4 ms·

This explanation does not make sense to me, which is probably due to my lack of understanding, but perhaps you can expand on this: > about 30-45 accounts _whic

This explanation does not make sense to me, which is probably due to my lack of understanding, but perhaps you can expand on this: > about 30-45 accounts _which had stake at that time The this is stated makes it sound difficult. But if this is false history presented by a malicious node, surely they could make up anything, as it the data does not need to line up with any official history at any point. (Without a trusted party, no history line is really offical anyway, is't it?). Constructing a history with 30 accounts with stake at any given point in time isn't any harder or easier than constructing 3 or 3000.

rictic 5y ago
With Ethereum at least, it's proof of work leading up to proof of stake, so you'd have to break proof of work to create a fake early history, so the initial stake has to be legal within the proof of work history of Ethereum. Unsure how pure PoS chains work, maybe they hard code an early block's hash? Like, it's not a legit xorcist-chain unless block #10 has hash #deadbeef
comex 5y ago
The history still needs to be signed by former stakers to be valid. The "nothing at stake" problem is that a staker might break the rules by signing two mutually incompatible histories. During the staking period, they are strongly disincentivized from doing this because anyone can present proof that they've done so, causing the network to punish them by taking away all the funds they staked. But once that period expires, they can send those funds to someone else, and now they can't be punished. Someone who's sent away their funds is longer a staker moving forward, but they can still sign an alternate history for the time when they were a staker, potentially fooling clients who haven't connected to the network for a long time. In practice, among the people who once staked large amounts of a proof-of-stake currency, most of them will probably continue being invested in its ecosystem moving forward. Even if they can't be personally punished for lying about the past, a successful history split would likely reduce the community's confidence in the currency, and thus its market value. Most of those people are also emotionally invested in the ecosystem and would not want to dishonestly subvert it. There will be exceptions. But to create an alternate history you need to subvert not just one validator, but most validators (or rather, validators who together control most of the currency being staked).
- hedora 5y ago
  This is the “nothing at stake problem” from the article. Warren Buffet buys up 70% of the network, induces a network partition, and then double spends it all, signing both transaction histories. By the time he’s caught, he’s converted 2x the value of the POS network to POW bitcoins. Replace “warren buffet” with “crypto exchanges selling bundled securities”, and the above is not just plausible, it’s inevitable. The same scam has been run over and over again with conventional banks (who are inevitably bailed out on top of getting to take the money and run), POS just changes the nature of the obscure underlying financial instruments.
  - deleted 5y ago
    [deleted]
  - EthanHeilman 5y ago
    A trust assumption of PoS (Proof of Stake) is that >66% of the stake is honest. If you violate this trust assumption then yes PoS breaks. This is a similar trust assumption to requiring that 51% of the mining power in PoW (Proof of Work) is not malicious. This risk can be mitigated: 1. The network should halt if a fork is detected. A fork with more than 66% of the stake behaving maliciously means a fundamental trust assumption of the network has been violated. Stop everything! Let humans figure out what is going on. I'm not saying every PoS system WILL halt under these circumstances, but as a countermeasure they SHOULD be designed to halt and value safety over partition resilience. Thus, an attacker forking a PoS must never allow parties to see either side of the fork. If a party notices a fork occurs, they will halt and can't be double spent against. 2. Following from 1, how do you prevent parties from communicating and discovering that a fork is occurring? Are you a tier-1 ISP and can control all internet traffic? You can defend against such attacks by making it very hard to hide the presence of a fork via redundant communication mechanisms. For instance the Bitcoin blockchain is broadcasted via satellite, a PoS blockchain could do that as well. 3. Additionally you can require that stakers lock their stake for long periods of time e.g., 6 months. This means that if an attacker wants to perform this attack and truly have nothing at stake they must cause a fork in the chain before the 6-months ago mark. Parties who are up to date with the latest chain are not vulnerable since they have already accepted the consensus history of chain. New parties who are syncing for the first time would be vulnerable, however clients could be programmed to have hardcoded 6th month checkpoints or clients could check block explorers and halt if a fork is detected.

rictic 5y ago

With Ethereum at least, it's proof of work leading up to proof of stake, so you'd have to break proof of work to create a fake early history, so the initial stake has to be legal within the proof of work history of Ethereum. Unsure how pure PoS chains work, maybe they hard code an early block's hash? Like, it's not a legit xorcist-chain unless block #10 has hash #deadbeef

comex 5y ago

The history still needs to be signed by former stakers to be valid. The "nothing at stake" problem is that a staker might break the rules by signing two mutually incompatible histories. During the staking period, they are strongly disincentivized from doing this because anyone can present proof that they've done so, causing the network to punish them by taking away all the funds they staked. But once that period expires, they can send those funds to someone else, and now they can't be punished. Someone who's sent away their funds is longer a staker moving forward, but they can still sign an alternate history for the time when they were a staker, potentially fooling clients who haven't connected to the network for a long time. In practice, among the people who once staked large amounts of a proof-of-stake currency, most of them will probably continue being invested in its ecosystem moving forward. Even if they can't be personally punished for lying about the past, a successful history split would likely reduce the community's confidence in the currency, and thus its market value. Most of those people are also emotionally invested in the ecosystem and would not want to dishonestly subvert it. There will be exceptions. But to create an alternate history you need to subvert not just one validator, but most validators (or rather, validators who together control most of the currency being staked).

hedora 5y ago
This is the “nothing at stake problem” from the article. Warren Buffet buys up 70% of the network, induces a network partition, and then double spends it all, signing both transaction histories. By the time he’s caught, he’s converted 2x the value of the POS network to POW bitcoins. Replace “warren buffet” with “crypto exchanges selling bundled securities”, and the above is not just plausible, it’s inevitable. The same scam has been run over and over again with conventional banks (who are inevitably bailed out on top of getting to take the money and run), POS just changes the nature of the obscure underlying financial instruments.
- deleted 5y ago
  [deleted]
- EthanHeilman 5y ago
  A trust assumption of PoS (Proof of Stake) is that >66% of the stake is honest. If you violate this trust assumption then yes PoS breaks. This is a similar trust assumption to requiring that 51% of the mining power in PoW (Proof of Work) is not malicious. This risk can be mitigated: 1. The network should halt if a fork is detected. A fork with more than 66% of the stake behaving maliciously means a fundamental trust assumption of the network has been violated. Stop everything! Let humans figure out what is going on. I'm not saying every PoS system WILL halt under these circumstances, but as a countermeasure they SHOULD be designed to halt and value safety over partition resilience. Thus, an attacker forking a PoS must never allow parties to see either side of the fork. If a party notices a fork occurs, they will halt and can't be double spent against. 2. Following from 1, how do you prevent parties from communicating and discovering that a fork is occurring? Are you a tier-1 ISP and can control all internet traffic? You can defend against such attacks by making it very hard to hide the presence of a fork via redundant communication mechanisms. For instance the Bitcoin blockchain is broadcasted via satellite, a PoS blockchain could do that as well. 3. Additionally you can require that stakers lock their stake for long periods of time e.g., 6 months. This means that if an attacker wants to perform this attack and truly have nothing at stake they must cause a fork in the chain before the 6-months ago mark. Parties who are up to date with the latest chain are not vulnerable since they have already accepted the consensus history of chain. New parties who are syncing for the first time would be vulnerable, however clients could be programmed to have hardcoded 6th month checkpoints or clients could check block explorers and halt if a fork is detected.