Thoughts on burner addresses

[nullama]

There are two nice ways to burn coins: the user-based way is called OP_RETURN, but there is also miner-based way: it is possible to just claim less coins in the coinbase transaction. Then, they are burned, and chain reorganization is the only way to get them back into the circulation. When it comes to burning, my favourite way is the miner way, because it has no trace in the UTXO set for all clients, just because there is no output that can be used to show that "here are some burned coins".

I think the miner way is a bit different though, as the coins were never generated in the first place. The coins were not technically burnt, they just never existed, a potential not realized. Also, not many people are in that position, you need to be a lucky miner.

But yeah, burning coins with OP_RETURN is great because the outputs are provably unspendable, which is not the case when sending coins to a 1BitcoinEater address.

Although I can see how some users might prefer burning coins by sending them to those addresses, it's a bit like throwing a coin into a fountain kind of thing. Also I'm sure some wallets don't provide the ability to run script, so sending to a 1BitcoinEater address might be the only option for some.

[garlonicon]

as the coins were never generated in the first place

You can burn existing coins, just by sending them as a fee, and then simply not taking them in the coinbase transaction. So yes, you can also burn existing coins in this way.

[NeuroticFish]

You can burn existing coins, just by sending them as a fee, and then simply not taking them in the coinbase transaction. So yes, you can also burn existing coins in this way.

As already said (just you didn't bother to read), burning coins means getting the amount out of circulation forever.
If you send them as fee, they are spent (you no longer have them), but not burned (since the miners receive the fees too, it's considered still in circulation).

You are somewhat right, since the link is broken between the spender and the receiver (miner), hence they don't receive the exact same coins (input).
But the term "burning" is used for amounts no longer in circulation, not necessarily inputs.
This is how I see it.

[garlonicon]

If you send them as fee, they are spent (you no longer have them), but not burned (since the miners receive the fees too, it's considered still in circulation).

I mean, miners can burn existing coins in this way. For users, there is OP_RETURN. So, if a miner will send a transaction, and will put some coins as a fee, then the same miner can simply take less amount in the coinbase transaction, then those fees will be burned. That's why miner-based burning is not limited only to the new coins.

[NeuroticFish]

So, if a miner will send a transaction, and will put some coins as a fee, then the same miner can simply take less amount in the coinbase transaction, then those fees will be burned. That's why miner-based burning is not limited only to the new coins.

OK, this is an interesting approach. Not such a common practice, but it is possible; actually I think that there were some coins burned (kind of) like this - most probably due to miners' mistakes while experimenting.

[larry_vw_1955]

Not only that but that someone will end up cracking to get the cash if the balance gets too big. The chance of that is probably even bigger.

It is not possible to "crack" a bitcoin address.

I meant that using burner addresses like the bitcoineater one, no one really knows if someone possesses the private key to it or not. you don't expect that anyone knows it but you don't know exactly how they came up with that address so you can't really say for sure. as more bitcoin comes into the "burner address" and none of it ever gets sent out, you get more confidence that maybe it really is the case that no one knows a private key for it. but you aren't sure 100%. i wouldn't trust a burner address. unless i was the one that made it up. but then other people couldnt trust me. so it's like a circular problem that can't get resolved.

Besides, if anyone wanted to waste their time on an impossible task they would have chosen one of the existing addresses with large balance instead of a burn address that would have far less.
For example 1P5ZEDWTKTFGxQjZphgWPQUpe554WKDfHQ contains about $4 billion worth of bitcoin.

Well I don't think that's how people go about trying to crack bitcoin addresses by picking a particular one. But that address would certainly be one they would want to know about. But why is someone using a legacy address to hold that much BTC? That seems risky. In the sense that it's an all or nothing proposition. Lose your private key or if someone else gets your private key, it's all gone.

[garlonicon]

no one really knows if someone possesses the private key to it or not

It is unlikely. Very unlikely. Like there is a 1:2^160 chance that someone has it.

but you don't know exactly how they came up with that address so you can't really say for sure

Simple, for legacy addresses just take some 160-bit number, and encode it in base58. For example, if you use all zeroes, you will get "76a914000000000000000000000000000000000000000088ac", so it will be 1111111111111111111114oLvT2. Then, you can change "0000000000000000000000000000000000000000" to something else. You just have 20 bytes, so let's use "username@example.com", in UTF-8 it will be "757365726e616d65406578616d706c652e636f6d". So, the script would be "76a914757365726e616d65406578616d706c652e636f6d88ac", then after using decodescript in Bitcoin Core console again, we will get 1Bi2JKSzSMosNFLGqm5SdDEzxUhsCAry9t.

Also, you can also do it in another way, you can put it explicitly in the address. You just need base58 encoding. So, you can use those characters: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz". You take some of them, and form some name, like "1AmGar1oniconAndThis1sMyBurnAddress". But it is a bit too long, however, still we can reach something. For example this one: 1AmGar1oniconAndThis1sMyBurnAknqFh. Some last characters have to be changed, because there is a checksum, but playing with https://learnmeabitcoin.com/technical/base58 and Bitcoin Core should give you any burn address you want.

But still, I prefer miner-based burning, because then there is no address, there is no additional UTXO, everything is burned without leaving any overhead on-chain, just less coins are taken in the coinbase transaction, and nobody can get them back, without re-mining the whole chain from that point.

[vjudeu]

Miner/pool usually have strong financial incentive, so it's unlikely it'll happen on practice.

Why not? If miners will be paid for burning coins, then I think they will have an incentive to do that. Some people thought about Proof of Burn, it is definitely possible to encourage miners to burn some coins, if they could be rewarded somehow for doing that. And burning coins in Proof of Burn should be done as garlonicon said, then it is clearly connected with mining, and no additional outputs are needed, so it requires no additional on-chain bytes.

I can also imagine that waiting 100 blocks may be inconvenient, so some miners could agree to mine a specific coinbase transaction on behalf of some user, just to receive some coins on-chain, that could be spent immediately. Also, because miners include transactions, it may be possible to do that atomically, like "I will give you those coins, only if you mine any coinbase transaction for me".

[pooya87]

I meant that using burner addresses like the bitcoineater one, no one really knows if someone possesses the private key to it or not. you don't expect that anyone knows it but you don't know exactly how they came up with that address so you can't really say for sure.

Then that is a different argument than "cracking the address".
You are right, there is no proof that the burn address is not-generated using a private key regardless of how unlikely it is. But that is still not called "cracking" since the creator would already have the key.

But why is someone using a legacy address to hold that much BTC?

Because it is 100% secure as long as the key was generated correctly (used a strong random generator) and kept safe.

Lose your private key or if someone else gets your private key, it's all gone.

Nobody can "get your key" as long as you are protecting it correctly. Besides if you are incapable of protecting one key, you are not going to be able to protect multiple either.

[NotATether]

OK, this is an interesting approach. Not such a common practice, but it is possible; actually I think that there were some coins burned (kind of) like this - most probably due to miners' mistakes while experimenting.

It's precisely that - in this day and age, a sane miner would never burn fees or rewards - they would take the maximum amount possible, given the equipment and electricity costs. So this method of burning cannot be counted on to be utilized.

[BlackHatCoiner]

It's precisely that - in this day and age, a sane miner would never burn fees or rewards - they would take the maximum amount possible, given the equipment and electricity costs. So this method of burning cannot be counted on to be utilized.

A sane miner wouldn't do it deliberately, but perhaps accidentally.

The reward of block 501726 was failed to be claimed. In block 124724, the miner destroyed 0.01000001 BTC, 0.01 in fees and 1 sat in block subsidy. The person who solved block 526591 chose to reward himself with half the block subsidy. Genesis block does also burn coins, for a reason, yet, unknown.

No sane person, generally, burns coins purposefully.

[PrimeNumber7]

Why does that make it more provable? As far as I know this just adds am Message to the transaction?

Because an OP_RETURN script cannot be unlocked, and so these coins cannot be spent. Coins in burn addresses can be unlocked by one of the correct private keys, it is just that no one knows what those private keys are.

I would also point out that sending to a "burner" address will increase the size of the UTXO set, while an op return transaction will not. So sending to a "burner" address will make it more expensive for everyone to run a full node.

....Because an OP_RETURN script cannot be unlocked, and so these coins cannot be spent. Coins in burn addresses can be unlocked by one of the correct private keys, it is just that no one knows what those private keys are.

I know I have said this before but that is not 100% true / proven.
With some of these addresses:
We *assume* that due to the math that nobody has the address.
We can prove that to generate the address through brute force cannot be done before the sun goes nova and destroys the Earth.
We CANNOT prove that nobody has it.

You can't prove a negative. And there is always the 2^160 to 1 chance (close enough to zero to be zero but still not zero)that someone has one of them.

Sorry it's just one of those things that I think should be out there.

-Dave

I have generated the address bc1q3lj2xv859lf5a8jqk60lhev4czd590tue7qjjg and have access to the private key. Mathematically speaking, the chances that I have the private key associated with the above address is the same that I have the private key to any other arbitrary address that is valid.

If someone generated a private key, and calculated the associated address, they could tell people to send coin to that address to "burn" said coin. OTOH, if someone were to randomly generate a valid address in a way that does not involve generating a private key, it can generally be safely assumed that no one has access to the associated private key, if in fact the address was generated in a random way. The problem is that it is not possible to know if someone generated the private key or if they generated a random, valid address.

[o_e_l_e_o]

Genesis block does also burn coins, for a reason, yet, unknown.

I wouldn't say the reason is unknown. The coinbase transaction from the genesis block is not entered in to the UTXO set, and so it cannot be spent, as any transaction trying to spend it would be rejected as nodes cannot locate the input.

Unless you mean the reason Satoshi did this? Likely just an oversight.


Just to add something else to the discussion: There are provably unspendable burn addresses which are not OP_RETURN outputs. The largest one I am aware of, which contains 2,609 unspendable bitcoin, is here: https://blockchair.com/bitcoin/address/s-272edf45031dd498e7b3ae89e11ff21b. This address requires a pubkeyhash of 0 to be unlocked, which cannot be reached from RIPEMD-160, and so these coins cannot be spent.

[garlonicon]

The problem is that it is not possible to know if someone generated the private key or if they generated a random, valid address.

I think numbers selected in a "nothing up my sleeve" way can be "trusted" in general. But of course using OP_RETURN is cheaper. And the cheapest is miner-based burning, because then it takes zero additional on-chain bytes, so it is possible to put more transactions, and get (or burn) more coins, so it is more effective. I think if people want to introduce Proof of Burn as a consensus rule, then it should be done on a mining level.

Unless you mean the reason Satoshi did this? Likely just an oversight.

The reason may be that nobody else could have a chance to mine that. Or another reason is that starting from an empty database is obvious way of starting the chain. Also, people assume that the first address belongs to the creator, in theory Satoshi could release it, so that someone else could mine that (with the same newspaper text), but then everything was on so early stage, that there was no reason to put someone else's address here, that could make it easier to attack later, by claiming that someone is Satoshi, because that person was lucky enough to mine the Genesis Block. Also, making the Genesis Block spendable could make people think that Bitcoin had a premine of 50 BTC. Fortunately, it is not the case. Also, it means that 21 millions are initially reduced by 50 BTC, because it is counted in the halving schedule (that is clearly visible also in regtest, after mining all coins locally).

[PrimeNumber7]

The problem is that it is not possible to know if someone generated the private key or if they generated a random, valid address.

I think numbers selected in a "nothing up my sleeve" way can be "trusted" in general. But of course using OP_RETURN is cheaper. And the cheapest is miner-based burning, because then it takes zero additional on-chain bytes, so it is possible to put more transactions, and get (or burn) more coins, so it is more effective. I think if people want to introduce Proof of Burn as a consensus rule, then it should be done on a mining level.

I cannot think of a way that it would be possible to prove to an arbitrary third party that you generated an address at random, without generating the associated private key.

OP_RETURN transactions are really the most appropriate way to "burn" any coin that you "need" to be burned. Based on current consensus implementations, this coin cannot be spent. Implementing "burning" transactions at the mining level would require the consent of the specific miner that finds the block that includes the subject transaction(s). Someone could "burn" 1BTC by including a 1BTC transaction fee into their transaction, and the miner could produce total outputs that are 1BTC less than the block subsidy plus the sum of all transaction fees, however, I don't think many miners would be willing to do this.

[pooya87]

Unless you mean the reason Satoshi did this? Likely just an oversight.

Chances of it being an oversight are low, in my opinion.
If you think about it, Genesis block and its reward (worth $1.5 million today) is technically a premine IF it could be spent and that's would not have been a good thing to have in Bitcoin.

[garlonicon]

I don't think many miners would be willing to do this.

Taking less coins in the coinbase transaction is a no-fork. That means, you can stay in the current network and always do that. We can't see a lot of burned bitcoins, because there is no incentive. But: if it would be "please burn 1 BTC, and I will give you 2 BTC", then some miners could agree to do that. Another option is to create something based on Bitcoin, where all coins that are burned in the coinbase transaction, will automatically reappear on some other chain with some other features. That chain could have zero coins initially, and create them by burning bitcoins. But of course, having two-way-peg is better than one-way-peg, we saw that in practice in some tokens like 1CounterpartyXXXXXXXXXXXXXXXUWLpVr. Imagine that all of those coins could be burned in the coinbase transaction, instead of sitting on that address. Using OP_RETURN is another option, but then it is not directly connected with mining, and I think consensus rules should be connected with that.

[o_e_l_e_o]

If you think about it, Genesis block and its reward (worth $1.5 million today) is technically a premine IF it could be spent and that's would not have been a good thing to have in Bitcoin.

I'm not sure that would have been a motivating factor for Satoshi. Was a "pre-mine" even a concept which existed prior to altcoin creators using it to make themselves richer at the expense of their users? Would Satoshi even have known of the concept of "pre-mining"? If he was overly concerned about being seen to be pre-mining, then it doesn't make sense for him to have mined the first block 5 days prior to announcing the release of the software to the mailing list.

And you could equally argue that the genesis block isn't a pre-mine; it's a regular mine. Pre-mining is setting aside x amount of coins before your chain is even launched. The genesis block wasn't that, but rather the standard block reward for mining a block. It just so happened to be the first block.

I don't read RIPEMD specification or how it works in detail, but did you mean RIPEMD-160 output always higher than zero?

RIPEMD-160, as the name suggests, always outputs a 160 bit/20 byte number. If it was to output 0000000000000000000000000000000000000000, then that would give the address 1111111111111111111114oLvT2 as has been discussed above, which is not provably unspendable however unlikely it is that someone knows one of the private keys. However, because it always outputs a 160 bit number, it will never output 0, and so there is no private key which will be able to unlock this script and move these coins.

[pooya87]

I'm not sure that would have been a motivating factor for Satoshi. Was a "pre-mine" even a concept which existed prior to altcoin creators using it to make themselves richer at the expense of their users? Would Satoshi even have known of the concept of "pre-mining"? If he was overly concerned about being seen to be pre-mining, then it doesn't make sense for him to have mined the first block 5 days prior to announcing the release of the software to the mailing list.

And you could equally argue that the genesis block isn't a pre-mine; it's a regular mine. Pre-mining is setting aside x amount of coins before your chain is even launched. The genesis block wasn't that, but rather the standard block reward for mining a block. It just so happened to be the first block.

The basic concept of a pre-mined coin is "coins that were produced in an unfair way when one party has all the advantage". In other words the fact that nobody else could mine block 0 and Satoshi mined it in private makes the reward of that block "pre-mined". I'd say that the fact that he mined the block doesn't change that.
In contrast block 1 could have been mined by anybody since the software was released and the network was live before the block was found, which makes the rewards of blocks 1+ fair distribution.

What pre-mined altcoins do is the same thing, they just remove the effort to mine a valid block by summoning the coins out of thin air but the principle of "coins created in an unfair way" is the same.

[PrimeNumber7]

I don't think many miners would be willing to do this.

Taking less coins in the coinbase transaction is a no-fork. That means, you can stay in the current network and always do that. We can't see a lot of burned bitcoins, because there is no incentive. But: if it would be "please burn 1 BTC, and I will give you 2 BTC", then some miners could agree to do that. Another option is to create something based on Bitcoin, where all coins that are burned in the coinbase transaction, will automatically reappear on some other chain with some other features. That chain could have zero coins initially, and create them by burning bitcoins. But of course, having two-way-peg is better than one-way-peg, we saw that in practice in some tokens like 1CounterpartyXXXXXXXXXXXXXXXUWLpVr. Imagine that all of those coins could be burned in the coinbase transaction, instead of sitting on that address. Using OP_RETURN is another option, but then it is not directly connected with mining, and I think consensus rules should be connected with that.

There is no reason to reinvent the wheel. It is already possible to burn coin via OP_RETURN transactions.

You are proposing something along the lines of creating an altcoin that sits on top of bitcoin, while using bitcoin's legitimacy to further its own.

If you are paying a miner 2BTC to burn 1BTC, then you are only burning 1BTC, and not 3BTC, although I think many would claim to be burning 3BTC.

Unless you mean the reason Satoshi did this? Likely just an oversight.

Chances of it being an oversight are low, in my opinion.
If you think about it, Genesis block and its reward (worth $1.5 million today) is technically a premine IF it could be spent and that's would not have been a good thing to have in Bitcoin.

I would tend to agree with oeleo above. In addition to his points, I don't think satoshi anticipated there being a lot of interest in mining bitcoin in it's very early days, and it appears that he had the capacity to mine many blocks while bitcoin was only days/weeks/months old. The coin from the first block is a drop in the bucket compared to the coin that satoshi is estimated to have mined.

I'm not sure that would have been a motivating factor for Satoshi. Was a "pre-mine" even a concept which existed prior to altcoin creators using it to make themselves richer at the expense of their users? Would Satoshi even have known of the concept of "pre-mining"? If he was overly concerned about being seen to be pre-mining, then it doesn't make sense for him to have mined the first block 5 days prior to announcing the release of the software to the mailing list.

And you could equally argue that the genesis block isn't a pre-mine; it's a regular mine. Pre-mining is setting aside x amount of coins before your chain is even launched. The genesis block wasn't that, but rather the standard block reward for mining a block. It just so happened to be the first block.

The basic concept of a pre-mined coin is "coins that were produced in an unfair way when one party has all the advantage". In other words the fact that nobody else could mine block 0 and Satoshi mined it in private makes the reward of that block "pre-mined". I'd say that the fact that he mined the block doesn't change that.
In contrast block 1 could have been mined by anybody since the software was released and the network was live before the block was found, which makes the rewards of blocks 1+ fair distribution.

What pre-mined altcoins do is the same thing, they just remove the effort to mine a valid block by summoning the coins out of thin air but the principle of "coins created in an unfair way" is the same.

If you were to create some altcoin Today, on June 4th, you could disseminate the announcement of said altcoin via some channel that is unlikely to get a lot of attention, mine the very early blocks of said altcoin "fairly", and later announce your altcoin via some other channel that is likely to get more attention and interest on June 10th (for example).

While satoshi did announce bitcoin via a channel that resulted in it getting the maximum attention possible, the attention that it initially got was very small.