14 ms·

>Yes, but the simplistic version of the argument is that any entity with such a large stake would be inherently incentivized to preserve the value of the curren

>Yes, but the simplistic version of the argument is that any entity with such a large stake would be inherently incentivized to preserve the value of the currency and act in good faith. This logic is, as you say, simplistic. Anyone with such a large stake can cash out, and then use their former large stake to fabricate an alternative chain in which they did not cash out, forking the blockchain at the block just before they cashed out. Commonly proposed defenses against this (checkpointing) are limited because when new nodes enter the network, they are in a naive state where they do not know who to trust. In a proof of work system, the entire blockchain can be validated by a naive node. Fraudulent blockchains could be constructed and fed to naive nodes, but they would be obvious forgeries because they would have to be constructed at lower network difficulties in order to generate blocks faster than the real network and become the longest chain. In a proof of stake system, people who formerly had stake in the system can simulate fraudulent alternative histories forked at the point before they cashed out, and feed those histories to naive nodes. If enough naive nodes accept the alternative history, it becomes the accepted chain. The possibility exists that these former stakeholders might use some of their cashed out money to start up many nodes in the cloud and feed their alternative chains to those nodes. The only real way to defend against this is to have trusted nodes coded into the protocol provide bootstrapping data to naive nodes. Once you do that, your network is no longer trustless. Read more here: http://www.cs.cornell.edu/~iddo/CoAslides.pdf http://www.cs.cornell.edu/~iddo/CoAslides.pdf

rrggrr 9y ago
> Anyone with such a large stake can cash out, and then use their former large stake to fabricate an alternative chain in which they did not cash out, forking the blockchain at the block just before they cashed out. A trade this large is likely to crater the currency before it can be filled in the absence of trade volume so large its practically impossible for one stakeholder to act in the manner you describe.
- inimino 9y ago
  But if the theory allows the attack, even if it seems impractical, there is likely to be a practical attack that is slightly different.
  - enord 9y ago
    This does not follow. Please elaborate. Theory allows a brute force attack on aes-256, no?
    - inimino 9y ago
      Of course. Theory also allows us to exactly model the probability of such an attack succeeding. The difference between a system that is provably secure and a system that is theoretically insecure but with no known practical attack is a pretty big difference. In the former case, your proof has to be wrong before you lose, in the latter, someone just has to think of something you didn't.
  - socrates1024 9y ago
    This is a great explanation for why theory is valuable.
- illumin8 9y ago
  > A trade this large is likely to crater the currency before it can be filled in the absence of trade volume so large its practically impossible for one stakeholder to act in the manner you describe. They don't have to actually sell the currency; they can simply transfer it to another wallet they control, use their huge stake to manipulate the blockchain saying they now have original wallet + new wallet, effectively doubling their currency. Then, they can cash out slowly, over time, without cratering the currency. Basically, this is like a secret money printing (double-spending) machine, although I would like to think that smart people would be able to detect the manipulation in some way or another.
  - znfi 9y ago
    My understanding of cryptocurrencies is rather limited, so maybe I'm wrong, but I dont see how this is possible. If you create a "fork" it will either include the transaction or not, how is it possible for them to somehow double the amount of ether they have?
    - CyberDildonics 9y ago
      They create a fork where they have a large balance on both forks, just in different addresses.
    - aiCeivi9 9y ago
      The steps are same for PoW & PoS: 1. Cashout - for example send coins to an exchange, sell them for other crypto, withdraw everything 2. Flood the network with transaction where your coin was transferred to your other wallet instead of exchange 3. There are two conflicting transactions, you want the network to select the one where coins stay in your hands. For PoW that requires 50%+ of CPU power, for PoS it requires to have significant % of all coins. It is like brute forcing card chargeback - merchant had your money and they are gone and he can't do much about it. It makes exchanges more likely a target of double spending attack than the source. I guess higher deposit/withdraw delays&fees would make PoS attacks unprofitable.
tscs37 9y ago
>In a proof of stake system, people who formerly had stake in the system can simulate fraudulent alternative histories forked at the point before they cashed out No because atleast for Ethereum there will be a "point of no return", a number of blocks after which the blockchain history can no longer be altered except by the user manually switching chains. Additionally, the system will encourage users to swap and share which chain they are on so that fraudulent chains can be detected easily.
- runeks 9y ago
  > No because atleast for Ethereum there will be a "point of no return", a number of blocks after which the blockchain history can no longer be altered except by the user manually switching chains. The problem is this: the large entity (e.g. exchange), who just cashed out, will spend the proceeds on thousands of VMs, all sending its fraudulent chain to new peers connecting to the network. In this case it will be the “good” nodes’ word against a majority of fraudulent “exchange”-nodes. > Additionally, the system will encourage users to swap and share which chain they are on so that fraudulent chains can be detected easily. How is this supposed to work when the fraudulent entity has more funds than the honest nodes, with which it can purchase nodes who vote for its fraudulent history?
  - tscs37 9y ago
    >How is this supposed to work when the fraudulent entity has more funds than the honest nodes, with which it can purchase nodes who vote for its fraudulent history? The answer is also for the previous part, ie, the "spend the proceeds on thousands of VMs. The plan, AFAIK, is that users must pick a chain. The process is entirely in meatspace and subjective. So even if someone purchases a million dishonest nodes which have a wrong history, that doesn't mean shit if not enough people, real meatspace people, agree that it's the correct chain. In case of a hostile takeover, this means starting a new chain is also super easy and can be done in a single day without any additional loss.
    - CyberDildonics 9y ago
      And how do you determine how many meatspace people are voting for something? This problem was confronted by Satoshi and his answer was proof of work.

rrggrr 9y ago

> Anyone with such a large stake can cash out, and then use their former large stake to fabricate an alternative chain in which they did not cash out, forking the blockchain at the block just before they cashed out. A trade this large is likely to crater the currency before it can be filled in the absence of trade volume so large its practically impossible for one stakeholder to act in the manner you describe.

inimino 9y ago
But if the theory allows the attack, even if it seems impractical, there is likely to be a practical attack that is slightly different.
- enord 9y ago
  This does not follow. Please elaborate. Theory allows a brute force attack on aes-256, no?
  - inimino 9y ago
    Of course. Theory also allows us to exactly model the probability of such an attack succeeding. The difference between a system that is provably secure and a system that is theoretically insecure but with no known practical attack is a pretty big difference. In the former case, your proof has to be wrong before you lose, in the latter, someone just has to think of something you didn't.
- socrates1024 9y ago
  This is a great explanation for why theory is valuable.
illumin8 9y ago
> A trade this large is likely to crater the currency before it can be filled in the absence of trade volume so large its practically impossible for one stakeholder to act in the manner you describe. They don't have to actually sell the currency; they can simply transfer it to another wallet they control, use their huge stake to manipulate the blockchain saying they now have original wallet + new wallet, effectively doubling their currency. Then, they can cash out slowly, over time, without cratering the currency. Basically, this is like a secret money printing (double-spending) machine, although I would like to think that smart people would be able to detect the manipulation in some way or another.
- znfi 9y ago
  My understanding of cryptocurrencies is rather limited, so maybe I'm wrong, but I dont see how this is possible. If you create a "fork" it will either include the transaction or not, how is it possible for them to somehow double the amount of ether they have?
  - CyberDildonics 9y ago
    They create a fork where they have a large balance on both forks, just in different addresses.
  - aiCeivi9 9y ago
    The steps are same for PoW & PoS: 1. Cashout - for example send coins to an exchange, sell them for other crypto, withdraw everything 2. Flood the network with transaction where your coin was transferred to your other wallet instead of exchange 3. There are two conflicting transactions, you want the network to select the one where coins stay in your hands. For PoW that requires 50%+ of CPU power, for PoS it requires to have significant % of all coins. It is like brute forcing card chargeback - merchant had your money and they are gone and he can't do much about it. It makes exchanges more likely a target of double spending attack than the source. I guess higher deposit/withdraw delays&fees would make PoS attacks unprofitable.

tscs37 9y ago

>In a proof of stake system, people who formerly had stake in the system can simulate fraudulent alternative histories forked at the point before they cashed out No because atleast for Ethereum there will be a "point of no return", a number of blocks after which the blockchain history can no longer be altered except by the user manually switching chains. Additionally, the system will encourage users to swap and share which chain they are on so that fraudulent chains can be detected easily.

runeks 9y ago
> No because atleast for Ethereum there will be a "point of no return", a number of blocks after which the blockchain history can no longer be altered except by the user manually switching chains. The problem is this: the large entity (e.g. exchange), who just cashed out, will spend the proceeds on thousands of VMs, all sending its fraudulent chain to new peers connecting to the network. In this case it will be the “good” nodes’ word against a majority of fraudulent “exchange”-nodes. > Additionally, the system will encourage users to swap and share which chain they are on so that fraudulent chains can be detected easily. How is this supposed to work when the fraudulent entity has more funds than the honest nodes, with which it can purchase nodes who vote for its fraudulent history?
- tscs37 9y ago
  >How is this supposed to work when the fraudulent entity has more funds than the honest nodes, with which it can purchase nodes who vote for its fraudulent history? The answer is also for the previous part, ie, the "spend the proceeds on thousands of VMs. The plan, AFAIK, is that users must pick a chain. The process is entirely in meatspace and subjective. So even if someone purchases a million dishonest nodes which have a wrong history, that doesn't mean shit if not enough people, real meatspace people, agree that it's the correct chain. In case of a hostile takeover, this means starting a new chain is also super easy and can be done in a single day without any additional loss.
  - CyberDildonics 9y ago
    And how do you determine how many meatspace people are voting for something? This problem was confronted by Satoshi and his answer was proof of work.