Merged Bitcoin: Proof of Work Blockchains with Multiple Hash Types

TL;DR

The paper introduces Merged Bitcoin, a PoW protocol that combines multiple hash types by scoring blocks across types and selecting the highest-score chain under a Δ-bounded delay model. It develops a general multiple-resource framework, proves that an AND-based security region is impossible in permissionless systems, and derives tight lower and upper bounds on the honest-chain growth rate to characterize the security region. Under linear cost-per-hash assumptions, it shows Merged Bitcoin can maximize attack cost and better withstand asymmetries such as hardware backdoors or quantum speedups, especially with appropriate difficulty adjustments. Compared to Minotaur, Merged Bitcoin avoids chain outages and takeover risks, while enabling broader trust across diverse hash ecosystems; the work also outlines practical considerations for difficulty tuning and future work on non-linear security regions and k-confirmation rules.

Abstract

Proof of work blockchain protocols using multiple hash types are considered. It is proven that the security region of such a protocol cannot be the AND of a 51\% attack on all the hash types. Nevertheless, a protocol called Merged Bitcoin is introduced, which is the Bitcoin protocol where links between blocks can be formed using multiple different hash types. Closed form bounds on its security region in the $Δ$-bounded delay network model are proven, and these bounds are compared to simulation results. This protocol is proven to maximize cost of attack in the linear cost-per-hash model. A difficulty adjustment method is introduced, and it is argued that this can partly remedy asymmetric advantages an adversary may gain in hashing power for some hash types, including from algorithmic advances, quantum attacks like Grover's algorithm, or hardware backdoor attacks.

Figures (4)

• Figure 1: Figure showing a fully-delayed honest chain growing when blocks have the same point value (left) and blocks have different point values (right). The point value of blocks are labeled with a number inside each circle, and a letter label is on its left. The blocks are positioned top to bottom based on the time they arrived; parentheses indicate the time passed for one full block delay of $\Delta$. Note that when point values are the same, block B orphans all blocks that arrive within $\Delta$ of the block, and the chain formed by this set of arrivals have blocks labeled (in order), ABD. However, when point values are different, a block that arrives within $\Delta$ of a block B may eventually be included in the final chain, and in this case the chain formed has labels ACE. This is because the node mining block $E$ sees a chain of score $4$ in subchain AC compared to 2 with subchain AB.
• Figure 2: Upper and lower bounds, as well as results from an 1000 second simulation, for score growth rate (in points per second) when honest blockrates are $h_{1}=2$ and $h_{2}=1$ (measured in hashes/second), and score constants are $c_{1}=1$ and $c_{2}=2$ (measured in points per hash). We vary the network delay $\Delta$ in increments of $0.5$ from $0$ to $5$ seconds. Note that for the $\Delta=0$ case, our upper and lower bounds are equal and our simulated result is lower than our lower bound due to random variation.
• Figure 3: Figure of Delta Interval Deletion Process as applied to a particular tree with a set of arrival times. The blocks are arranged top to bottom based on the time of their arrival. The guaranteed blocks are labelled and the interval of length $\Delta$ following each guaranteed block is shaded in gray. Note that in this process all blocks that arrive in the gray regions are deleted, resulting in the chain on the right.
• Figure 4: Figure of Small Block Increase Process. On the left is a possible fully-delayed honest chain. Large circles are higher score blocks and smaller circles are lower score blocks. The blocks are arranged top to bottom based on the time they arrived. The guaranteed blocks are labeled, and the interval of time $\Delta$ after each guaranteed block is highlighted. To the right is what this tree is transformed to in the Small Block Increase Process. Note that the second two guaranteed blocks have a large block that arrives within $\Delta$ of their arrival, so as per the rules of the process, these blocks are increased to big blocks, forming a new chain. We prove that this new chain has a score at least as large as the score before the increase process.

Theorems & Definitions (24)

• Definition 1
• Definition 2
• Definition 3
• Definition 4
• Definition 5
• Definition 6
• Definition 7
• Definition 8
• Lemma 9
• Theorem 10