4 ms·

> If it is recognised that you mine on more than one fork at a time, you lose the security deposit you gave before the fork. Yes, modern proof-of-stake algorit

by comex 5y ago

> If it is recognised that you mine on more than one fork at a time, you lose the security deposit you gave before the fork. Yes, modern proof-of-stake algorithms work this way. The caveat is that at some point (on the order of months later) the security deposit is refunded, and at that point you can lie about the past without consequence. But this is a limited attack: you can only successfully lie to someone who has been offline since you were a staker, or else they would already have a record of the real successor chain (which now has a new set of stakers, who themselves still have their security deposit deposited).

PeterisP 5y ago
The original article asserts that this does not work according to their requirements since there's no way to independently verify which is the "real successor chain" - they just have to trust someone's word that chain A is true and chain B is not, and a convincing liar could provide them with opposite data. In schemes like Bitcoin, there's objective validation of the "longest chain" with the most work invested; in your example where would that "record of the real successor chain" come from, and how can it be validated/verified in a decentralized manner in a way that a major ex-staker can't satisfy? Like, this is trivially solved with a central authority (e.g. have some trusted core developer every day publish a signed message saying "this is the real successor chain"), but it does enable that central authority to arbitrarily bless a fake ex-staker's fork.
- EthanHeilman 5y ago
  > they just have to trust someone's word that chain A is true and chain B is not, and a convincing liar could provide them with opposite data. In schemes like Bitcoin, there's objective validation of the "longest chain" with the most work invested; Note that in Bitcoin you can have a fork in which both chains have equal length. The idea is that eventually the longest chain will be established, but if say 90% of the mining is malicious that malicious miner could ensure that most of the time both chains are of equal length. With a PoS fork you can ask, which fork has the most amount of stake voting for it. An attacker that controls enough stake might be able to balance the total stake vote in the same way as a malicious miner could on Bitcoin. In both cases if the core security assumption of the blockchain is violated, that blockchain should halt until that assumption is made sound again. If someone orphans the last two years of Bitcoin's blockchain something has gone horribly wrong. The fact that Bitcoin now switches to the longest chain doesn't actually address the problem that two years of transactions may have been rendered invalid.

by comex 5y ago

PeterisP 5y ago

The original article asserts that this does not work according to their requirements since there's no way to independently verify which is the "real successor chain" - they just have to trust someone's word that chain A is true and chain B is not, and a convincing liar could provide them with opposite data. In schemes like Bitcoin, there's objective validation of the "longest chain" with the most work invested; in your example where would that "record of the real successor chain" come from, and how can it be validated/verified in a decentralized manner in a way that a major ex-staker can't satisfy? Like, this is trivially solved with a central authority (e.g. have some trusted core developer every day publish a signed message saying "this is the real successor chain"), but it does enable that central authority to arbitrarily bless a fake ex-staker's fork.

EthanHeilman 5y ago
> they just have to trust someone's word that chain A is true and chain B is not, and a convincing liar could provide them with opposite data. In schemes like Bitcoin, there's objective validation of the "longest chain" with the most work invested; Note that in Bitcoin you can have a fork in which both chains have equal length. The idea is that eventually the longest chain will be established, but if say 90% of the mining is malicious that malicious miner could ensure that most of the time both chains are of equal length. With a PoS fork you can ask, which fork has the most amount of stake voting for it. An attacker that controls enough stake might be able to balance the total stake vote in the same way as a malicious miner could on Bitcoin. In both cases if the core security assumption of the blockchain is violated, that blockchain should halt until that assumption is made sound again. If someone orphans the last two years of Bitcoin's blockchain something has gone horribly wrong. The fact that Bitcoin now switches to the longest chain doesn't actually address the problem that two years of transactions may have been rendered invalid.