 The next question comes from Vincent and is about simplified payment verification proofs in sidechains. Vincent asks, I would like to understand better how they work. Who are the verifiers? What is the special output mentioned in slide 21? Are the verifiers the miners? Are SPV proofs only used in the two-way peg model? On page 21, just for reference, the text reads, The technical basis of sidechains is a two-way peg, whereby bitcoin can be transferred between any chain, parent and sidechains, at a deterministic or fixed rate, that's an exchange rate. In addition, SPV proofs play a vital role in sidechains. SPV proofs allow verifiers to check that some amount of work has been committed to the existence of a special output and to determine history by trusting that the longest blockchain is the correct longest blockchain. To answer Vincent's question, what are the SPV proofs and how are they used in this particular scenario? What SPV proof is, effectively, is demonstrating that a transaction output that is unspent was created in a specific block in the Bitcoin blockchain, for example, relating it to the Merkle route of transactions. A block has, within it, a Merkle route for transactions, and that Merkle route has been committed in the block, and is part of the block hash, and therefore is immutable. That Merkle route depends on all of the transactions that are in the Merkle tree. You can prove that a transaction is inside a specific block, with a very simple and short proof, where you relate it to the Merkle route by showing a Merkle path. A Merkle path is a series of hashes that show the other side of the tree, so that you can reconstruct all the way up to the Merkle route. So you say, well, here's the transaction ID. Here's the hash it was hashed with to produce its parent. Here's the hash that parent was hashed with to produce its parent. Here's the hash that parent was hashed with to produce its parent all the way up to the Merkle route. Now, if you have, for example, 1,000 or 2,000 transactions in the tree, you can do that proof with just 10 hashes you can produce a Merkle path to the top. So that gives you a very short proof with just 10, 256-bit hashes that allows you to demonstrate the existence of any one of 2,000 transactions in a specific block. Combined with showing the proof of work and the block header, you can actually demonstrate that that block had an enormous amount of mining behind it when it was recorded and that serves as proof that that block was actually mined on the Bitcoin blockchain. Now, this is not as stronger proof as being able to verify the entire chain all the way up to that particular block and verify the UTXO itself and also verify that that UTXO has not been spent, but it is a simplified payment verification, which is why they call it SPV. So SPV proofs are verified by the miners who are verifying the sidechain and the consensus algorithm can be different. In some cases, the verifiers are federated groups, such as, for example, in the liquid sidechain where the verifiers are a federation who participate in a multi-sig and the SPV proofs are verified by this federation. In other examples, you might have a sidechain that uses proof of work or proof of stake or some other consensus model. So it depends entirely on the consensus model of the sidechain. Remember, when you have a sidechain, its security is only as strong as its consensus mechanism and if it's a sidechain to the Bitcoin blockchain, its security will be different from the proof of work security that is provided in the Bitcoin blockchain. So when you are looking at the security of sidechains, you have to consider the consensus model and level of security that the sidechain offers as well as the level of security that the primary chain offers. Any chain can be a sidechain to any other chain, effectively.