On 1-conf being 1/10th the PoW
I’m surprised this keeps coming up, because it conflates two different numbers: how much work is in a block, versus how much it costs to reverse that block. A coinbase worth $800 or $80 doesn’t mean you pay some magic box that amount and get a guaranteed double-spend.
Against a minority attacker, reversal probability is a function of confirmations, not time — the whitepaper race math doesn’t care whether a block took 1 minute or 10. A service keeping 1-conf accepts the same probabilistic risk as today. Against a majority attacker, the cost is sustaining >50% of hashrate per hour, which is unchanged because the network still buys the same hashes per hour. The race may be shorter, but he still has to command that hashrate for its duration.
Against minority hash, 2 one-minute confirmations are more secure than 1 ten-minute confirmation, because minority-attacker odds decay exponentially with confirmation count. A 10% attacker needs a ~36× coinbase target just to break even on a 1-conf double-spend. Nervous about 1-conf? Take 2-conf and get more security in ~2 minutes instead of ~10.
Bitcoin’s design assumed an honest majority. We live in a world where hash can be rented, and BTC miners could in principle sell an attacker enough to reach 51% on BCH. However, that’s a sustained hash-war scenario, not something you can conjure reactively. One does not simply walk into a shop and rent 51% of the hashrate for the few minutes a 1-conf race lasts. The logistics are the real obstacle to low-value double-spends, whether the target is $800 or $80. For high-value targets, accumulated chainwork and finalization are the ultimate defense.
And if 1-conf is too weak, consider what we already rely on: 0-conf has zero PoW, and every miner gets a free shot at reversing it in a way DSProofs can’t always detect. If 1-conf is the worry, 0-conf is the thing we’ve been living with for years. Litecoin and Dogecoin have also run 1-conf services for years without a wave of cheap double-spends.
On the side effects
These are real concerns, and addressing them took the bulk of the CHIP. Propagation and stale rates are analyzed in Mining Centralization Risk with a 2% tolerable threshold and an impact estimate of 0.5 to 1.3%, where empirical studies done on Dogecoin and Zcash indicate our estimate is erring on the safe side. Mining dynamics (orphan skew, centralization pressure) are in the same section and in the Security Analysis. SPV sync is in Header Chain Growth, with MMR mitigations. Implementation complexity is the entire Activation Costs section.
None of this is “we’ll figure it out later.” It’s the document’s main body; “potential side effects” as a category is the most-analyzed part of the proposal. If any specific section doesn’t hold up, let’s discuss it in the technical thread.
The BCH-unique parts (covenants, locktime normalization) are handled inside the CHIP and concern BCH-native builders who are already engaged; to generic multi-coin services, BCH is just another coin wired via node APIs.
On the alternatives
DSProofs detect a double-spend; they don’t prevent one, and they don’t give you a confirmed transaction. And they structurally can’t cover covenants: a DSProof requires exactly one key whose signature is always required, which any public covenant breaks by design. So composing a Cauldron swap into a merchant payment will always fall back to 1-conf no matter how much we expand coverage. And the direction runs both ways: Cauldron benefits from 1-conf because a block resyncs all mempools, resolving any stuck covenant chain. Expanding DSProof is worth doing, but it sharpens 0-conf detection; it doesn’t create a finer confirmation slider.
Conflict-signaling mechanisms are the same category: 0-conf tooling. They tell you a competing spend exists; they don’t confirm anything.
Avalanche is evaluated and rejected in the CHIP (Avalanche Pre-consensus), for reasons I won’t fully re-litigate here: it bolts on a second consensus mechanism, and PoW-weighted pre-consensus has a vulnerability (temporary hashrate buys lasting influence) that eCash’s staked Avalanche doesn’t have. eCash isn’t a drop-in existence proof for a PoW-weighted version on BCH.
All three solve “0-conf confidence.” None solve “confirmed, but faster.” The CHIP’s claim is narrower than “faster finality” — it’s that the confirmation-fallback experience shouldn’t be stuck at 10-minute granularity.
On testnets
Last cycle we forked chipnet on Nov 15th off a code-build, and the mainnet lock-in release came in January! But what does “lock-in” even mean? Bugs can surface in chipnet phase, in which case we have to fix them after “lock-in” and do a new release ahead of activation. Could chipnet phase reveal a show stopper that would have us cancel the planned upgrade? If we did our job right up until now, that should be extremely unlikely, but it’s still a valid contingency.
But what’s the expectation from testnet or chipnet? What could it reveal that we don’t already know from empirical data from other similar chains or can model well because the problem space is well mapped? With regards to orphan rates I expect confirmation of analytical findings in the CHIP, so the most likely (and desired) outcome is we just continue smooth sailing towards chipnet and mainnet activation.
With this in mind, what do we want a testnet for?
a) we want data otherwise unknowable to us, data upon which a key specification decision would hinge
VS
b) running a testnet just to confirm the implementation is solid and bug-free, where the most likely outcome is the same spec going ahead — either no bugs were found, or they were found and fixed without touching the base spec.
In all past upgrades it was really just b) and chipnet served that role between code-build and signed release.
I think there’s still time for a preliminary “dirty testnet” before the Nov 15 chipnet upgrade. That would lower the stakes of the first live test.
Holding mainnet as formally provisional has a real cost: downstream integrators may read “not locked in” as “don’t prepare yet,” which makes post-chipnet approval harder, not easier.