Note on fair coin toss via Bitcoin

In this short note we show that the Bitcoin network can allow remote parties to gamble with their bitcoins by tossing a fair or biased coin, with no need for a trusted party, and without the possibility of extortion by dishonest parties who try to abort. The superfluousness of having a trusted party implies that there is no house edge, as is the case with centralized services that are supposed to generate a profit. One simple way to accomplish a coin toss protocol with Bitcoin is via a protocol fork that adds to the Bitcoin scripting language an opcode that puts on the stack the hash of the block in which the transaction resides. However, this implies that the parties have to wait for 10 minutes on average until the result of the bet becomes known. Worse still, such an opcode should have a maturity time of e.g. 100 blocks due to possible reorgs, thus the winning party will have to wait for more than 16 hours before being able to spend the coins that she won. We propose an alternative coin toss protocol that utilizes the current Bitcoin implementation, i.e. with no need for a protocol fork. Further, with our protocol it is not necessary to wait for the next solved block, and instead the amount of coins of the bet can dictate the appropriate confidence level that the parties require. This means that 0-confirmations security for low value bets does not use the PoW irreversibility property, and instead the mining race degrades into a network race. Hence this is similar to Point of Sale for low value transactions with Bitcoin, as merchants can take a small risk by accepting unconfirmed transactions, while listening on the network to detect double-spending attempts.