The issue of mining centralization has been a significant one in recent weeks. GHASH.io, the largest mining pool within the Bitcoin network, has for the last month redirected more than 40%<\/a> of the hashpower of the Bitcoin network, and two weeks ago, it briefly surged beyond 50%, theoretically providing it with monopoly oversight over the Bitcoin network. Although miners swiftly departed from the pool and diminished its hashpower to 35%, it is apparent that the dilemma remains unresolved. Concurrently, ASICs pose a further threat to the very production’s decentralization. One potential resolution to this issue is the approach I supported in my earlier article<\/a>: develop a mining algorithm that is ensured to stay CPU-friendly over time. Alternatively, one could entirely eliminate mining and substitute it with a novel model for achieving consensus.<\/p>\n <\/p>\n The main secondary alternative so far has been a method known as “proof of stake,” the rationale behind which is outlined below. In a conventional proof-of-work blockchain, miners “vote” on which transactions occurred when by utilizing their CPU power; the greater the CPU power one possesses, the proportionately more significant their influence becomes. In proof-of-stake, the system operates under a similar but distinct framework: stakeholders cast their votes using their capital (or rather, the internal currency of the specific network). Regarding how this functions technically, the simplest configuration has been referred to as the “simulated mining rig”: essentially, every account has a certain probability per second of generating a valid block, akin to a piece of mining equipment, and this probability is proportionate to the account’s balance. The simplest equation for this is:<\/p>\n <\/p>\n <\/p>\n prevhash<\/span> indicates the hash of the preceding block, address<\/span> refers to the location of the stake-miner, timestamp<\/span> signifies the current Unix time in seconds, balance<\/span> represents the account balance of the stake-miner, and diff<\/span> is a modifiable global difficulty metric. If a specified account fulfills this equation at any given second, it may generate a valid block, entitling that account to a block reward.<\/p>\n <\/p>\n An alternative method is to utilize not the balance, but “coin age” (i.e., the balance multiplied by the duration during which the coins have remained untouched), as the weighting parameter; this ensures more equitable returns but at the risk of enabling potentially simpler collusion attacks, as attackers may have the ability to accumulate coin age, possibly resulting in superlinearity; for these reasons, I generally favor the straightforward balance-based method in most situations, and we will adopt this as our baseline for the remainder of this discussion.<\/p>\n <\/p>\n Various other solutions to “proof of X” have been suggested, including excellence, bandwidth, storage, and identity, but none are particularly practical as consensus<\/em> algorithms; instead, all of these frameworks exhibit many characteristics akin to proof of stake, thus making indirect implementation the most effective means – by rendering them pure mechanisms for currency distribution, and subsequently employing proof of stake on those distributed currencies to achieve actual consensus. The sole exception might be the Ripple system based on social-graph theory, yet many advocates of cryptocurrency view such models as overly reliant on trust to be genuinely considered “decentralized”; this matter can be debated, but focusing on one subject at a time is prudent, and thus we will dwell on stake.<\/p>\n <\/p>\n If executed correctly, in theory, proof of stake presents numerous benefits. Notably, there are three: It is important to note that one significant counterargument has been raised regarding point #2: if a substantial entity credibly commits to acquiring 51% of currency units and subsequently employs those funds to frequently undermine the network, the price will plummet drastically, allowing that entity to purchase the tokens more easily. This does somewhat diminish the advantage of stake, although not critically; an entity that can credibly promise to buy 50% of coins is also likely capable of launching 51% attacks against proof of work. Nevertheless, with the simplistic proof of stake algorithm outlined above, one critical issue arises: as described by some Bitcoin developers, “there is nothing at stake.” This implies the following: in the context of a proof-of-work blockchain, if an accidental fork occurs, or a deliberate transaction reversal (“double-spend”) attempt is made, and two competing forks of the blockchain emerge, miners must decide on which to contribute. Their three options are either:<\/p>\n <\/p>\n “`html<\/p>\n As I noted in a prior entry<\/a>, observe the remarkable resemblance to SchellingCoin\/Truthcoin in this context: you succeed by aligning with the majority, but here, the selection pertains to the sequence of transactions rather than a numerical (as in SchellingCoin) or binary (as in TruthCoin) value. The motivation is to back the chain that most participants endorse, leading to swift alignment and foiling successful assaults, provided that no more than 51% of the network is colluding. In the simplistic proof of stake method, however, the decisions to vote on A or B are autonomous; therefore, the ideal tactic is to mine on any available fork. Consequently, to orchestrate a successful attack, an intruder merely needs to overpower all the selfless players keen on voting exclusively for the proper chain.<\/p>\n <\/p>\n Regrettably, the challenge is somewhat intrinsic. Proof of work is beneficial because the mechanism of hash verification allows the network to acknowledge external factors – notably, computing power, which acts as a stabilizing anchor. In a simplistic proof of stake framework, however, the chains are only cognizant of their own existence; hence, it\u2019s intuitively clear that this weakens their robustness and stability. Nevertheless, this is merely an intuitive assertion; it does not constitute a mathematical proof that a proof-of-stake mechanism can neither be incentive-compatible nor secure, and indeed, there exist several potential approaches to mitigate this challenge.<\/p>\n <\/p>\n The initial approach is the one utilized in the Slasher<\/a> protocol, relying on a fundamental insight: while chains lack awareness of external phenomena during a fork, they do recognize each other. Therefore, the protocol averts double-mining by locking the mining reward of a block for 1000 blocks; if one also mines on an alternate chain, anyone else can submit the block from the rival chain into the original chain to claim the mining reward. However, it should be noted that things are not so straightforward, as there is a major caveat: miners must be identifiable beforehand. The issue arises that if the above algorithm is applied directly, double mining can be easily concealed through probabilistic strategies.<\/p>\n The dilemma is this: imagine possessing 1% ownership, which gives a 1% chance for every block that you will be able to produce (hereafter, “sign”) it. Now, assume there is a split between chain A and chain B, with chain A being the “accurate” chain. The “honest” tactic is to solely create blocks on A, yielding an expected 0.01 A-coins per block. Alternatively, one could opt to create blocks on both A and B, discarding B if a block on both is discovered simultaneously. The earnings per block include one A-coin if fortunate on A (0.99% chance), one B-coin if fortunate on B (0.99% chance), and one A-coin but no B-coins if lucky on both; thus, the anticipated payout is 0.01 A-coins plus 0.0099 B-coins when double-voting. However, if the participants that need to sign a specific block are predetermined (that is, specifically chosen prior to the fork initiation), then one cannot vote on A without also voting on B; you must have the chance on both or none. Thus, the “dishonest” strategy simply merges with the “honest” strategy.<\/p>\n <\/p>\n Yet, if block signers are chosen ahead of time, another complication emerges: if improperly handled, block signers could “mine” their blocks, persistently attempting to generate a block with varied random data until the resulting block allows that same signer to sign another block very soon. For instance, if the signer for block N+1000 was merely selected from the hash of block N, and an adversary possessed a 1% stake, the adversary could repeatedly modify the block until block N+1000 also named the adversary as its signer (i.e., anticipating 100 iterations). Over time, the adversary would gradually acquire signing authority over additional blocks, ultimately filling the blockchain with length-1000 cycles under their control. Even if the hash of 100 combined blocks is employed, manipulation of the value remains possible. Hence, the dilemma becomes: how do we ascertain the signers for forthcoming blocks? The resolution implemented in Slasher involves a secure decentralized random number generation procedure: numerous parties first submit to the blockchain the hashes of their values, followed by the submission of their actual values. This method precludes manipulation, as each submitter is obligated to provide in the second round the value corresponding to the hash they provided in the first round, and in the first round, no party possesses sufficient information for any tampering. Participants still retain the choice of whether to take part in the second round, but two counterbalancing points are (1) this represents merely one unit of freedom, although it amplifies for substantial miners capable of controlling multiple accounts, and (2) a rule can be established whereby failure to participate results in the forfeiture of one’s mining rights (miners in round N select miners for round N+1 during round N-1, thereby offering a chance to enact this if certain round-N miners misbehave throughout this selection phase).<\/p>\n An additional concept, introduced by Iddo Bentov and others in their “Cryptocurrencies Without Proof of Work<\/a>” publication, is the utilization of a “low-influence” function – fundamentally, a function where the probability that a solitary actor can alter the outcome by manipulating the input is exceedingly low. A straightforward instance of an LIF over small sets is majority rule; here, since we aim to elect a random miner, there exists a vast array of options to select from, hence majority rule per bit is implemented (for example, if there are 500 participants and the goal is to select a random miner from a billion, assign them into thirty groups of 17, have each group vote on whether their specific bit is zero or one, and subsequently aggregate the bits as a binary number at the conclusion). This eliminates the necessity for a complex two-step protocol, potentially enabling faster execution and even parallel processing, reducing the likelihood that predetermined stake-miners for a specific block would collaborate and collude.<\/p>\n <\/p>\n A third intriguing strategy, adopted by NXT, is to utilize the addresses of the stake-miners for blocks N and N+1 to determine the miner for block N+2; this inherently results in only one option for the subsequent miner in each block. Introducing a condition that every <\/p>\n Although the Slasher methodology effectively addresses the nothing-at-stake dilemma against conventional 51% assaults, complications emerge in scenarios known as “long-range attacks”: rather than an assailant commencing mining from ten blocks prior to the current block, the attacker initiates their operations from ten thousand blocks earlier. In a proof-of-work environment, such a move seems absurd; it effectively necessitates thousands of times more effort than is required to execute an assault. However, in this context, generating a block is nearly free of computational costs, rendering it a viable tactic. The rationale behind its effectiveness lies in the fact that Slasher’s mechanism for penalizing multi-mining is limited to 1000 blocks, and its method for identifying new miners extends to 3000 blocks. Hence, beyond that “scope,” Slasher operates in the same manner as a basic proof-of-stake coin. It is important to note that Slasher represents a significant enhancement; in fact, assuming users remain unchanged, it can be rendered completely secure by instituting a rule in each client forbidding the acceptance of forks extending back more than 1000 blocks. However, the challenge arises when a new participant enters the scenario. When a new participant first downloads a proof-of-stake coin client, it encounters various versions of the blockchain: the longest and therefore legitimate fork, alongside numerous imposters attempting to mine their own chains from the genesis. As previously mentioned, proof-of-stake chains are entirely self-referential; consequently, the client perceiving these chains possesses no awareness of any contextual factors such as which chain was created first or which carries greater value (note: in a hybrid proof-of-stake combined with social graph system, the user would obtain the initial blockchain data from a reliable source; this method is practical, albeit not entirely decentralized). The sole information available to the client is the distribution within the genesis block, along with all transactions since that point. Therefore, all “pure” proof-of-stake systems ultimately manifest permanent nobilities where the members of the genesis block allocation perpetually retain the ultimate authority. Regardless of developments ten million blocks ahead, the members of the genesis block can always unite and instigate an alternative fork with a different transaction history, ensuring that fork takes precedence.<\/p>\n <\/p>\n If you comprehend this, and still find the concept of pure proof of stake acceptable (the specific reasoning you might find it acceptable is that, if the initial allocation is conducted appropriately, the “nobility” should remain substantial enough that it cannot feasibly collude), then this realization opens avenues for more innovative interpretations of how proof of stake could evolve. The most straightforward proposal is for the members of the genesis block to vote on every block, where double-mining incurs a permanent forfeiture of voting power. Note that this structure thoroughly resolves the nothing-at-stake concerns, since each holder of the genesis block possesses a mining privilege that retains value indefinitely into the future, rendering double-mining consistently unprofitable. Nonetheless, this system is limited in duration – specifically, it has the maximum lifespan (and interest) dictated by the genesis signers, and it also grants the nobility a perpetual profit-making privilege, not merely voting power. Yet, the existence of this algorithm is promising as it implies that long-range nothing-at-stake issues may potentially be fundamentally solvable. Thus, the task remains to devise a method to ensure that voting privileges can transfer, all while upholding security.<\/p>\n <\/p>\n An alternative method for addressing the nothing-at-stake conundrum approaches the issue from a distinctly different perspective. The primary challenge lies in naive proof-of-stake, wherein rational agents will engage in double-voting. The solutions akin to Slasher attempt to resolve the issue by making double-voting unfeasible, or at the very least severely penalizing such behavior. But what if a different strategy exists; specifically, what if we eliminate the motivation to double-vote? In all the proof-of-stake systems outlined previously, the incentive is clear, yet unfortunately, also fundamental: the individual producing blocks requires motivation to engage in the process, thus they benefit from including a block in as many forks as they can. The resolution to this dilemma stems from a creative, unconventional proposal by Daniel Larimer: transactions as proof of stake<\/a>. The fundamental concept behind transactions as proof-of-stake is straightforward: rather than mining being executed by a distinct class of individuals, whether hardware owners or stakeholders, mining and transaction submissions are fused into one process. The rudimentary TaPoS algorithm is as follows:<\/p>\n <\/p>\n This algorithm features a property of extreme scalability challenges, collapsing after approximately 1 transaction every 2-5 seconds, and it is not the proposal Larimer endorses or the one intended for practical use; instead, it serves solely as a theoretical validation that we will investigate to determine if this method holds any validity. If it does, there are likely opportunities for optimization. Let\u2019s examine the economic implications of this model. Assume a fork exists, with two competing iterations of the TaPoS chain. You, as a transaction initiator, executed a transaction on chain A, and there is now a forthcoming chain B. Do you possess the motivation to double-mine and insert your transaction into chain B as well? The answer is negative – in fact, you would prefer to double-spend your recipient, thus you would refrain from placing the transaction on an alternative chain. This rationale is particularly compelling in the context of long-range attacks, where you have already received your product in exchange for funds; in the short-term, of course, the motivation remains to ensure the transaction is executed, thereby giving senders an incentive to double-mine; nevertheless, since this concern is confined to a specific timeframe, it can be mitigated through a Slasher-like approach.<\/p>\n <\/p>\n One question that arises is this: considering the existence of forks, how simple is it to overwhelm the system? For instance, if a fork is present, under what circumstances would a particular entity be able to double-spend? In the transaction-fee version, the requirement is straightforward: you must incur more transaction fees than the rest of the network. This may appear weak, but in practice, it isn’t; we understand that in the situation of Bitcoin, once the currency supply ceases to expand, mining will depend exclusively on transaction fees, and the operational mechanics remain exactly the same (sincethe sum that the network will utilize for mining will approximately relate to the overall quantity of transaction fees being transmitted in); therefore, fee-based TaPoS is, in this aspect, at least as reliable as fee-exclusive PoW mining. In the alternative situation, we encounter a distinct model: rather than mining with your coins, you are mining with your liquidity. Anyone can launch a 51% attack on the system only if they possess a sufficiently substantial amount of coin-days-destroyed at their disposal. Consequently, the expense of incurring a hefty transaction fee post-factum is substituted by the expense of forfeiting liquidity in advance.<\/p>\n <\/p>\n The conversation surrounding liquidity introduces another crucial philosophical notion: security cannot exist without cost. In any setup where there is a block reward, the prerequisite for the reward (be it CPU, stake, or anything else) cannot be complimentary, as otherwise everyone would be claiming the reward indefinitely, and in TaPoS, transaction senders must supply some sort of fee to validate security. Additionally, whatever resource is utilized to underpin security, whether CPU, currency forfeitures, or liquidity forfeitures, the attacker merely needs to acquire an equivalent amount of that resource as the remainder of the network. It\u2019s important to note, in terms of liquidity forfeitures (which is the essence of naive proof of stake), the relevant amount here is not 50% of coins, but rather the advantage of accessing 50% of coins for a limited time – a service that, assuming a perfectly efficient market, might cost merely a few hundred thousand dollars. The resolution to this enigma is that marginal cost is different from average cost. In the context of proof of work, this holds true only to a highly restricted degree; although miners do obtain a positive nonzero profit from mining, they all incur substantial expenses (unless they are CPU miners utilizing their home heating, but even there significant inefficiency occurs; laptops executing hash functions at full capacity, while effective for heating, are inherently less efficient than systems fashioned for that purpose). In the scenario of currency sacrifices, everyone pays the same, yet the payment is redistributed as dividends to other stakeholders, and this profit becomes too dispersed to be retrieved via market mechanisms; thus, while the system may be costly from a local viewpoint, it is virtually costless from a global perspective.<\/p>\n <\/p>\n The final option, liquidity sacrifice, occupies a space between the two. Although liquidity sacrifice incurs a cost, there is significant variation in how individuals value liquidity. Some individuals, such as personal users or businesses with minimal savings, place a high value on liquidity; others, such as savers, do not consider liquidity important at all (for example, I could not be less concerned if I lost the ability to spend ten of my bitcoins for a certain period). Therefore, while the marginal cost of liquidity may be elevated (specifically, equal to either the mining reward or the transaction fee), the average cost is considerably lower. This creates a leverage effect that makes the cost of an attack substantially higher than the inefficiency of the network, or the amount that senders expend on transaction fees. Additionally, it is noteworthy that in Larimer’s scheme specifically, arrangements are made so that all<\/em> liquidity sacrificed in consensus is liquidity that was already going to be sacrificed (i.e., by not sending coins earlier), so the practical inefficiency level is zero.<\/p>\n <\/p>\n Now, TaPoS does indeed encounter its challenges. Firstly, if we attempt to enhance its scalability by reintroducing the concept of blocks, there needs to be some justification for creating blocks that isn\u2019t profit-driven, to avoid reintroducing the nothing-at-stake issue. One approach may be to compel a specific category of large transaction senders to generate blocks. Secondly, attacking a chain remains theoretically \u201ccost-free,\u201d causing the security assurances to be somewhat less appealing than in proof-of-work. Thirdly, within the context of a more intricate blockchain like Ethereum, and not merely a currency, certain transactions (i.e., concluding a bet) are genuinely advantageous to send, leading to an incentive for double-mining on at least some transactions (though not nearly all, preserving some level of security). Lastly, it is a genesis-block-nobility system, akin to all proof-of-stake systems. Nevertheless, in terms of pure proof-of-stake systems, it appears significantly more advantageous than the variant of proof of stake that imitates Bitcoin mining.<\/p>\n <\/p>\nSHA256<\/span>(<\/span>prevhash + address + timestamp<\/span>)<\/span> <\/span> <\/span>2<\/span>^256 * balance \/ <\/span>diff<\/span>\n<\/span><\/code><\/pre>\n<\/div>\nStrengths and Weaknesses<\/h3>\n
\n<\/p>\n\n
\n<\/p>\n\n
\n<\/p>\n
\n<\/p>\nThe Block Signer Selection Dilemma<\/h3>\n
\n![\"\"](\"https:\/\/blog.ethereum.org\/images\/posts\/2014\/07\/tworound.png\")
\n<\/p>\n![\"\"](\"https:\/\/blog.ethereum.org\/images\/posts\/2014\/07\/stake_low_influence.png\")
\n<\/p>\n
\n“`miner must be secured for 1440 blocks to engage, which inhibits the dispatching of transactions as a means to avert double-mining. Nevertheless, the swift choice of stake-miners also undermines the property of resistance to the nothing-at-stake issue due to the probabilistic nature of double-mining; this clarifies why ingenious strategies aimed at rapidly determining miners inevitably become, beyond a certain threshold, counterproductive.<\/p>\nLong-Range Attacks<\/h3>\n
\n<\/p>\nChanging Incentives<\/h3>\n
\n<\/p>\n\n
\n<\/p>\nCost of Liquidity<\/h3>\n
\n![\"\"](\"https:\/\/blog.ethereum.org\/images\/posts\/2014\/07\/liquidity.png\")
\n<\/p>\nHybrid Proof of Stake<\/h3>\n