11 ms·

> The granddaddy of all consensus mechanisms—behind Bitcoin, Litecoin, Monero, and (for the time being at least) Ethereum—is called proof of work. Essentially,

by aazaa 5y ago

> The granddaddy of all consensus mechanisms—behind Bitcoin, Litecoin, Monero, and (for the time being at least) Ethereum—is called proof of work. Essentially, PoW makes adding transactions to the blockchain computationally—and therefore financially—very expensive, so as to discourage fraudulent activity. ... This passage reflects a deep-seated, widespread misunderstanding of how/why Bitcoin works. I suspect the author knows, but the brevity of the article prevents actually explaining the issue. This is a recurring problem in this space and has opened up a large fraud opportunity as every bottle of snake oil looks the same to those who don't do the deep technical dive. Proof-of-work has nothing to do with ensuring the validity of transactions. Transactions contain all of the information needed to detect invalid transactions. Hashes, signatures, scripts, and amounts can all be checked and will be rejected if invalid. The validity of every transaction can be tested without proof-of-work. Systems like this had been developed prior to Bitcoin. So it's possible to eliminate every kind of fraud through cryptography alone, except one. The problem proof-of-work solves is double spending, a term you won't find in the article. A malicious actor can try to spend the same coin twice (or more). Both versions of the double spend transaction are valid, but a node can only accept one. Which one does it accept? It accepts the one on the block with the most cumulative proof-of-work ("strongest chain"). In the event of a tie, the node accepts the first version it saw. The strongest proof-of-work chain can therefore change from one moment to the next as blocks are received. Proof-of-work imposes a non-recoverable cost to publishing a block of transactions. That cost and its finality discourage double spending by making the publication of double spending transactions permanently expensive. An attacker needs to out-spend the entire rest of the network to succeed, and loses everything spent if the attack fails. The cost of a failed attack can never be recovered. So any scheme to replace proof-of-work needs to maintain that element of irrecoverable loss of value for a failed double spending attack. It hasn't been an easy nut to crack. A lot of projects claimed to have done it only to discover some flaw in the game mechanics or technology.

dboreham 5y ago
Another way to describe this is that PoW is a Cybil resistance measure.
- acjohnson55 5y ago
  Although just saying that doesn't really tell anyone much, who doesn't already know. A Sybil attack is the creation of a bunch of identities to subvert a system that is attempting to distribute power amongst a bunch of participants. The Sybil resistance of these schemes comes from allocating power in proportion to some form of commitment of a scarce resource, which could be indigenous to the system (e.g. proof of stake, proof of burn) or exogenous (e.g. proof of work, proof of storage). I think it's noteworthy that all of these systems are plutocratic. They will all effectively redistribute wealth upward, because anything that doesn't would encourage the creation of more identities.
  - dolmen 5y ago
    https://en.wikipedia.org/wiki/Sybil_attack https://en.wikipedia.org/wiki/Sybil_attack
  - ItsMonkk 5y ago
    Exactly. The current techniques to Sybil resistance directly leads to plutocracy because of economies of scale. I think the solution is fees based on transaction expediency. If I want a transaction to go through for the minimum possible fee I could schedule it for a year in advance. In one years time, the money would be available. If I wanted it sooner, say instantly, that transaction would cost say, 1x. So if it was a $100 transaction, the fee would be $100. Maybe 1 day is 0.1x, 1 week is 0.01x and 1 month is .001x. If you want the best odds of double spending and choose to pick instantly, the fee is equivalent to the transaction, so you don't actually end up gaining anything. Smart merchants will start essentially doing futures. I am going to need corn in one year, I setup the deal today, when it goes onto the chain I transact my corn. Better still, we can use these fees to add to the supply. The only reason that a transaction would go through with a fee is if the profit of the transaction from both sides was above 0, so we can directly track a portion of the surplus of our currency. We can calculate how much security we need based on the available currency at a certain time, and mostly the miners only earn enough of the fees such that we can ensure that we won't be harmed by a malicious attacker who does not care that they aren't getting anything. So the difficulty is based not on mining power, but on exploitability. So what do we do with the rest of the fees including the new coins generated through those fees? We give them to people who have actively locked up coins as we want to encourage people locking up their coins, as the more they have locked up, the less risk there is that a double spend can occur. So that means if you know that you will not transact your coins for one year, you will transact with yourself and lock in, and essentially you get yourself a CD. This is all super preliminary, and I am looking for problems with this setup, but it seems to work.
hypertele-Xii 5y ago
I don't get it. Suppose a bad actor tries to double spend. They have to cryptographically sign both transactions, so the whole network will eventually receive knowledge of both transactions. Why can't the network simply wait for some duration of time before accepting a transaction, to verify that no double-spends propagate from elsewhere? If double spending is ever detected from a party, that party is dis-trusted by the network. The network will de-prioritize processing transactions from dis-trusted parties. Problem solved?
- fogof 5y ago
  Well let's say we do things this way, and I double spend a transaction, sending one to Alice and one to Bob. Suppose Alice waits t seconds after receiving the transaction, and if she doesn't see any double spends in that time, she accepts that the coin is hers and she then sends me something in return. One second before Alice "confirms" my transaction, I can send out my transaction to Bob. Since my message takes time to propagate through the network, it won't reach Alice soon enough and she will think I've paid her, and she'll send me whatever I was paying for. But other people will see both these transactions within t seconds of each other. They won't know which they should believe is correct, and they might not accept payment from Alice in the future.
  - DennisP 5y ago
    The same thing happens in PoW networks. You have to wait several blocks to gain confidence that a transaction won't be reverted. In Ethereum's PoS, by waiting a similar amount of time you actually get finality; at that point your transaction cannot be reverted without a third of total stake being destroyed.
    - sparkie 5y ago
      Unless Vitalik proposes a rollback.
      - DennisP 5y ago
fogof 5y ago
To include the whole passage you are talking about: > The granddaddy of all consensus mechanisms—behind Bitcoin, Litecoin, Monero, and (for the time being at least) Ethereum—is called proof of work. Essentially, PoW makes adding transactions to the blockchain computationally—and therefore financially—very expensive, so as to discourage fraudulent activity. At the same time, users who go to the trouble of creating valid blocks, known as mining, are rewarded with cryptocurrency. I would say this passage gets the facts totally correct. The author doesn't say that Proof-of-work has to do with the validity of transactions, they say it has to do with the validity of blocks. Indeed, it can't be easy to make valid blocks or double spending would become a problem as you say. Not sure why you think this reflects the misunderstanding of the inherent costs of consensus systems.
bouncycastle 5y ago
PoW is not the only way to solve double spending (and make sure that the blocks are ordered in a particular timeline), in PoS it is solved by randomly choosing which validator will create the next block according to an algorithm that all the nodes follow. So there's no race to find the next block, the block producer is known in advance. What's more, in PoS, you have guaranteed finality, meaning that after a certain amount of blocks, you can be sure that the order will not change. This is superior to the probabilistic finality offered by PoW. > loses everything spent if the attack fails They don't lose everything, they still get to keep the mining hardware and can retry the attack again. They can also use a "selfish mining" strategy and earn block rewards that subsidize their attack (by earning more than their fair share). In PoS on the other hand, the attacker loses everything after an attack and cannot try again. This is because attackers get slashed (their stacked coins are destroyed). If they want to try again, they need to acquire more coins.
- kerkeslager 5y ago
  There are a bunch of ways in which you're not exactly correct here. First, you're describing a very particular implementation of PoS. Not all PoS implementations include slashing. This isn't a mere technicality: the most popular implementation of PoS (as measured by market cap) is Cardano's and it doesn't include slashing. And not all PoS implementations involve randomly choosing a validator. The bigger problem here is that proof of stake is actually a misnomer because doesn't actually provide proof, period--it's a consensus algorithm, not a proof algorithm. That's fine if you're actively connected to a bunch of nodes, because you can resolve double spends by polling the network to find out the consensus. But if you're only connected to two nodes and those two nodes are showing you two different spends of the same balance, you have no way to resolve that conflict. In PoW (a real proof algorithm) you simply look at the longer chain. In PoS, there's no way to actually enforce the longer chain, because there's no cost to producing a longer chain. This is a problem which occurs in practice when nodes newly connect to a network or reconnect after a long absence. Slashing does nothing to address this issue. If I'm running a PoS validator node, I can stake coins, unstake them, and then spend the coins. Now I've got a free license to mine blocks without risk of slashing. I can mine blocks by simply validating blocks that say that I never unstaked. And I'm at no risk of slashing because I've already spent the coins: there's no balance to slash. You alluded to an attempted solution with "it is solved by randomly choosing which validator will create the next block according to an algorithm that all the nodes follow" but that doesn't work: a provable random function can choose a validator which creates artificial scarcity, but there has to be a fallback in case validators drop offline, otherwise a downed node would grind the entire chain to a halt as soon as it was chosen as a validator and doesn't validate a block when it's supposed to. The malicious validator can use this because there's no temporality stored on-chain: you just find a situation where your staking address is the fallback node and claim that the validators who were chosen by the random function validated late, and nobody can prove you wrong. This may sound suspicious, but in fact these fallbacks happen in practice. To create a believable chain after this, you have to create a situation where a lot of validators drop off and are replaced by nodes you control. This also looks suspicious, but again this also happens in practice: for example if AWS S3 US East VA goes down, there will be a huge number of validators that drop offline. Probably the most thorough explanation of this type of attack and the theory behind it can be found in On Stake and Consensus[1]. There's some debate on the importance of this attack--Vitalik Buterin calls this "weak subjectivity" and has written about it in length[2]. But to say he's not concerned about it would be inaccurate; he says, "actually implementing a proof of stake algorithm that is effective is proving to be surprisingly complex"[3]. That sentence was written in 2014 and Ethereum still does not rely on proof of stake in 2021--be assured that if in seven years Vitalik Buterin has not satisfactorily solved the problem, it's not trivial. I would caution anyone extolling the virtues of Proof of Stake from overstating their case--PoS is not a panacea and presents many challenges of its own. [1] https://download.wpsoftware.net/bitcoin/pos.pdf https://download.wpsoftware.net/bitcoin/pos.pdf [2] https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/ https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov... [3] https://blog.ethereum.org/2014/10/03/slasher-ghost-developments-proof-stake/ https://blog.ethereum.org/2014/10/03/slasher-ghost-developme...
xwolfi 5y ago
What I fail to understand, and thanks to your explanation, is why not use a central trusted ledger which would synchronize all transactions. It could surely work at the current speed of bitcoin and relieve the entire planet of the energy cost of bitcoin, providing the same safety that no double spend could happen. All you'd need is a small private army, a few lawyers, an historically accepted jurisdiction, and you'd be ready to go with your central ledger. I don't think you're right to say double spending is the only thing being solved with proof of work, I think people are trying very very very hard not to centralize (for no good reason in my opinion), despite the prohibitive cost, and why ? Because of that insane fear the ledgers would be changed: hence you'd have to admit the author was a bit right that eventually this whole story is to protect paranoid people against a very absurd risk at the cost of asking government to subsidize reopening coal mines...
- rep_movsd 5y ago
  This is called the state backed banking system. Eventually they will make all your money digital. They will track everything you buy. Then at the very least they will sell your information to advertisers, and at worst retain totalitarian control over all your purchasing power. Its already happening in China - the state has the power to prevent people from travelling etc. based on their "social credit" The US is making a CBDC (central bank digital currency). No matter how pure the intentions of creating a government backed digital currency are, it will degenerate into a means of control
  - Scarblac 5y ago
    > Eventually they will make all your money digital. They will track everything you buy. Which is why Bitcoin starts out doing exactly that by default?
- dolmen 5y ago
  You mean like... paying using a card number (VISA, Mastercard, Amex) on the Internet?
- Geee 5y ago
  If the central trusted ledger starts censoring transactions, blocking users or producing invalid blocks with additional rewards to themselves, then what? Just keep going with it and accept the new reality? Then we would be back at what we have now - the current central bank monetary system. Trustless decentralized architecture makes the Bitcoin network incredibly robust against attacks on its principles. It can't be changed (without users/capital switching over to new version), stopped or censored by anyone.
danbruc 5y ago
Yes and no. Yes, proof of works prevents double spending or more generally establishes consensus on which transaction become accepted. But no, this could be achieved with many different consensus protocol and does in general not require any irrecoverable loss. Just issue a key pair to each human and make them send signed votes to establish consensus by simple majority. The true reason something like proof of work is required is because the system is also anonymous and distributed where being anonymous is the more critical aspect. Because of that you can not know who is out there and can cast a vote. Are this votes from a million legitimate users or did one user just send a million votes? The solution to prevent users from casting arbitrary many votes is then to make it hard for them to cast a vote, you make them for example waste a lot of clock cycles for each vote. But, as I said, not because this is inherently a requirement but because you want to establish consensus among members of an anonymous group of unknown size and them wasting a certain number of clock cycles is a rough proxy for everyone gets one vote assuming that everyone has very roughly access to the same amount of computing power.
- ywei3410 5y ago
  For context, this is usually known as a 'Sybil attack'. [1] https://en.wikipedia.org/wiki/Sybil_attack https://en.wikipedia.org/wiki/Sybil_attack
  - micropresident 5y ago
    This is a common mistake w/r/t Proof of Work. It doesn't prevent Sybil attacks. The Bitcoin whitepaper performs slight of hand to say "instead of identities, we'll use CPUs" which are obviously what Sybil attacks are in the first place. One person can own lots of CPUs... (Thus mining operations.) What it does do is make Sybilers larger and larger shareholders in the network to make it so that the more you Sybil the network the less you'd want to try to damage it.
- ajkdhcb2 5y ago
  If you have a central entity that can generate key pairs then they may as well be running a database. It doesnt achieve decentralisation at all. It has nothing to do with anonymity: anything based on identity is broken because it has an entity that can fake those identities -- you can't verify ID with code
admax88q 5y ago
I would consider a double spend transaction to be invalid.
- teawrecks 5y ago
  I agree. It seems to me that pow is specifically designed to make adding new transactions to the blockchains take a certain amount of time. If anyone could add to the blockchain instantaneously, imagine the same account being used to spend money on both sides of the earth at the same "time". Afaik general relativity says it would be virtually impossible to tell which one happened "first" in a decentralized way. So by slowing everything down, we force there to be a window for transactions to propagate.
- sparkie 5y ago
  Which one was the first spend and which one was the double-spend? You are talking about a distributed network where there is no universal time by which this can be measured. The blockchain is the solution to this problem. It provides an ordering which is to be universally agreed upon, because the only way to disagree with the ordering is to use >51% of the amount of electricity securing the network to state your disagreement. A spend is invalid if the consensus in the network is that the TXO being used as an input for a transaction has already been spent in a transaction which has been mined into a valid block. Until that happens, any valid transaction which spends a TXO may be the correct one.
  - noxer 5y ago
    > Which one was the first spend and which one was the double-spend? The answer to that question is actually that it doesn't matter. Seems weird at first but if you think about it, no one who uses the system cares which one is "the first" the only thing people care about is that once one is picked it will not change later on aka finality. And for that a majority must agree on one. Which one again doesn't matter at all. FBA (Federated Byzantine Agreement) "blockchains" make use of that. Each node signals which Tx it saw first but if no super-majority can be reached it simply switches to the Tx that has more votes. The sole purpose is to agree on one which makes the second Tx unfunded and thus fail. Bitcoin and bitcoin-like system cant do this. They always have some kind of lottery that decides who writes the Tx. There is no agreement and thus no finality and that's the whole reason why double-spends can happen.
brighton36 5y ago
Proof of work also enables users to buy Bitcoin from their power company. Which, is a necessary feature for many applications.
KallDrexx 5y ago
> The problem proof-of-work solves is double spending, That doesn't seem to be my understanding. In my mind the problem proof of work solves is how quickly new blocks can be generated, thus limiting the supply of new blocks and giving an incentive to move the head pointer to an agreed upon next value (by granting coins to the miner who was able to compute the value). Double spend is solved due to the single branch tree nature of the chain, since that block can validate that the coin hasn't been spent within that one block, nor in previous blocks (and side blocks can be ignored). Proof of work has nothing to do with that, any system that can encourage everyone to agree on the next block does the same prevention of double spend.
- jasode 5y ago
  >Proof of work has nothing to do with that, any system that can encourage everyone to agree on the next block does the same prevention of double spend. What foundational frame of reference are you using to write that sentence above? Because for Bitcoin's specific implementation, the purpose of POW is to prevent double spend without centralized trust. Consider the following "if()" statement in bitcoin source code: Excerpt from validation.cpp [1]: bool CBlockIndexWorkComparator::operator()(const CBlockIndex *pa, const CBlockIndex *pb) const { // First sort by most total work, ... if (pa->nChainWork > pb->nChainWork) return false; if (pa->nChainWork < pb->nChainWork) return true; In older versions of source code, excerpt from main.cpp [2]: if (pindexNew->bnChainWork > bnBestChainWork) { ... The motivation for the C++ code above to compare the chain work is in the original 2009 Bitcoin whitepaper. Excerpt: >12. Conclusion : We have proposed a system for electronic transactions without relying on trust. We started with the usual framework of coins made from digital signatures, which provides strong control of ownership, but is incomplete without a way to prevent double-spending. To solve this, we proposed a peer-to-peer network using proof-of-work to record a public history of transactions that quickly becomes computationally impractical for an attacker to change if honest nodes control a majority of CPU power. [1] https://github.com/bitcoin/bitcoin/blob/271155984574a5bba9619d8f6da9bb0606d93f8c/src/validation.cpp#L87 https://github.com/bitcoin/bitcoin/blob/271155984574a5bba961... [2] https://github.com/bitcoin/bitcoin/blob/40cd0369419323f8d7385950e20342e998c994e1/main.cpp#L1236 https://github.com/bitcoin/bitcoin/blob/40cd0369419323f8d738...
- 5y ago
billytetrud 5y ago
> any scheme to replace proof-of-work needs to maintain that element of irrecoverable loss of value for a failed double spending attack. As others have said, this is not true. All that is required is that it is expensive to successfully double spend.
- catlifeonmars 5y ago
  More expensive than the value of the 2nd spend (in terms of expected value)?
  - billytetrud 5y ago
    Well, generally a 51% attack doesn't requier expending cost as much as it requires accumulating capital. With PoW, that capital is mining hardware. With PoS, that capital is the currency itself. In both PoW and PoS, a double spend could be done in a way that doesn't "cost" the attacker anything. But it does require accumulating so much capital that its hopefully extremely unlikely that any one person or group (even a government) could accumulate that much. An attack would generally substantially decrease the value of the capital accumulated (again, mining hardware or coins) and so there is a cost there. But it isn't the kind of thing where you can say "1 attack costs X dollars and 2 attacks costs 2X dollars", so the value of a particular double spend isn't really that relevant.
m3kw9 5y ago
He did mention 51% attack which implies double spend.

by aazaa 5y ago

dboreham 5y ago

Another way to describe this is that PoW is a Cybil resistance measure.

acjohnson55 5y ago
Although just saying that doesn't really tell anyone much, who doesn't already know. A Sybil attack is the creation of a bunch of identities to subvert a system that is attempting to distribute power amongst a bunch of participants. The Sybil resistance of these schemes comes from allocating power in proportion to some form of commitment of a scarce resource, which could be indigenous to the system (e.g. proof of stake, proof of burn) or exogenous (e.g. proof of work, proof of storage). I think it's noteworthy that all of these systems are plutocratic. They will all effectively redistribute wealth upward, because anything that doesn't would encourage the creation of more identities.
- dolmen 5y ago
  https://en.wikipedia.org/wiki/Sybil_attack https://en.wikipedia.org/wiki/Sybil_attack
- ItsMonkk 5y ago
  Exactly. The current techniques to Sybil resistance directly leads to plutocracy because of economies of scale. I think the solution is fees based on transaction expediency. If I want a transaction to go through for the minimum possible fee I could schedule it for a year in advance. In one years time, the money would be available. If I wanted it sooner, say instantly, that transaction would cost say, 1x. So if it was a $100 transaction, the fee would be $100. Maybe 1 day is 0.1x, 1 week is 0.01x and 1 month is .001x. If you want the best odds of double spending and choose to pick instantly, the fee is equivalent to the transaction, so you don't actually end up gaining anything. Smart merchants will start essentially doing futures. I am going to need corn in one year, I setup the deal today, when it goes onto the chain I transact my corn. Better still, we can use these fees to add to the supply. The only reason that a transaction would go through with a fee is if the profit of the transaction from both sides was above 0, so we can directly track a portion of the surplus of our currency. We can calculate how much security we need based on the available currency at a certain time, and mostly the miners only earn enough of the fees such that we can ensure that we won't be harmed by a malicious attacker who does not care that they aren't getting anything. So the difficulty is based not on mining power, but on exploitability. So what do we do with the rest of the fees including the new coins generated through those fees? We give them to people who have actively locked up coins as we want to encourage people locking up their coins, as the more they have locked up, the less risk there is that a double spend can occur. So that means if you know that you will not transact your coins for one year, you will transact with yourself and lock in, and essentially you get yourself a CD. This is all super preliminary, and I am looking for problems with this setup, but it seems to work.

hypertele-Xii 5y ago

I don't get it. Suppose a bad actor tries to double spend. They have to cryptographically sign both transactions, so the whole network will eventually receive knowledge of both transactions. Why can't the network simply wait for some duration of time before accepting a transaction, to verify that no double-spends propagate from elsewhere? If double spending is ever detected from a party, that party is dis-trusted by the network. The network will de-prioritize processing transactions from dis-trusted parties. Problem solved?

fogof 5y ago
Well let's say we do things this way, and I double spend a transaction, sending one to Alice and one to Bob. Suppose Alice waits t seconds after receiving the transaction, and if she doesn't see any double spends in that time, she accepts that the coin is hers and she then sends me something in return. One second before Alice "confirms" my transaction, I can send out my transaction to Bob. Since my message takes time to propagate through the network, it won't reach Alice soon enough and she will think I've paid her, and she'll send me whatever I was paying for. But other people will see both these transactions within t seconds of each other. They won't know which they should believe is correct, and they might not accept payment from Alice in the future.
- DennisP 5y ago
  The same thing happens in PoW networks. You have to wait several blocks to gain confidence that a transaction won't be reverted. In Ethereum's PoS, by waiting a similar amount of time you actually get finality; at that point your transaction cannot be reverted without a third of total stake being destroyed.
  - sparkie 5y ago
    Unless Vitalik proposes a rollback.
    - DennisP 5y ago

fogof 5y ago

To include the whole passage you are talking about: > The granddaddy of all consensus mechanisms—behind Bitcoin, Litecoin, Monero, and (for the time being at least) Ethereum—is called proof of work. Essentially, PoW makes adding transactions to the blockchain computationally—and therefore financially—very expensive, so as to discourage fraudulent activity. At the same time, users who go to the trouble of creating valid blocks, known as mining, are rewarded with cryptocurrency. I would say this passage gets the facts totally correct. The author doesn't say that Proof-of-work has to do with the validity of transactions, they say it has to do with the validity of blocks. Indeed, it can't be easy to make valid blocks or double spending would become a problem as you say. Not sure why you think this reflects the misunderstanding of the inherent costs of consensus systems.

bouncycastle 5y ago

PoW is not the only way to solve double spending (and make sure that the blocks are ordered in a particular timeline), in PoS it is solved by randomly choosing which validator will create the next block according to an algorithm that all the nodes follow. So there's no race to find the next block, the block producer is known in advance. What's more, in PoS, you have guaranteed finality, meaning that after a certain amount of blocks, you can be sure that the order will not change. This is superior to the probabilistic finality offered by PoW. > loses everything spent if the attack fails They don't lose everything, they still get to keep the mining hardware and can retry the attack again. They can also use a "selfish mining" strategy and earn block rewards that subsidize their attack (by earning more than their fair share). In PoS on the other hand, the attacker loses everything after an attack and cannot try again. This is because attackers get slashed (their stacked coins are destroyed). If they want to try again, they need to acquire more coins.

kerkeslager 5y ago
There are a bunch of ways in which you're not exactly correct here. First, you're describing a very particular implementation of PoS. Not all PoS implementations include slashing. This isn't a mere technicality: the most popular implementation of PoS (as measured by market cap) is Cardano's and it doesn't include slashing. And not all PoS implementations involve randomly choosing a validator. The bigger problem here is that proof of stake is actually a misnomer because doesn't actually provide proof, period--it's a consensus algorithm, not a proof algorithm. That's fine if you're actively connected to a bunch of nodes, because you can resolve double spends by polling the network to find out the consensus. But if you're only connected to two nodes and those two nodes are showing you two different spends of the same balance, you have no way to resolve that conflict. In PoW (a real proof algorithm) you simply look at the longer chain. In PoS, there's no way to actually enforce the longer chain, because there's no cost to producing a longer chain. This is a problem which occurs in practice when nodes newly connect to a network or reconnect after a long absence. Slashing does nothing to address this issue. If I'm running a PoS validator node, I can stake coins, unstake them, and then spend the coins. Now I've got a free license to mine blocks without risk of slashing. I can mine blocks by simply validating blocks that say that I never unstaked. And I'm at no risk of slashing because I've already spent the coins: there's no balance to slash. You alluded to an attempted solution with "it is solved by randomly choosing which validator will create the next block according to an algorithm that all the nodes follow" but that doesn't work: a provable random function can choose a validator which creates artificial scarcity, but there has to be a fallback in case validators drop offline, otherwise a downed node would grind the entire chain to a halt as soon as it was chosen as a validator and doesn't validate a block when it's supposed to. The malicious validator can use this because there's no temporality stored on-chain: you just find a situation where your staking address is the fallback node and claim that the validators who were chosen by the random function validated late, and nobody can prove you wrong. This may sound suspicious, but in fact these fallbacks happen in practice. To create a believable chain after this, you have to create a situation where a lot of validators drop off and are replaced by nodes you control. This also looks suspicious, but again this also happens in practice: for example if AWS S3 US East VA goes down, there will be a huge number of validators that drop offline. Probably the most thorough explanation of this type of attack and the theory behind it can be found in On Stake and Consensus[1]. There's some debate on the importance of this attack--Vitalik Buterin calls this "weak subjectivity" and has written about it in length[2]. But to say he's not concerned about it would be inaccurate; he says, "actually implementing a proof of stake algorithm that is effective is proving to be surprisingly complex"[3]. That sentence was written in 2014 and Ethereum still does not rely on proof of stake in 2021--be assured that if in seven years Vitalik Buterin has not satisfactorily solved the problem, it's not trivial. I would caution anyone extolling the virtues of Proof of Stake from overstating their case--PoS is not a panacea and presents many challenges of its own. [1] https://download.wpsoftware.net/bitcoin/pos.pdf https://download.wpsoftware.net/bitcoin/pos.pdf [2] https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/ https://blog.ethereum.org/2014/11/25/proof-stake-learned-lov... [3] https://blog.ethereum.org/2014/10/03/slasher-ghost-developments-proof-stake/ https://blog.ethereum.org/2014/10/03/slasher-ghost-developme...

xwolfi 5y ago

What I fail to understand, and thanks to your explanation, is why not use a central trusted ledger which would synchronize all transactions. It could surely work at the current speed of bitcoin and relieve the entire planet of the energy cost of bitcoin, providing the same safety that no double spend could happen. All you'd need is a small private army, a few lawyers, an historically accepted jurisdiction, and you'd be ready to go with your central ledger. I don't think you're right to say double spending is the only thing being solved with proof of work, I think people are trying very very very hard not to centralize (for no good reason in my opinion), despite the prohibitive cost, and why ? Because of that insane fear the ledgers would be changed: hence you'd have to admit the author was a bit right that eventually this whole story is to protect paranoid people against a very absurd risk at the cost of asking government to subsidize reopening coal mines...

rep_movsd 5y ago
This is called the state backed banking system. Eventually they will make all your money digital. They will track everything you buy. Then at the very least they will sell your information to advertisers, and at worst retain totalitarian control over all your purchasing power. Its already happening in China - the state has the power to prevent people from travelling etc. based on their "social credit" The US is making a CBDC (central bank digital currency). No matter how pure the intentions of creating a government backed digital currency are, it will degenerate into a means of control
- Scarblac 5y ago
  > Eventually they will make all your money digital. They will track everything you buy. Which is why Bitcoin starts out doing exactly that by default?
dolmen 5y ago
You mean like... paying using a card number (VISA, Mastercard, Amex) on the Internet?
Geee 5y ago
If the central trusted ledger starts censoring transactions, blocking users or producing invalid blocks with additional rewards to themselves, then what? Just keep going with it and accept the new reality? Then we would be back at what we have now - the current central bank monetary system. Trustless decentralized architecture makes the Bitcoin network incredibly robust against attacks on its principles. It can't be changed (without users/capital switching over to new version), stopped or censored by anyone.

danbruc 5y ago

Yes and no. Yes, proof of works prevents double spending or more generally establishes consensus on which transaction become accepted. But no, this could be achieved with many different consensus protocol and does in general not require any irrecoverable loss. Just issue a key pair to each human and make them send signed votes to establish consensus by simple majority. The true reason something like proof of work is required is because the system is also anonymous and distributed where being anonymous is the more critical aspect. Because of that you can not know who is out there and can cast a vote. Are this votes from a million legitimate users or did one user just send a million votes? The solution to prevent users from casting arbitrary many votes is then to make it hard for them to cast a vote, you make them for example waste a lot of clock cycles for each vote. But, as I said, not because this is inherently a requirement but because you want to establish consensus among members of an anonymous group of unknown size and them wasting a certain number of clock cycles is a rough proxy for everyone gets one vote assuming that everyone has very roughly access to the same amount of computing power.

ywei3410 5y ago
For context, this is usually known as a 'Sybil attack'. [1] https://en.wikipedia.org/wiki/Sybil_attack https://en.wikipedia.org/wiki/Sybil_attack
- micropresident 5y ago
  This is a common mistake w/r/t Proof of Work. It doesn't prevent Sybil attacks. The Bitcoin whitepaper performs slight of hand to say "instead of identities, we'll use CPUs" which are obviously what Sybil attacks are in the first place. One person can own lots of CPUs... (Thus mining operations.) What it does do is make Sybilers larger and larger shareholders in the network to make it so that the more you Sybil the network the less you'd want to try to damage it.
ajkdhcb2 5y ago
If you have a central entity that can generate key pairs then they may as well be running a database. It doesnt achieve decentralisation at all. It has nothing to do with anonymity: anything based on identity is broken because it has an entity that can fake those identities -- you can't verify ID with code

admax88q 5y ago

I would consider a double spend transaction to be invalid.

teawrecks 5y ago
I agree. It seems to me that pow is specifically designed to make adding new transactions to the blockchains take a certain amount of time. If anyone could add to the blockchain instantaneously, imagine the same account being used to spend money on both sides of the earth at the same "time". Afaik general relativity says it would be virtually impossible to tell which one happened "first" in a decentralized way. So by slowing everything down, we force there to be a window for transactions to propagate.
sparkie 5y ago
Which one was the first spend and which one was the double-spend? You are talking about a distributed network where there is no universal time by which this can be measured. The blockchain is the solution to this problem. It provides an ordering which is to be universally agreed upon, because the only way to disagree with the ordering is to use >51% of the amount of electricity securing the network to state your disagreement. A spend is invalid if the consensus in the network is that the TXO being used as an input for a transaction has already been spent in a transaction which has been mined into a valid block. Until that happens, any valid transaction which spends a TXO may be the correct one.
- noxer 5y ago
  > Which one was the first spend and which one was the double-spend? The answer to that question is actually that it doesn't matter. Seems weird at first but if you think about it, no one who uses the system cares which one is "the first" the only thing people care about is that once one is picked it will not change later on aka finality. And for that a majority must agree on one. Which one again doesn't matter at all. FBA (Federated Byzantine Agreement) "blockchains" make use of that. Each node signals which Tx it saw first but if no super-majority can be reached it simply switches to the Tx that has more votes. The sole purpose is to agree on one which makes the second Tx unfunded and thus fail. Bitcoin and bitcoin-like system cant do this. They always have some kind of lottery that decides who writes the Tx. There is no agreement and thus no finality and that's the whole reason why double-spends can happen.

brighton36 5y ago

Proof of work also enables users to buy Bitcoin from their power company. Which, is a necessary feature for many applications.

KallDrexx 5y ago

> The problem proof-of-work solves is double spending, That doesn't seem to be my understanding. In my mind the problem proof of work solves is how quickly new blocks can be generated, thus limiting the supply of new blocks and giving an incentive to move the head pointer to an agreed upon next value (by granting coins to the miner who was able to compute the value). Double spend is solved due to the single branch tree nature of the chain, since that block can validate that the coin hasn't been spent within that one block, nor in previous blocks (and side blocks can be ignored). Proof of work has nothing to do with that, any system that can encourage everyone to agree on the next block does the same prevention of double spend.

jasode 5y ago
>Proof of work has nothing to do with that, any system that can encourage everyone to agree on the next block does the same prevention of double spend. What foundational frame of reference are you using to write that sentence above? Because for Bitcoin's specific implementation, the purpose of POW is to prevent double spend without centralized trust. Consider the following "if()" statement in bitcoin source code: Excerpt from validation.cpp [1]: bool CBlockIndexWorkComparator::operator()(const CBlockIndex *pa, const CBlockIndex *pb) const { // First sort by most total work, ... if (pa->nChainWork > pb->nChainWork) return false; if (pa->nChainWork < pb->nChainWork) return true; In older versions of source code, excerpt from main.cpp [2]: if (pindexNew->bnChainWork > bnBestChainWork) { ... The motivation for the C++ code above to compare the chain work is in the original 2009 Bitcoin whitepaper. Excerpt: >12. Conclusion : We have proposed a system for electronic transactions without relying on trust. We started with the usual framework of coins made from digital signatures, which provides strong control of ownership, but is incomplete without a way to prevent double-spending. To solve this, we proposed a peer-to-peer network using proof-of-work to record a public history of transactions that quickly becomes computationally impractical for an attacker to change if honest nodes control a majority of CPU power. [1] https://github.com/bitcoin/bitcoin/blob/271155984574a5bba9619d8f6da9bb0606d93f8c/src/validation.cpp#L87 https://github.com/bitcoin/bitcoin/blob/271155984574a5bba961... [2] https://github.com/bitcoin/bitcoin/blob/40cd0369419323f8d7385950e20342e998c994e1/main.cpp#L1236 https://github.com/bitcoin/bitcoin/blob/40cd0369419323f8d738...
5y ago

billytetrud 5y ago

> any scheme to replace proof-of-work needs to maintain that element of irrecoverable loss of value for a failed double spending attack. As others have said, this is not true. All that is required is that it is expensive to successfully double spend.

catlifeonmars 5y ago
More expensive than the value of the 2nd spend (in terms of expected value)?
- billytetrud 5y ago
  Well, generally a 51% attack doesn't requier expending cost as much as it requires accumulating capital. With PoW, that capital is mining hardware. With PoS, that capital is the currency itself. In both PoW and PoS, a double spend could be done in a way that doesn't "cost" the attacker anything. But it does require accumulating so much capital that its hopefully extremely unlikely that any one person or group (even a government) could accumulate that much. An attack would generally substantially decrease the value of the capital accumulated (again, mining hardware or coins) and so there is a cost there. But it isn't the kind of thing where you can say "1 attack costs X dollars and 2 attacks costs 2X dollars", so the value of a particular double spend isn't really that relevant.

m3kw9 5y ago

He did mention 51% attack which implies double spend.