Lecture 9: Bitcoin as a Platform

What this lecture covers

Having built up Bitcoin's technical mechanics in earlier lectures, this lecture asks what else can be built on top of it, either with no changes to Bitcoin or with small additions. It moves through several loosely related applications: secure timestamping using Bitcoin's append-only log, tracking custom digital tokens (colored coins) and overlay currencies, running secure multi-party lotteries, extracting public randomness from mining, and building prediction markets.

The lecture sits between the discussion of alternative mining puzzles and the next lecture on altcoins, which picks up where this one leaves off: several of the applications here, especially prediction markets, turn out to need features Bitcoin doesn't have, motivating the move to alternative cryptocurrencies. After watching, you should be able to explain how Bitcoin can serve as a timestamping service, what colored coins are and their tradeoffs, how a timed hash commitment secures a Bitcoin lottery, how block randomness can seed a decentralized beacon, and which pieces of a prediction market Bitcoin can and cannot support on its own.

Key ideas

• Secure timestamping: publishing a hash commitment to data in Bitcoin's append-only blockchain lets you later prove you knew that data at or before a specific time, without revealing it upfront.
• Provably unspendable output: the preferred way to embed a data commitment in a Bitcoin transaction, using an OP_RETURN-style script that can never be redeemed, avoiding permanent bloat in the unspent transaction output set.
• Overlay currency: a system such as Mastercoin that writes its own transaction data into the Bitcoin blockchain, reusing Bitcoin's consensus without miners understanding or validating the overlay's rules.
• Colored coins: a scheme for tagging specific Bitcoins with metadata (a "color") representing things like tickets, stock, or property deeds, while the coins remain valid, transferable Bitcoin.
• Timed hash commitment: a Bitcoin transaction structure using a bond and nLockTime that forces a party to reveal committed data before a deadline or forfeit their bond, used to make multi-party lotteries fair.
• Randomness beacon: a service that regularly emits unpredictable, publicly verifiable random values; Bitcoin's block nonces can serve as a decentralized beacon since predicting them would amount to a mining shortcut.
• Prediction market: a market for trading shares in future events, where a share's price reflects the market's estimated probability of that outcome; building one securely on Bitcoin requires payment, arbitration, and an order book.
• Decentralized order book with front-running as a feature: letting miners match trades and keep the bid-ask spread as a fee removes their incentive to front-run, at the cost of potentially higher and less efficient fees.

Walkthrough

Secure timestamping and its limits (3:13)

The lecture opens by explaining how Bitcoin's append-only property enables secure timestamping: publish a hash commitment now, reveal the underlying data later, and anyone can confirm you knew it beforehand. Applications include proving prior knowledge of an idea and proving receipt of data such as a vote. It then walks through why this cannot prove clairvoyance, using a real example from a World Cup final where a Twitter account appeared to have predicted outcomes in advance, but had actually tweeted every possible outcome and deleted the wrong ones. The offline analog, publishing a hash in a widely witnessed newspaper, is presented before turning to Bitcoin-specific implementations.

Embedding commitments in Bitcoin transactions (10:13)

Several approaches to writing a commitment into Bitcoin are compared: sending coins to a hash-of-data address (simple but bloats the UTXO set permanently), CommitCoin (brute-forcing a key whose bits embed the data, invisible to miners but expensive), and the now-preferred provably unspendable output. The lecture notes the cost is roughly a 40-byte commitment for about 5 cents, and discusses the downside that arbitrary data written to the blockchain can include illegal content, which has already happened as a griefing tactic against the community.

Overlay currencies and colored coins (16:47)

Because Bitcoin lets you write arbitrary data into transactions, the lecture explains how an overlay currency like Mastercoin can build a much richer feature set on top of Bitcoin's consensus without needing new miners, at the cost of relying on the community rather than miners to reject invalid transactions. It then covers colored coins: adding authenticated metadata to specific coins so they can represent tickets, stock, property, or domain names, implemented through issuance addresses and marker outputs. The tradeoff is that verifying a colored coin's current color requires tracing its entire transaction history, ruling out lightweight SPV verification.

Building a secure multi-party lottery (28:24)

The lecture builds up a Bitcoin lottery step by step: participants each commit to a random value with a hash, then reveal it later so the combined randomness picks a winner. The basic version is vulnerable because whoever reveals last can refuse to reveal if they see they're about to lose. The fix is a timed hash commitment, where a participant posts a bond that is only recoverable if they reveal their value before a deadline set with nLockTime, otherwise the other players keep the bond. This makes revealing rational as long as the bond exceeds the lottery's stakes, though the protocol scales quadratically with the number of participants.

Generating public randomness from Bitcoin (42:31)

This section surveys historical attempts at public randomness, including the 1985 NBA draft lottery and the 1969 Vietnam draft lottery, both of which drew accusations of rigging, the latter due to poor physical mixing. It then covers cryptographic beacons such as NIST's, which relies on trusting a single institution, and natural signals like weather or stock prices, which are slow and still depend on a trusted observer. The lecture then proposes extracting randomness directly from Bitcoin block nonces, arguing that predicting them would require a mining shortcut, and works out the cost of manipulating the beacon: an attacker must discard blocks (forfeiting the block reward) until a favorable output appears, making manipulation costly in proportion to the stakes at risk.

Prediction markets on top of Bitcoin (1:00:42)

The final section defines a prediction market as a venue for trading shares in future events, illustrated with the 2014 World Cup and the 2008 US presidential election, where share prices track the market's belief about outcomes over time. Building a decentralized version on Bitcoin requires four pieces: payment (which Bitcoin handles well), arbitration of what actually happened (covered through trusted arbiters, user or miner voting, and the Reality Keys protocol, illustrated with the ambiguous "what color Gatorade" Super Bowl bet), settlement of positions, and an order book. The lecture concludes that Bitcoin alone cannot support decentralized settlement or a built-in order book, which is why prediction markets motivate the move to purpose-built altcoins covered in the next lecture.

Before you watch

• Be comfortable with Bitcoin's basic transaction and scripting model, including nLockTime and OP_RETURN-style unspendable scripts, covered in earlier lectures.
• Recall the transaction graph and anonymity discussion from the earlier lecture on anonymity, since colored coins and fungibility build directly on it.
• Familiarity with hash commitments as used in previous mining and pooling discussions will help with the lottery and timestamping sections.

Check your understanding

1. Why can secure timestamping prove you knew something in advance, but not that you can predict the future?
2. What problem does a timed hash commitment solve in the multi-party lottery protocol, and how does the bond enforce honest revealing?
3. Why can Bitcoin's block nonces serve as a source of public randomness, and what determines the cost of manipulating that beacon?
4. What are the four components needed to build a decentralized prediction market, and which of them can Bitcoin support without modification?
5. Why does verifying ownership of a colored coin require more than checking that a transaction was included in the blockchain?