The Spectre of MEV on Bitcoin

Early into Ethereum’s journey, the unbounded dangers of Miner Extractable Value (MEV) drove people back to Bitcoin. “MEV nihilists” embraced Bitcoin’s extreme simplicity as the sole solution to the pathological nature of open, expressive systems. 

While Bitcoin still lacks expressiveness, the introduction of Ordinal Theory by Casey Rodarmor, along with a renaissance of proposed implementations for trust-minimized sidechains has brought the dark forest to Bitcoin’s once pearly shores. 

Re-Visiting Extractable Value 

MEV is the value extracted by power users and nodes (miners, etc) from apps and users by abusing power over a given block. Extraction typically involves transaction insertion, manipulation, and censorship along with reordering of a chain’s blocks.

There are both quantifiable (onchain) and unquantifiable (out of the protocol) forms of MEV. Generally more value is captured externally. However, both types induce cartelization, pushing transaction flow to the most sophisticated players. MEV ultimately threatens the decentralization and neutrality of a network, slowly undermining the basis for it to exist in the first place. 

The Complex History of Bitcoin MEV

While MEV was coined in 2019 by the Flash Boys 2.0 paper, as an idea it first emerged in 2014. Reddit user pmcgoohan in a note titled “Miners Frontrunning'' pointed out that miners could reorder, delay, and insert arbitrary transactions without “anything close to 50% of mining power.” 

Source: Old Reddit

Batching transactions seemed to yield a simple fix, but the visibility of transactions coupled with the trust necessarily placed in the sequencer (auctioneer) suggested that any sufficiently stateful and open system would face issues from MEV. 

Ethereum has since grappled with MEV, mitigating it where possible and minimizing (or using) it otherwise. Starting with mev-geth, fixes have been tacked onto infrastructure, frontends, and more. The core of its push remains “proposer builder separation”, which outsources resource heavy block building to uphold low validator requirements. 

Source: Flashbots

Ever Ethereum’s contra, a focus on MEV within Bitcoin remains limited. Pre-Ordinals a few instances of extraction, involving mostly fee sniping, occurred. Early research described excess profit from “greedy code" while other work stressed instability without a block reward and a need to induce blockspace demand.

Despite this work and despite an early focus on MEV in Ethereum land (or perhaps in spite of it), understanding of Bitcoin MEV remains juvenile. 

Instead, the community banks on simplicity, and slowly ossifying itself by limiting technical changes to things like p2p networking, mempool rules, or uncontentious forks meant to append data and add privacy. But still, the spectre creeps on.

Ordinals 

While a few methods of extraction existed on Bitcoin prior to 2022, “Bitcoin NFTs” or Ordinals sprung open Pandora’s box. Ordinals - a standard (accidentally) born out of the SegWit and Taproot upgrades - ascribe sats with extra value based on serial numbering. Under the design, segwit data inside a sat can point to or hold arbitrary data. 

Source: Data Always

Rapid Ordinal adoption gave Bitcoin’s blockspace high fee variance, creating a reason for traders and bots to re-order, front-run, and otherwise tinker with transactions.

Source: Data Always

Fee variance should escalate to the point that miners reorg Bitcoin during 2024’s halving. In a race to win a “epic sat” (the first satoshi created after the halving) along with other standards released during the halving (such as Rodamor’s Runes), miners can forgo ongoing block rewards (3.125 BTC) for sats valued orders of magnitude more. 

Source: your friendly neighborhood anon

In all ways, acceleration in fee variance and instability with joint deceleration in block rewards is the herald of greater MEV to come. 

Types of MEV on Bitcoin Today

While not as rich as Ethereum’s MEV market, Bitcoin hosts several forms of MEV today. 

I. Replace-By-Fee (RBF): typically Bitcoin inclusion is done on a first seen basis. RBF lets users update fees to push transactions through faster. A large chunk of hashrate already does full RBF, obviating standard norms for ordering to earn greater revenue. This adoption enables more sophisticated MEV strategies.

II. Lightning Watch Tower Attacks: Lighting channels have a maximum capacity of transactions they can resolve at any time, meaning a node can be flooded and looted. By colluding with a miner, one party can grief another, capturing fees. Dust UTXOs can also be closed by anyone, leaving additional fees for miners to compete over.

III. Sniping Sidechain Auctions: the Stacks sidechain auctions off fees and the right to mine its blocks by having Bitcoin miners send BTC to sidechain stakers. Along with mining pools, auctions have driven monopolization, reorgs, and censorship. The upcoming “Nakamoto Release” aims to be a fix, but it's unclear that it will obviate all MEV.

IV. Front-Running Ordinal Mints: partially signed (open) UTXOs are used to mint and exchange Ordinals, making them prone to sniping. Whitelisted mints can be bypassed by miners in the mempool. BRC-20 mints are prone to similar sniping and can drive reorgs. Tooling will eventually automate sniping, pushing users to offchain solutions.

V. Feather Forks: honest miners build on any valid block, but malicious miners can create Feather Forks (Block Discouragement) by refusing to build on specific ones. With about 33% of hashrate blacklisting blocks, fees for censored transactions rise considerably. Profits from this censorship MEV can exceed forgone revenue.

VI. Empty Blocks, Full Mempool: miners sometimes leave blocks empty, collecting issuance without including UTXOs from the mempool. This occurs due to the race conditions miners face to contribute a valid block, but it can also occur as a form of censorship MEV (Ocean Pool enlists a similar style of MEV). Related to VII, this occurs most often when miners get to pre-verify block templates other miners are hashing.

VII. Miner Cartelization: pooled mining enables savvy multi-block MEV by raising the odds of winning consecutive blocks, creating systemic risk. Pools and other mining cartels have enforced common block templates by absuing pooling economics, blacklisting smaller miners practicing nonstandard block building. Consistent surplus fees plus economies of scale induces consolidation, birthing a pathological loop. 

While not universal, the cases above confirm the reality of Bitcoin MEV. Portraying the market qualitatively is useful (more cases here), but quantifying it maps MEV best.

Sizing MEV on Bitcoin 

Any quantification of the MEV market is a lower bound since most value is extracted across distinct, private domains (by arbitrageurs trading between a centralized marketplace and a blockchain). Two things help us gauge the extent of MEV on Bitcoin:  

1. Price change: the typical assumption for price changes over a given time is the standard deviation move of an asset’s price is approximately the square root of (time). Basically, more time between trades leads to sublinear changes in price, widening arbitrage potential.

2. Block time: Bitcoin’s SHA256 mining algorithm results in probabilistic block times of ten minutes on average. This means price differences between onchain exchanges and centralized marketplaces are much steeper than on most alternative networks. About once a week, Bitcoin takes an hour to produce a block, creating massive arbitrage potential.

Jointly this implies MEV on Bitcoin will be relatively deeper and more perverse than on other networks. In practice however, MEV should be capped by Bitcoin's low expressivity. But, as detailed below, even this minimal state will make MEV a growing critical issue on Bitcoin.

Key Divergences from PoS MEV

Bitcoin has very distinct MEV due to it's Nakamoto consensus being powered by proof of work. By portraying Bitcoin alongside Ethereum and other Proof of Stake (PoS) networks, key differences and their relative advantages and disadvantages become clear.

Gasper meets Nakamoto 

Bitcoin leverages the opportunity cost of future block rewards to create probabilistic finality. The low odds of winning hashrate to a fork makes reorging Bitcoin impractical and unprofitable. However, as issuance shrinks relative to fees, Bitcoin users will need deeper block confirmations (notably, slow settlement pushed exchanges away from Bitcoin as collateral). 

In contrast, CometBFT, Gasper, and other PoS-based networks use both issuance (a carrot) and slashing (a stick) to encourage consensus. These mechanisms are based around Accountable Safety, a property that stops nodes from voting on multiple blocks with slashing. With Accountable Safety, chains can get fast finality and make reorgs prohibitively costly. 

Bitcoin’s probabilistic settlement lacks quick or single slot finality (SSF). While finality has different exact definitions for probabilistic-based and voting-based consensus mechanisms, SSF creates  a stabler climate for apps by eliminating multiblock reorgs. The potential for systemic issues due to multi-block MEV is quite high.

Developers in a fast finality environment can focus on single block MEV. Deeper reorgs lead to user and developer attrition by hampering network guarantees and user experience. While Gasper lacks SSF, Ethereum is prioritizing it to limit multi-block MEV.

Extending Sybil Resistance: PoW &  PoS

Ethereum hosts the most complex MEV market today, partially due to staking. PoS is both more extendable and durable then PoW, meaning it can provide liveness and safety to external protocols. Stake is internal and easy to rehypothecate, so it can be durably used to secure other networks. 

PoW mining involves external, transient inputs (energy, hardware) and is subject to a difficulty adjustment where costs rise to pinch profits algorithmically. This pushes miners to the margin, making them quite revenue sensitive relative to their PoS counterparts. 

All designs, whether tied to a PoS or PoW chain, need liveness and ordering. Generally, since PoW is more transient and less extendable than PoS, sidechains tied to Bitcoin will need more incentives to operate. While reusing stake in this context seems beneficial, it carries novel risks, fosters new MEV, and lowers coordination costs by encouraging cartelization. Still, due to low margins, it is likely miners would jump quicker to earn new fees on sidechains then stakers.

Centralization from external activities has been used as an argument against Merge Mining (the first sidechain scheme meant to extend PoW sybil resistance) for years. 

Source: bitcoin-dev

The outright tradeoffs of extensibility and durability need to be seen in practice, but PoS undoubtedly is a more durable way to power things beyond the protocol. Counter-intuitively, Bitcoin sidechains may be more robust as their sustainability requires more independence.

Re-Entering a Byzantine World

Concerns over Ethereum centralization led to proposer builder separation (PBS), a design which outsourced resource heavy sequencing to savvy builders and left transaction inclusion to a broader set of unsophisticated nodes. PBS is designed for both rational participants, who operate based on welfare, and Byzantine ones, with arbitrary behavior. 

Historically, Bitcoin has relied on miner preference for vanilla standards (90% of miners run Bitcoin Core), while also benefiting from miners being legally bound from some MEV activity (about 30% of hash power resides in the USA). As MEV becomes the bulk of revenue, it will induce deviations from norms, birthing a dark market for UTXO flow. Like Ethereum before it, pinched profits plus singular benefits from private flow will foster hashrate consolidation. 

To be Byzantine Fault Tolerant, open systems like Bitcoin make security assumptions about how many actors are Byzantine (51% hashrate, 66% stake, etc). Bitcoin’s new ability to catalyze MEV (and the censorship and systemic instability potential which come with) requires reworking values and infrastructure away from honest assumptions and back to Byzantine roots. 

Bitcoin is an open system, making rational assumptions self-defeating. Source: bford.info

This means culture change (no, forking out expressiveness or applications isn’t a fix) and significant infrastructure uplift (designs like Stratum V2 assumes ordering doesn’t matter and hence is unstable in an MEV rich world) are necessary to steward Bitcoin’s core values. The issues downstream of censorship MEV on Ethereum clearly demonstrates the Byzantine world Bitcoin lives in. 

Complexity in the Mirror … 

Rollups and other schemes for trust-minimized sidechains preserve the core properties of Bitcoin - neutrality, openness, scarcity, etc - while adding immense value in the form of expressive, immutable state. With this complexity heightened risks from MEV are certain. 

Depending upon which scheme is chosen, MEV on Bitcoin will progress differently. Below a few approaches are given and then examined based on MEV properties each brings to Bitcoin. 

Merge Mined Chains

Merge Mining is the original trust minimized sidechain scheme. Merge Mining scales Bitcoin by simply upholding the scarcity of its asset, bitcoin. No guarantees beyond double-spend protection and supply limits are upheld. Early designs gave miners power over sidechains, but attempts today (BIP300 + BIP300) involve “Blind Merge Mining” (BMM).

Under this design, miners are kep blind to data and state on “Drivechains” using envelopes. Miners simply vote on data (in the form of simple payment verification proofs) optimistically, slowly ossifying UTXO balance updates by voting on transfers with hashrate. Miners earn fees by indexing this data onchain, creating a two-way peg for bitcoin. BMM creates fee variance, so it will drive MEV. And much like unbundling attacks on Ethereum, miners with enough hashrate can reorg Bitcoin and/or a BBM chain to capture fees . Because BMM is essentially a subjective (relies on hashrate majority) and optimistic (no penalty for deviation) commitment, these reorgs will be as deep as fees entice them to be given a certain hashrate distribution. Ultimately, though, Bitcoin should still reach “settlement” over a block.

Rollups

While bred in Ethereum, rollups have gained credibility in Bitcoin. For a rollup with a smart contract bridge to go live, Bitcoin needs two new opcodes and a soft fork. A few opcode choices exist, ranging from the restrictive TXHASH to the more general OP_CAT. 

Regardless of which opcode escapes the governance “bikeshed”, all will create fee variance with data publishing. Critically, typical rollups will be parasitic, siphoning fees from Bitcoin miners (no, ordinals fees will not suffice as a security budget). 

While rollups may pay data fees to miners, a rollup’s ability to halt makes importing data from other networks feasible. Given operating a rollup is costly and they compete as revenue capturing businesses (as opposed to currency-esque L1s), importing from low cost providers makes sense, especially when users don’t care or know where their data is published but have highly elastic demand with respect to fees. Largely, this suggests data will be commoditized.

Not paying data to L1s certainly hurts in the general case, but because it specifically benefits each rollup individually importing data is likely to occur (alignment has a free-riding problem). It’s not entirely clear rollups maximally benefit Bitcoin. If rollups pay data fees they destabilize Bitcoin, but if they post data elsewhere they remove economic activity from Bitcoin completely. 

To what extent rollups pull value will depend on the specific fork-choice rule used. Regardless of which wins, fees from data publishing will drive new MEV, completely altering Bitcoin. 

BitVM

BitVM leverages computation offchain to bring advanced expressivity to Bitcoin. Using a scheme akin to a fraud or optimistic proof, BitVM lets verifiers map input data to specific computational outputs offchain. Anyone or thing can act as verifier, checking and slashing provers responsible for offchain computation. 

While BitVM is still being developed, it (theoretically) can anchor trust minimized bridges for sidechains and other protocols to bring rich state to Bitcoin. BitVM will not necessarily generate MEV. In the extreme, incentives could drive miners to collaborate to break a bridge. Miners can also be paid to censor transactions proving state updates on BitVM. 

The actual amount of statefulness BitVM introduces to Bitcoin will determine how much new MEV generated. Bitcoin’s long average block times and the lack of penalties for reorgs suggests BitVM may mostly be used as a way of bridging to lower latency environments. However, any new expressivity introduced at Bitcoin’s base will introduce novel incentives (which can have drastic unknown consequences) which themselves will need to be dealt with or minimized. 

Bitcoin-backed stakechains

As a PoW chain, bitcoin doesn’t accrue value by securing itself. As discussed above, the network uses external inputs, giving Bitcoin distinct properties from PoS chains. With the BitVM, sidechains can use Bitcoin-backed PoS to get safety (>34%) and liveness (>67%) from bitcoin. 

Source: stakechains.pdf

Using bitcoin PoS sidechains get fast finality with high economic security. In the initial spec, a smart contract adaptor locks bitcoin collateral and then, using one-time signatures from nonces, the collateral becomes slashable based on preconditions. 

It's feasible sidechains or Bitcoin miners themselves can opt into MEV schemes akin to PBS using stakechains. Critically, stakechains will need governance which mitigates value extraction from bitcoin holders delegating bitcoin to stakechain operators or token holders (LidoDAO is pushing this with dual-governance, which lets stETH holders veto the DAO; Optimism is also working on it with a two-tier system). 

Bitcoin-backed PoS doesn’t ensure the durability of sidechains (economic activity on the sidechain does) or provide a way to bridge bitcoin. Much like app specific blockchains, incentivizing progression without sustainable issuance will prove challenging. This means stakechains will ideally use a consensus with fast finality.

Bitcoin staking can enhance finality for all sorts of sidechain schemes. However, it does not guarantee settlement or transaction inclusion. It is likely that this PoS - like any staking system - will create a plutocracy. Arguably, stakers tend to be more incentive aligned than revenue hungry miners, but rigidity can also create new types of MEV fallout.

… is Closer than it Appears

Regardless of what solution wins, complexity is coming to Bitcoin. The BitVM, sophisticated multisig sidechains, and other designs will add expressivity without any consensus changes, while future encryption schemes guarantee Bitcoin rollups are a (albeit far out) certainty.

With Indistinguishability Obfuscation, L2s can be verified with a simple signature. 

Bitcoin must begin adapting to MEV now. Matters like who gets to order a sidechain (randomness isn’t a solution) and how to create stability while pushing L2 data fees to miners are crucial open issues. The risks from cross-domain MEV - whereby one party or group gets excess MEV by acting across spaces - will be particularly critical on Bitcoin. 

While hashpower can drift between pools and cross-domain capture has frictions (transaction costs), these alone can’t protect Bitcoin. Decreasing rewards, low value blocks being the norm for basic miners, private flow (which Marathon set loose with Slipstream, a private channel for non-standard transactions) and selfish mining will create entirely new pressure to centralization. Notably, miners are already working to own sidechains by building their own. 

All and all, new expressivity coupled with PoW’s penchant to algorithmically push miners to the ropes will foster more cross-domain pressures on Bitcoin. While some scaling schemes seem to make more sense (e.g. Drivechains don’t need to post data but also don’t inherit security to the same degree as rollups), Ethereum’s history of missteps with different designs suggests a varied approach is best. And just as Ethereum doesn’t want one party building all its blocks, Bitcoin must resist hashrate consolidation and complete capture of other domains by its miners. 

mev/acc

Since Ordinals pushed MEV into the limelight, the MEV-savvy Bitcoiners began evangelizing for extreme changes. The reasoning goes that MEV is already here, so Bitcoin should lean into complexity and relinquish any vestiges of simplicity. But this accelerationism remains dubious. In open systems protocol incentives can be fully distorted by external value as anyone or anything acts as extractor - this means MEV is open value best exercised by the savviest players. Just like Ethereum after mev-geth, competition and normalization of nonstandard practices will push base miner sophistication higher. 

Given expressivity is unavoidable but block rewards are high, Bitcoin’s historic path of stepping slow is ideal (albeit MEV ignorance isn’t a viable path). By keeping its pace, core properties - like dynamic availability, robustness, and scarcity - can be kept intact while mitigation mechanisms mature and the community works to codify updated values.

Final thoughts

Ethereum’s aspirations include recapturing value via “economically aligned infrastructure” and hosting its own decentralized services to. When it comes to MEV, Ethereum nets in favor of moving validator earnings away from fees (which are burnt) and instead using issuance to stabilize the chain.

Given its considerable differences, many of the mechanisms Ethereum uses won’t work on Bitcoin. The same spirit of minimizing MEV should be pursued on Bitcoin without breaking its one-of-a-kind features. Exponential fee smoothing or some sort of accountability gadget hold the greatest chance at dampening externalities. 

Future work should look at other forms of Bitcoin MEV, finality gadgets for PoW, and examine schemes to push sidechain revenue to miners in a smooth manner. If you are working in a related area, the team at cyber•Fund would love to chat :) 

Acknowledgements: Big thanks to Data Always for insights and editing work along with pointers from Robin Linus, Psifour, Charlie Spears, Gwart, Paul Szortc, Robert Miller, Alex Stokes, Justin Drake, Artem Kotelskiy, Vasiliy Shapovalov, and Alexander Nezlobin. And special thanks to Eric Wall for his many tweets about Bitcoin MEV.