Merge mining (BOB) with Dogecoin — what it is, how it works, and what's left to do

[BtcBob]

This came up in Discord: "by merge mineable with Doge what do you mean? How would one dual mine the two at once with 1 miner? Or are you saying it will happen in the backend?" Fair question, and the answer, everything is  already done and sitting in the wallet you're running. -sorta.


1. What merge mining actually is

You don't dual mine. There is no second miner, no second algorithm, no split hashrate. You hash once, and the same hash counts on both chains.

Doge and (BOB) are both scrypt. Merge mining — AuxPoW, "auxiliary proof of work" — lets a small chain accept work that was actually solved on a bigger chain. The small chain's block hash is written into the big chain's coinbase transaction before hashing starts. When a miner finds a scrypt hash good enough for the small chain's target, they hand the small chain three things: the parent block's header, the parent's coinbase transaction, and a merkle proof that the small chain's block hash was committed inside it. The small chain verifies the proof and checks the parent header's scrypt hash against its own difficulty. If it passes, the block is accepted.

Nothing is mined twice. Same nonce grinding, same hashrate, one submission — the pool fans the result out to every chain it is registered with. The extra coins are free in the literal sense: they cost zero additional hashes.

2. One correction on "with Dogecoin"

Dogecoin is itself the aux chain. Since block 371,337 in September 2014, Doge has been merge-mined under Litecoin as its parent. So the shape isn't (BOB)-under-Doge, it's:

Code Select Expand

Litecoin        <- parent, where the PoW is actually solved
 |- Dogecoin    <- aux, chain ID 0x0062
 |- (BOB)      <- aux, chain ID 0x00B0
 |- other scrypt aux chains

Siblings under the same parent block. "Merge mineable with Doge" means alongside Doge, not underneath it — any pool already merge-mining LTC+DOGE can drop (BOB) into the same merkle tree and pay out a third coin for hashes it was already producing.

The chain IDs are what keep this honest. Each aux chain gets its own deterministic slot in that merkle tree, derived from (chain ID, nonce, tree height), so two chains cannot claim the same commitment and a chain cannot serve as its own parent. (BOB) took 0x00B0 specifically because it doesn't collide with Doge, Syscoin, LottoCoin or the other live scrypt aux chains.

3. Where the code came from

We did not invent any of this, and the copyright headers say so plainly:

• Vince Durham — the pseudonymous creator of Namecoin, who wrote the original merged mining implementation in 2011. AuxPoW is his design.
  
• Daniel Kraft ("domob") — the Namecoin Core developer who modernized it in 2014-2016: splitting CPureBlockHeader out of CBlockHeader, tightening the CAuxPow validator, and adding the createauxblock/submitauxblock RPC pair.
  
• The Dogecoin Core developers — whose version of the header split is the one (BOB) carries.
  

That inheritance is the whole point. (BOB)'s wire format is byte-identical to Namecoin's and Dogecoin's, and the RPC names are the same names, because it is the same code. A pool operator adding (BOB) is not integrating something new — they're adding a config entry for a chain that speaks a protocol they already implement.

4. What's already built

All of it, and it shipped a while ago:

• CPureBlockHeader split out, with an optional AuxPoW trailer on the block header
• CAuxPow validator — 0xfabe6d6d coinbase magic, chain merkle branch, expected-index check, strict parent/child chain ID separation
• chain ID 0x00B0
  
• createauxblock / submitauxblock RPCs
• consensus activation gate, with test coverage on both sides of the fork

It went out as v0.12.0, the "AuxPoW Activation" release, and has been carried forward ever since. It is in v0.13.7 today.

Activation is mainnet block 2,000,000. The chain is at 1,901,992 as I write this — roughly 98,000 blocks to go. At the two-minute target that's about four and a half months; at the rate the chain actually moves, call it early 2027.

5. What's still required

Four things, and only one of them is code.

a. Everyone has to upgrade before block 2,000,000. After that height every valid block header must declare chain ID 0x00B0. A node older than v0.12.0 rejects those headers and quietly forks itself onto a dead chain. That is the real deadline — not the merge mining, the upgrade. If you run a node, a pool, an explorer or a service against (BOB), this is the part that concerns you.

b. A pool has to say yes. The code makes (BOB) merge-mineable; it cannot make anyone merge-mine it. Someone already running an LTC+DOGE merge pool has to add (BOB) as an aux chain and point it at a (BOB) node's createauxblock/submitauxblock. That is a conversation, not a commit.

c. The difficulty shock, in both directions. Network hashrate right now is around 510 kh/s at difficulty 0.016. One merge-mining pool arriving brings orders of magnitude more than that, and LWMA-3 has to climb to meet it. The dangerous half is the exit: if the merge-miners leave, difficulty is stranded high and the chain stalls cold. The emergency-difficulty valve that activated at block 1,888,888 exists for precisely that scenario — it is named in the source comments.

d. Solo mining survives it. Worth saying plainly, because people are mining in the wallet right now: after the fork the AuxPoW bit is optional. A plain scrypt-mined block that declares the right chain ID is still a valid block. Nothing about your setup breaks.

The trade

Merge mining buys (BOB) security it cannot otherwise afford. A chain at 510 kh/s is cheap to attack; hanging off Litecoin's hashrate makes it expensive overnight. What it costs is the small solo miner's odds — and those are the same coin flipped. The thing that makes an attacker's 51% unaffordable is the same thing that makes a lone 30 kh/s rig a rounding error.

Which is why it isn't switched on yet, and why block 2,000,000 is far enough out to argue about it first. That's what this board is for.

[EndCiv]

ok i read it twice and i follow the mechanics. free hashrate, litecoin does the work, we get the security for nothing. that's the good part and i get it.

but nobody has said the obvious thing so i'm going to say it.

right now we're under a megahash. if we hook onto litecoin we're suddenly sitting behind something measured in gigaflops or whatever the number is this week. so what happens to us? we never solve a block again. that's not a maybe. one machine here versus a farm over there is not a competition, it's just over.

and then whoever that pool is gets 1.5 coins a block. every block. every ten minutes, every day, forever, for hashes they were already making anyway. that's an assload of (BOB) going to one guy who showed up with a config file.

so my questions are pretty simple

- who is that guy, and do we pick him or does he just turn up one day
- does he pay any of it out to his miners or does he keep the lot
- can anybody stop him once he's started
- and the people mining (BOB) right now, on our pool, on their own rigs - what actually happens to them. not "less". what happens.

i'm not saying don't do it. i'm saying somebody should say out loud what we're handing over, before we hand it over.

and if the fix is changing something in the code so it gets split up - doesn't that have to go in at 2,000,000 with everything else? because after that it's another hardfork and another round of chasing everybody to upgrade, and we both know how that went last time.

ninety odd thousand blocks left to argue about it. after that its somebody else's coin.

[BtcBob]

all four are fair and the answers are worse than you're expecting. taking them in your order.

who is that guy, do we pick him - we don't pick him. he turns up. createauxblock takes an address as its one argument and hands it straight to CreateNewBlock as the scriptPubKey, so whatever string a pool operator types into their config is the coinbase. consensus checks that the amount isn't more than the subsidy and checks nothing else. it does not know whose address that is and has no way to care.

does he pay it out or keep the lot - entirely his call. we have no mechanism for it. a pool that merge mines us and keeps all 1.5 isn't doing anything the code objects to, because there is nothing in the code about it.

can anybody stop him once he's started - no. it's visible on chain, anybody can see which address is taking every block, and any other pool can bolt us on the same afternoon and compete. that's not a protection though. that's just daylight.

and the fourth one, which you're right to put last because it's the one that matters.

they stop finding blocks. not less. none.

we're at 75,850 H/s and difficulty 0.00223 as i write this. litecoin is petahash. i'm not going to pretend i know today's exact number but it's a factor with about ten zeros in it. first real LTC pool that adds us moves our difficulty by orders of magnitude inside a few retargets and after that a gridseed is noise. the chain doesn't stall. it just stops being ours to mine.

you asked how much we're handing over, so i worked it instead of guessing.

subsidy has been hard set at 1.5 since block 951,753 - look at GetBlockValue, the halvings stop there and nothing caps it after. 1.5 a block, 720 blocks a day:

    1,080 (BOB) a day
    394,200 (BOB) a year
    4.8% of every coin that has ever existed, per year, forever

supply today is 8,221,680. so about twenty years of that and whoever turned up holds more than everyone who has ever mined this chain put together. you weren't exaggerating.

now your last question, about writing a split into the code before 2,000,000. yes, it would have to go in at that fork or it's a second hardfork and another round of chasing people to upgrade, and we've still got peers sitting on 2.0.9 from the last one.

i thought about it properly and i'm not doing it.

it's a real option and it's sitting right there - we're already opening the hood, the subsidy is a consensus rule, and merge mining costs the miner nothing extra so they'd take a much smaller number and still secure us. i still won't. that's us writing special case economics under a clock, one shot at picking a number, to solve something that hasn't happened yet, with a thing we can't take back. every chain that's written a founder reward into its coinbase spends the rest of its life explaining it.

so we stay on schedule. 2,000,000, auxpow, no split, no touching the emission on the way past.

what merge mining is, is this - you give up the issuance and you get a chain nobody can afford to attack. that's not a side effect i'm tolerating, that's the deal. if somebody merge mines us and collects, that's what happened. it's what the thing does. i'd rather own that now than act surprised later.

and honestly, a chain that can't be attacked and whose issuance i don't control is closer to the point than one i can still mine on my own hardware.

the part i won't dress up is your last line, and you already know it. whoever's got a gridseed on (BOB) today is doing it because it's small enough that one machine matters, and this ends that on purpose. no subsidy trick saves it. so we say it out loud before 2,000,000, not after somebody works it out from their own balance.

that's what we're handing over. now it's said out loud, which is what you asked for.