Bitcoin Racers 🏁

Every race costs the depot a little, and when it runs dry nobody races. This builds the top-up here, unsigned, and hands it to Phar Lap to sign — this page never sees a key.

The run is simulated before anything exists, and the car is compiled for that run and no other — the physics, the distance, the finish test and the way it ends are all unrolled into one locking script. Minting it is a commitment: the transaction asserts this car finishes in N ticks, and the covenant refuses it if the arithmetic disagrees.

So a wrong prediction produces no race, never a wrong one. Claiming a spin that did not happen, or a time one tick shorter, both simply fail to validate.

The depot mints at most ten cars per window, and the reset costs nothing: a transaction cannot be mined until median time past passes its nLockTime, and that only moves when a block is found. The script never has to know what a block is.

⚠ It only works because the depot also checks its own nSequence. A transaction whose inputs are all final ignores nLockTime entirely — so without that one line, the whole scheme would be decoration.

1 · A covenant with no key. A Bitcoin script cannot normally see the transaction that is spending it. OP_PUSH_TX is the technique that lets it: the spender pushes the signature preimage as plain data, and the script proves that data is genuine by running OP_CHECKSIG against a public constant rather than anybody's key. A forged preimage fails the check.

⚠ So the one OP_CHECKSIG in these scripts authorises nothing — it is how the transaction is read. ⇒ Once a script can see its own outputs, it can constrain them. That is the whole of a covenant, and no key exists anywhere in a car: nothing to steal, nothing to lose, nobody to ask.

2 · How the depot emits a car. A mint is one transaction with exactly two outputs:

INPUT   the depot's UTXO, holding V satoshis
OUT 0   the CAR — a brand new covenant, funded with exactly its race fee
OUT 1   the depot again — same program, new state, V - car - fee

The depot never sees the car's source and has no idea how long a race is. It checks five things and nothing else:

shape      the car's TAIL is pinned as literal bytes — the pushtx frame, the fee
           rule, and the address the last satoshi comes home to
size       OP_SIZE <= 16,000 bytes
funding    the car may be handed at most DRAW = 2,000 satoshis
value      out1 >= V - (DRAW + MAX_FEE)   <- a FLOOR, never an equality
successor  out1 must be the depot itself — see 3

★ The tail is pinned but the body is free, which is why one depot can mint a five-tick car of 1.7 KB and a fifty-six-tick car of 13 KB without knowing anything about either. It is not recognising a car it has seen before; it is requiring that whatever comes out ends like a racer — paying its fee, and paying it home.

⚠ And the value rule being a floor is what makes a gift possible at all: handing the depot more than it had is always legal, at any balance, from anyone.

3 · The depot rebuilds itself. It reads its own scriptCode back out of the preimage, drops in the new state, and demands that the result is what the transaction actually pays:

hash256( newValue ‖ rebuilt scriptCode ‖ the car ‖ anything else ) == hashOutputs

★★ A spender never supplies the successor's program — it is derived from the depot's own bytes. So handing the tank to a different script is not forbidden, it is unrepresentable: the transaction simply cannot be built in a form that validates.

4 · The car is a race, unrolled. The run is simulated in JavaScript before anything is minted, so every branch is already decided. Each one is compiled as an assertion instead of two arms:

IF prop > 0 THEN th = throttle    ->    VERIFY fuel > 0     (or = 0 on a dry tick)
IF demand > grip THEN spun = 1    ->    VERIFY grip >= demand
IF nv >= BLOW_V THEN out = 1       ->    VERIFY nv < BLOW_V

⇒ A car contains no control flow at all — about 222 bytes per tick of pure arithmetic. A branch says whichever way this goes, handle it; an assertion says this goes this way, and if it does not, the spend is invalid. The covenant enforces exactly as much either way; it refuses instead of branching.

5 · Why a faster car is a cheaper one. The mint fee is linear in the two script lengths — roughly (2·car + 2·depot + 267) / 10 — and the 2× is the interesting part: every script is paid for twice, once as the output itself and again inside the preimage that proves it. A car's length is its tick count, and its tick count is its time.

★ So the fee is the elapsed time, and nobody designed that — it falls out of the mechanism. You pay less to win.