4 ms·

There are a lot of unsolved problems with Proof of Stake, despite what it's proponents typically advertise, and many of them are believed by experts to be insur

by Taek 9y ago

There are a lot of unsolved problems with Proof of Stake, despite what it's proponents typically advertise, and many of them are believed by experts to be insurmountable. For example, one problem with proof of stake is that private keys only have value while you still hold onto them. Once you sell your coins, your private keys are no longer worth anything, which means you could potentially even sell these keys to an attacker with no risk to yourself. The attacker of course does have value though, if someone can gather enough private keys together for a specific snapshot in time, they can create an alternate history. Another big issue with proof of stake is that once you have a certain amount of stake, through diligence you are always guaranteed to preserve that amount of stake. And even further, if you are a validator who approves transactions, your permission is required when someone else wants to buy stake. An attacker who is able to gain enough stake to commit an attack for a short period of time can commit that attack forever. With PoW, hashrate requires heavy ongoing electricity expenses. Getting to 51% does not mean that you will stay at 51%, and there's little you can do to stop someone else from buying more chips to push you back below 51%. There are a lot of other fundamental issues with Proof of Stake, and a lot of good reason to believe that it will never be viable in the fully decentralized, fully trustless environment that bitcoin thrives in.

16th_hop 9y ago
The criticism's in this post really make very little sense. What does that mean that "private keys only have value when you hold them." Private keys are worthless, they only give you access to the wallets that they unlock. Also, no, you are not guaranteed to stay at 51% forever. Vitalik has explicitly said that if a 51% attack happens, the community is expected to fork, and all of your funds will be isolated and slashed in the fork. If you want to attack again, you then need to collect another 51% of funds. This gets exponentially more difficult.
- drcode 9y ago
  > What does that mean that "private keys only have value when you hold them." What he's saying is that people would sell their old private keys and an attacker could then use these to create a fake history of stakers- The existence of this attack is a valid criticism against POS, though one that can be easily prevented by just syncing to the network at regular intervals.
drcode 9y ago
> if someone can gather enough private keys together for a specific snapshot in time, they can create an alternate history. This only works for histories older than the account deposits for stakers, which will likely be 4-6 months. In other words, a person using ethereum's POS will need to turn on their computer once every 4-6 months to sync to the network, while stakeholders still have their deposits locked, to make this attack impossible- However, I agree this is less optimal than POW in a theoretic sense but the issue is pretty negligible. (for those interested in learning more about this line of argumentation and who want to understand why regular syncing to the network is needed to counter this attack, look up the term "weak subjectivity" on Google. > An attacker who is able to gain enough stake to commit an attack for a short period of time can commit that attack forever. No, an attacker's addresses will be known and the protocol will slash their funds for most types of attack. In the cases for more difficult attacks that the protocol cannot slash for, the community can fork the network an exclude the attacker's accounts (something not possible in POW where a miner staging an attack can switch addresses at will.) The reverse is actually true: If there was a successful 51% attack against bitcoin, the hashrate would drop precipitously (since the value of the currency and mining profitability would drop) and hence the attacker's 51% would skyrocket to an even higher number immediately. > a lot of good reason to believe that it will never be viable in the fully decentralized, fully trustless environment that bitcoin thrives in. I'm pretty confident Bitcoiners will clamor for a POS algorithm in a few years, once it gets marginalized by POS coins. But you Bitcoiners are definitely welcome to hobble along with the status quo approach if you like :-)
- runeks 9y ago
  > In the cases for attacks that the protocol cannot slash for, the community can fork the network an exclude the attacker's accounts […] Forks are always possible but, they’re not the solution, they’re the problem that a blockchain tries to avoid in the first place, because they lead to the issue: which chain do we follow? If the community were able to organize itself to reach consensus on a given transaction history, we wouldn't need a blockchain in the first place.
  - drcode 9y ago
zaarn 9y ago
>if someone can gather enough private keys together for a specific snapshot in time IIRC from the CASPER blog posts, the solution is simply to not let the validators reverse history beyond a certain point. I think that was about 2000 blocks or so. After that point a client won't accept an alternate history. >An attacker who is able to gain enough stake to commit an attack for a short period of time can commit that attack forever. Not necessarily. Again, CASPER, an attacker who violates some of the consensus rules will loose their entire stake over time (heavy penalties), so behaving is the most profitable option. To misbehave means to burn a lot of cash. Since CASPER is based on betting, an attacker may be able to temporarily censor a transaction but they can't censor another validator who is honest without loosing money in the process (they have to bet against and burn the money) >a lot of good reason to believe that it will never be viable in the fully decentralized, fully trustless environment that bitcoin thrives in. Honestly, it doesn't need to be. It just needs to be decentralized enough, trustless enough while also providing better value than bitcoin.
- runeks 9y ago
  > IIRC from the CASPER blog posts, the solution is simply to not let the validators reverse history beyond a certain point. I think that was about 2000 blocks or so. After that point a client won't accept an alternate history. This doesn’t solve the boostrap problem: how do new clients know which fork to choose? PoS is an algorithm that takes a chain as input, and outputs who gets to build the next block. The problem, however, is deciding which chain to give this function as input in the first place — deciding who gets to mine the next block in a chain is fairly easy, agreeing on which chain to choose in the first place is the hard part. > Not necessarily. Again, CASPER, an attacker who violates some of the consensus rules will loose their entire stake over time (heavy penalties), so behaving is the most profitable option. They will only lose their stake on a fork, that includes the proof of their violation (because stakers have no incentive to include the proof in the chain they control). Which, again, brings us back to the initial issue: how do clients, who want to join the network, decide which fork to follow?
  - zaarn 9y ago
    >This doesn’t solve the boostrap problem: how do new clients know which fork to choose Google "weak subjectivity". In short; they don't. The user supplies initial consensus. It's also fairly okay if the clients come with a baked in blockhash to start from, you only need to update that once every quarter or so to keep it current. If an attacker would poison a chain, for example by censoring it, the network can fairly easily slash his stake (this is allowed as part of the protocol) and start a new chain. You only need to point the client at it. That is, an attacker can only operate while they have both the proof-of-stake consensus and the social consensus. If they loose either, they loose everything.

by Taek 9y ago

16th_hop 9y ago

The criticism's in this post really make very little sense. What does that mean that "private keys only have value when you hold them." Private keys are worthless, they only give you access to the wallets that they unlock. Also, no, you are not guaranteed to stay at 51% forever. Vitalik has explicitly said that if a 51% attack happens, the community is expected to fork, and all of your funds will be isolated and slashed in the fork. If you want to attack again, you then need to collect another 51% of funds. This gets exponentially more difficult.

drcode 9y ago
> What does that mean that "private keys only have value when you hold them." What he's saying is that people would sell their old private keys and an attacker could then use these to create a fake history of stakers- The existence of this attack is a valid criticism against POS, though one that can be easily prevented by just syncing to the network at regular intervals.

drcode 9y ago

> if someone can gather enough private keys together for a specific snapshot in time, they can create an alternate history. This only works for histories older than the account deposits for stakers, which will likely be 4-6 months. In other words, a person using ethereum's POS will need to turn on their computer once every 4-6 months to sync to the network, while stakeholders still have their deposits locked, to make this attack impossible- However, I agree this is less optimal than POW in a theoretic sense but the issue is pretty negligible. (for those interested in learning more about this line of argumentation and who want to understand why regular syncing to the network is needed to counter this attack, look up the term "weak subjectivity" on Google. > An attacker who is able to gain enough stake to commit an attack for a short period of time can commit that attack forever. No, an attacker's addresses will be known and the protocol will slash their funds for most types of attack. In the cases for more difficult attacks that the protocol cannot slash for, the community can fork the network an exclude the attacker's accounts (something not possible in POW where a miner staging an attack can switch addresses at will.) The reverse is actually true: If there was a successful 51% attack against bitcoin, the hashrate would drop precipitously (since the value of the currency and mining profitability would drop) and hence the attacker's 51% would skyrocket to an even higher number immediately. > a lot of good reason to believe that it will never be viable in the fully decentralized, fully trustless environment that bitcoin thrives in. I'm pretty confident Bitcoiners will clamor for a POS algorithm in a few years, once it gets marginalized by POS coins. But you Bitcoiners are definitely welcome to hobble along with the status quo approach if you like :-)

runeks 9y ago
> In the cases for attacks that the protocol cannot slash for, the community can fork the network an exclude the attacker's accounts […] Forks are always possible but, they’re not the solution, they’re the problem that a blockchain tries to avoid in the first place, because they lead to the issue: which chain do we follow? If the community were able to organize itself to reach consensus on a given transaction history, we wouldn't need a blockchain in the first place.
- drcode 9y ago

zaarn 9y ago

>if someone can gather enough private keys together for a specific snapshot in time IIRC from the CASPER blog posts, the solution is simply to not let the validators reverse history beyond a certain point. I think that was about 2000 blocks or so. After that point a client won't accept an alternate history. >An attacker who is able to gain enough stake to commit an attack for a short period of time can commit that attack forever. Not necessarily. Again, CASPER, an attacker who violates some of the consensus rules will loose their entire stake over time (heavy penalties), so behaving is the most profitable option. To misbehave means to burn a lot of cash. Since CASPER is based on betting, an attacker may be able to temporarily censor a transaction but they can't censor another validator who is honest without loosing money in the process (they have to bet against and burn the money) >a lot of good reason to believe that it will never be viable in the fully decentralized, fully trustless environment that bitcoin thrives in. Honestly, it doesn't need to be. It just needs to be decentralized enough, trustless enough while also providing better value than bitcoin.

runeks 9y ago
> IIRC from the CASPER blog posts, the solution is simply to not let the validators reverse history beyond a certain point. I think that was about 2000 blocks or so. After that point a client won't accept an alternate history. This doesn’t solve the boostrap problem: how do new clients know which fork to choose? PoS is an algorithm that takes a chain as input, and outputs who gets to build the next block. The problem, however, is deciding which chain to give this function as input in the first place — deciding who gets to mine the next block in a chain is fairly easy, agreeing on which chain to choose in the first place is the hard part. > Not necessarily. Again, CASPER, an attacker who violates some of the consensus rules will loose their entire stake over time (heavy penalties), so behaving is the most profitable option. They will only lose their stake on a fork, that includes the proof of their violation (because stakers have no incentive to include the proof in the chain they control). Which, again, brings us back to the initial issue: how do clients, who want to join the network, decide which fork to follow?
- zaarn 9y ago
  >This doesn’t solve the boostrap problem: how do new clients know which fork to choose Google "weak subjectivity". In short; they don't. The user supplies initial consensus. It's also fairly okay if the clients come with a baked in blockhash to start from, you only need to update that once every quarter or so to keep it current. If an attacker would poison a chain, for example by censoring it, the network can fairly easily slash his stake (this is allowed as part of the protocol) and start a new chain. You only need to point the client at it. That is, an attacker can only operate while they have both the proof-of-stake consensus and the social consensus. If they loose either, they loose everything.