning channels, at least not in the near-term future. For these use cases, a low block frequency is not exactly what the market seems to demand and that might hinder user adoption.
Finally, although very unlikely, attackers may steal the bitcoin in the UTXO of the ACSA, or Bitcoin mining pools may boycott the sidechain block. Any time this happens, sidechain users would need to wait for the next Bitcoin block to be produced in order to confirm the next sidechain block. This could lower the block frequency even further.
Sequentia’s original stake-based consensus model instead has a block frequency that can be arbitrarily chosen by the community in its inception. Also, it doesn’t suffer from possible attacks by Bitcoin miners that have no stake in the sidechain. On the other hand, it requires a complex consensus that introduces a fully pre-mined token for the blocksigner selection.
That being said, nothing prevents the coexistence of combinations of multiple consensus systems as interoperable Elements-based sidechains working as “shards” for different purposes. A nice byproduct of this is that in case of consensus failure, a new chain can be launched as a “backup” based on an alternative model. For example, if we think of a scenario in which all stakers in Stake-based Sequentia go rogue (corrupting or stalling the chain), users can simply fork it, keeping the full ledger of Stake-based Sequentia and writing its last uncorrupted status in the new genesis block of a shard inside a new ACSA transaction in Bitcoin. Given the identical structure of the sidechains, with the exception of the consensus model, such a “backup” is easily viable and users can access the fork very easily in a Sequentia wallet, selecting another shard in the same way that Metamask lets you select a different network. The mere possibility of such an easily doable fork (also from a UX perspective) could constitute a further incentive for network participants towards honest behaviour.
Final considerations from a business perspective
Funding the development of Sequentia as a BMM chain might be an issue from a business perspective since you don’t have the speculative element of the PoS token that makes a token pre-sale or any backed-by-token Equity sale enticing for investors. On the other hand, speculation entails other risks, as described in the original article announcing Sequentia as the first slavechain model. That doesn’t mean speculation is necessarily wrong. It may help adoption in various ways. For example, a big exchange might install a Sequentia node with the only purpose of listing its token, but once the node is installed, the exchange will automatically support an ecosystem of tokens running on Sequentia. This kind of network effect is very difficult to replicate in the case of solutions like Liquid, RGB, or a BMM version of Sequentia.
