How not to piggyback on the Bitcoin network

It's possible to secure smaller blockchains with Bitcoin's hashrate. It's also possible to do it badly.

• VeriBlock's inefficiencies and closed source status raise serious concerns and risk giving Bitcoin piggybacking a bad name
• Existing Bitcoin piggybacking solutions such as Komodo dPoW provide a much, much better example of how to do the same thing
• There are naturally some downsides associated with piggybacking, but they can be surprisingly inoffensive

VeriBlock is perhaps best known as the project that accounts for somewhere north of 25% of Bitcoin transactions when in operation. Its mainnet launched on 25 March, and seems to have immediately bumped Bitcoin transaction fees up to a slightly higher floor.

It works by writing transactions on its own network to the Bitcoin blockchain to secure them against the hashrate of the larger network. But this doesn't come cheap. VeriBlock transactions involve making actual Bitcoin transactions, which means paying fees. To date the VeriBlock network has spent hundreds of BTC on those fees, and it has to keep spending as long as it's around.

The point of it all is to secure smaller networks with the full hashpower of Bitcoin, in order to protect smaller proof-of-work networks from the 51% attacks that have ravaged quite a few projects already.

So VeriBlock is expensive and convoluted, but if it can secure smaller networks with the strength of Bitcoin, maybe it's worth it?

Also watch

Is VeriBlock worth it?

"I don't want to attack another technology," said Komodo CTO Kadan Stadelmann, shortly before going to admirable lengths not to.

"The biggest problem here; I really tried to gain more information, however I noticed that VeriBlock isn't open source," he said apologetically. "I couldn't believe it, so I really got in touch with a couple of other developers I know... At the end of the day, VeriBlock's consensus is closed source – most likely some centralised layer. And on top of that, unfortunately very inefficient in the way it is backing into bitcoin.

"VeriBlock is spending millions of dollars for this protocol. So how would you sustain such a protocol without income, without revenue, without specific products, without clients that are using your technology?

"Right now VeriBlock is securing its own chain, and to secure their own chain, they need 30 to 40% of Bitcoin transaction volume. It's inefficient," Stadelmann points out.

"Tech-wise, we can't say if it's really secure or not. Not sure if there have been any kind of reports, but from recent talk with my devs and with VeriBlock community members, there are no public reports, and VeriBlock has not replied to requests regarding this.

"The biggest concern is the closed source nature. There is just one reason you'd close source tech; that it is if there's centralised layers or it's not secure.

"I've invested at least 8 to 12 hours into research, and all I could find is some basic information about that technology. It's currently impossible to prove their claims. It's really, really hard to get it. Just from their explanation it doesn't sound very bad, but the problem is if this sort of tech is closed sourced, we all know what it means."

Other researchers have also been suspicious of the closed source design, including one who also observes that VeriBlock didn't set "strictfp" for its consensus code. Strictfp is a command which ensures consistent calculations across multiple platforms, which is generally considered pretty important for something like a consensus mechanism.

If only there was a better way

The main problem might be that Bitcoin piggybacking is actually a potentially extremely valuable technique when done right, and VeriBlock's standout achievements to date risks giving the technique a bad name.

51% attacks are a major problem for smaller networks, and a quick and easy way of essentially rendering them immune to such attacks would obviously be very useful. But if VeriBlock is colouring everyone's perception of what it actually looks like, people might dismiss the technique out of hand or prematurely decide it's not for them.

Fortunately, it's not the only way.

"There are other technologies that basically use the same idea, right? The first tech that is using this logic scheme is Komodo," Stadelmann explains. "Komodo has a tech called delayed proof of work, and we also piggyback it on the Bitcoin blockchain.

"We don't have to use 30, 40% to do so. Komodo uses around 0.04% of the daily bitcoin transactions. We're speaking of 144 transactions per day, where VeriBlock – worst case – goes over 150,000 per day.

"Komodo itself isn't just securing Komodo with those 144 Bitcoin transactions per day," Stadelmann adds. "We're securing over 50 different blockchains, right, with our technology and this transaction scheme we're using. And on top of this, Komodo dPoW technology is 100% open source. But even, like, the security layer has been heavily pen-tested publicly."

Let's go ahead and put VeriBlock and Komodo into a comparison table, and play spot the difference.

Does it actually work?

A while ago, the hacker who goes by the name GeoCold intended to livestream a 51% attack against the little-known Einsteinium cryptocurrency, but ended up being turned away by Einsteinium's use of Komodo dPoW. It's one of the 55+ other blockchains currently under the protection of Komodo's piggybacking.

So GeoCold attacked Bitcoin Private instead. It's a considerably larger coin with considerably more hashrate, but it was still infinitely easier to knock over than Einsteinium, which GeoCold conceded was beyond attack, small hashrate notwithstanding.

"You would have to first hack Bitcoin, and afterwards you'd even have to take over Komodo before you can take over all the chains we are securing," Stadelmann explains.

"What Komodo blockchain does, is it reads specific blockchain information of all blockchains we are securing – those that are part of the dPoW network," Stadelmann explained. "Komodo dPoW is an open network, and any blockchain can join this network in order to enjoy this security. This bitcoin level security is publicly available."

What's the catch?

If on-tap 51% attack resistance without any limitations whatsoever sounds a little too good to be true, that's because it is. Nothing is perfect.

There are some technical limitations around which kinds of coins can currently join Komodo's dPoW network. But mostly these aren't inherent technical limitations, so much as a question of Komodo having the resources to do the legwork.

"As of now we support all Bitcoin-based protocol cryptocurrencies," Stadelmann says. "So all Bitcoin protocol variants. We also are working on some sort of Ethereum layer, but that is something in the start, subject to evaluations and feasibility analysis... basically there is no obstacle."

Of course, there's still the cost. Komodo is thousands of times more efficient than VeriBlock, but it still has to pay something for those Bitcoin transactions, and there are some integration costs on its end.

"We do not charge anything for this [dPoW integration]," Stadelmann says. "We basically just ask for those monetisation fees we pay for those transactions, and a very small integration fee. We're talking peanuts for the benefits you're getting.

"The only obstacle is if it's basically a 100% open source project without any funds. Then we offer the option to become a smart chain – basically a Komodo based chain. We really are open to anyone and to date there have been no projects with an obstacle."

Even those who don't have the funds for the ongoing integration fee – some 360 KMD (about $360) per year – have had the costs waived if they're serious about joining.

"Anyone who has made a request for dPoW integration has it," Stadelmann emphasised. "I would even personally fund it if it’s a worthy project. I've done it 2 or 3 times already."

The harder-to-calculate risks

The cost barrier is extremely low compared to most things in the crypto space, and the technical obstacles are minimal. Einsteinium was able to implement dPoW with just a couple hours of work, Stadelmann recalls.

But there are still some softer risks associated with hitching one's star to a separate project.

Firstly and maybe most interestingly, there's the strange question of how this could or should affect token value. Theoretically, the only reason a lot of standalone blockchains have a coin at all is to effectively incentivise miners to secure the network, but if those miners are no longer needed, then why is the token needed? If a blockchain is being secured by Komodo, but it still has miners of its own, what exactly are they doing? As a service provider, why are they getting paid if their mining is not actually needed to secure the network?

There are no wrong answers to these questions, but it's slightly concerning to think that maybe there aren't any right answers either.

There's also the risk that if a project that starts depending on a third party for 51% attack resistance, it could become vulnerable again through no fault of its own if that third party should fail.

But projects will still want to make sure they're hitching their wagon to a sustainable system.

In the case of VeriBlock, this is a serious concern. First, as far as people can tell, its costs will grow as its network does. So anyone who wants to use the security of VeriBlock might find their costs quickly rising if other customers join the system.

"A hacker could probably use this method to spam them out, to drain their funds," Stadelmann suggests. "This is just one potential attack surface I as a security expert can see. We will be certain once this software goes public and open source... [but] we don't think it's gonna be really open sourced soon."

But Komodo doesn't have this problem, he says. Its costs won't spiral out of control no matter how many chains join the dPoW network. As for its sustainability as an entity that needs to pay the ongoing costs of this security layer, in the form of Bitcoin transactions, Stadelmann isn't concerned.

"We can continue operating our project long term. We're talking decades of not worrying about how we're going to fund our security block layer," he says. "We always try to operate very efficiently, very economically. This is why the Komodo platform is still hiring. We're still hiring developers full time.

"Our ICO funds, our project funds... put us into this privileged position of not worrying about the financial statement of our project. We can focus on the tech, the development. We're sorted," Stadelmann says.

For some perspective, the Komodo ICO in 2016 raised 2,639 BTC worth about US$2 million at the time, and around $14.5 million today. But at the time of writing, Veriblock has already spent around 200 BTC on network fees, and it only launched its mainnet about a month ago.

Of course, even if Komodo were to disappear tomorrow, the main downside for coins in the dPoW would be that they lose their 51% resistance, which they wouldn't have had anyway without Komodo.

What it's all about

Komodo already has 55+ separate blockchains in its dPoW network, all of them quite a bit more obscure than Komodo itself. Think names like PirateChain (ARRR), Einsteinium (EMC2), GINcoin (GIN) and so on. It's the projects which would be extremely vulnerable to 51% attacks without Komodo dPoW.

But what's it all in aid of?

The idea is to make it easy for any small blockchain to thrive, Stadelmann says, and to make it easy for anyone to create their very own functional blockchain. Not long ago this would be primarily associated with making it easy for anyone to easily launch a convincing-looking ICO for a quick cash grab, but as the industry matures Stadelmann is picturing more useful applications.

"I see Komodo as a mothership," he explains. "We've got the glue that's sticking together all those other chains. All those other systems are joining the mothership, docking in, docking out."

They can simply come and go as desired, he says, and don't ever become strictly dependent on Komodo.

"Even if the mothership disappears, the chain is still there," he says. "We just give you the whole tech layer for free. That's all that matters. We want to see adoption by the mainstream. We believe that by creating this open, public ecosystem we're laying a good foundation for this."

This open foundation is already attracting a diverse range of interests. You're getting the usual experimentation from the tech companies – IBM Germany has created a chain with Komodo – but it's also had a lot of interest from everyday small businesses.

"We had even pubs getting in touch, asking could they get their own coin, accepting it for payment and so on," Stadelmann recalls.

Mass adoption is when you see even the non-tech and non-blockchain industries joining in to experiment with the technology, he says. The idea of central companies plying technologies to the public in a top-down way is somewhat antithetical to the nature of crypto, so by putting the tools out there to make it easy for anyone to DIY a blockchain, you're making sure it can stay more open and publicly accessible.

"It's free, it's public, it's open source. We even see community projects reusing our tech, setting up their own bitcoin piggybacking, and we’re glad this is happening," Stadelmann says. "The day you open such a tech layer you'll get hackers, you'll get improvements. Over the last 12, 18 months we've gone through a really awesome, incredible optimisation and hardening process.

"We've seen chains being created and right now we see hundreds of blockchains being created with our tech.

"We also have a vision of personal blockchain at some point in time. Blockchain tech, maybe in a strongly adapted and modified form, may be available to people in a personal form. Your identity, your health information... we started just by having this tech working."

You've got to start somewhere, and effective Bitcoin piggybacking might be as good an entry into the wider ecosystem as any.

Disclosure: The author holds BTC at the time of writing.