Technical whitepaper
This document describes only the mechanism and its correctness arguments. It makes no claims about value, investment, return, or any economic property — ThankBitcoin is an experimental, educational protocol-research project, not a production system.
A new proof-of-work chain cannot offer any meaningful tamper-resistance for its own history: its hashrate is far below that of a mature chain, so the longest-chain rule is effectively toothless. This paper presents a mechanism that hands the ruling of the single most consensus-critical decision on a new chain — who receives each block's reward — to an external, hashrate-rich proof-of-work chain (the "parent chain"; Bitcoin in this implementation). The ruling is settled by a public bid on the parent chain: a bid is a structurally-constrained transaction on the parent chain, and the winner obtains reward ownership for a fixed-length interval (a "term") into the future. The same transaction also anchors this chain's key block hashes into the parent chain, giving the anchored history parent-chain-level finality. This paper formalizes the mechanism in four parts — terms and rewards (§2), the qualifying-bid predicate on the parent chain (§3), the rollover state machine and its ruling function (§4), and the anchoring checkpoint rule (§5) — and argues its determinism, replay-resistance, resistance to after-the-fact poisoning, and liveness (§6). Every decision is a pure function of the current parent-chain view, so any two nodes holding the same parent-chain view reach the same verdict on the same block of this chain.
The security of a proof-of-work chain is proportional to its hashrate. Let the honest fraction of hashrate be $q$ and the attacker's be $p=1-q$; the probability that the attacker catches up from $z$ blocks behind decays exponentially in $z$ when $p Prior work (e.g. periodic notarization) writes this chain's block hashes into parent-chain transactions so that, once confirmed on the parent chain, the recorded history is hard to rewrite. This mechanism goes one step further: it not only records this chain's hashes, it lets one consensus-critical decision be ruled by a bid on the parent chain, and makes this chain's consensus mandatorily verify that ruling. Recording and ruling are done at once by the same parent-chain transaction. What is protected is not every transaction on this chain — those still depend on this chain's own proof of work — but the single decision of "reward ownership." The rest of this paper formalizes the mechanism. Notation. This chain's block height is denoted $h$; the parent chain's is denoted with a capital $H$. Term length $L=1000$. Term $n$ spans this-chain heights $[Ln,\ Ln+L-1]$. Parent-chain maturity depth (confirmations) $C_{\text{conf}}=8$. Terms. This chain's blocks are divided into terms of $L=1000$ blocks each. Term $n$ spans the height interval Within one term the beneficiary (the reward-ownership address) is fixed. Term $n$'s first block is at height $Ln$, its last block at $Ln+L-1$; the last block's hash is written $H^{\text{end}}_n$, which is the binding anchor for the next term's bids (§3). Reward split. Let the miner's base subsidy at height $h$ be $s(h)$ (following the parent chain's halving schedule, valued with this chain's parameters, see §7). The coinbase produces two shares: Transaction fees $\text{fees}(h)$ go to the miner only. The beneficiary share uses integer arithmetic ($\times 17 \div 10$, rounded down) to avoid floating-point divergence. Term 0 ($h\in[1,999]$) is the bootstrap period: the coinbase produces only the miner share and mints no beneficiary share, so the beneficiary-side reward is simply not issued during term 0. Determining the beneficiary. The term-0 beneficiary is hard-coded to the sentinel address $A_{\text{sentinel}}$ — an address on this chain with a provably absent private key (an all-zero HASH160; no public key hashes to all zeros, so anyone can verify no private key exists, and coins sent to it can never be spent = destruction in the cryptographic sense); the fallback terms in §4 use this same address (consensus does not check the term-0 beneficiary output). For $n\ge 1$ the beneficiary is uniquely determined by the rollover mechanism of §4. A term's first block $Ln$ is valid if and only if its beneficiary output pays exactly the address the mechanism determined (§5); paying the wrong beneficiary is rejected by honest nodes. Bidding happens on the parent chain, not on this chain. Whoever wants to compete for the next term's beneficiary broadcasts a structurally-constrained transaction on the parent chain. It is made of several outputs, each with a distinct role: Roles of the outputs: Sentinel-exclusion constraint. A qualifying bid's declared beneficiary address must not equal the fallback sentinel address $A_{\text{sentinel}}$ (the all-zero burn address of §4). Otherwise it would create an "auctioned term whose beneficiary happens to be the sentinel value," which on-chain is indistinguishable from a fallback term (§4), causing nodes to disagree. Qualifying predicate. Let $\text{Qual}(\tau, A_{\text{prev}}, H^{\text{end}}_n)$ denote the conjunction of all the constraints above. It is a pure function of the transaction $\tau$, independent of node-local state — any node independently judging the same transaction reaches the same conclusion. Rollover is the core of the mechanism: at every term boundary this chain deliberately pauses and waits until the parent chain delivers a ruling. Every block's coinbase on this chain records an integer heartbeat $w(h)$ = the latest parent-chain height the miner saw when packing that block. The heartbeat is bound by two purely in-chain rules (they only compare integers in adjacent blocks, never read the parent chain's current state, hence introduce no divergence): An honest miner fills the heartbeat as where $H_{\text{tip}}$ is the parent-chain height the miner sees. This guarantees a miner's own block always passes its own heartbeat check. Term $n$'s last block ($h = Ln+L-1$) has its heartbeat defined as the next term's window anchor: $W_n$ marks the parent-chain height at which term $n{+}1$'s bidding window opens. Let the current parent-chain tip height be $H_{\text{tip}}$. The maturity height is the deepest height that has accumulated at least $C_{\text{conf}}$ confirmations: Term $n$'s ($n\ge1$) scan start $\sigma_n$ advances term by term: where $C_{n-1}$ is the parent-chain block hash committed in the previous term's first-block coinbase (§5). Let whether a qualifying bid exists in the parent-chain block at height $H$ be where $A^{\text{nom}}_{n-1}$ is the previous term's nominal beneficiary (the chaining anchor). The decisive block $B^\ast_n$ is the first block at or after the scan start that contains a qualifying bid and is already mature: If that set is non-empty, term $n$ is an auctioned term, and the beneficiary is the highest bidder inside $B^\ast_n$: ordered lexicographically by $(\text{bid}, \text{txid})$ — higher bid wins; on an exact tie, the larger big-endian-hex txid wins (a deterministic tie-break). The commitment is $C_n := B^\ast_n$. If the set is empty (no qualifying bid in the interval), the fallback test applies: if and only if then term $n$ is a fallback term, the beneficiary share is paid to the sentinel address $A_{\text{sentinel}}$, and the commitment is $C_n := $ the block at height $H_{\text{mat}}$. Otherwise the ruling is not yet ready, the miner waits (WAIT), and produces no first block. Once the ruling is ready, the miner may pack the next term's first block $L(n{+}1)$, writing the commitment $C_n$ into its coinbase. Of the $L=1000$ blocks in a term, $L-1=999$ are produced normally at the target interval; only the first block pauses, waiting for $B^\ast$ to mature. The commitment $C_n$ anchors a first block's validity to a concrete parent-chain block and a fixed scan interval. Except for term 0 (whose first block is the genesis block, with no $C$), every term's first block $Ln$ must write the 32-byte $C_n$ into its coinbase. An honest node validating the first block re-checks, over the parent-chain closed interval $[\sigma_n,\ C_n]$, as follows: Auctioned term (the interval contains a qualifying bid), four checks: Check (iii) is the key to auction safety: it forbids a miner from skipping an earlier block containing a (possibly higher) qualifying bid and choosing a later block that favors itself as the decisive block. Because the same $H^{\text{end}}_{n-1}$ can appear in multiple parent-chain blocks, self-anchoring alone cannot prevent skipping — hence the explicit closed-interval minimality check. Fallback term (the interval contains no qualifying bid), check (here $W_n$ is the heartbeat of the previous term's last block $H^{\text{end}}_{n-1}$, from which the grace period is measured): If any check fails, the first block is invalid and rejected. What the closed interval buys (poisoning-resistance). Validation examines only $[\sigma_n, C_n]$, the closed interval hard-wired by the coinbase. Any late bid broadcast after $C_n$ falls outside the interval and is ignored by rule. Hence both auctioned and fallback terms can be re-validated consistently at any time — a finalized fallback term cannot be overturned by someone later publishing a late bid. The tamper-resistance boundary of anchoring. To tamper with a term's last block that has already been anchored, an attacker must not only redo this chain's proof of work but also make the forged $H^{\text{end}}$ occupy the decisive-block position of that round on the parent chain — i.e. reorganize the parent chain. So the difficulty of altering anchored history is, at the consensus level, raised to the parent chain's level. But the protection is a sparse checkpoint, not a whole-chain shield: the 999 ordinary blocks within a term still rely only on this chain's own PoW; a fallback term with no bids has no parent-chain hashrate backing it (it is still self-verifiable, but has no finality). Proposition 1 (Determinism / no split). The ruling function $B^\ast_n$, winner selection, and the fallback test are all pure functions of the current parent-chain view. Hence any two nodes holding the same parent-chain main view reach the same verdict on the same block of this chain. *Argument.* $B^\ast_n=\min\{H:\dots\}$ depends only on $\sigma_n$, $H_{\text{mat}}$, and the contents of each $\text{block}(H)$, caching no intermediate result; ties are broken by the globally-unique txid lexicographic order; the heartbeat rules compare only in-chain integers. None takes node-local state as input. $\square$ Proposition 2 (Replay-resistance). A bid's payload contains $H^{\text{end}}_{n-1}$, which exists only after the previous term's last block is mined, so a qualifying bid must postdate that block; an old bid's $H^{\text{end}}$ does not match the new round, so $\text{Qual}$ is false. $\square$ Proposition 3 (Poisoning-resistance). The validation criterion is the closed-interval predicate $\forall H\in[\sigma_n,C_n]$. $C_n$ is hard-wired by the coinbase; bids later than $C_n$ do not change the predicate's value within the interval. Hence once a term is finalized, its type (auctioned / fallback) and beneficiary re-verify identically under any future parent-chain view (provided $C_n$ has not been moved off the main chain by a deep parent-chain reorg, see §7). $\square$ Proposition 4 (Liveness). Assume the parent chain keeps producing blocks. Then $H_{\text{tip}}$ strictly increases, and $H_{\text{mat}}$ with it. For any fixed $W_n$, there is a finite time at which $H_{\text{mat}}-W_n\ge\text{GAP}$, so in the absence of bids the fallback eventually becomes ready and the chain never pauses forever. *Boundary.* The argument requires $H_{\text{mat}}$ to be able to exceed $W_n$. With $C_{\text{conf}}\ge 2$, $W_n$ (= the tip seen at the last block) and $H_{\text{mat}}=H_{\text{tip}}-(C_{\text{conf}}-1)$ are separated by $C_{\text{conf}}-1$, which parent-chain progress crosses. In the degenerate value $C_{\text{conf}}=1$ with the parent chain producing zero blocks across an entire term, $W_n$ equals $\sigma_{n+1}$ and the fallback path degenerates into being unable to advance; hence $C_{\text{conf}}\ge 2$ is a parameter necessary for liveness (this implementation uses $C_{\text{conf}}=8$). $\square$ Proposition 5 (Fallback is unprofitable). The fallback beneficiary output is always $A_{\text{sentinel}}$, unrelated to the previous beneficiary (ordinary-block validation uses the payout address, not the nominal address). Hence manufacturing a "no-bid" situation cannot let any incumbent keep collecting the beneficiary share; the profit-driven motive to seize the seat is removed. (Vetoing for off-chain, destructive motives is not covered here.) $\square$ Known boundaries (recorded honestly, not overstated). This paper describes a mechanism that outsources a new chain's reward-ownership ruling to an external proof-of-work chain. Ruling, replay-binding, and history anchoring are all done at once by the same structurally-constrained transaction on the parent chain, and are mandatorily verified by this chain's consensus via a closed-interval checkpoint rule. Every decision is a pure function of the parent-chain view, guaranteeing determinism and self-verifiability; the closed-interval criterion provides resistance to after-the-fact poisoning; the monotone–step constraints on the heartbeat guarantee, purely in-chain, that the window anchor cannot be manipulated by a single block; and $C_{\text{conf}}\ge 2$ guarantees fallback liveness. The anchored history gains parent-chain-level finality, at the cost of a sparse checkpoint network rather than whole-chain protection — a boundary this paper delineates honestly.
2. Terms and Rewards
3. Bidding on the Parent Chain
input: bidder's parent-chain coins ──┐
│
├─▶ bid output ──▶ A_donation (fixed recipient)
│ the amount IS the "bid"; higher ranks better
│
├─▶ link output ──▶ A_prev (previous beneficiary)
│ small; chains this round to the last term
│
├─▶ change ──▶ back to the bidder (no semantics)
│
└─▶ data output ──▶ OP_RETURN: [ prev term's last block hash H_end | payout addr ]
Two addresses of different nature — do not confuse them. $A_{\text{donation}}$ is an address on the parent chain with a real recipient; the $A_{\text{sentinel}}$ used for fallback below (§4) is an all-zero, provably-keyless address on this chain. The former is the destination of a real transfer; the latter is equivalent to destruction.
4. The Rollover Mechanism
4.1 Heartbeat and Window Anchor
Why monotonicity and the step cap are both necessary. Monotonicity prevents a single last-block miner from reporting $W_n$ too low (the preceding block was mined honestly by others and its heartbeat already equals the then-current real height); pushing $W_n$ down requires controlling a long run of tail blocks spanning roughly $C_{\text{conf}}$ parent-chain confirmations (majority-hashrate scale). The step cap (including the finite relaxation $\Delta_{\text{first}}$ for the first block) prevents a single block from filling the heartbeat to the 32-bit maximum and then locking it forever via monotonicity — without such a cap, one extreme value would cause permanent loss of liveness.
4.2 The Ruling Function
The fallback grace period is measured from $W_n$, not from $\sigma_n$. $\sigma_n$ lags the present by roughly the parent-chain height of $L$ of this chain's blocks ($\approx 100$ parent-chain blocks); measuring the grace period from it would make $H_{\text{mat}}-\sigma_n\ge\text{GAP}$ always true, so fallback could be declared the instant the last block appears, leaving bidders no time to get on-chain. Measuring from $W_n$ instead gives bidders roughly $C_{\text{conf}}$ parent-chain confirmations of real on-chain time from when the window opens.
4.3 State Machine
this chain ┌────────── term n (1000 blocks) ──────────┐┌─ term n+1 ─
height ... 1000n last blk 1000n+999 wait 1000(n+1) 1000(n+1)+1 ...
│ │ ▓▓▓▓ │ │
└── heartbeat monotone ─▶ W_n ┄┄┄┄┄┄┄┄┄┄┄┄▶ commit C_n fast ─▶
┊ ▲
parent chain ──────────────────── ┊ ──────────────────── ┊ ───────────────▶
σ_n W_n bid window B*_n (first mature
(=C_{n-1}+1) (window opens) ◀─ ≥8 conf ─▶ block with a qualifying bid)
└────── ruling within closed interval [σ_n, C_n] ──────┘
5. The Anchoring Checkpoint Rule
6. Correctness Arguments
7. Parameters and Known Boundaries
Parameter Symbol Value Term length $L$ 1000 blocks Target block interval — 60 seconds Parent-chain maturity depth $C_{\text{conf}}$ 8 confirmations Fallback grace GAP 1 Heartbeat step (ordinary / first block) $\Delta_{\text{step}}/\Delta_{\text{first}}$ 12 / 500 Beneficiary-share factor — $\times 17/10$ Bid recipient address (parent chain) $A_{\text{donation}}$ fixed parent-chain address with a real recipient Sentinel / fallback beneficiary (this chain) $A_{\text{sentinel}}$ all-zero HASH160, provably keyless = burn
8. Conclusion
References