16 ms·

Are blockchains decentralized?

151 points by rdl 4y ago

mattwilsonn888 4y ago
> "For a blockchain to be optimally distributed, there must be a so-called Sybil cost. There is currently no known way to implement Sybil costs in a permissionless blockchain like Bitcoin or Ethereum without employing a centralized trusted third party (TTP). Until a mechanism for enforcing Sybil costs without a TTP is discovered, it will be almost impossible for permissionless blockchains to achieve satisfactory decentralization." https://saito.tech/wolves-and-sheep/ https://saito.tech/wolves-and-sheep/
rdl 4y ago
This is great research and if anything understates the case for alarm; Bitcoin is one of the more-decentralized projects, and PoW generally has some incentives for diverse hosting (if not network layer). PoS systems often end up on AWS specifically, and sometimes depend on some of the more niche AWS services -- an outage (engineered or accidental) in those could cause easy degradation and facilitate takeover.
- latchkey 4y ago
  Actually, no. It isn't that great. A lot of people are correcting specific points here in the comments. > More than one in five Bitcoin nodes are running an old version of the Bitcoin core client that is known to be vulnerable. This is brought out as an issue, but it really doesn't matter. Being a large decentralized systems means that having nodes which are at all sorts of different versions, can still work. This is like saying that everyone has to be at the same web browser version for websites to work. The thing that matters is that the nodes that are used for forming blocks (ie: the nodes the pools are running), are updated.
tyoma 4y ago
I would love to see a follow-up that addresses emergent centralization due to winner-take-all or winner-take-most dynamics. This is how we end up with monopolies/duopolies elsewhere in the tech sector, and I suspect the same would hold for blockchain.
m00dy 4y ago
>>Key Findings >>The number of entities sufficient to disrupt a blockchain is relatively low: four for Bitcoin, two for Ethereum, and less than a dozen for most proof-of-stake networks. then why we haven't seen a Bitcoin hack before ? Maybe it is the most secured system.
- mattwilsonn888 4y ago
  https://saito.tech/the-double-spend-attack-is-not-the-same-as-the-51-percent-attack/ https://saito.tech/the-double-spend-attack-is-not-the-same-a... https://www.investopedia.com/terms/s/selfish-mining.asp https://www.investopedia.com/terms/s/selfish-mining.asp Because you can make more money keeping it under the radar.
- frabert 4y ago
  From the report, > Even though these Nakamoto coefficients are relatively low, some might argue that exploiting them to attack a blockchain would be prohibitively expensive. While this may be true for individuals, the actors incentivized to perpetrate these attacks include operators of competing currencies and nation-states who have the requisite resources. Perverse incentives can exist with blockchains in the same way that the relative values of fiat currencies can be manipulated.
  - mypastself 4y ago
    Competing currencies are unlikely to profit from Bitcoin’s downfall in this scenario, given how much the entire space relies on its reputation. Nation-states, on the other hand, are the more credible threat. Just because none of them has yet found it a big enough threat to expend the required resources, doesn’t mean it can’t happen. I feel like the more Bitcoin is used for its original intended purpose rather than merely speculation, the more likely it is to be attacked by such actors.
  - bhaak 4y ago
    I think it's more complex than the report poses it. It's not as if those mentioned entities always have complete control over their mining hardware as those entities include pool miners. I think there's more that prevents an attack than just being "prohibitively expensive".
greyface- 4y ago
> The research to which this blog post refers was conducted by Trail of Bits based upon work supported by DARPA under Contract No. HR001120C0084 More info: https://govtribe.com/award/federal-contract-award/definitive-contract-hr001120c0084 https://govtribe.com/award/federal-contract-award/definitive...
roenxi 4y ago
This is interesting research and I encourage everyone to go read the article. But, on the assumption that a lot of people will just read the headline and comments I'm going to preemptively talk about the question there ... People misunderstand decentralisation in practice. Computer types, when they talk about decentralisation, usually mean a relatively large number of homogeneous nodes acting as peers. Which is cool but not how decentralised systems work in practice out in the meaty reality we all live in. In reality, we have an economy that quickly works out who is the best (say, Samuel is the best) at something (say, mining bitcoin) and routes most of the resources available for hashing to Samuel. The situation is still decentralised, because if Samuel stops being the best at calculating hashes then resources will be reallocated to someone else. But in the short term all the resources will go to Samuel and he could do a lot of damage to the network. People keep thinking that because the economy picks out a few winners that means that the system is now locked in stone - that isn't the case. The economy is perfectly happy to change things up radically when the situation changes. At least until a government steps in and regulates the ability to change flexibly out of the system.
- sandworm101 4y ago
  Except that Samuel wants to keep his place. So he will do whatever he can to leverage his current centrality to continue. His hope is to be in control when the hammer falls and flexibility stops. One way of doing that is to force the issue. Those in central positions within a dynamic market eventually seek to kill that market, leaving them in the monopoly position (amazon, google, facebook etc). To maintain decentralization in the long term such leaders need to be periodically culled, hopefully though market forces prior to them killing the market. In bitcoin, that might mean periodic removal of the largest commercial actors, perhaps by periodic price crashes that favor niche setups.
  - roenxi 4y ago
    > (amazon, google, facebook etc) I'm not sure where I sit on your major point, but these 3 just are not monopolists and this is a mistake that keeps getting made. All 3 of these are in cut throat markets where they compete by selling really great products (AWS, Google Search and Facebook respectively). A lot of individuals don't like them (I refuse to use Google, for example) but that doesn't change the fact that they get market share by being great at what they do.
ncmncm 4y ago
I am always impressed with Trail of Bits work.
whatisweb3 4y ago
Some issues with this report: > The challenge with using a blockchain is that one has to either (a) accept its immutability and trust that the programmers did not introduce a bug, or (b) permit upgradeable contracts or off-chain code that share the same trust issues as a centralized approach. This paints the issue as binary, although there is more to it. Look at the WETH contract in which we both (a) accept its immutability and trust there are no bugs, but also (c) can migrate to a fork at a later point if desired through social consensus. There is another option (d) which is a less developed area: governance models that are not entirely centralized, see Uniswap and Aave. > The number of entities sufficient to disrupt a blockchain is relatively low: four for Bitcoin, two for Ethereum, and less than a dozen for most proof-of-stake networks. The Nakamoto coefficient relates to validator pools colluding to form a 51% attack. In Ethereum PoS this count is a bit higher, around 25-35[1]. Important to note the extreme costs of these attacks, and the defense mechanisms of PoS. If enough validators collude to 51% attack a PoS chain, users can follow a fork and have the attackers coins burned. Attacker would have to continually re-purchase coins to re-attack the new soft forks.[2] > For a blockchain to be optimally distributed, there must be a so-called Sybil cost. There is currently no known way to implement Sybil costs in a permissionless blockchain like Bitcoin or Ethereum without employing a centralized trusted third party (TTP). Until a mechanism for enforcing Sybil costs without a TTP is discovered, it will be almost impossible for permissionless blockchains to achieve satisfactory decentralization. This is based on the Kwon paper which defines "full decentralization" as a set of specific numerical constraints, and demonstrates that it is theoretically impossible for any permissionless system currently known to mankind to satisfy these constraints. Kwon makes no claims about whether this degree of decentralization is "satisfactory" or even necessary for a blockchain. A system that is distributed across thousands of nodes and highly resistant to 51% attacks and collusion is likely enough for it to be considered "decentralized" for practical purposes. [1] https://shsr2001.github.io/beacondigest/notebooks/2021/07/19/measuring_decentralization.html https://shsr2001.github.io/beacondigest/notebooks/2021/07/19... [2] https://vitalik.ca/general/2020/11/06/pos2020.html https://vitalik.ca/general/2020/11/06/pos2020.html
avnigo 4y ago
I found it interesting reading the blog post, but delving into the report, some areas didn't seem as straightforward. I expect to get some flak for saying this, and I don't mean to be cynical, but it's interesting how the table on p. 9 of the report lists Solana with a relatively high Nakamoto coefficient (19 to Bitcoin's 4), given the recent events with Solana [0]. From p. 1 of the report, emphasis my own: > Trail of Bits also operates a center of excellence for blockchain security. Notable projects include audits of Algorand, Bitcoin SV, Chainlink, Compound, Cosmos, Ethereum 2.0, MakerDAO, Matic, Polkadot, Solana, Uniswap, Web3, and Zcash. Some of those notable projects are fervently anti-bitcoin, so while some criticisms and concerns may appear to be valid at a first glance, I don't think it can be said to be without bias. [0]: https://www.coindesk.com/tech/2022/06/19/solana-defi-platform-votes-to-control-whale-account-in-bid-to-avoid-liquidation-chaos/ https://www.coindesk.com/tech/2022/06/19/solana-defi-platfor...
- etherael 4y ago
  There are very good reasons to be fervently anti-BTC given its history since 2017.
- Anon1096 4y ago
  That was Solend, not Solana. The concern was just that a liquidation of that scale would significantly move the market.
- woodruffw 4y ago
  Trail of Bits has no pro- or anti- position when it comes to various cryptocurrency projects. Moreover, this research was entirely funded by DARPA, and was not assisted by any project. Finally, the results only address decentralization, and not the myriad other ways in which these schemes can be economically, politically, or cryptographically unsound. FD: My employer.
  - latchkey 4y ago
    > FD: My employer. Oh, that's interesting. Did you write this blog post too? You've been pretty anti-crypto in previous comments here.
JonathanBeuys 4y ago
What the article is missing is the incentive structure. For example: "The number of entities sufficient to disrupt a blockchain is relatively low: four for Bitcoin". This probably refers to the 4 largest mining pools. Yes, they could temporarily annoy some people by not processing their transactions. But it would come at a giant cost to them. They would be out of business quickly as miners can switch to a different pool in minutes. That is like saying the US economy is brittle because if Walmart, Apple, Amazon and ExxonMobil would just send everybody home and set their premises on fire, there would be a problem.
- mattwilsonn888 4y ago
  That's fair enough, but I believe the paper stayed in its bounds; it is correct that given the means or the willpower control could be assumed. What you should be more worried about than blatant double-spends are all the hidden ways having 51% of network control allows you to cartel, centralize, and siphon funds away from smaller, newer players in the system. https://saito.tech/the-double-spend-attack-is-not-the-same-as-the-51-percent-attack/ https://saito.tech/the-double-spend-attack-is-not-the-same-a...
- etherael 4y ago
  It would be easier even than that, observe what happened in 2017. Bitfinex said they would allocate the BTC ticker to the present BTC chain no matter what the hash power indicated was the actual canonical chain and that was the end of it. Contrary to popular belief, miners aren't choosing anything when it comes to BTC. They're rubber stamping the decisions of the BTC core developers, who are blessed by the exchanges such as Bitfinex, and they are collecting fees on that rubber stamp.
  - JonathanBeuys 4y ago
    That sounds like the right thing to do? Why would the hash power decide what is called BTC? If Dogecoin some day attracts more hashing power than Bitcoin, then Bitfinex is supposed to assign the BTC ticker to Dogecoin?
wslh 4y ago
In July 2016, we created a simple spreadsheet [1] comparing different blockchains and security state of the art at that time [2]. There are things to review there but the theoretical attack to Bitcoin was relatively low for state actors and miners. Miners are not incentivized to do this or do it only as the latest option. It is also important to know that new blockchain technologies such as Solana, Algorand, Avalanche don't have enough scientific peer reviews to make a strong claim in favor or against them now. [1] https://blog.coinfabrik.com/wp-content/uploads/2016/07/Blockchain-Players-and-Feature-Matrix.pdf https://blog.coinfabrik.com/wp-content/uploads/2016/07/Block... [2] https://blog.coinfabrik.com/cryptocurrency/overview-of-blockchain-technologies/ https://blog.coinfabrik.com/cryptocurrency/overview-of-block...
dale_glass 4y ago
I think this misses the elephant in the room: the tech may have flaws, but there's far worse flaws. Who is it that actually has control and influence in crypto? 1. The developers. 2. The miners. 3. Everyone else (very distant from the rest) The developers aren't decentralized at all, they typically are a single, small team with some sort of leader. They can make a lot of decisions almost unilaterally. Then very close below are the miners. The miners have serious economic concerns, so they can do things like refusing to run the software the developers provide. So we can expect devs and miners to be in close contact in most cryptocurrencies. And very far below that is everyone else. You can run your "full node", but most nobody cares. Miners decide what goes or doesn't on the network. And that's why Bitcoin is the way it is. Back when fees rose to $50/transaction because the capacity was overwhelmed... Did the devs have a problem? No, because they had ideas how to sell add-on products to deal with that issue, and such products are much easier to sell when there's a problem that needs fixing. Did the miners have a problem? No, because the network was still heavily used and they were reaping all those juicy fees coming their way. Did the users have a problem? Yes, their experience sucked badly. But for both parties actually in control solving those problems would require losing money. And thus crypto ends up being controlled by a small cabal of elites, while the normal users get screwed.
- loopdoend 4y ago
  I was wondering how Ethereum founder Vitalik Buterin is able to walk around without a security detail, going on extensive backpacking trips, what if someone steals his keys? He’d just fork the entire blockchain. Normal users don’t have that luxury.
  - q-big 4y ago
    > He’d just fork the entire blockchain. > Normal users don’t have that luxury. Everybody else can fork the entire blockchain, too. The difference is that if a "normal user" does such a fork, hardly anyone does care. The central difference rather is that the trust and authority that Vitalik Buterin holds - if he does a decision, it is accepted by and large. The question that you should rather ask is: why do so many people involved in Ethereum have so much trust in Vitalik Buterin's authority and decisions?
8organicbits 4y ago
> More than one in five Bitcoin nodes are running an old version of the Bitcoin core client that is known to be vulnerable. Patching software that is remotely accessible is a pretty basic security measure. I suppose the risk of a hacked node is fairly low, maybe about the same as a node that's run by a malicious owner. Although exploiting nodes would extend the reach if a malicious party.
jrm4 4y ago
Yup, I've come to realize that the word(s) "centralized/decentralized" are doing way too much heavy-lifting in these discussions, and that examining the details is very important. When you use one of these words, you have to immediately ask -- "the power to do WHAT, exactly?" As in, compare to the question e.g. "Is Tesla centralized w/r/t Elon Musk?" You can't meaningfully answer the question with yes or no, and this gets even more complicated with many things in crypto, especially with (the extremely stupidly named) "Smart Contract" as a part of the game.
- mattwilsonn888 4y ago
  I've had the same realization illuminated to me as well. "Decentralized," is just the shape of the network - what people really care about are what the opportunities to control the network look like and how preventable central power is. Its unintuitive but the network can have a centralized topology while still possessing the positive traits people actually seek when they use the work 'decentralized.' https://www.youtube.com/watch?v=C81D6B9sgH8 https://www.youtube.com/watch?v=C81D6B9sgH8
forgotmypw17 4y ago
> Tor is now the largest network provider in Bitcoin; just about 55% of Bitcoin nodes were addressable only via Tor (as of March 2022). A malicious Tor exit node can modify or drop traffic. I'm not sure if I understand this criticism. Is it not true that if something is ONLY available via Tor, then exit nodes are NOT used at all when accessing it, and all of the traffic is encrypted with Tor's encryption layer?
- sweetbitter 4y ago
  You are correct, the researchers just did not realize this.
manytree 4y ago
Honestly there’s a lot of valid points to be made here but the actual report reads as if their intention was to prove blockchains are insecure and centralized. That is true for a lot of them, but true Nakamoto consensus is not quite as fragile as they suggest it is. They don’t provide an analysis of the true cost of launching a 51% attack. Their assertions about the security risk of “altering the software that nodes run” fail to mention how this is a voluntary process which all node operators choose to undergo. If a consensus emerges on the network or a subset of the network that the changes are problematic, these dissenting node operators can choose to hard fork. There will be few supporters of an obviously malicious attack in the network, so it would be unable to gain traction. Their point about the number of entities in control of Bitcoin is technically correct, because of the way that pooling works in Bitcoin: many nodes send any propfs they find to one node, and that one node writes to the blockchain. So, there is a definite concentration of power. There are some in depth game theoretical analyses of why this is unlikely to become a problem but in general it is easy to imagine that, for instance, the US treasury would not want to destroy trust in the USD. Interestingly, Chia, a new proof of work blockchain which launched a year ago, developed by Bram Cohen, has a unique and innovative solution to pooling which does not result in concentration of power: individual node operators submit proofs to the network, not to the pool, and the pool receives a fraction of the reward for minting a new block. Chia also has more full nodes than any oher blockchain, including Bitcoin. At this point it’s relatively unknown however.
- vngzs 4y ago
  The subtext of the DARPA funding makes me think the purpose of this paper is to analyze whether governments can disrupt, block, or compromise cryptocurrencies. The conclusions make some more sense in that light. Still, I think they fail to address several mitigating factors for each of the issues, which weakens the overall message: (1) Mining pools are not even remotely static. In fact, they gain/lose marketshare very quickly, and when problems are discovered, miners actually move. Therefore, it would have to be shown that these pools can be disrupted clandestinely, otherwise an attempted takeover/51% attack would just cause a rebalancing of the pools. To better understand this, it's good to visualize it; here's a graph of changes to miner pool distribution over time: [0] (2) 51% attacks permit double-spend, but many guarantees persist in the light of 51% attacks - nobody can invent coins they don't have with a 51% attack; they can just undo transactions that were assumed to be settled [1]. (3) Software centralization and the implied lack of immutability is subject to the voting influences of node operators; maintainers can't just do whatever they want (in other words, backdoors would probably need to be bugdoors, else they would not be deployed and therefore de facto rejected). Taking Bitcoin as an example, many BIPs have been withdrawn or rejected, either early in the development process or later by the community refusing to adopt releases they don't support: [2]. And you can see this process at work in the block size debates and ultimate resolution [3]. ISP centrality and the vulnerability of the network to malicious Tor exit nodes is the most interesting point to me. Miners can go switch pools, and node operators can band together & refuse to update to new software that does things they disagree with. But can node operators/miners switch ISPs quickly and easily? Not really. There's virtually no free market competition among ISPs, so people can't freely switch ISPs if theirs starts inserting arbitrary latency into Bitcoin traffic. We probably need some ways to operate nodes/miners that are less sensitive to corrupt ISP disruption. Encrypting BTC P2P traffic and developing strategies for operating nodes/miners behind anti-censorship software like ShadowSocks should be high-priority. [0]: https://public.flourish.studio/visualisation/2879848/ https://public.flourish.studio/visualisation/2879848/ [1]: "Even a 51% attacker cannot propose a block that takes away your ETH, because such a block would violate the protocol rules and so it would get rejected by the network. Even if 99% of the hashpower or stake wants to take away your ETH, everyone running a node would just follow the chain with the remaining 1%, because only its blocks follow the protocol rules. More generally, if you have an application on Ethereum, then a 51% attack could censor or revert it for some time, but what comes out at the end is a consistent state." - Vitalik, https://old.reddit.com/r/ethereum/comments/rwojtk/ama_we_are_the_efs_research_team_pt_7_07_january/hrngyk8/ https://old.reddit.com/r/ethereum/comments/rwojtk/ama_we_are... [2]: https://en.wikipedia.org/wiki/Bitcoin_Improvement_Proposals#List_of_BIPs https://en.wikipedia.org/wiki/Bitcoin_Improvement_Proposals#... [3]: https://en.bitcoin.it/wiki/Block_size_limit_controversy https://en.bitcoin.it/wiki/Block_size_limit_controversy
prettyWise 4y ago
"On October 25, 2021, a vulnerability in all prior versions of Geth was discovered that permitted a carefully crafted peer-to-peer message to inflict a denial-of-service attack on the receiving node. 42 From our crawls of the Bitcoin network, we observe that 21% of Bitcoin nodes are running an old version of the Bitcoin Core client that is known to be vulnerable." The beginning of this excerpt is talking about Geth, and how unpatched Geth resulted in a fork of Ethereum. Then, out of nowhere they indicated 21% of Bitcoin nodes are vulnerable and running an old version of the bitcoin core client, and they bold it. They didn't say anything about this vulnerability in the preceding paragraph. Vulnerable to what? Certainly not vulnerable to the same thing that Geth exploit took advantage of.
simonw 4y ago
I found this information about the DARPA contract that funded this research: https://govtribe.com/award/federal-contract-award/definitive-contract-hr001120c0084 https://govtribe.com/award/federal-contract-award/definitive...
- uncomputation 4y ago
  Interesting they are totally different. ZK proofs are used in cryptocurrency, but they can also be used totally separately just as mathematical objects on their own. I don’t see how ZK proofs for defense "capabilities" relates to centralization risk in cryptocurrency networks.
deleted 4y ago
[deleted]
ezoe 4y ago
The article doesn't say the research pointed out that many users aren't decentralized at all. They don't run full-node. They relies on somebody else's SaaS.
sweetbitter 4y ago
> Tor is now the largest network provider in Bitcoin; just about 55% of Bitcoin nodes were addressable only via Tor (as of March 2022). A malicious Tor exit node can modify or drop traffic. Tor's onion services are end-to-end encrypted and do not use exit nodes.

151 points by rdl 4y ago

> "For a blockchain to be optimally distributed, there must be a so-called Sybil cost. There is currently no known way to implement Sybil costs in a permissionless blockchain like Bitcoin or Ethereum without employing a centralized trusted third party (TTP). Until a mechanism for enforcing Sybil costs without a TTP is discovered, it will be almost impossible for permissionless blockchains to achieve satisfactory decentralization." https://saito.tech/wolves-and-sheep/ https://saito.tech/wolves-and-sheep/

rdl 4y ago

This is great research and if anything understates the case for alarm; Bitcoin is one of the more-decentralized projects, and PoW generally has some incentives for diverse hosting (if not network layer). PoS systems often end up on AWS specifically, and sometimes depend on some of the more niche AWS services -- an outage (engineered or accidental) in those could cause easy degradation and facilitate takeover.

latchkey 4y ago
Actually, no. It isn't that great. A lot of people are correcting specific points here in the comments. > More than one in five Bitcoin nodes are running an old version of the Bitcoin core client that is known to be vulnerable. This is brought out as an issue, but it really doesn't matter. Being a large decentralized systems means that having nodes which are at all sorts of different versions, can still work. This is like saying that everyone has to be at the same web browser version for websites to work. The thing that matters is that the nodes that are used for forming blocks (ie: the nodes the pools are running), are updated.

tyoma 4y ago

I would love to see a follow-up that addresses emergent centralization due to winner-take-all or winner-take-most dynamics. This is how we end up with monopolies/duopolies elsewhere in the tech sector, and I suspect the same would hold for blockchain.

m00dy 4y ago

>>Key Findings >>The number of entities sufficient to disrupt a blockchain is relatively low: four for Bitcoin, two for Ethereum, and less than a dozen for most proof-of-stake networks. then why we haven't seen a Bitcoin hack before ? Maybe it is the most secured system.

mattwilsonn888 4y ago
https://saito.tech/the-double-spend-attack-is-not-the-same-as-the-51-percent-attack/ https://saito.tech/the-double-spend-attack-is-not-the-same-a... https://www.investopedia.com/terms/s/selfish-mining.asp https://www.investopedia.com/terms/s/selfish-mining.asp Because you can make more money keeping it under the radar.
frabert 4y ago
From the report, > Even though these Nakamoto coefficients are relatively low, some might argue that exploiting them to attack a blockchain would be prohibitively expensive. While this may be true for individuals, the actors incentivized to perpetrate these attacks include operators of competing currencies and nation-states who have the requisite resources. Perverse incentives can exist with blockchains in the same way that the relative values of fiat currencies can be manipulated.
- mypastself 4y ago
  Competing currencies are unlikely to profit from Bitcoin’s downfall in this scenario, given how much the entire space relies on its reputation. Nation-states, on the other hand, are the more credible threat. Just because none of them has yet found it a big enough threat to expend the required resources, doesn’t mean it can’t happen. I feel like the more Bitcoin is used for its original intended purpose rather than merely speculation, the more likely it is to be attacked by such actors.
- bhaak 4y ago
  I think it's more complex than the report poses it. It's not as if those mentioned entities always have complete control over their mining hardware as those entities include pool miners. I think there's more that prevents an attack than just being "prohibitively expensive".

greyface- 4y ago

> The research to which this blog post refers was conducted by Trail of Bits based upon work supported by DARPA under Contract No. HR001120C0084 More info: https://govtribe.com/award/federal-contract-award/definitive-contract-hr001120c0084 https://govtribe.com/award/federal-contract-award/definitive...

roenxi 4y ago

This is interesting research and I encourage everyone to go read the article. But, on the assumption that a lot of people will just read the headline and comments I'm going to preemptively talk about the question there ... People misunderstand decentralisation in practice. Computer types, when they talk about decentralisation, usually mean a relatively large number of homogeneous nodes acting as peers. Which is cool but not how decentralised systems work in practice out in the meaty reality we all live in. In reality, we have an economy that quickly works out who is the best (say, Samuel is the best) at something (say, mining bitcoin) and routes most of the resources available for hashing to Samuel. The situation is still decentralised, because if Samuel stops being the best at calculating hashes then resources will be reallocated to someone else. But in the short term all the resources will go to Samuel and he could do a lot of damage to the network. People keep thinking that because the economy picks out a few winners that means that the system is now locked in stone - that isn't the case. The economy is perfectly happy to change things up radically when the situation changes. At least until a government steps in and regulates the ability to change flexibly out of the system.

sandworm101 4y ago
Except that Samuel wants to keep his place. So he will do whatever he can to leverage his current centrality to continue. His hope is to be in control when the hammer falls and flexibility stops. One way of doing that is to force the issue. Those in central positions within a dynamic market eventually seek to kill that market, leaving them in the monopoly position (amazon, google, facebook etc). To maintain decentralization in the long term such leaders need to be periodically culled, hopefully though market forces prior to them killing the market. In bitcoin, that might mean periodic removal of the largest commercial actors, perhaps by periodic price crashes that favor niche setups.
- roenxi 4y ago
  > (amazon, google, facebook etc) I'm not sure where I sit on your major point, but these 3 just are not monopolists and this is a mistake that keeps getting made. All 3 of these are in cut throat markets where they compete by selling really great products (AWS, Google Search and Facebook respectively). A lot of individuals don't like them (I refuse to use Google, for example) but that doesn't change the fact that they get market share by being great at what they do.

ncmncm 4y ago

I am always impressed with Trail of Bits work.

whatisweb3 4y ago

Some issues with this report: > The challenge with using a blockchain is that one has to either (a) accept its immutability and trust that the programmers did not introduce a bug, or (b) permit upgradeable contracts or off-chain code that share the same trust issues as a centralized approach. This paints the issue as binary, although there is more to it. Look at the WETH contract in which we both (a) accept its immutability and trust there are no bugs, but also (c) can migrate to a fork at a later point if desired through social consensus. There is another option (d) which is a less developed area: governance models that are not entirely centralized, see Uniswap and Aave. > The number of entities sufficient to disrupt a blockchain is relatively low: four for Bitcoin, two for Ethereum, and less than a dozen for most proof-of-stake networks. The Nakamoto coefficient relates to validator pools colluding to form a 51% attack. In Ethereum PoS this count is a bit higher, around 25-35[1]. Important to note the extreme costs of these attacks, and the defense mechanisms of PoS. If enough validators collude to 51% attack a PoS chain, users can follow a fork and have the attackers coins burned. Attacker would have to continually re-purchase coins to re-attack the new soft forks.[2] > For a blockchain to be optimally distributed, there must be a so-called Sybil cost. There is currently no known way to implement Sybil costs in a permissionless blockchain like Bitcoin or Ethereum without employing a centralized trusted third party (TTP). Until a mechanism for enforcing Sybil costs without a TTP is discovered, it will be almost impossible for permissionless blockchains to achieve satisfactory decentralization. This is based on the Kwon paper which defines "full decentralization" as a set of specific numerical constraints, and demonstrates that it is theoretically impossible for any permissionless system currently known to mankind to satisfy these constraints. Kwon makes no claims about whether this degree of decentralization is "satisfactory" or even necessary for a blockchain. A system that is distributed across thousands of nodes and highly resistant to 51% attacks and collusion is likely enough for it to be considered "decentralized" for practical purposes. [1] https://shsr2001.github.io/beacondigest/notebooks/2021/07/19/measuring_decentralization.html https://shsr2001.github.io/beacondigest/notebooks/2021/07/19... [2] https://vitalik.ca/general/2020/11/06/pos2020.html https://vitalik.ca/general/2020/11/06/pos2020.html

avnigo 4y ago

I found it interesting reading the blog post, but delving into the report, some areas didn't seem as straightforward. I expect to get some flak for saying this, and I don't mean to be cynical, but it's interesting how the table on p. 9 of the report lists Solana with a relatively high Nakamoto coefficient (19 to Bitcoin's 4), given the recent events with Solana [0]. From p. 1 of the report, emphasis my own: > Trail of Bits also operates a center of excellence for blockchain security. Notable projects include audits of Algorand, Bitcoin SV, Chainlink, Compound, Cosmos, Ethereum 2.0, MakerDAO, Matic, Polkadot, Solana, Uniswap, Web3, and Zcash. Some of those notable projects are fervently anti-bitcoin, so while some criticisms and concerns may appear to be valid at a first glance, I don't think it can be said to be without bias. [0]: https://www.coindesk.com/tech/2022/06/19/solana-defi-platform-votes-to-control-whale-account-in-bid-to-avoid-liquidation-chaos/ https://www.coindesk.com/tech/2022/06/19/solana-defi-platfor...

etherael 4y ago
There are very good reasons to be fervently anti-BTC given its history since 2017.
Anon1096 4y ago
That was Solend, not Solana. The concern was just that a liquidation of that scale would significantly move the market.
woodruffw 4y ago
Trail of Bits has no pro- or anti- position when it comes to various cryptocurrency projects. Moreover, this research was entirely funded by DARPA, and was not assisted by any project. Finally, the results only address decentralization, and not the myriad other ways in which these schemes can be economically, politically, or cryptographically unsound. FD: My employer.
- latchkey 4y ago
  > FD: My employer. Oh, that's interesting. Did you write this blog post too? You've been pretty anti-crypto in previous comments here.

JonathanBeuys 4y ago

What the article is missing is the incentive structure. For example: "The number of entities sufficient to disrupt a blockchain is relatively low: four for Bitcoin". This probably refers to the 4 largest mining pools. Yes, they could temporarily annoy some people by not processing their transactions. But it would come at a giant cost to them. They would be out of business quickly as miners can switch to a different pool in minutes. That is like saying the US economy is brittle because if Walmart, Apple, Amazon and ExxonMobil would just send everybody home and set their premises on fire, there would be a problem.

mattwilsonn888 4y ago
That's fair enough, but I believe the paper stayed in its bounds; it is correct that given the means or the willpower control could be assumed. What you should be more worried about than blatant double-spends are all the hidden ways having 51% of network control allows you to cartel, centralize, and siphon funds away from smaller, newer players in the system. https://saito.tech/the-double-spend-attack-is-not-the-same-as-the-51-percent-attack/ https://saito.tech/the-double-spend-attack-is-not-the-same-a...
etherael 4y ago
It would be easier even than that, observe what happened in 2017. Bitfinex said they would allocate the BTC ticker to the present BTC chain no matter what the hash power indicated was the actual canonical chain and that was the end of it. Contrary to popular belief, miners aren't choosing anything when it comes to BTC. They're rubber stamping the decisions of the BTC core developers, who are blessed by the exchanges such as Bitfinex, and they are collecting fees on that rubber stamp.
- JonathanBeuys 4y ago
  That sounds like the right thing to do? Why would the hash power decide what is called BTC? If Dogecoin some day attracts more hashing power than Bitcoin, then Bitfinex is supposed to assign the BTC ticker to Dogecoin?

wslh 4y ago

In July 2016, we created a simple spreadsheet [1] comparing different blockchains and security state of the art at that time [2]. There are things to review there but the theoretical attack to Bitcoin was relatively low for state actors and miners. Miners are not incentivized to do this or do it only as the latest option. It is also important to know that new blockchain technologies such as Solana, Algorand, Avalanche don't have enough scientific peer reviews to make a strong claim in favor or against them now. [1] https://blog.coinfabrik.com/wp-content/uploads/2016/07/Blockchain-Players-and-Feature-Matrix.pdf https://blog.coinfabrik.com/wp-content/uploads/2016/07/Block... [2] https://blog.coinfabrik.com/cryptocurrency/overview-of-blockchain-technologies/ https://blog.coinfabrik.com/cryptocurrency/overview-of-block...

dale_glass 4y ago

I think this misses the elephant in the room: the tech may have flaws, but there's far worse flaws. Who is it that actually has control and influence in crypto? 1. The developers. 2. The miners. 3. Everyone else (very distant from the rest) The developers aren't decentralized at all, they typically are a single, small team with some sort of leader. They can make a lot of decisions almost unilaterally. Then very close below are the miners. The miners have serious economic concerns, so they can do things like refusing to run the software the developers provide. So we can expect devs and miners to be in close contact in most cryptocurrencies. And very far below that is everyone else. You can run your "full node", but most nobody cares. Miners decide what goes or doesn't on the network. And that's why Bitcoin is the way it is. Back when fees rose to $50/transaction because the capacity was overwhelmed... Did the devs have a problem? No, because they had ideas how to sell add-on products to deal with that issue, and such products are much easier to sell when there's a problem that needs fixing. Did the miners have a problem? No, because the network was still heavily used and they were reaping all those juicy fees coming their way. Did the users have a problem? Yes, their experience sucked badly. But for both parties actually in control solving those problems would require losing money. And thus crypto ends up being controlled by a small cabal of elites, while the normal users get screwed.

loopdoend 4y ago
I was wondering how Ethereum founder Vitalik Buterin is able to walk around without a security detail, going on extensive backpacking trips, what if someone steals his keys? He’d just fork the entire blockchain. Normal users don’t have that luxury.
- q-big 4y ago
  > He’d just fork the entire blockchain. > Normal users don’t have that luxury. Everybody else can fork the entire blockchain, too. The difference is that if a "normal user" does such a fork, hardly anyone does care. The central difference rather is that the trust and authority that Vitalik Buterin holds - if he does a decision, it is accepted by and large. The question that you should rather ask is: why do so many people involved in Ethereum have so much trust in Vitalik Buterin's authority and decisions?

8organicbits 4y ago

> More than one in five Bitcoin nodes are running an old version of the Bitcoin core client that is known to be vulnerable. Patching software that is remotely accessible is a pretty basic security measure. I suppose the risk of a hacked node is fairly low, maybe about the same as a node that's run by a malicious owner. Although exploiting nodes would extend the reach if a malicious party.

jrm4 4y ago

Yup, I've come to realize that the word(s) "centralized/decentralized" are doing way too much heavy-lifting in these discussions, and that examining the details is very important. When you use one of these words, you have to immediately ask -- "the power to do WHAT, exactly?" As in, compare to the question e.g. "Is Tesla centralized w/r/t Elon Musk?" You can't meaningfully answer the question with yes or no, and this gets even more complicated with many things in crypto, especially with (the extremely stupidly named) "Smart Contract" as a part of the game.

mattwilsonn888 4y ago
I've had the same realization illuminated to me as well. "Decentralized," is just the shape of the network - what people really care about are what the opportunities to control the network look like and how preventable central power is. Its unintuitive but the network can have a centralized topology while still possessing the positive traits people actually seek when they use the work 'decentralized.' https://www.youtube.com/watch?v=C81D6B9sgH8 https://www.youtube.com/watch?v=C81D6B9sgH8

forgotmypw17 4y ago

> Tor is now the largest network provider in Bitcoin; just about 55% of Bitcoin nodes were addressable only via Tor (as of March 2022). A malicious Tor exit node can modify or drop traffic. I'm not sure if I understand this criticism. Is it not true that if something is ONLY available via Tor, then exit nodes are NOT used at all when accessing it, and all of the traffic is encrypted with Tor's encryption layer?

sweetbitter 4y ago
You are correct, the researchers just did not realize this.

manytree 4y ago

Honestly there’s a lot of valid points to be made here but the actual report reads as if their intention was to prove blockchains are insecure and centralized. That is true for a lot of them, but true Nakamoto consensus is not quite as fragile as they suggest it is. They don’t provide an analysis of the true cost of launching a 51% attack. Their assertions about the security risk of “altering the software that nodes run” fail to mention how this is a voluntary process which all node operators choose to undergo. If a consensus emerges on the network or a subset of the network that the changes are problematic, these dissenting node operators can choose to hard fork. There will be few supporters of an obviously malicious attack in the network, so it would be unable to gain traction. Their point about the number of entities in control of Bitcoin is technically correct, because of the way that pooling works in Bitcoin: many nodes send any propfs they find to one node, and that one node writes to the blockchain. So, there is a definite concentration of power. There are some in depth game theoretical analyses of why this is unlikely to become a problem but in general it is easy to imagine that, for instance, the US treasury would not want to destroy trust in the USD. Interestingly, Chia, a new proof of work blockchain which launched a year ago, developed by Bram Cohen, has a unique and innovative solution to pooling which does not result in concentration of power: individual node operators submit proofs to the network, not to the pool, and the pool receives a fraction of the reward for minting a new block. Chia also has more full nodes than any oher blockchain, including Bitcoin. At this point it’s relatively unknown however.

vngzs 4y ago
The subtext of the DARPA funding makes me think the purpose of this paper is to analyze whether governments can disrupt, block, or compromise cryptocurrencies. The conclusions make some more sense in that light. Still, I think they fail to address several mitigating factors for each of the issues, which weakens the overall message: (1) Mining pools are not even remotely static. In fact, they gain/lose marketshare very quickly, and when problems are discovered, miners actually move. Therefore, it would have to be shown that these pools can be disrupted clandestinely, otherwise an attempted takeover/51% attack would just cause a rebalancing of the pools. To better understand this, it's good to visualize it; here's a graph of changes to miner pool distribution over time: [0] (2) 51% attacks permit double-spend, but many guarantees persist in the light of 51% attacks - nobody can invent coins they don't have with a 51% attack; they can just undo transactions that were assumed to be settled [1]. (3) Software centralization and the implied lack of immutability is subject to the voting influences of node operators; maintainers can't just do whatever they want (in other words, backdoors would probably need to be bugdoors, else they would not be deployed and therefore de facto rejected). Taking Bitcoin as an example, many BIPs have been withdrawn or rejected, either early in the development process or later by the community refusing to adopt releases they don't support: [2]. And you can see this process at work in the block size debates and ultimate resolution [3]. ISP centrality and the vulnerability of the network to malicious Tor exit nodes is the most interesting point to me. Miners can go switch pools, and node operators can band together & refuse to update to new software that does things they disagree with. But can node operators/miners switch ISPs quickly and easily? Not really. There's virtually no free market competition among ISPs, so people can't freely switch ISPs if theirs starts inserting arbitrary latency into Bitcoin traffic. We probably need some ways to operate nodes/miners that are less sensitive to corrupt ISP disruption. Encrypting BTC P2P traffic and developing strategies for operating nodes/miners behind anti-censorship software like ShadowSocks should be high-priority. [0]: https://public.flourish.studio/visualisation/2879848/ https://public.flourish.studio/visualisation/2879848/ [1]: "Even a 51% attacker cannot propose a block that takes away your ETH, because such a block would violate the protocol rules and so it would get rejected by the network. Even if 99% of the hashpower or stake wants to take away your ETH, everyone running a node would just follow the chain with the remaining 1%, because only its blocks follow the protocol rules. More generally, if you have an application on Ethereum, then a 51% attack could censor or revert it for some time, but what comes out at the end is a consistent state." - Vitalik, https://old.reddit.com/r/ethereum/comments/rwojtk/ama_we_are_the_efs_research_team_pt_7_07_january/hrngyk8/ https://old.reddit.com/r/ethereum/comments/rwojtk/ama_we_are... [2]: https://en.wikipedia.org/wiki/Bitcoin_Improvement_Proposals#List_of_BIPs https://en.wikipedia.org/wiki/Bitcoin_Improvement_Proposals#... [3]: https://en.bitcoin.it/wiki/Block_size_limit_controversy https://en.bitcoin.it/wiki/Block_size_limit_controversy

prettyWise 4y ago

"On October 25, 2021, a vulnerability in all prior versions of Geth was discovered that permitted a carefully crafted peer-to-peer message to inflict a denial-of-service attack on the receiving node. 42 From our crawls of the Bitcoin network, we observe that 21% of Bitcoin nodes are running an old version of the Bitcoin Core client that is known to be vulnerable." The beginning of this excerpt is talking about Geth, and how unpatched Geth resulted in a fork of Ethereum. Then, out of nowhere they indicated 21% of Bitcoin nodes are vulnerable and running an old version of the bitcoin core client, and they bold it. They didn't say anything about this vulnerability in the preceding paragraph. Vulnerable to what? Certainly not vulnerable to the same thing that Geth exploit took advantage of.

simonw 4y ago

I found this information about the DARPA contract that funded this research: https://govtribe.com/award/federal-contract-award/definitive-contract-hr001120c0084 https://govtribe.com/award/federal-contract-award/definitive...

uncomputation 4y ago
Interesting they are totally different. ZK proofs are used in cryptocurrency, but they can also be used totally separately just as mathematical objects on their own. I don’t see how ZK proofs for defense "capabilities" relates to centralization risk in cryptocurrency networks.

deleted 4y ago

[deleted]

ezoe 4y ago

The article doesn't say the research pointed out that many users aren't decentralized at all. They don't run full-node. They relies on somebody else's SaaS.

sweetbitter 4y ago