Bitcoin and Cryptocurrency Technologies

the altcoin’s difficulty is 60% * 5 / 10 = 30% that of Bitcoin. Note that 40% of Bitcoin blocks do not
contain hash pointers to altcoin blocks.
Conversely, every valid altcoin block results from an attempt at mining a Bitcoin block, but only 30%
of them actually meet Bitcoin’s difficulty target. For the other 70% of altcoin blocks, the altcoin
network needs to be able to verify the mining puzzle solution. The simple way to do this is to
broadcast the Bitcoin near‐block in addition to the altcoin block. But a cleverer way is to broadcast
just the header of the Bitcoin near‐block and the Merkle proof of inclusion of the Coinbase transaction
in the Bitcoin block.
It’s also possible (although rarely seen) for the altcoin to actually have a ​more difficult​puzzle than
Bitcoin. This is unusual because most altcoins want to have blocks found more often than once per 10
minutes, but if for some reason you wanted a slower rate this would be easy to achieve as well. In this
case, you would see some Bitcoin blocks which the miner hoped would also be an altcoin block, but
will be rejected on the altcoin network because they didn’t meet the harder difficulty target.
Finally, note that any number of altcoins can be simultaneously merge‐mined with Bitcoin, and every
miner is free to pick an arbitrary subset of altcoins to merge mine. In this case, the Coinbase scriptSig
would itself be a Merkle tree of hash pointers to various altcoin blocks. Note the levels of complexity:
verifying the inclusion of an altcoin transaction requires verifying, among other things: (1) a Merkle
proof of inclusion of the altcoin transaction in the altcoin block (2) a Merkle proof of inclusion of the
altcoin block hash in the Coinbase scriptSig and (3) a Merkle proof of inclusion of the Coinbase
scriptSig in the Bitcoin block or near‐block!
Merge mining and security.​Merge mining is a mixed blessing. It makes bootstrapping easier, as
we’ve discussed, and the resulting boost to your altcoin’s total hash power increases its resilience to
attack. An adversary who is looking to buy computing power to destroy your altcoin will need to make
an enormous up‐front investment.
On the other hand, one could argue that this is a false sense of security, because such an adversary
would presumably recoup the cost of his investment by mining Bitcoin, and the marginal cost to
attack your altcoin is trivial. This is easier to appreciate if we think about an adversary who is already a
large Bitcoin miner. Indeed, CoiledCoin, the altcoin described earlier that suffered infanticide, was
merge‐mined. The Eligius mining pool and its participants did not need to stop Bitcoin mining in order
to attack it. In fact, the pool participants were not even aware that their computing resources were
being used in the attack!
Sidebar: trends in altcoin mining puzzles.​As of 2015 few altcoins launch with the same SHA‐256
mining puzzle as Bitcoin, with or without merge mining, which suggests that it is perhaps
considered a security risk. Scrypt is a much more popular choice, which makes Bitcoin ASICs useless
for mining or attacking such altcoins. Of course, scrypt ASICs being manufactured for Litecoin
mining could be used to attack them.
278