J Grid Computinghttps://doi.org/10.1007/s10723-020-09537-9

Dominating OP Returns: The Impact of Omniand Veriblock on Bitcoin

Elias Strehle · Fred Steinmetz

Received: 27 March 2020 / Accepted: 30 October 2020© The Author(s) 2020

Abstract Bitcoin has always been used to store arbi-trary data, particularly since Bitcoin Core developersadded a dedicated method for data storage in 2014:the OP Return operator. This paper provides an in-depth analysis of all OP Return transactions publishedon Bitcoin between September 14, 2018, and Decem-ber 31, 2019. The 32.4 million OP Return transactions(22% of all Bitcoin transactions) published during thisperiod added 10 GB to the blockchain’s size. Almostall OP Return transactions can be attributed to oneof 37 blockchain services. The two dominant servicesare Veriblock (58% of OP Return transactions) andOmni/Tether (40%). Veriblock transactions pay only14% of the average transaction fee, partly becausemost of them are submitted during times when over-all activity on Bitcoin is low. Omni transactions, onthe other hand, pay more than twice the average trans-action fee and therefore compete with regular Bitcointransactions for inclusion in new blocks.

E. Strehle · F. Steinmetz ()Blockchain Research Lab, Max-Brauer-Allee 46, Hamburg,22765, Germanye-mail: fred.steinmetz@uni-hamburg.de

E. Strehlee-mail: strehle@blockchainresearchlab.org

F. SteinmetzFaculty of Business, Economics, Social Sciences,Universitat Hamburg, Von-Melle-Park 5,Hamburg, 20146, Germany

Keywords Bitcoin · Blockchain · Econometrics ·Transaction fees

1 Introduction

The Bitcoin blockchain was created to serve a singlepurpose: the operation of a decentralized and securedigital currency. But even its inventor(s) SatoshiNakamoto could not resist using it for something else.The following text is hidden in the details of the firstBitcoin transaction: “The Times 03/Jan/2009 Chan-cellor on brink of second bailout for banks.” Whetherintended as a political statement or simply as a time-stamp, the text goes beyond the declared purpose ofthe Bitcoin blockchain as a store of payment-relateddata. Many other Bitcoin users have since found ituseful to publish nonpayment data on the blockchain.

Most early methods of data insertion on Bitcoin hadthe undesirable effect of permanently increasing thenumber of unspent transaction outputs (UTXO), forc-ing full nodes to keep a growing number of “fake”transactions in memory. Bitcoin Core1 developersreacted in 2014 and released the OP Return scriptoperator. It allows users to add up to 80 bytes of arbi-trary data to a transaction without negatively affecting

1Bitcoin Core is the reference implementation for Bitcoinclients. Originating from Satoshi Nakamoto’s [13] first client,the source code for Bitcoin Core is open source. By 2016, morethan 400 developers had contributed to the enhancement andcontinued upgrading of the Bitcoin system [1].

(2020) 18:575–592

/ Published online: 11 December 2020

E. Strehle, F. Steinmetz

the UTXO. However, the release notes emphasize thatthe introduction of the OP Return operator “is not anendorsement of storing data on the blockchain. Storingarbitrary data in the blockchain is still a bad idea.”2

But is it? Bitcoin’s perceived immutability,censorship-resistance and accessibility make it anexcellent medium for publishing data in a transpar-ent and tamper-proof way. By mid-2017, more thantwo million OP Return transactions had been pub-lished on Bitcoin, mostly by organizations in search ofa sustainable business model [3]. The overall impacthowever was small at the time. OP Return transactionsaccounted for only one percent of all transactions.

This changed in the following years. From the endof 2017 until the end of 2019, the total number ofOP Return transactions grew from four million tothirty-nine million.3 Almost all new OP Return trans-actions came from two services: Omni and Veriblock.Omni is the protocol layer that supports the well-known “stable coin” Tether, whose value is peggedto the US Dollar. Veriblock is a blockchain projectbuilt around a novel security mechanism called Proof-of-Proof (PoP), which combines notarization of thecurrent state of Veriblock’s blockchain with a complexsystem of mining rewards. Veriblock emerged fromobscurity in 2019 as it became the single largest sourceof OP Return transactions, accounting for up to 20%of daily Bitcoin transactions.4

Both Omni and Veriblock sparked controversy forstoring large amounts of “arbitrary” data on Bitcoin.Advocates lauded them for using Bitcoin in an inno-vative way and raising the demand for its token.5

Opponents suspected them of raising transaction fees,crowding out regular Bitcoin transactions, and illegit-imately bloating the size of the blockchain.6

While various papers have analysed nonpaymentdata on Bitcoin, none of them covers the recent surgein the number of OP Return transactions. The mostcomprehensive studies [3, 12] only cover OP Returntransactions published until 2017 and thus account for

2https://bitcoin.org/en/release/v0.9.0#opreturn-and-data-in-the-block-chain.3https://opreturn.org/op-return-per-month.4https://www.forbes.com/sites/ktorpey/2019/01/09/a-new-blockchain-project-is-generating-20-of-daily-bitcoin-transactions.5https://www.veriblock.org/#qanda, Question “How does Veri-Block help Bitcoin?”6See e.g. the sources cited in https://news.bitcoin.com/veriblock-captured-close-to-60-of-btcs-op-return-transactions-in-2019.

less than ten percent of all OP Return transactions pub-lished by the end of 2019. In particular, we are notaware of any scientific studies that discuss the suddenrise of Veriblock and its effect on Bitcoin. This paperaims to fill the gap with an in-depth analysis of allOP Return transactions published on Bitcoin betweenSeptember 14, 2018 (the day of the first Veriblock tran-saction on Bitcoin), and December 31, 2019. We iden-tify which services published OP Return transactions,how much they paid for them and how they contri-buted to the size of the Bitcoin blockchain. Our mainfocus lies on Omni and Veriblock as the two dominantpublishers of OP Return transactions on Bitcoin.

2 Storing Data on Bitcoin

2.1 Methods of Data Insertion, the UTXO Set, andthe OP Return Operator

The desirable characteristic of Bitcoin’s blockchain isthe authenticity of its records [10]. The cumulativecomputational effort of creating and maintaining theBitcoin blockchain presents a virtually insurmount-able security wall. Incentivization schemes ensure thatthe users work hard to protect the integrity of thedata submitted to the blockchain, which can thereforebe considered immutable. This property has inducedusers to find ways to insert arbitrary data ever since thebeginning of the Bitcoin blockchain. Arbitrary data onBitcoin refers to any data or file that is not related toeither payment or the operation of the Bitcoin network.

As data can only be added to the blockchain inthe course of transactions, any arbitrary data must besubmitted as part of the transaction data. Bitcoin’sscripting language Script defines standard script types,which principally frame the playing field for cre-ating data insertion techniques.7 Sward et al. [16]differentiate such methods according to whether theyrely on Bitcoin’s standard script type Pay-to-Script-Hash (P2SH). Methods that do not use P2SH include

7A miner can also decide to accept non-standard transac-tions which include arbitrary data. However, Bitcoin’s referenceclient only accepts standard transactions based on the standardscripts. Matzutt et al. [11] identify approximately 290,000 non-standard transactions in Bitcoin’s blockchain until July 2016,almost all of which are OP Return transactions with an emptypayload. Only 132 are non-standard transactions that do not usestandard script templates. We therefore consider the relevanceof non-standard transactions negligible.

576

Dominating OP Returns...

Coinbase transactions, Pay-to-Fake-Key (P2FK), Pay-to-Fake-Key-Hash (P2FKH), OP Return and Pay-to-Fake-Multi-Signature (P2FMS). Methods that useP2SH are more complex; they include Pay-to-Fake-Script-Hash (P2FSH), Data Drop and Data Hash. Inthe most widely used methods, various parameterswithin input and output scripts are substituted or mod-ified to convey specific content in the form of files(including images) or plain text.

Matzutt et al. [12] distinguish methods for datainsertion according to whether they utilize input oroutput scripts. Input scripts are part of every Bit-coin transaction (except Coinbase transactions) andprovide a “proof” of satisfying a set of conditions out-lined in a previous output. Consequently, spending thisoutput in a subsequent transaction requires the inputscript to satisfy the conditions of the previous outputscript. Output scripts relate to signing transactions, sothat an input script allows a miner to verify that thesender is also the owner of the respective BTC [11].

As an example, the P2FKH method uses theP2PKH standard script to insert arbitrary data in aspecial field for the hash value of the public key thatcontains the destination address of a transaction. Thisfield is part of a transaction’s output script and requiresa certain amount of BTC to be attached. By replac-ing an existing public key with a hash of arbitrarydata, the BTC associated with the transaction’s outputbecome unspendable, which adds to the cost of usingthis method. However, the hash that replaces the keyis permanently stored by miners because they do notknow whether the hash corresponds to an existing pub-lic key [16]. Accordingly, submitting arbitrary datavia Bitcoin transactions always requires getting min-ers to verify and include those transactions in blocks.Because the miners might refuse to support transac-tions that aim to insert arbitrary data, methods havebeen developed to disguise that purpose.

The insertion of arbitrary transaction data mayrequire miners to store more data. Besides inflat-ing Bitcoin’s blockchain, several methods of insertingarbitrary data affect another important data set: theUnspent Transaction Outputs (UTXO) set. The UTXOset “is a subset of Bitcoin transaction outputs that havenot been spent at a given moment” [8]. It is used forvalidating new transactions without the necessity toinspect the whole blockchain. Miners and full nodesin the Bitcoin network must continuously update theUTXO set. Every transaction produces changes in

the UTXO set as transaction inputs consume UTXOsand outputs generate new ones. According to Swardet al. [16], five out of nine methods for insertingarbitrary data affect the UTXO set and thus produceadditional overhead for miners.8 Bartoletti and Pom-pianu [2] find that until 2017, approximately 1.5% ofthe transactions that were initiated for inserting datainto Bitcoin’s blockchain bloat the UTXO set.

The OP Return operator presents an alternative tothose problematic data insertion techniques. It wasintroduced with the release of Bitcoin’s referenceclient Bitcoin Core 0.9. Although the description ofthe version release specifies that the introduction ofthe OP Return operator is not an endorsement for stor-ing data on Bitcoin’s blockchain, its recognition in thereference client is most likely a reaction to the increas-ing activity of storing arbitrary data on the blockchainusing various inefficient methods [1].9

The OP Return is an instruction in Bitcoin’s script-ing language. It can be used in the locking script ofan output. In a transaction, one output at most maycontain the OP Return instruction. The interpreter ofthe scripting language ignores any data that follows it.Nevertheless, the arbitrary data is part of the transac-tion and will eventually be stored in the blockchain.The data cannot exceed 80 bytes,10 which is much lessthan with other methods of data insertion [16].

The instruction to ignore the data differentiates theOP Return from other “more harmful” techniques. Itproduces a prunable output, which means that Bit-coin nodes which store the complete blockchain — arequirement for full nodes and mining nodes — candecide whether to store the output of the OP Returntransaction in their UTXO set. This accelerated itsacceptance by Bitcoin miners. Furthermore, unlikeother methods, OP Return transactions do not requirethe sender to burn BTC valued higher than “dust”11

[11, 16]. That is, the amount of Bitcoin associated withthe output of the OP Return transaction can be small

8For a comprehensive analysis of the different techniques andtheir implications for Bitcoin, see [6, 16], and [3].9https://www.coindesk.com/bitcoin-core-dev–update-5-transaction-fees-embedded-data.10This limit has changed over time. For a historic review of theOP Return, see [2].11According to the Bitcoin Core reference implementation,“dust” is the output of a transaction whose redemption feeexceeds one third of its value (see https://github.com/bitcoin/bitcoin/blob/v0.10.0rc3/src/primitives/transaction.h#L139-L146).

577

E. Strehle, F. Steinmetz

or even zero. This is especially attractive for proto-cols whose services require storing arbitrary data onBitcoin because it reduces costs compared to othermethods. It also reduces complexity as transactionscan be initiated solely for the purpose of inserting datavia OP Returns. In sum, Sward et al. [16] concludethat the OP Return is the most efficient method forinserting small amounts of data.

While the OP Return operator has been part of Bit-coin’s scripting language since the beginning [2], itwas only its recognition in Bitcoin’s reference clientin March 2014 that paved the way for its accep-tance and increased usage. Since then, the OP Returnhas experienced widespread adoption, having alreadybecome the most widely used data insertion methodby mid-2015 [11].

2.2 Literature Review

The share of OP Return transactions relative to otherdata insertion methods increased significantly sinceits introduction in 2014, which led researchers toinvestigate it. Existing research focuses either ondata insertion in Bitcoin in general or on OP Returntransactions specifically. The investigated data periodsrange from Bitcoin’s first ever mined block in 2009until November 2018, with transaction counts of upto 356.6 million, depending on the study period andmethodological differences.

In an early contribution to the topic, Matzutt et al. [11]classify the content submitted to Bitcoin’s blockchain.The transaction data they analyse spans the periodfrom Bitcoin’s beginning in 2009 until July 2016. Ofthe 146 million Bitcoin transactions they examine,approximately 936,000 are OP Return transactions.12

Bartoletti and Pompianu [2] identify approximately1.9 million OP Return transactions for the period until2017. Thus, the number of such transactions doubledbetween mid-2016 and early 2017, and their overallshare increased from 0.64% to 0.96%. For their dataperiod from March 2014 until February 2017, Barto-letti and Pompianu report a share of OP Return trans-actions of 1.16%. The total size of all arbitrary datainserted into the Bitcoin blockchain via OP Return

12The authors refer to OP Return transactions as “null-data” transactions. These terms are used synonymously, seee.g. https://bitcoin.org/en/glossary/null-data-transaction.

transactions amounted to 44 MB (1.9 million transac-tions) by early 2017, while Bitcoin’s blockchain itselfamounted to 102 GB at the time. Overall, those OPReturn transactions consumed 323 MB. The authorsidentify 22 protocols which account for 51% of thetransactions.13 They categorize these protocols asassets, document notary, digital arts, and others.

A later study by Faisal et al. [9] illustrates theincreasing popularity of OP Return transactions. Theauthors analyse a dataset containing all blocks ofthe Bitcoin blockchain from the end of March 2013to the beginning of July 2017 and identify a totalof 3.7 million OP Return transactions. Compared tothe earlier study by Bartoletti and Pompianu [2],the number of OP Return transactions appears tohave almost doubled within less than five months in2017. With regard to service categories of OP Returnservices, the authors distinguish between key valuestores, notary/doc, assets, any message, and proof ofownership.

Bartoletti et al. [3] identify approximately 2.9 mil-lion OP Return transactions in 480,000 blocks from2009 until August 2017. This amounts to about 1.2%of all Bitcoin transactions since 2009 and about 1.4%of all transactions since March 2014. In light ofthe earlier study by Bartoletti and Pompianu [2],these results imply that approximately one millionOP Return transactions were initiated within less thansix months from February 15, 2017, until August 10,2017. For the 2.9 million OP Return transactions pub-lished by mid-2017, the authors calculate a total dataload of 77 MB. Roughly 10% of all OP Return trans-actions had no data attached. The authors identify 45protocols and 39 identifiers.14

Matzutt et al. [12] analyse the impact of arbitrarycontent on Bitcoin based on transaction data from July2009 until August 2016. The authors identify 3.5 mil-lion transactions that contain nonpayment data, 86.8%of which are OP Return transactions. With a reportedshare of 1.2% of all Bitcoin transactions, the authors’result for the share OP Return transactions signifi-cantly exceeds those of the aforementioned works.The authors further find that OP Return and Coin-base transactions jointly account for 81% (96 MB) of

13The authors identify 25 protocols, but only provide data for22.14Some protocols use more than one identifier and 19 protocolsdo not use any identifiers.

578

Dominating OP Returns...

the nonpayment data on Bitcoin’s blockchain. Theycategorize data insertion services as digital notary ser-vices, secure releases of cryptographic commitments,and non-equivocation schemes.

Bistarelli et al. [4] is, to the best of our knowl-edge, the latest publication on OP Return transactions.It analyses standard and non-standard transactions inBitcoin until November 2018. For the last year, theauthors report that the number of OP Return trans-actions exceeded five million, which would implyanother significant increase since mid-2017. They fur-ther find that most transactions (four million) have asize of only 20 bytes, while half a million are 40 bytesand one million are 80 bytes in size. This distributionof OP Return sizes is mostly due to the changes inthe OP Return capacity over the course of subsequentreleases of the Bitcoin Core reference client. Approx-imately 297,000 OP Return transactions did not carryany data load, 222,000 of which can be attributed to anetwork stress test during September 2015.

Interestingly, only BTC 2,615 were burned whilesubmitting data to Bitcoin’s blockchain in the timeperiod considered by Bistarelli et al. [4]. With theintroduction of the OP Return operator in Bitcoin’sreference client, burning Bitcoin is no longer a prereq-uisite for inserting data. Therefore, the more interest-ing indicator is the amount of fees paid for OP Returntransactions. Sward et al. [16] report that the totalcost of storing 80 bytes of arbitrary data on Bitcoin’sblockchain using OP Return transactions amountsto 6,340 satoshi/byte (one BTC equals 100 millionsatoshi), although it is unclear which data period wasconsidered to obtain this number.

We assume that most transactions that carry arbi-trary data are initiated solely for the purpose of insert-ing this data into the Bitcoin blockchain, and thus donot carry any meaningful transactions of BTC betweenusers. Accordingly, when measuring the data load ofOP Return transactions in Bitcoin, one should con-sider the size of the entire transaction instead of thesize of the inserted data.

OP Return transactions can often be associatedwith specific protocols by identifiers contained in theOP Return data. Most protocol owners and inven-tors are companies that use OP Return transactions tooffer specific services. The identifiers are structuresin the data of OP Returns that allow users and ser-vice providers to find and verify data submitted tothe blockchain. Based on these recurring structures

different types of services have been identified. Inthe literature, the different categorizations and tax-onomies of these services overlap considerably [2,3, 9, 12]. The most granular categorization is pro-vided by [3]; in the following, we expand upon it inmore detail. The authors categorize protocols as finan-cial, notary, digital rights management, message, andsubchain.

The purpose of financial protocols such as Colu [5]and Omni [18] is the management of assets other thanBitcoin. Associated OP Return transactions includeinformation about the ownership and size of the trans-ferred asset. This way, a currency is implementedthrough a technical layer “on top” of Bitcoin, withoutthe need for a dedicated blockchain. Notary proto-cols provide proof of existence and timestamps fordocuments by submitting cryptographic identifiers tothe blockchain. This way they attest that a documentexisted at the time of submission to the blockchain,and the unchanged integrity of a file since its sub-mission can be verified. In combination with privatekey encryption, the originator of the file can alsobe ascertained: it is the owner of the private keyat the time of submission. Examples of notary pro-tocols are Stampery [7] and Factom [15]. Digitalrights management protocols facilitate the manage-ment of access rights to documents and files. Asan example of such services, Monegraph focuses onenabling creators of digital art to maintain controlover the reproduction and use of their work throughtechnical licensing methods. Similar services includeBinded (formerly Blockai) and Ascribe. Message ser-vices like Eternity Wall and BitAlias store text mes-sages and aliases on Bitcoin’s blockchain. Finally,Subchain protocols “construct transaction chains torecord execution traces of third-party smart con-tracts” [3]. The only service in this category is theBlockstack Naming Service (BNS, formerly Block-store).

The categories indicate that OP Return transactionsare used for various purposes and across differentdomains. According to Bartoletti et al. [3], “financial”is the dominant category in terms of the number oftransactions and data load. From about 2,000 in April2015, the number of transactions in the financial cate-gory increased to approximately 200,000 in July 2017,accounting for 63% of all OP Return transactions.Financial protocols (referred to as asset protocols inother research articles), also appear to be the most

579

E. Strehle, F. Steinmetz

common category in previous articles, accounting for27% [2] and 30% [9] of the transactions. Matzuttet al. [11] find that 10% of all non-empty OP Returntransactions are associated with the protocol OpenAssets, which is also an asset protocol.

Table 1 summarizes the results from the literature.To the best of our knowledge, previous comprehen-sive studies of OP Return protocols only incorporateblockchain data until August 2017. Since then, thelandscape of protocols and their use have changeddrastically. During the surge in cryptocurrency pricesin late 2017 and early 2018, the protocol Omni gainedsignificant importance. Moreover, new protocols havebeen developed which secure the blockchains ofalternative cryptocurrencies. Among these, Veriblockreceived the most media attention due to the largenumber of transactions associated with it.15 It appearsthat no published research covers the current state ofOP Return transactions, the shares of the different pro-tocols and the allegedly dominant services, Omni andVeriblock.

2.3 The Dominant Services: Omni and Veriblock

Omni is a protocol layer built on top of Bitcoin. Itwas developed to enable the creation of new tokens onthe Bitcoin blockchain [18]. The most popular tokenthat uses the Omni protocol is the “stable coin” Tether(USDT). Its originator Tether Ltd. promises that allUSDT in circulation are backed by a reserve and canbe redeemed at any time, which should guarantee thatone USDT is always worth one USD [17].

Every Bitcoin transaction can carry an Omni trans-action. Conversely, every Omni transaction requiresa Bitcoin transaction. The Omni protocol itself doesnot charge transaction fees for basic transactions, butthe sender must pay the transaction fees for the cor-responding Bitcoin transaction. A higher transactionfee typically implies quicker publication of the corre-sponding transaction.

Figure 1a shows the OP Return format of a typ-ical Omni transaction. It begins with the identifier“omni” and includes the transaction type (e.g. a “sim-ple send”), the targeted property (e.g. Tether) and thetransfer amount. The OP Return data does not include

15See e.g. https://news.bitcoin.com/veriblock–captured-close-to-60-of-btcs-op-return-transactions-in-2019.

any addresses because Omni reuses the sender andreceiver addresses of the Bitcoin transaction itself.

The Omni protocol has been in operation since2013. Tether was launched on Omni and thus onBitcoin in 2014 and remains the main use case forOmni, although Tether is by now also available onother blockchains, including Ethereum. Still, Omnihas been one of the most important services using Bit-coin’s OP Return transactions: more than 40% of allOP Return transactions ever published on Bitcoin areOmni transactions.16

Veriblock is a blockchain project that is builtaround a novel security mechanism called Proof-of-Proof (PoP).17 Veriblock’s users can act as “Proof-of-Proof miners” by publishing a snapshot of theVeriblock blockchain in an OP Return transaction onBitcoin. In the context of Proof-of-Proof, the pub-lished snapshot is referred to as an endorsement.While new blocks on Veriblock are created by stan-dard Proof-of-Work (PoW) mining, forks are resolvedin favour of the chain that has more and older endorse-ments on Bitcoin. The intention is to make Veriblockjust as secure against 51% attacks as Bitcoin, in thata successful attack against Veriblock would requirecontrol over the endorsements published on Bitcoin.Consequently, Veriblock advertises that cryptocurren-cies built on top of its blockchain inherit Bitcoin’ssecurity without having to operate on Bitcoin directly.

Publishing endorsements on Bitcoin entails trans-action fees. To create an incentive to pay these fees,Veriblock grants a mining reward to every user whopublishes an endorsement and references it in a specialtransaction on Veriblock. In a sense, Proof-of-Proofminers exchange BTC (in the form of transaction fees)for Veriblock’s cryptocurrency VBK (in the form ofmining rewards). The first users to endorse a newblock on Bitcoin receive the largest share of the min-ing reward. Proof-of-Proof miners thus face the chal-lenge of finding the optimal level of transaction feesthat guarantees speedy publication on Bitcoin at min-imal cost and thus the best “exchange rate” betweenBTC and VBK.

16https://opreturn.org/op-return-protocols; the category“6f6d6e” corresponds to Omni transactions.17Information on Veriblock was obtained from the originalwhitepaper [14], the most recent version of the whitepaper [19],and Veriblock’s website (https://veriblock.org) and wiki (https://wiki.veriblock.org). The authors clarified some details via chatin the Veriblock Discord channel under the username “estrehle”.

580

Dominating OP Returns...

Table1

OP

Ret

urn

tran

sact

ions

inB

itcoi

n’s

bloc

kcha

inas

iden

tifie

din

the

liter

atur

e

Pape

rD

ata

peri

odT

rans

actio

ns(M

io.)

Dat

eB

lock

sO

PR

etur

nTo

tal

Mat

zutt

etal

.,20

16[1

1]01

.09.

09–

31.0

7.16

0–

423,

075

0.9

146.

0

Bar

tole

ttian

dPo

mpi

anu,

2017

[2]

01.0

9.09

–15

.02.

170

–45

3,20

01.

919

6.6

Bar

tole

ttiet

al.,

2019

[3]

01.0

9.09

–10

.08.

170

–48

0,00

02.

9–

Mat

zutt

etal

.,20

18[1

2]01

.09.

09–

31.0

8.17

0–

482,

869

3.1

250.

9

Bis

tare

lliet

al.2

019

[4]

01.0

9.09

–14

.11.

180

–55

0,00

0>

5.8

356.

6

Fais

alet

al.,

2018

[9]

29.0

3.13

–06

.07.

1722

8,59

6–

474,

451

3.7

–

Thi

spa

per

14.0

9.18

–31

.12.

1954

1,30

6–

610,

681

32.4

147.

6

581

E. Strehle, F. Steinmetz

Fig. 1 OP Return formatsof Omni and Veriblocktransactions

Figure 1b shows the OP Return format of a Veri-block transaction. It was designed to fit the 80 bytelimit and contains the height of the endorsed Veri-block block, the protocol version, a timestamp, andmultiple shortened hashes, including the hash of themost recent block on Veriblock and hashes of the twomost recent “keystone blocks.”18 The endorsementalso contains the Veriblock address of the miner whopublished it.

Veriblock’s Proof-of-Proof mining on the Bitcoinmainnet began on September 14, 2018, with thelaunch of the Veriblock “high-noon” testnet. The test-net ran until March 3, 2019, and was succeeded by theVeriblock mainnet on March 25, 2019. Outstandingbalances on the testnet were doubled and transferredto the mainnet. The first services began testing inte-gration with Veriblock in early 2020.19 Accordingly,Veriblock’s own blockchain saw little activity until theend of 2019, averaging approximately one thousandnon-mining transactions per day between September

18Keystone blocks are intended as protection against hid-den long-range attacks on Proof-of-Proof. For details, seeSection 6.2 of [19].19Two of these services are Placeholder (https://www.placeh.io/index.jsp#map) and Pexa (https://medium.com/@ryanmhein/pexa-project-committed-to-incorporating-the-veriblock-proof-of-proof-consensus-protocol-27f073aab4de/.

2018 and November 2019.20 This is in sharp contrastto the activity of Veriblock’s Proof-of-Proof minerson Bitcoin, who were estimated to publish more than77,000 transactions per day in 2019.21

3 Actual Use of OP Return Transactions

3.1 Methodology

To study the current use of OP Return transactionsand the impact of Omni and Veriblock, we analyse alltransactions published on the Bitcoin mainnet betweenSeptember 14, 2018 (the day of the first Veriblocktransaction on Bitcoin), and December 31, 2019. Wedownloaded all blocks mined during this period (blockheights 541,306 to 610,681) via the Smartbit BitcoinBlock API, ignoring orphaned blocks. We classify atransactions as an OP Return transaction if exactly oneof its outputs is of the “nulldata” type, i.e. an outputwhose locking script begins with the OP Return opera-tor. Note that Coinbase transactions can be OP Returntransactions.

20Data obtained from Veriblock’s Block API (https://explore.veriblock.org/api/block/block height). The API documenta-tion can be found at https://wiki.veriblock.org/index.php/Dashboard API.21https://www.forbes.com/sites/ktorpey/2019/01/09/a-new-blockchain–project-is-generating-20-of-daily-bitcoin-transactions.

582

Dominating OP Returns...

To categorize the OP Return transactions, we checkits data for identifiers. An identifier is a charactersequence included in the OP Return data to allowits attribution to a protocol. Most identifiers are pre-fixes to the OP Return data. For example, OP Returndata published in accordance with the Omni proto-col begins with “omni”. The Komodo protocol is anexception: it uses a suffix instead of a prefix. We checkall identifiers from Table 2 in Bartoletti et al. [3] andadd identifiers that we discovered by visual inspectionof a subset of our data. Four of these additional iden-tifiers could not be attributed to a known protocol butare included nonetheless: “DC-L5”, “POR”, “POTX”,and “VX”. One identifier, the “SegWit commitment”,is only used by Bitcoin miners in Coinbase transac-tions as part of the segregated witness consensus layer.In total, we check for 50 identifiers associated with 37services.

Veriblock’s OP Return data does not contain anidentifier, so we use a heuristic to detect Veriblocktransactions: If an OP Return transaction could notbe matched with a known identifier and has exactly80 bytes of OP Return data, we parse the data accord-ing to the format described in Fig. 1b and extract thevalues for version, height and timestamp. The transac-tion is categorized as a Veriblock transaction if eitherof the following sets of conditions applies:

1. version equals 1 (Veriblock testnet), heightbetween 0 and 472,000 (the highest blockmined on the testnet), and timestamp between1,536,883,200 (September 14, 2018; our startdate) and 1,553,472,000 (March 25, 2019; the daythe mainnet was launched);

2. version equals 2 (Veriblock mainnet), heightbetween 0 and 761,487 (the highest block minedduring our data period), and timestamp between1,553,472,000 (see above) and 1,577,836,799(December 31, 2019; our end date).

Since these conditions are not sufficient, there isa possibility of overestimating the number of Veri-block transactions. However, given the specificity ofthe conditions, we expect the number of misclassifiedtransactions to be negligible. An exact categorizationwould require elaborate cross-validation of OP Returndata with the Veriblock blockchain.

All remaining OP Return transactions are catego-rized as “Empty” if the OP Return data comprises0 bytes and as “Unknown” otherwise.

For each Bitcoin block, we obtain its height andtimestamp. We further calculate aggregate metrics forthe following groups of transactions: all transactionsin the block, all OP Return transactions, and each cat-egory of OP Return transactions (i.e. all protocols asdistinguished by identifiers, plus Veriblock, Empty,and Unknown). The aggregate metrics are: numberof transactions, total transaction fee (in satoshi), size(in bytes), and virtual size (in vbytes). Size refers tothe total size of a transaction, not the size of its OPReturn data. In addition, we calculate the transactionfee per virtual size (in satoshi/vbyte) as the most com-mon measure of the value of a transaction to Bitcoinminers.

We additionally obtain the following informationfor every Omni and Veriblock transaction: Blockheight and timestamp, time when the transaction wasfirst seen by the Smartbit Bitcoin server (as a biasedestimate of when the transaction was submitted to theBitcoin network), number of inputs and outputs, inputamount, output amount sent to non-input addresses,fee, size, virtual size, and the OP Return data.

3.2 Data Analysis

Between September 14, 2018, and December 31,2019, 147.6 million transactions were published onthe Bitcoin mainnet, adding 73 GB to blockchain sizeand paying BTC 22,000 in transaction fees—roughlyUSD 150 million (at 7,000 USD/BTC). Our samplecomprises 32.4 million OP Return transactions (22%of all transactions), with a total size of 10 GB (14%)and total transaction fees of BTC 3,300 (15%). Notethat we measure the total size of OP Return transac-tions, not the size of OP Return data, which explainsthe discrepancy with previous studies.

We are able to categorize almost 99% of theOP Return transactions based on an identifier or onour heuristic for Veriblock transactions. Fewer than391,000 transactions are “Unknown”. Table 2 at thevery end of the paper contains the results of ourgeneral analysis of OP Return protocols, including acomparison between our data period and the periodconsidered by Bartoletti et al. [3], which ends inAugust 2017. Our data confirm the dominance of Veri-block (58% of all OP Return transactions) and Omni(40%). Only five protocols (Veriblock, Omni, Factom,Komodo, and Blockstore) averaged more than 1,000transactions per month—compared to nine services

583

E. Strehle, F. Steinmetz

Table2

OP

Ret

urn

prot

ocol

s,id

entif

iers

,tra

nsac

tion

coun

ts,f

ees

inB

TC

,siz

esin

MB

and

tran

sact

ions

per

mon

thfo

rou

rda

tape

riod

(Sep

tem

ber

14,2

018

toD

ecem

ber

31,2

019)

Prot

ocol

Iden

tifie

rsa

Tra

nsac

tions

Fee

(BT

C)

Size

(MB

)Fe

e/vs

ize

(sat

./vby

te)

Tra

ns./

mon

thb

Tra

ns./m

onth

(Bar

tole

ttiet

al.,

2019

)c

Asc

ribe

ASCRIBE

490.

000.

0413

.79

1,50

5(3

)

BitA

lias

BALI

0–

––

0(0

)

BitP

roof

BITPROOF

0–

––

26(0

)

Blo

ckai

/Bin

ded

0x1F00

30.

000.

0018

.78

21(0

)

Blo

cksi

gnBS

50.

000.

0021

.44

40(0

)

Blo

ckst

ore

0x5808

,0x5888

,0x6964

25,8

082.

6710

.33

25.8

46,

444

(1,6

37)

Cha

inX

ChainX:

9,51

20.

773.

3625

.16

–(6

03)

Coi

nSpa

rkSPK

50.

000.

0036

.13

743

(0)

Col

uCC

5,95

10.

822.

9228

.17

9,59

7(3

77)

Cou

nter

part

yCNTRPRTY

0–

––

16,5

63(0

)

Cry

ptoC

opyr

ight

CryptoProof-

,CryptoTests-

0–

––

1(0

)

Ete

rnity

Wal

lEW

355

0.07

0.08

89.1

9–

(23)

Fact

omFA

,Fa

,FACTOM00

,Factom!!

67,2

801.

6316

.40

9.96

2,59

1(4

,267

)

Hel

perb

itHB

10.

000.

0028

.21

1(0

)

Kom

odo

Suff

ix:K

MD

0x00

65,7

1420

.50

103.

8619

.74

–(4

,168

)

LaP

reuv

eLaPreuve

0–

––

2(0

)

Mon

egra

phMG

329

0.03

0.09

36.1

02,

605

(21)

Nic

osia

UNicDC

0–

––

1(0

)

Not

ary

Notary

10.

000.

008.

855

(0)

Om

niomni

12,8

82,9

362,

928.

824,

357.

7067

.92

12,7

71(8

17,1

00)

584

Dominating OP Returns...

Table2

(con

tinue

d)

Prot

ocol

Iden

tifie

rsa

Tra

nsac

tions

Fee

(BT

C)

Size

(MB

)Fe

e/vs

ize

(sat

./vby

te)

Tra

ns./

mon

thb

Tra

ns./m

onth

(Bar

tole

ttiet

al.,

2019

)c

Ope

nAss

ets

OA

2,67

00.

850.

8896

.73

5,19

6(1

69)

Ope

ncha

inOC

50.

000.

0024

.10

125

(0)

Ori

gina

lMy

ORIGMY

0–

––

5(0

)

Phot

ecto

rPEIRMOBILE.COM

,PHOTECTOR.COM

1,94

30.

080.

5321

.16

–(1

23)

po.e

tPOET

0x00000012

10,2

440.

812.

7442

.39

–(6

50)

Proo

fof

Exi

sten

ceDOCPROOF

1,11

00.

120.

2745

.53

136

(70)

Prov

eBit

ProveBit

0–

––

2(0

)

Rem

embr

RMBd

,RMBe

0–

––

1(0

)

RSK

RSKBLOCK:

6,74

90.

001.

980.

00–

(428

)

Smar

tBit

SB.D

0–

––

406

(0)

Stam

pdSTAMPD##

20.

000.

0096

.15

18(0

)

Stam

pery

S1

,S2

,S3

,S4

,S5

,S6

1,56

10.

100.

4235

.95

2,53

6(9

9)

SegW

itcommitment

0xAA21A9ED

57,3

030.

0015

.94

0.00

–(3

,634

)

Ver

iBlo

ckN

oid

entif

ier

18,9

10,4

6627

3.32

5,36

1.78

5.45

–(1

,199

,395

)

Unknownprotocol

DC-L5:

2,25

50.

200.

5735

.56

–(1

43)

Unknownprotocol

POR:

382

0.19

0.10

184.

18–

(24)

Unknownprotocol

POTX:

474

0.24

0.13

184.

58–

(30)

Unknownprotocol

VX

0x00000005

106

0.00

0.03

10.8

1–

(7)

Empty

770.

010.

0326

.05

7,17

1(5

)

Unknown

390,

579

27.2

912

6.57

22.4

815

,593

(24,

772)

Tota

l32

,443

,875

3,25

8.53

10,0

06.7

433

.91

84,1

03(2

,057

,751

)

For

com

pari

son,

the

last

colu

mn

show

str

ansa

ctio

nspe

rm

onth

for

the

data

peri

odpr

ior

toA

ugus

t10,

2017

,as

repo

rted

byB

arto

letti

etal

.[3]

a Cha

ract

ers

pref

ixed

with

0x

are

inhe

xade

cim

al.S

pace

sin

iden

tifie

rssh

ould

beig

nore

d.Fo

rex

ampl

e,th

ehe

xade

cim

alid

entif

ier

ofpo

.eti

s0x504F455400000012

.bD

efin

edas

30*

Tra

nsac

tions

/Num

ber

ofda

ysbe

twee

nSe

ptem

ber

14,2

018

and

Dec

embe

r31

,201

9.c B

ased

onTa

bles

2an

d5

inB

arto

letti

etal

.[3]

.Def

ined

as30

*T

rans

actio

ns/N

umbe

rof

days

betw

een

firs

tite

man

dA

ugus

t10,

2017

585

E. Strehle, F. Steinmetz

in the period considered by Bartoletti et al. [3]. Tenprotocols seem to have ceased operation altogether.Among them is Counterparty, formerly the largestpublisher of OP Return transactions.

Figure 2 reveals how much the ups and downs ofOmni and Veriblock impacted the overall utilization ofBitcoin. The number of Bitcoin transactions increasedsteadily between September 2018 and February 2019,followed by a sharp decline in March 2019 and a jumpto even higher levels in April and May 2019. Our anal-ysis shows that this was almost entirely due to Veri-block, which saw increasing popularity in the monthsafter its launch and went on hiatus in March 2019between the shutdown of its testnet and the launchof its mainnet. Similarly, the increase in Omni trans-actions until mid-2019 and the subsequent decline

are clearly noticeable. Interestingly, Bitcoin activity isrevealed to be very stable if one excludes Veriblockand Omni. It appears that regular demand fluctu-ated only slightly around the mean of approximately245,000 transactions per day.

One key metric for blockchain transactions is thetransaction fee per virtual size. Since the Bitcoin pro-tocol limits block size in terms of virtual size, minersgenerally maximize their income by including thosetransactions in their candidate blocks that carry thehighest fee per virtual byte. The average transaction inour data period paid 37.98 satoshi/vbyte. The averageOP Return transaction paid 33.91 satoshi/vbyte, butfees vary strongly between protocols. The unknownprotocols “POR” and “POTX” paid particularly highaverage fees of more than 184 satoshi/vbyte, while

Fig. 2 Number of transactions on Bitcoin between September 14, 2018, and December 31, 2019. The fourth time series plots allBitcoin transactions except for transactions attributable to Veriblock or Omni/Tether

586

Dominating OP Returns...

Factom paid only 9.96 satoshi/vbyte. How the serviceRSK managed to publish more than 6,700 transactionswithout paying any transaction fees at all remains anopen question.

The most surprising observations regardingtransaction fees concern Veriblock and Omni.Veriblock transactions paid an average fee of5.45 satoshi/vbyte—only about 14% of the over-all average. Consequently, Veriblock transactionsaccount for only 1% of all transaction fees paid dur-ing our data period, despite making up 13% of thetransactions. By contrast, Omni transactions paid anaverage fee of 67.92 satoshi/vbyte, which is almosttwice the average. Figure 3a plots the distribution ofVeriblock’s and Omni’s transaction fees. The fees forOmni transactions are also more dispersed than thefees for Veriblock. Almost all Veriblock transactionspaid less than 20 satoshi/vbyte, while 24% of Omnitransactions paid less than 20 satoshi/vbyte and 21%paid more than 100 satoshi/vbyte.

We are not aware of previous attempts to explainthe unusually low fees paid by Veriblock or the unusu-ally high fees paid by Omni. In the following we con-sider two potential partial explanations: Omni userspay high fees to ensure quick confirmation of theirtransactions; Veriblock users pay low fees becausethey are most active when overall activity on Bitcoinis low.

In principle, we define the confirmation time of atransaction as the number of blocks published betweensubmission to the Bitcoin network and inclusion in ablock. If a transaction is included in the first blockafter submission, the confirmation time is one block; ifit is included in the second block after submission, the

confirmation time is two blocks; etc. However, we donot know the exact submission time of transactions—that information is generally only available to thepublisher of the transaction. Therefore, we replace thetime of submission with a biased proxy, namely thetime when the transaction was first seen by our datasource, the Smartbit Bitcoin server. Figure 3b plotsthe distribution of confirmation times and shows thatOmni transactions are indeed confirmed more quicklythan Veriblock transactions. For Omni, 81% of thetransactions are confirmed in the first block and 92%are confirmed by the third block, compared to 56%and 83% for Veriblock. In this regard at least, thehigher transaction fees paid by Omni users pay off.

Figure 4 shows how transaction frequency andaverage fees vary throughout the week. In general,the Bitcoin network is most active on working daysand during European daytime. High activity typi-cally implies high transaction fees, as more transac-tions compete for confirmation. Veriblock’s publish-ers engage in anti-cyclical behavior. They are mostactive on the weekend and during European night-time, which allows them to publish transactions at lowcost. However, publishers of Omni transactions, too,tend to avoid the times of greatest activity and publishmost transactions during European night-time.

For further insights on who publishes Omni andVeriblock transactions, we parse the OP Return dataof all Omni and Veriblock transactions according tothe formats shown in Fig. 1a and b. As describedin Section 2.3, Veriblock transactions are publishedby Proof-of-Proof miners who compete for miningrewards. We find that the 18.9 million Veriblock trans-actions on Bitcoin mention 905 different Veriblock

Fig. 3 Distribution of transaction fees and confirmation time for Veriblock and Omni transactions

587

E. Strehle, F. Steinmetz

Fig. 4 Number of transactions by weekday and hour (UTC).Veriblock transactions are mostly published on the weekend andduring European night-time, when overall activity on Bitcoin is

low. Omni transactions are mostly published on working daysduring European night-time and early daytime

addresses, so this is the maximum number of miners ormining pools that participated in Proof-of-Proof min-ing. Most of them ceased mining before mid-2019.Veriblock transactions published between July andDecember 2019 mention only 77 Veriblock addresses.

During this time, the 30 most active addresses accountfor 93% of all Veriblock transactions.

Our analysis suggests that the vast majority of Veri-block transactions served no other purpose than thepublication of OP Return data: Approximately 92% of

588

Dominating OP Returns...

the Veriblock transactions are self-transfers that send asingle unspent transaction output to the same address,subtracting only the transaction fee and adding theVeriblock OP Return output.

It is worth noting that the 18.9 million Veriblocktransactions on Bitcoin contain only 5.9 million differ-ent endorsements; on average, a Proof-of-Proof minerpublishes the same endorsement on Bitcoin more thanthree times. This is a consequence of Veriblock’sreward scheme, which pays a higher share to minerswho publish the same endorsement multiple times.

More than 700 tokens22 use the Omni protocol,but 98% of the Omni transactions in our data periodare simple send transactions for Tether (USDT).Most transactions transfer between USDT 100 andUSDT 10,000. Surprisingly, the fees of a transactionare independent of its transfer size. Even transac-tions below USDT 100 carry the unusually high feesobserved for all Omni transactions.

While the share of self-transfers is lower for Omnithan for Veriblock, 17% of the Omni transactions donot send any BTC to a non-input address, i.e. anaddress that is not contained in any of the transactioninputs, and 94% only send 10,000 satoshi (approx-imately USD 0.70) or less. This suggests that mostOmni transactions, too, serve no purpose beyond datapublication.

3.3 Discussion

The comparison with Bartoletti et al. [3] reveals majorshifts in the field of OP Return protocols. Many proto-cols have disappeared since 2017, others have becomemore popular. The fact that Omni and Veriblock makeup 98% of all OP Return transactions in our dataperiod should not conceal the success of other pro-tocols like Factom, Komodo, and Blockstore. Thedominance of Omni and Veriblock in terms of thesheer number of transactions is mostly a result of theirrespective designs: Every Omni transaction requires aBitcoin transaction, and Veriblock pays a reward forevery Proof-of-Proof endorsement that is publishedon Bitcoin. It would be premature to conclude thatOmni and Veriblock are “more successful” than otherOP Return protocols—other protocols are responsi-ble for far fewer Bitcoin transactions but might carryjust as much business value. Komodo, for instance,

22https://omniexplorer.info/properties/production.

makes very similar security promises to Veriblockbut appears to implement them with a much smallernumber of Bitcoin transactions.23 Similarly, a singletransaction published by a notary service might secureassets worth thousands of dollars.

It is safe to conclude, however, that Omni andVeriblock are the only OP Return protocols with asignificant effect on the Bitcoin ecosystem in termsof blockchain size and transaction fees. Tracing theiractivity over time reveals how peaks and troughs inoverall Bitcoin activity were in fact caused by thevarying popularity of these two services. This hasimplications for predictions of future Bitcoin activity:Our results suggest that regular activity is remark-ably stable, fluctuating around approximately 245,000transactions per day throughout 2019. The additionalactivity from Veriblock and Omni as well as other ser-vices that might become popular in the future is harderto predict. In this regard, it might be helpful to separatepredictions into a stable baseline of regular activityand more volatile contributions from fashionable OPReturn services.

Omni transactions alone account for more than13% of the total transaction fees paid during our dataperiod. While miner income is currently still domi-nated by mining rewards, large and reliable sourcesof transaction fees will become increasingly importantfor Bitcoin miners as mining rewards continue to halveevery four years.

Protocols that pay high transaction fees are advan-tageous to miners, but not necessarily to other Bitcoinusers. Both Omni and Veriblock have been accusedof raising transaction fees and increasing confirma-tion times for “real” Bitcoin transactions (as opposedto OP Return transactions). We are unable to issue afinal verdict, but it seems likely that the large numberand high fees of Omni transactions have increased thetransaction fees that regular Bitcoin transactions havehad to pay to ensure swift confirmation. Omni’s OPReturn transactions can thus impact Bitcoin’s intendedfunctionality as a payment infrastructure.

Veriblock is an altogether different matter. Verylow transaction fees, relatively long publication timesand the anticyclical behaviour of its Proof-of-Proofminers suggest that Veriblock transactions are moreaptly regarded as a supplement to the regular use of

23https://github.com/SuperNETorg/komodo/wiki/Delayed-Proof-of-Work-(dPoW)-Whitepaper.

589

E. Strehle, F. Steinmetz

Bitcoin: they fill up the free space in Bitcoin blocksthat is left over by other transactions. More than90% of the Veriblock transactions pay a transactionfee of 10 satoshi/vbyte or less and are thus no seri-ous competition for most other transactions. As longas this remains the case, Veriblock transactions areunlikely to have a significant effect on the level ofBitcoin transaction fees during times of high activ-ity. In the future, it is possible that Veriblock’s miningmechanism becomes unprofitable as overall activityon Bitcoin increases and the publication of transac-tions at minimal cost becomes impossible. Yet wemay also see the value of Veriblock’s cryptocurrencyincrease significantly, which could entice Proof-of-Proof miners to pay much higher transaction fees onBitcoin.

The assumption that most OP Return transactionsare initiated solely for the purpose of data publica-tion is confirmed for Omni and Veriblock. We there-fore suggest that any analysis of the effects of OPReturn protocols on Bitcoin consider the size of theentire transaction, not just the size of the publisheddata. With a joint volume of 10 GB over our dataperiod, transactions associated with the Omni andVeriblock protocols certainly have an impact on Bit-coin’s blockchain size. The question remains to whatextent these OP Return transactions displaced regularBitcoin transactions.

Unlike Proof-of-Work mining, profitable Proof-of-Proof mining does not require any specialized hard-ware. Any user of Veriblock and Bitcoin can competefor mining rewards. Veriblock itself encourages Bit-coin users to “mine on the side” by adding an OPReturn output in the appropriate format to their regulartransactions.24 We find no evidence of this happeningduring our data period; almost all Veriblock trans-actions exist for the sole purpose of earning miningrewards. Veriblock’s Proof-of-Proof mining is con-ducted by a small and shrinking number of dedicatedProof-of-Proof miners.

4 Conclusion and Further Research

Almost six years have passed since Bitcoin Coredevelopers released the OP Return operator as a

24https://www.veriblock.org/#qanda, Question “How does Veri-Block help Bitcoin wallet providers?”

dedicated method of publishing nonpayment data onthe blockchain. Our analysis confirms that OP Returntransactions have become an integral part of the Bit-coin ecosystem. In fact, the comparison with paststudies reveals that the number of OP Return trans-actions increased more than five-fold from November2018 until the end of 2019. Discarding the publicationof nonpayment data on Bitcoin as a “bad idea” doesnot do this reality justice.

We find that 22% of the transactions from our dataperiod are OP Return transactions, and 98% of theseare associated with either Omni or Veriblock. WhileOmni, which has Tether as its most important token,has been around since 2014 and has achieved a sig-nificant market share in relation to other protocols,Veriblock is a novel protocol whose properties incen-tivize its users, so-called Proof-of-Proof miners, toactively publish OP Return transactions on Bitcoin.Accounting for 58% of all OP Return transactions,Veriblock is the dominant service in terms of thenumber of transactions and the associated data load.

Compared to earlier studies, the landscape of pro-tocols has changed drastically. We find that manyprotocols that published considerable numbers of OPReturn transactions in the past, such as Counterparty[2] and Open Assets [11], have ceased to operate.In particular, we note the reduced activity of notaryservices.

Our analysis shows that OP Return transactionshave a considerable impact on Bitcoin’s intendedfunctionality as a payment structure. Most OP Returntransactions are initiated solely for the purpose ofinserting arbitrary data. Their cumulative data load,considering the size of the entire transaction and notjust the arbitrary data, exceeds 10 GB during theperiod we investigate. Yet the impacts of Veriblockand Omni differ. While Veriblock transactions areanticyclical to network activity and thus to high fees inBitcoin, Omni transactions are not. This suggests thatOmni transactions typically compete with regular Bit-coin transactions, while Veriblock transactions typi-cally do not. Omni transactions also have an impact ontransaction fees, while Veriblock transactions ratherfill blocks during times of low network activity. Omnitransactions carry fees of 67.92 satoshi/vbyte, whichis almost twice the average fee. By contrast, Veriblocktransactions only carry fees of 5.45 satoshi/vbyte.

It is unclear why Omni users pay such high transac-tion fees, especially for low-value transfers of Tether.

590

Dominating OP Returns...

The official Omni wallet contains an algorithm thatattempts to compute optimal transaction fees.25 How-ever, given that USDT are often used to buy othercryptocurrencies, it is likely that the majority of Tetherand thus Omni transactions are sent from and toexchanges.26 Users of exchanges might be less knowl-edgeable about appropriate transaction fees on Bit-coin and more focussed on short confirmation times.Exchanges might act accordingly by charging highfees to their users and then sending high-fee transac-tions to the Bitcoin network.

Veriblock’s Proof-of-Proof mechanism is a novelapproach for decentralizing notarization services.After initial popularity, the number of Proof-of-Proofminers has decreased. Between July and December2019, only 77 Veriblock addresses were referencedin Veriblock transactions, with the 30 most activeones accounting for 93% of all Veriblock transac-tions. Consequently, most mining rewards on Veri-block are paid out to very few individuals. It remainsto be seen whether this centralization of funds willnegatively affect the credibility and economics ofVeriblock. Additionally, the anticyclical activity ofProof-of-Proof mining indicates that its level of pro-tection varies inversely with activity on the Bitcoinmainnet. In times of high Bitcoin activity, Veriblock’sincentive mechanism may open windows for specificattacks on the Veriblock blockchain and the cryptocur-rencies which use it. How this interrelates with theprice volatility of VBK and BTC and variations inaverage transaction fees on Bitcoin is a topic for futureresearch.

On the other hand, the anticyclical behaviour cur-rently exhibited by Proof-of-Proof miners on Bitcoinmay catch on. Not all Bitcoin transactions requireswift publication. For example, notarization servicesor exchanges that rebalance their accounts may beflexible enough to postpone transactions by hours oreven days in order to achieve significantly lower trans-action fees, just as Proof-of-Proof miners manage toreduce their transaction fees to only 14% of the aver-age value. It certainly seems worthwhile to furtherexplore the effect of transaction timing on transactionfees.

25https://github.com/OmniLayer/omniwallet/wiki/How-to-adjust-the-miner-fee.26As shown for example by the trading volumes of BTC/USDTcompared to BTC/USD on https://www.bti.live/bitcoin-coin.

As long as Bitcoin is perceived as a secure publicdata store, services will use it to store non-paymentdata. Our analysis reveals that different services affectBitcoin in different ways. Omni users pay unusu-ally high transaction fees, which increases the incomeof Bitcoin miners but increases competition for reg-ular Bitcoin transactions. Veriblock users withdrawfrom competition by paying low transaction fees andpublishing transactions when activity on Bitcoin islow and blocks contain empty space. Metaphoricallyspeaking, Veriblock transactions fill Bitcoin blocks inthe same way that padding fills a parcel. Note how-ever that the “social cost” of increasing the storagerequirements for every Bitcoin full node is just as pro-nounced for Veriblock as it is for Omni. It remainsto be seen how Omni and Veriblock fare as demandfor Bitcoin evolves. Nonetheless, we conclude that OPReturn transactions have become a major factor in theBitcoin ecosystem and are likely to remain so for theforeseeable future.

Funding Open Access funding enabled and organized byProjekt DEAL.

Compliance with Ethical Standards

Conflict of interests The authors declare that they have noconflict of interest.

Open Access This article is licensed under a Creative Com-mons Attribution 4.0 International License, which permitsuse, sharing, adaptation, distribution and reproduction in anymedium or format, as long as you give appropriate credit tothe original author(s) and the source, provide a link to the Cre-ative Commons licence, and indicate if changes were made. Theimages or other third party material in this article are includedin the article’s Creative Commons licence, unless indicated oth-erwise in a credit line to the material. If material is not includedin the article’s Creative Commons licence and your intended useis not permitted by statutory regulation or exceeds the permit-ted use, you will need to obtain permission directly from thecopyright holder. To view a copy of this licence, visit http://creativecommonshorg/licenses/by/4.0/.

References

1. Antonopoulos, A.M.: Mastering Bitcoin – Unlocking Digi-tal Cryptocurrencies, 2nd edn. O’Reilly Media, Sebastopol(2017)

2. Bartoletti, M., Pompianu, L.: An analysis of OP RETURNmetadata. In: Brenner, M., Rohloff, K., Bonneau, J., Miller,

591

E. Strehle, F. Steinmetz

A., Ryan, P.Y.A., Teague, V., Bracciali, A., Sala, M., Pin-tore, F., Jakobsson, M. (eds.) Financial Cryptography andData Security, pp. 218–230. Springer, Cham (2017)

3. Bartoletti, M., Bellomy, B., Pompianu, L.: A journey intobitcoin metadata. J. Grid Comput. https://doi.org/10.1007/s10723-019-09473-3 (2019)

4. Bistarelli, S., Mercanti, I., Santini, F.: An analy-sis of non-standard. Transactions Front Blockchain.https://doi.org/10.3389/fbloc.2019.00007 (2019)

5. Colu Technologies DLT Ltd.: Colu Local Network – Ver-sion 1.0 (whitepaper). Available via https://cln.network/pdf/cln whitepaper.pdf. Cited 27 Feb 2020 (2018)

6. Cremona, K., Tabone, D., De Raffaele, C.: Cybersecu-rity and the blockchain – preventing the insertion of childpornography images. In: O’Conner, L. (ed.) 2019 Inter-national Conference on Cyber-Enabled Distributed Com-puting and KnowLedge Discovery (Cyberc). IEEE, Guilin(2019)

7. de Pedro Crespo, A.S., Garcıa, L.: Blockchain Timestamp-ing Architecture Version 6 (BTAv6) (whitepaper).Available via https://doi.org/10.13140/RG.2.2.17223.80805. Cited 27 Feb 2020 (2017)

8. Delgado-Segura, S., Perez-Sola, C., Navarro-Arribas, G.,Herrera-Joancomartı, J.: Analysis of the bitcoin UTXO set.In: Zohar, A., Eyal, I., Teague, V., Clark, J., Bracciali, A.,Pintore, F., Sala, M. (eds.) Financial Cryptography and DataSecurity – FC 2018, vol. 10958. Springer, Berlin (2019)

9. Faisal, T., Courtois, N., Serguieva, A.: The evolutionof embedding metadata in blockchain transactions. In:2018 International Joint Conference on Neural Networks(IJCNN). IEEE, Rio de Janeiro (2018)

10. Lemieux, V.L.: Blockchain and distributed ledgers astrusted recordkeeping systems – an archival theoretic eval-uation framework. In: Proceedings of the 2017 FutureTechnologies Conference (FTC), pp. 41–48. The Scienceand Information (SAI) Organization, Vancouver (2017)

11. Matzutt, R., Hohlfeld, O., Henze, M., Rawiel, R., Ziegel-dorf, J.H., Wehrle, K.: I don’t want that content – onthe risks of exploiting bitcoin’s blockchain as a contentstore (poster). In: Proceedings of the 2016 ACM SIGSACConference on Computer and Communications Security,pp. 1769–1771. Association for Computing Machinery,New York (2016)

12. Matzutt, R., Hiller, J., Henze, M., Ziegeldorf, J.H.,Mullmann, D., Hohlfeld, O., Wehrle, K.: A quantitativeanalysis of the impact of arbitrary blockchain content on bit-coin. In: Meiklejohn, S., Sako, K. (eds.) Financial Cryptog-raphy and Data Security, pp. 420–438. Springer, Berlin (2018)

13. Nakamoto, S.: Bitcoin – A Peer-to-peer Electronic CashSystem (whitepaper). Available via https://bitcoin.org/bitcoin.pdf. Cited 27 Feb 2020 (2008)

14. Sanchez, M., Fisher, J.: Proof-of-Proof – A Decentral-ized, Trustless, Transparent, and Scalable Means of Inher-iting Proof-of-Work Security – Version 1.0 (whitepa-per). Available via https://www.veriblock.org/wp-content/uploads/2018/03/PoP-White-Paper.pdf. Cited 27 Feb 2020(2018)

15. Snow, P., Deery, B., Lu, J., Johnston, D., Kirby, P.:Factom – Business Processes Secured by ImmutableAudit Trails on the Blockchain (whitepaper). Avail-able via https://github.com/FactomProject/FactomDocs/blob/master/Factom Whitepaper.pdf. Cited 27 Feb 2020(2014)

16. Sward, A., Vecna, I., Stonedahl, F.: Data insertionin bitcoin’s blockchain ledger. https://doi.org/10.5195/ledger.2018.101 (2018)

17. Tether Ltd.: Tether – Fiat Currencies on the BitcoinBlockchain (whitepaper). Available via https://tether.to/wp-content/uploads/2016/06/TetherWhitePaper.pdf. Cited27 Feb 2020 (2016)

18. Willett, J.R., Hidskes, M., Johnston, D., Gross, R., Schnei-der, M., Zathras Dexx., Gilligan, S.: Omni Protocol Speci-fication. Available via https://github.com/OmniLayer/spec.Cited 27 Feb 2020 (2017)

19. VeriBlock, Inc.: Proof-of-Proof and Veriblock BlockchainProtocol Consensus Algorithm and Economic Incentiviza-tion Specifications – Version 1.0 (whitepaper). Availablevia https://www.veriblock.org/wp-content/uploads/2019/06/Proof-of-Proof and VeriBlock Blockchain Protocol Consensus Algorithm and Economi Incentivization v1.0.pdf.Cited 27 Feb 2020 (2019)

Publisher’s Note Springer Nature remains neutral withregard to jurisdictional claims in published maps and institu-tional affiliations.

592