S15 E46: Peter Todd on Bitcoin Covenants, Tail Emission, OpenTimestamps & Why Lightning Rocks

Peter Todd has been on my show four or five times, and he rarely softens an answer to make a room more comfortable. I caught him again in Mallorca for an episode I published in July 2024, at a point when every Bitcoin conversation seemed to bend toward the same handful of topics: covenant soft forks, ZK rollups, Drivechains, BitVM and whether the Lightning Network had quietly lost the plot. My plan was to walk him through all of it and see where he would refuse to follow the crowd.

He refused in a lot of places. He defended inscriptions as an economic reality rather than an attack. He called the 21 million meme a design mistake that people are too invested in to question. He told me Lightning, not rollups, is the thing that still excites him most. And then, in the second half, he explained how OpenTimestamps ended up as one small piece of evidence in a contested presidential election in Guatemala.

The episode runs under an hour. It is dense, combative and very Peter.

Full RBF and the Free Market Argument

We started with full replace-by-fee, which he had been pushing for years. If you missed the earlier fight, I hosted Peter Todd and Sergej Kotliar debating full RBF in Season 14. By mid-2024 his position was that the argument was already over in practice. As far as he could tell, essentially all miners were running it. The exception he knew of was Ocean, and only because Ocean lets miners pick between Bitcoin Knots and Bitcoin Core templates.

What annoyed him was that Bitcoin Core had just closed his pull request to turn it on by default. "Dude, you should just merged this months ago," he said, describing his reaction. He also mentioned a free relay attack he had found involving the gap between full-RBF miners and non-full-RBF nodes, and was blunt about the bigger picture: "I don't think this class of problems is fixable."

I pushed him on the politics. Two of his friends started Ocean, and I half expected him to line up with them on inscriptions. He did the opposite. His reasoning was the same he used for full RBF: miners follow the money, and there is no technical wall high enough to stop people from paying to put data or assets into normal-looking transactions.

"There isn't a long-term way that this can be blocked, so we should accept that and not waste a lot of development effort trying to stop all this stuff."

For readers coming to this later: Bitcoin Core 28.0, released in October 2024, made mempoolfullrbf=1 the default. Peter got his outcome a few months after this recording, even if not through his own pull request.

Tail Emission and the 21 Million Meme

This is where Peter tends to lose half of any Bitcoin audience, and he knows it. He has argued for a tail emission for years, and his blog post "Surprisingly, Tail Emission Is Not Inflationary" is the long version. The short version is that Bitcoin starts life paying miners mostly from the subsidy and then bets that a fee market will take over completely.

He rejected the idea that "markets just magically fix everything." As he put it: "Markets go do what markets do based on incentives."

His worry is specific. When all revenue comes from fees, mining gets unstable, because a miner can try to reorganize the chain to grab fees that someone else already collected, and the bigger the miner, the more that game pays. He called the current design reckless and pointed out that, in his view, no other cryptocurrency has made that transition successfully. He also enjoyed pointing out the irony that the people who hate tail emission the most often hate inscriptions and other fee-paying transactions too. "What exactly is these people's plan? I don't get it."

I offered the obvious counterargument: without the promise of 21 million, the Austrian economists who carried Bitcoin's early narrative might never have shown up. He did not accept it at all. "That's an incredibly stupid argument, because having a supply that grows at a fixed rate is a fixed supply," he said. Fifty bitcoin per block forever, in his telling, would have become the rallying cry instead, much as gold bugs treat gold as fixed even though mining output rises with price and technology.

We then had a smaller disagreement about Litecoin. I suggested merged mining with Dogecoin is what kept it alive after the price stagnated. He said the real protection is that Litecoin is "so insignificant that no one's going to spend a bunch of money to attack it." I mentioned BitPay's claim that it processes more Litecoin payments than Bitcoin and Lightning combined. He was skeptical, and explained that he sometimes pays in Litecoin himself through swap services, only because a merchant takes nothing else, and holds it for minutes. If you want the other side of that argument, Charlie Lee made it on my show a few months earlier.

Covenants: Necessary for What?

Covenants were the hot topic of 2024. CTV (BIP 119) and OP_CAT (BIP 347) were the two main candidates, with SIGHASH_ANYPREVOUT and TXHASH-style proposals around the edges. I asked whether Bitcoin really needs covenants for Lightning, Ark and trust-minimized sidechains.

His answer was to question the premise. "Covenants are certainly necessary to do certain things on Bitcoin, but there's a bigger question of how necessary it is to do those things in the first place." By his estimate you can open roughly a billion Lightning channels per year with existing on-chain capacity, enough to support hundreds of millions of self-custodial users. He tied that to smartphone ownership and falling fertility rates, arguing the realistic population of direct Bitcoin users may shrink rather than grow. His conclusion: there is no rush.

I brought up the replacement cycling attack that Antoine Riard disclosed in late 2023, which some people framed as a reason Lightning needs a soft fork. Peter said "a very clear way to fix it" is his own OP_EXPIRE opcode, "which is not a covenant in any way shape or form," and that well-designed clients can force an attacker to keep paying for each round until they run out of money.

On OP_CAT specifically, he was more worried. When I mentioned Super Testnet's sketch of Drivechain-style sidechains built with OP_CAT, without BIP 300, Peter said that class of thing is a very good argument against it. OP_CAT is "such a general purpose tool" that, combined with a few other scripting changes, it can do basically anything. When I quoted Andrew Poelstra's view that the change is about 90% good, Peter asked what the other 10% would cost. "You're dealing with enormous amount of money. Are you really going to go risk this for people's pet projects?"

Between the two, he said CTV is the more obvious pick, though he did not let Jeremy Rubin off easy. In his view the original CTV BIP had examples that were "clearly bogus" and fee-payment problems. "If you're going to do a change to Bitcoin, it has to be well researched, has to be argued well." Jeremy, for what it's worth, came back on the show in Season 17 to defend CTV and talk about building in an adversarial environment.

ZK Rollups and the Data Problem

I had interviewed Eli Ben-Sasson of StarkWare earlier in the season, and he told me ZK proofs could let you sync a full node on a phone. I liked that idea. Peter did not.

His objection was not about the cryptography itself. It was about incentives and data availability. A node, he said, is not only about validation. It is also about making sure the data behind Bitcoin is widely published. "Really good ZK SNARKs actually screw up the incentives of Bitcoin, because I can prove validity of a block to you without actually giving you the block, and that's extremely harmful."

He added that people promoting rollups have "huge amounts [of] investment money riding on this tech being successful," and that the financial products they want to bring do not obviously serve people who hold bitcoin and make payments. Lightning, by contrast, passed that test easily. It lets you send bitcoin around the world "nearly instantly at very little money." (For transparency: StarkWare was one of this episode's sponsors.)

Drivechains and Firefighters Made of Gasoline

At Baltic Honeybadger in 2023 Peter said something on a panel about computation being cheaper than politics, and I asked him to explain it. His point was that if you really want a block size increase, an actual block size increase is less costly than a Drivechain model, because Drivechains move validity into a vote.

"Drivechains assumes that you ultimately determine validity through politics, through voting." In his view that gives miners an easy path to confiscation, including government-ordered confiscation, in a way that Lightning does not. In a Lightning channel, miners need one of the two parties to collude. In a Drivechain, "they just take the money, and that's that."

I made the usual counterargument: if Foundry is too big, anyone can mine and decentralize hashrate. He answered with the best metaphor of the episode. Relying on emergency defenses as your main defense, he said, "is like saying, well, firefighters exist, why don't we go make all of our buildings out of gasoline." He cited Braiins no longer building its own block templates as evidence of how hard it is for smaller pools to stay independent.

He was harsh about Paul Sztorc's motivations in a way I am not going to repeat as fact. Paul has been on the show many times to make his own case, including the Season 15 episode about scaling and Drivechains, and readers can judge both men by their arguments.

Cashu, BitVM and Why Lightning Still Wins

I expected Peter to dislike Cashu and other Chaumian ecash projects, because to me they can look like rebuilding banks on top of Lightning. Instead he shrugged. "If you don't like it, don't use it." He uses a Cashu wallet himself, partly for privacy and partly because using it widens the anonymity set for everyone else.

On BitVM, he said he had not seen a way to build a real trust-minimized sidechain with it. When I mentioned Sergio Demian Lerner's BitVMX work for Rootstock, he answered that once you introduce trust, many things become possible, and that is exactly the part he does not find interesting.

Then I asked what excites him most. "I'd still have to go say Lightning," he said, thinking pragmatically about what people can actually use for real-world payments. His suspicion is that payment channels and HTLCs will turn out to be a fundamental mechanism in computer science, similar to accounting with ledgers. "Something like Lightning, with that kind of model of channels and something like HTLCs, is going to be with us till the end of time."

Asked what sucks, he picked v3 transactions, the package-relay policy now known as TRUC (BIP 431). He called it "such a clumsy, ugly way to go fix the problem" of transaction pinning and said replace-by-feerate would be cleaner. He also used it to criticize Bitcoin Core culture: people afraid to call each other out, and a sunk cost fallacy around work that had not received enough outside review. TRUC did ship as standard policy in Bitcoin Core 28.0, so this is one argument he lost.

The John Dillon Emails

People had recently resurfaced Peter's emails with "John Dillon" from more than a decade earlier, and some were calling him a spook. Amir Taaki, who I mentioned was somewhere around the venue that day, was one of the louder voices. Peter's reply was that Amir had misread the material, and that Dillon had actually donated to a CoinJoin bounty rather than working against it. "Just read the [...] leaked emails. It's not hard." I am reporting this as his side of an argument, not as a ruling on it.

OpenTimestamps in Guatemala

The part of this interview I would point newcomers to is the OpenTimestamps story. I had already interviewed Rafael Cordon about how Bitcoin helped secure Guatemala's election, and I wanted Peter's version.

He was careful about his role. "I wasn't working directly for the Guatemalan government." He described himself as a subcontractor to a subcontractor working with the electoral authority. The system was paper ballots counted by hand in front of observers. Tally sheets were filled in per ballot box, and one copy was scanned and sent to election headquarters. That scan was the moment the timestamp was created.

The value, he explained, was in showing when each result entered the system. Most boxes were counted and scanned within minutes of polls closing. In some parts of the country the scans arrived hours later, alongside eyewitness accounts and video suggesting boxes had been taken and returned. He was explicit that he was relaying parts of this secondhand, and that OpenTimestamps was "one piece of the evidence" among many. It also helped show that most of the vote had been handled correctly, so the fraud was limited enough that the election did not need to be rerun. After months of legal battles, he said, "the party who won legitimately finally got into power."

He mentioned Mexico doing something similar, less officially, and said El Salvador avoided mixing elections with Bitcoin for political reasons.

Timestamping the Internet Archive

I also wanted to put something on the record that Peter rarely gets credit for: he timestamped the Internet Archive. He downloaded metadata for items across the archive, including Wayback Machine crawls, uploaded scans, videos and old games, built "a giant Merkle tree," and timestamped it. For a while you could paste in the hash of almost any file in the archive and get back an OpenTimestamps proof.

He eventually gave up because his server could not keep up with new material. He said faster NVMe drives would make the project much more feasible today, and that he would love to do it again with funding.

Three Cryptocurrencies, and Not a Fourth

I asked him to name cryptocurrencies that are not scams. He gave me Bitcoin, Monero and, with some hesitation, Zcash. "Three is not too hard. Four is very hard."

I own the laptop he used in the Zcash Sprout ceremony, which I later had him unbox at TABConf 8, so I was curious that Zcash still made his list. He said his conflict with some people around Zcash was more than personal, but that he would not call the technology bad because of them. What he likes is that Zcash's anonymity set covers all shielded coins. He mentioned Monero moving toward a similar model with full-chain membership proofs, which he described as a meaningful upgrade over what he called "coin join with some improvements."

On Litecoin's MWEB, he revealed that Litecoin had hired him to review it, and that he never sent the bill because there was not much to say. His critique was that Mimblewimble does not deliver the privacy or the scaling people expect, because some per-transaction data cannot be compressed away. David Burkett defended MWEB on the show a few months later.

The Speed of Light

My last real question was where Bitcoin will be in ten years. He named something like Ark as the most likely change average users will notice, probably used to run Lightning channels with less on-chain footprint. ZK proofs, he argued, do not solve the retail problem, because they still do not make a payment confirm instantly.

"If you want the fastest possible transactions, ultimately you're limited by speed of light," he said. Instant payments mean either custodial ecash or something like Lightning with fast routing. For Peter, everything else is a detour.

At the time he was still working on replace-by-feerate and Libre Relay, writing a paper comparing Layer 2 protocols and covenants, and looking for funding to do more on OpenTimestamps after an OpenSats application was rejected. It is a good snapshot of a developer who keeps choosing the unpopular side of an argument and then, a surprising amount of the time, watching the network move toward him anyway.

If you want more Peter, the earlier Season 11 episode on Bitcoin inflation, Lightning and privacy is the natural companion to this one.