9 ms·

Proof of burn: An alternative method for distributed consensus

139 points by ghgr 9y ago

sillysaurus3 9y ago
Aha. When I was thinking of how to set up a distributed marketplace, I came up with Proof of Burn myself. The idea would be that you want sellers to pay something to participate in the market, but it's not fair for them to pay it to a central authority. So the solution is to burn some coins. I should really put together the rest of the ideas into a whitepaper or something... There's a way to do a distributed marketplace in a fair and reliable way. There are a few people trying to do that currently, but most of them seem hung up on some weird design decisions. Mainly you want to be able to see how many orders a seller has "in flight" at any given time. If 30 orders are placed, and the seller hasn't processed any of them, it's a good sign they're going to welch with the coins. The fact that certain currencies are publicly viewable (BTC for example) allows buyers to have those insights into sellers' activities in a distributed fashion.
- contrarian_ 9y ago
  > The idea would be that you want sellers to pay something to participate in the market What? Why would you want to do that beyond covering expenses for scam prevention?
  - Tepix 9y ago
    Spam prevention.
  - sillysaurus3 9y ago
    Trust level. If you see a seller advertise 1 teddybear for sale, and you know they burned 3 teddybears worth of coins just to offer you that first teddybear, you can be pretty certain they're not going to run off with your money. On the other hand, if a new seller didn't spend anything, they could run off with your coins on the first transaction. This isn't just theoretical; it's the central problem in most darknet markets.
    - lifeisstillgood 9y ago
      And if they are participating just to build a sufficient level of trust before doing a runner, then you are saying there must be a ratio of "trust to stake" - maybe 1:1 at first maybe increasing - it would be interesting to know what market makers in stock exchanges run at - 1:10 or more?
    - wastewaste 9y ago
      absolute non sequitur. I'd just think burning the stuff was mad destructive.
- miguelrochefort 9y ago
  I also came up with the idea of Proof of Burn last week. This would be the ideal one-way upgrade path to a better crypto-currency, without the implications of a coin split (Bitcoin Gold, Bitcoin Cash, Bitcoin Diamond, etc).
brndnmtthws 9y ago
I'm not entirely convinced that cryptocurrencies require fee incentives to stay secure. Most people using a currency aren't interested in the 'value' of a transaction, but rather, they want to perhaps pay a vendor or simply hold a balance. The miners (or stakeholders, in proof of stake) act in order to earn a profit, and may not actually act in the best interests of currency users (including holders and vendors). Miners and stakers are, in a way, just siphoning off profits, and it might be true that actors in the system would still behave honestly without the mining/staking incentives. I wrote a blog post about this: https://medium.com/@brndnmtthws/questioning-assumptions-do-cryptocurrencies-need-fees-827c8f825e34 https://medium.com/@brndnmtthws/questioning-assumptions-do-c...
- Klathmon 9y ago
  Aren't fees just the side effect though? They are an easy way to limit transactions to prevent spam, as well as give the option to pick and choose which transactions get into a limited size block. Without fees, miners have no incentives to include anything into a block in a PoW system (since not including any transactions is faster, which would mean more profit over time), and users have no incentive to not make significant amounts of transactions for no reason on the blockchain.
  - brndnmtthws 9y ago
    That's how they're pitched, yes. But what's actually happen with Bitcoin currently, is that miners have started spamming the mempool with small transactions that never confirm just to bump the TX fees. Furthermore, exchanges like Coinbase haven't implemented TX batching and Segwit, which further compounds the problem. Coinbase is one of the biggest contributor to the 'spam', by forcing fees higher and higher. So in practice, it appears not to be working as theorized.
    - Klathmon 9y ago
      >spamming the mempool with small transactions that never confirm just to bump the TX fees. For starters, i'm not convinced it's "spam" and not just people consolidating dust with low fees that don't really care if it never gets confirmed, but will try for a time when it might anyway. I have done this myself, by carefully crafting a transaction with a ton of dust addresses and setting the fee to be a hair over 1 sat/byte, and it sat in the mempool for a month or 2 (after being rebroadcast several times) before finally getting confirmed a while back. You might call that spam, but for me it was Bitcoin working as intended. My "low importance" transaction waited until the mempool was low to get included. But even then unless the "spammers" are spending a LOT of money on the fees, it won't affect anything, since all you need to do is spend 1 sat/byte more than them and you will get in next block... >Furthermore, exchanges like Coinbase haven't implemented TX batching and Segwit, which further compounds the problem. And fees provide them the ONLY incentive to fix those problems. Without the need for fees, why would anyone in the bitcoin ecosystem ever do batching (a complicated and potentially less secure way of managing transactions), segwit (requires more development resources), and even things like compressed keys (which some exchanges still don't use).
al2o3cr 9y ago
(regarding the true randomness source) I believe there would be no trouble propagating this to all nodes, by out-of-band means if necessary. Similarly, surviving on a deserted island is easy - I believe you'll have no trouble finding a can opener and plenty of canned food. If your solution to a distributed consensus problem starts with "assume all parties cooperate and agree on a continually-updating feed of data", it's not exactly compelling. Also, there's no need to make up words like "remurrage" - economics already has "deflation" for when HODLing currency returns a positive amount.
- alextheparrot 9y ago
  To be fair regarding your last critique, we could also say there’s no need to make up words such as “HODLing” when English already has “holding”. I believe the key idea the author wanted to convey with their new word is that the positive amount is returned explicitly because the quantity of the currency has decreased. This is a particular case of deflation, so it isn’t completely odd to consider introducing a word that succinctly captures that meaning.
- jerf 9y ago
  I think that would be easy to fix, though. Hash every X'th block in some manner, to take effect in 5X blocks or whatever, would probably be good enough. Again, if someone is manipulating literally every bit of an accepted block successfully to successfully hack you via this method, your currency already has a problem. There's enough agreed-upon entropy lying around for this to work.
  - DennisP 9y ago
    A method for really strong randomness is threshold signatures, like DFinity is using. As long as you get M of N submitters you get a random result which none of them can predict or manipulate; it's the same result no matter which M submit. But I think it depends on elliptic curves, so it'd be vulnerable to quantum computers. Another possibility is for participants to submit a hash of a random number, and then submit their preimages in a second round, with a deposit that gets slashed if they fail to submit the second round. A third approach is for participants to submit random numbers, and then to use a lengthy hashing phase to generate the random result, with a trick to more quickly verify the result: https://www.reddit.com/r/ethereum/comments/4mdkku/could_ethereum_do_this_better_tor_project_is/d3v6djb/ https://www.reddit.com/r/ethereum/comments/4mdkku/could_ethe...
Ceezy 9y ago
I m confused why would burn your proof of work coin? Proof of work is slow energy ineficient, does it changes that?
- em3rgent0rdr 9y ago
  > "why would burn your proof of work coin?" You burn your coin to prove that you endured some cost. Why do you have to prove that you endured some cost? So there is a cost to mining. Why does there need to be a cost to mining? To disincentivize dishonest mining. > "Proof of work is slow energy ineficient, does it changes that?" While it doesn't change the proof of work, it does allow that wasted money to be shared by multiple proof-of-burn chains. Remember, it is not the individual coins which are energy inefficient, it is mining which is energy inefficient. There isn't a limit to the number of coins which can be stored in a block, though, so there isn't really a large energy cost of an individual coin.
eximius 9y ago
Does this have any benefits whatsoever over Proof of Stake? (I admit, I couldn't finish reading. The writing style was awful and seemed technically incompetent, though that's probably an unfair assessment from the style.)
wildbunny 9y ago
I did a bunch of analysis on proof of burn, and came to the conclusion that it cannot work in practice because it relies on transactions in order to burn, which themselves are subject to consensus. You can read my detailed analysis here: https://bitcointalk.org/index.php?topic=1182677.0 https://bitcointalk.org/index.php?topic=1182677.0 Cheers, Paul.
- sova 9y ago
  Thanks! Very insightful
- barbegal 9y ago
  And the same applies to proof of stake. You need some form of external randomness to give you security. Of course many people have tried to come up with schemes where randomness can be created fairly by a group of people who don't necessarily trust each other [1]. Unfortunately all these schemes require at least half the participants to be honest so are vulnerable to trivial Sybil attacks. And the only way we know how to prevent Sybil attacks is to use proof of work or some sort of centralised system: leaving us back where we started. I am convinced it can be mathematically proven that Proof of Stake/Burn algorithms don't work (without some sort of external randomness) but I don't have the mathematical skill to produce the proof. [1] https://eprint.iacr.org/2017/216.pdf https://eprint.iacr.org/2017/216.pdf
  - wildbunny 9y ago
    I found that proof of burn actually was exactly equivalent to proof of stake in terms of overall security. I.e. not good enough.
  - timjver 9y ago
    Doesn't the Proof of Stake algorithm protect against Sybil attacks by trusting participants based on how much they are staking?
    - ufo 9y ago
      The issue is in a lower level than that. A proof of stake system will want to randomly choose who gets to mine the next block, weighted by how much everyone is staking. But making this choice depends on everyone agreeing on a source of randomness, which is what the previous posts were talking about.
wyldfire 9y ago
Proof of burn is leveraged by Counterparty [1]. Counterparty is a colored-coin system that uses Bitcoin. You can create tokens in it just like Ethereum. Bitcoin's enormous popularity and ensuing transaction fee growth has made counterparty much less useful IMO. [1] https://en.wikipedia.org/wiki/Counterparty_(technology)#Use-cases https://en.wikipedia.org/wiki/Counterparty_(technology)#Use-...
Proven 9y ago
Counterparty.io is a PoB meta-token on the Bitcoin blockchain
miguelrochefort 9y ago
Such a currency would destroy PoW coins, putting an end to the environment impact of mining.
viach 9y ago
I think proof of burn could work in case of 2 blockchains - first is powered by good old proof of work, second is using proof of stake. Proof of stake validators could burn coins in 1st blockchain and reference these transactions from the 2nd. Actually, there could be > 1 proof of stake blockchain parasitising on a shared proof of work blockchain. Oh ok, seems like a white paper just born...
- lucb1e 9y ago
  But if your good blockchain depends on a bad one (i.e. burning real-world resources), how is it ever going to require burning less real-world resources than only having a bad one? If you propose to just burn less, then any attacker is going to attack the weaker chain.
  - viach 9y ago
    Yes, there is still burning of electricity, in this scheme, but the number of dependent PoS blockchain can be many times > 1. So that we burn real energy once and build many energy efficient blockchains on top of it.
libeclipse 9y ago
> ...that is, sent them to a verifiably unspendable address. How would you accomplish something like this?
- em3rgent0rdr 9y ago
  maybe by sending to an address which couldn't be possibly generated. Such as maybe address 0 (or another address which could be provable to not be able to be generated).
em3rgent0rdr 9y ago
Another green method for distributed consensus: https://en.wikipedia.org/wiki/Proof-of-space https://en.wikipedia.org/wiki/Proof-of-space Basically anything which is cheap to verify but costly to prove could be used. Proof of burn and proof of stake both ultimately destroy resources. But what if the proof is something that can be used by humanity? Like proof of charity? So instead of sending the coins to an unspendable address, you send the coins to an address which is a charity, such as the Pineapple Fund? Of course such a charity would need to have strict controls on it such that it doesn't funnel misuse the money (such as mining for itself), but actually performs charity.
- em3rgent0rdr 9y ago
  Brainstorming about ways to prevent misuse of the coins used for mining. Having the charity be operated by humans might be problematic (cause as we all know humans are corruptible). So might be better to have the charity be operated algorithmically, ideally via a smart contract. And dumber algorithms might be better since complexity provides more opportunities to exploit. Since people seem to like the idea of basic income, what if the charity address was exactly that...a basic income provider, which would evenly send out received coins to every real human who registered their own basic income address?

139 points by ghgr 9y ago

Aha. When I was thinking of how to set up a distributed marketplace, I came up with Proof of Burn myself. The idea would be that you want sellers to pay something to participate in the market, but it's not fair for them to pay it to a central authority. So the solution is to burn some coins. I should really put together the rest of the ideas into a whitepaper or something... There's a way to do a distributed marketplace in a fair and reliable way. There are a few people trying to do that currently, but most of them seem hung up on some weird design decisions. Mainly you want to be able to see how many orders a seller has "in flight" at any given time. If 30 orders are placed, and the seller hasn't processed any of them, it's a good sign they're going to welch with the coins. The fact that certain currencies are publicly viewable (BTC for example) allows buyers to have those insights into sellers' activities in a distributed fashion.

contrarian_ 9y ago
> The idea would be that you want sellers to pay something to participate in the market What? Why would you want to do that beyond covering expenses for scam prevention?
- Tepix 9y ago
  Spam prevention.
- sillysaurus3 9y ago
  Trust level. If you see a seller advertise 1 teddybear for sale, and you know they burned 3 teddybears worth of coins just to offer you that first teddybear, you can be pretty certain they're not going to run off with your money. On the other hand, if a new seller didn't spend anything, they could run off with your coins on the first transaction. This isn't just theoretical; it's the central problem in most darknet markets.
  - lifeisstillgood 9y ago
    And if they are participating just to build a sufficient level of trust before doing a runner, then you are saying there must be a ratio of "trust to stake" - maybe 1:1 at first maybe increasing - it would be interesting to know what market makers in stock exchanges run at - 1:10 or more?
  - wastewaste 9y ago
    absolute non sequitur. I'd just think burning the stuff was mad destructive.
miguelrochefort 9y ago
I also came up with the idea of Proof of Burn last week. This would be the ideal one-way upgrade path to a better crypto-currency, without the implications of a coin split (Bitcoin Gold, Bitcoin Cash, Bitcoin Diamond, etc).

brndnmtthws 9y ago

I'm not entirely convinced that cryptocurrencies require fee incentives to stay secure. Most people using a currency aren't interested in the 'value' of a transaction, but rather, they want to perhaps pay a vendor or simply hold a balance. The miners (or stakeholders, in proof of stake) act in order to earn a profit, and may not actually act in the best interests of currency users (including holders and vendors). Miners and stakers are, in a way, just siphoning off profits, and it might be true that actors in the system would still behave honestly without the mining/staking incentives. I wrote a blog post about this: https://medium.com/@brndnmtthws/questioning-assumptions-do-cryptocurrencies-need-fees-827c8f825e34 https://medium.com/@brndnmtthws/questioning-assumptions-do-c...

Klathmon 9y ago
Aren't fees just the side effect though? They are an easy way to limit transactions to prevent spam, as well as give the option to pick and choose which transactions get into a limited size block. Without fees, miners have no incentives to include anything into a block in a PoW system (since not including any transactions is faster, which would mean more profit over time), and users have no incentive to not make significant amounts of transactions for no reason on the blockchain.
- brndnmtthws 9y ago
  That's how they're pitched, yes. But what's actually happen with Bitcoin currently, is that miners have started spamming the mempool with small transactions that never confirm just to bump the TX fees. Furthermore, exchanges like Coinbase haven't implemented TX batching and Segwit, which further compounds the problem. Coinbase is one of the biggest contributor to the 'spam', by forcing fees higher and higher. So in practice, it appears not to be working as theorized.
  - Klathmon 9y ago
    >spamming the mempool with small transactions that never confirm just to bump the TX fees. For starters, i'm not convinced it's "spam" and not just people consolidating dust with low fees that don't really care if it never gets confirmed, but will try for a time when it might anyway. I have done this myself, by carefully crafting a transaction with a ton of dust addresses and setting the fee to be a hair over 1 sat/byte, and it sat in the mempool for a month or 2 (after being rebroadcast several times) before finally getting confirmed a while back. You might call that spam, but for me it was Bitcoin working as intended. My "low importance" transaction waited until the mempool was low to get included. But even then unless the "spammers" are spending a LOT of money on the fees, it won't affect anything, since all you need to do is spend 1 sat/byte more than them and you will get in next block... >Furthermore, exchanges like Coinbase haven't implemented TX batching and Segwit, which further compounds the problem. And fees provide them the ONLY incentive to fix those problems. Without the need for fees, why would anyone in the bitcoin ecosystem ever do batching (a complicated and potentially less secure way of managing transactions), segwit (requires more development resources), and even things like compressed keys (which some exchanges still don't use).

al2o3cr 9y ago

(regarding the true randomness source) I believe there would be no trouble propagating this to all nodes, by out-of-band means if necessary. Similarly, surviving on a deserted island is easy - I believe you'll have no trouble finding a can opener and plenty of canned food. If your solution to a distributed consensus problem starts with "assume all parties cooperate and agree on a continually-updating feed of data", it's not exactly compelling. Also, there's no need to make up words like "remurrage" - economics already has "deflation" for when HODLing currency returns a positive amount.

alextheparrot 9y ago
To be fair regarding your last critique, we could also say there’s no need to make up words such as “HODLing” when English already has “holding”. I believe the key idea the author wanted to convey with their new word is that the positive amount is returned explicitly because the quantity of the currency has decreased. This is a particular case of deflation, so it isn’t completely odd to consider introducing a word that succinctly captures that meaning.
jerf 9y ago
I think that would be easy to fix, though. Hash every X'th block in some manner, to take effect in 5X blocks or whatever, would probably be good enough. Again, if someone is manipulating literally every bit of an accepted block successfully to successfully hack you via this method, your currency already has a problem. There's enough agreed-upon entropy lying around for this to work.
- DennisP 9y ago
  A method for really strong randomness is threshold signatures, like DFinity is using. As long as you get M of N submitters you get a random result which none of them can predict or manipulate; it's the same result no matter which M submit. But I think it depends on elliptic curves, so it'd be vulnerable to quantum computers. Another possibility is for participants to submit a hash of a random number, and then submit their preimages in a second round, with a deposit that gets slashed if they fail to submit the second round. A third approach is for participants to submit random numbers, and then to use a lengthy hashing phase to generate the random result, with a trick to more quickly verify the result: https://www.reddit.com/r/ethereum/comments/4mdkku/could_ethereum_do_this_better_tor_project_is/d3v6djb/ https://www.reddit.com/r/ethereum/comments/4mdkku/could_ethe...

Ceezy 9y ago

I m confused why would burn your proof of work coin? Proof of work is slow energy ineficient, does it changes that?

em3rgent0rdr 9y ago
> "why would burn your proof of work coin?" You burn your coin to prove that you endured some cost. Why do you have to prove that you endured some cost? So there is a cost to mining. Why does there need to be a cost to mining? To disincentivize dishonest mining. > "Proof of work is slow energy ineficient, does it changes that?" While it doesn't change the proof of work, it does allow that wasted money to be shared by multiple proof-of-burn chains. Remember, it is not the individual coins which are energy inefficient, it is mining which is energy inefficient. There isn't a limit to the number of coins which can be stored in a block, though, so there isn't really a large energy cost of an individual coin.

eximius 9y ago

Does this have any benefits whatsoever over Proof of Stake? (I admit, I couldn't finish reading. The writing style was awful and seemed technically incompetent, though that's probably an unfair assessment from the style.)

wildbunny 9y ago

I did a bunch of analysis on proof of burn, and came to the conclusion that it cannot work in practice because it relies on transactions in order to burn, which themselves are subject to consensus. You can read my detailed analysis here: https://bitcointalk.org/index.php?topic=1182677.0 https://bitcointalk.org/index.php?topic=1182677.0 Cheers, Paul.

sova 9y ago
Thanks! Very insightful
barbegal 9y ago
And the same applies to proof of stake. You need some form of external randomness to give you security. Of course many people have tried to come up with schemes where randomness can be created fairly by a group of people who don't necessarily trust each other [1]. Unfortunately all these schemes require at least half the participants to be honest so are vulnerable to trivial Sybil attacks. And the only way we know how to prevent Sybil attacks is to use proof of work or some sort of centralised system: leaving us back where we started. I am convinced it can be mathematically proven that Proof of Stake/Burn algorithms don't work (without some sort of external randomness) but I don't have the mathematical skill to produce the proof. [1] https://eprint.iacr.org/2017/216.pdf https://eprint.iacr.org/2017/216.pdf
- wildbunny 9y ago
  I found that proof of burn actually was exactly equivalent to proof of stake in terms of overall security. I.e. not good enough.
- timjver 9y ago
  Doesn't the Proof of Stake algorithm protect against Sybil attacks by trusting participants based on how much they are staking?
  - ufo 9y ago
    The issue is in a lower level than that. A proof of stake system will want to randomly choose who gets to mine the next block, weighted by how much everyone is staking. But making this choice depends on everyone agreeing on a source of randomness, which is what the previous posts were talking about.

wyldfire 9y ago

Proof of burn is leveraged by Counterparty [1]. Counterparty is a colored-coin system that uses Bitcoin. You can create tokens in it just like Ethereum. Bitcoin's enormous popularity and ensuing transaction fee growth has made counterparty much less useful IMO. [1] https://en.wikipedia.org/wiki/Counterparty_(technology)#Use-cases https://en.wikipedia.org/wiki/Counterparty_(technology)#Use-...

Proven 9y ago

Counterparty.io is a PoB meta-token on the Bitcoin blockchain

miguelrochefort 9y ago

Such a currency would destroy PoW coins, putting an end to the environment impact of mining.

viach 9y ago

I think proof of burn could work in case of 2 blockchains - first is powered by good old proof of work, second is using proof of stake. Proof of stake validators could burn coins in 1st blockchain and reference these transactions from the 2nd. Actually, there could be > 1 proof of stake blockchain parasitising on a shared proof of work blockchain. Oh ok, seems like a white paper just born...

lucb1e 9y ago
But if your good blockchain depends on a bad one (i.e. burning real-world resources), how is it ever going to require burning less real-world resources than only having a bad one? If you propose to just burn less, then any attacker is going to attack the weaker chain.
- viach 9y ago
  Yes, there is still burning of electricity, in this scheme, but the number of dependent PoS blockchain can be many times > 1. So that we burn real energy once and build many energy efficient blockchains on top of it.

libeclipse 9y ago

> ...that is, sent them to a verifiably unspendable address. How would you accomplish something like this?

em3rgent0rdr 9y ago
maybe by sending to an address which couldn't be possibly generated. Such as maybe address 0 (or another address which could be provable to not be able to be generated).

em3rgent0rdr 9y ago

Another green method for distributed consensus: https://en.wikipedia.org/wiki/Proof-of-space https://en.wikipedia.org/wiki/Proof-of-space Basically anything which is cheap to verify but costly to prove could be used. Proof of burn and proof of stake both ultimately destroy resources. But what if the proof is something that can be used by humanity? Like proof of charity? So instead of sending the coins to an unspendable address, you send the coins to an address which is a charity, such as the Pineapple Fund? Of course such a charity would need to have strict controls on it such that it doesn't funnel misuse the money (such as mining for itself), but actually performs charity.

em3rgent0rdr 9y ago
Brainstorming about ways to prevent misuse of the coins used for mining. Having the charity be operated by humans might be problematic (cause as we all know humans are corruptible). So might be better to have the charity be operated algorithmically, ideally via a smart contract. And dumber algorithms might be better since complexity provides more opportunities to exploit. Since people seem to like the idea of basic income, what if the charity address was exactly that...a basic income provider, which would evenly send out received coins to every real human who registered their own basic income address?