Do the current Bitcoin opcodes and transaction size limit allow constructing a UTXO which is only spendable if a specified amount of work has been performed?

So the spender, would provide a nonce as input to the script. Then the script would essentially perform a highly simplified version of how bitcoin's block headers are verified (the nonce is combined with some other data, hashed, and the hash is compared with a "target.").

Without OP_CAT and with arithmetic limited to 4 byte inputs, do I understand correctly that the above would be impossible? Or is there some workaround?

  • 4
    You could add an op return to your tx with the first 200 bits of the private key. A spender would have to grind the last 56 bits until they find the right private key to sign with. Combine with multisig or Schnorr tweak to target a single recipient! – pinhead Oct 18 '19 at 3:50
  • @pinhead thanks! That's a clever way to do it. Indeed it would require proof of work to uncover the key. However, in this case everyone would be guaranteed to ultimately end up with essentially the same "nonce" (which is just the full private key), so wouldn't a mainchain miner just be able to steal the reward? Or, put another way, can you clarify what you mean about using, for example, multisig so that it targets a single recipient? Namely whoever put in the work but also in a manner that the original UTXO didn't need to know who the set of potential workers is. Is this making sense? – philbw4 Oct 18 '19 at 4:03
  • 2
    Hm that's hard. Miners can steal anything that's not signed. My thought was you could send to a 2of2 multisig where one key is a known recipient and the other key must be brute forced (by that recipient) A miner wouldn't be able to steal that. – pinhead Oct 18 '19 at 4:07
  • Again, thank you very much for your answer. This is extremely helpful. So the challenge have with that construction (the 2of2 method you proposed) is that I would need to know the key of the recipient ahead of time which is not what I want. Is there a way we can sort of chain a series of these types of transactions together to accomplish that? – philbw4 Oct 18 '19 at 4:16
  • What is the application of this? I’m curious to know what you’re trying to accomplish – chytrik Oct 18 '19 at 22:12

This talk gives you one way to do it. Also you don't have to write script. You can write sCrypt in an IDE.

  • Thank you for your answer. However, the links you provide do not pertain to the bitcoin network I asked about but instead to a fork of a fork of BTC. Are you suggesting that these tools can also be used on BTC as-is? – philbw4 Oct 23 '19 at 5:04
  • No. If you look into it, it is much more aligned with the original bitcoin than BTC. – sinoTrinity Oct 23 '19 at 6:39
  • 3
    I understand what you are saying but, again, my question (and this forum itself) is generally for questions about BTC, not other networks. If you are aware of a solution to my question that works on BTC, please feel free to edit your answer. However, for now I will mark it as not helpful so as to not confuse others. Thanks again for taking the time to answer though. – philbw4 Oct 23 '19 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.