23 ms·

Ethereum Proof-of-Stake

YetAnotherNick 4y ago
I have seen description like this so many times, but no guide seems to describe exactly how everything is done in decentralised way. "The validators for each slot are assigned to committees". By whom? Also what if there is network partition for these 12 seconds. It's not very unlikely that some country could be completely cutoff from the internet for some time due to anything from natural or political reasons. Could there be recovery after this? At least in PoW, it is clear on what could be the possible scenarios.
- RL_Quine 4y ago
  Generally we've described this sort of research as "review resistant", rather than being secure in some classical sense. How Ethereum and other cryptocurrencies actually work is often eagerly explained but completely unfathomable on closer inspection. Concerns raised are fixed with additional complexity repeatedly until the reviewer grows weary of attempting to piece it together. Consequently there's sufficient conflicting descriptions that I don't think anybody has any hope of successfully understanding the system as a whole, much less being able to come to conclusions about its security.
  - whatisweb3 4y ago
    The spec is open and documented pretty clearly.[1] [1] https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc
    - capableweb 4y ago
      Considering that Eth2 also have about 7 clients that work today (with more being worked on), the specification is clearly understandable by at least 7 different entities, further eroding the argument that Eth2 specification is so complicated no one actually understands it.
      - ben-schaaf 4y ago
        Most of the linked spec is pseudocode - actually it looks like valid python code. So to be fair I highly doubt you'd need any understanding of what it's actually doing to successfully implement that spec. Just like I still have no clue how Quaternions work, yet I've implemented them multiple times.
        freemint 4y ago
        How much would one need to pay you to test your hypothesis? That is you try to implement a standard complaint new Eth2 implementation from scratch ( and possible record yourself while doing so.
    - YetAnotherNick 4y ago
      That's just a random function description. The main thing here is how is seed calculated and analysis of whether it seed is safe from network partition, DDoS, malicious attack, nodes being offline, forks etc.
      - whatisweb3 4y ago
        Also clearly documented and open to researchers to examine. The full code for the various Eth2 clients is open source. [1] https://eth2book.info/altair/part2/building_blocks/randomness https://eth2book.info/altair/part2/building_blocks/randomnes... [2] https://eth2.incessant.ink/book/06__building-blocks/02__randomness.html https://eth2.incessant.ink/book/06__building-blocks/02__rand...
  - capableweb 4y ago
    That's a gross misrepresentation of how it works in the real-world. Do you believe the same about cryptography? Since you can't understand it, and few really understand the full system, algorithms and functions, it must be "review resistant" rather than actually safe to use?
    - josh2600 4y ago
      Cryptography has mathematical proofs of the underlying math that are rigorous. There are constraints such as breaking if a proof of an attack against the discrete log were to emerge or other constraints related to p=np. The implementations are also very close to formally verified if not fully formally verified. Nothing is perfect but cryptographic code has to be pretty bulletproof or a lot of systems would get owned. The descriptions of how to verify cryptographic systems are academically and professionally rigorous especially compared to eth. Caveat: sometimes the underlying systems that cryptographic implementations utilize change degrading their guarantees. There have been times where the compiler will get updated and cause what was a branchless process to branch which could lead to information leaks against a dedicated attacker. Thankfully such examples are rare in the literature.
      - capableweb 4y ago
        > The implementations are also very close to formally verified if not fully formally verified. So is Eth2, see "Formal Verification of the Ethereum 2.0 Beacon Chain" by Franck Cassez, Joanne Fuller, Aditya Asgaonkar, paper (https://arxiv.org/abs/2110.12909 https://arxiv.org/abs/2110.12909) and source code (https://github.com/ConsenSys/eth2.0-dafny https://github.com/ConsenSys/eth2.0-dafny). More efforts to formally verify Eth2 is ongoing as well, by different entities. > Nothing is perfect but cryptographic code has to be pretty bulletproof or a lot of systems would get owned Same with Ethereum. The chance of having a major impact with a vulnerability is even higher I'd argue, as you can easily extract currency you can trade for USD, and the entire network is inter-connected, so finding targets to exploit becomes even easier. Point still stands that cryptography goes over a lot of peoples head, but you don't hear those people complaining that because they don't understand it, no one does.
  - bowsamic 4y ago
    "I don't get it so it must be false" that's what you sound like right now
  - douglaswlance 4y ago
    All popular Ethereum clients are open-source. If you really want to know how it works, go read the code.
  - pa7x1 4y ago
    How can this argument be made in good faith? The spec is open source, all the clients are open source. Furthermore, it's implemented and running. You could argue that someone in particular has made a poor or incomplete explanation of how it works but not that they way it works is unfathomable or being patched as your speak. It's already implemented, go look at the code if you don't want to believe what anyone says.
    - jayd16 4y ago
      If the spec is open source, how can you say all the clients are open source? Or do you simply mean there are open source clients one can inspect and use?
      - pa7x1 4y ago
        There is a specification of the protocol, which is open source: https://github.com/ethereum/consensus-specs https://github.com/ethereum/consensus-specs And there are over 5 interoperable, independent and open source implementations of said specification: - https://github.com/sigp/lighthouse/ https://github.com/sigp/lighthouse/ - https://github.com/ChainSafe/lodestar https://github.com/ChainSafe/lodestar - https://github.com/status-im/nimbus-eth2 https://github.com/status-im/nimbus-eth2 - https://github.com/prysmaticlabs/prysm https://github.com/prysmaticlabs/prysm - https://github.com/ConsenSys/teku https://github.com/ConsenSys/teku - https://github.com/sifraitech/grandine https://github.com/sifraitech/grandine ...
        deleted 4y ago
        [deleted]
  - Humdeee 4y ago
    But isn't that a great description of our current banking system as it is today? Not everyone knows everything, somehow it works, complex, etc. However, still so woefully insecure.
  - aaaaaaaaata 4y ago
    Spoken like somebody who doesn't read Buterin.
- 3np 4y ago
  As for the source of randomness, they mention it briefly in the appendix: > RANDAO: the random number generation scheme used to select block proposers, sort validators into committees, etc Spec and implementation: https://github.com/randao/randao https://github.com/randao/randao
- rgrmrts 4y ago
  Heres my understanding of it: committee assignment is random, as in baked into the protocol, similar to how a validator is selected for a block (i.e. randomly). While only one validator creates the block, others create attestations which I understand as duplicate work done to check the chosen validators produced block. If an entire country goes down, those validators fall out of the active set and assuming some majority is still active they'll produce and verify blocks. Incorrect state is rejected by the majority, and the minority is punished (slashing their stake). Full disclosure, I'm not an expert - just an enthusiast interested in these protocols. Would love for someone more knowledgeable to correct my mistakes. I'm also not arguing for or against anything here.
  - bhaak 4y ago
    > Incorrect state is rejected by the majority, and the minority is punished (slashing their stake). That's wrong. Also the state of those validators that are separated from the larger network is not wrong it's just not the same as what the majority considers the state. They will be on a forked chain of the network. But for being on a fork, no validator is slashed. They will only lose out on the rewards they would have gotten on the majority chain. Validators are only slashed if they try to vote for the same slot/blockheight on different forks of the chain.
    - rgrmrts 4y ago
      Ah, thanks. How does the forked chain reconcile with the rest of the network once the networks sync back up?
      - bhaak 4y ago
        I think that depends on how long the validators were cut off from the majority of validators. Ethereum's POS has a concept called finality which means that under certain conditions the blockchain gets checkpoints that can't ever be reverted. Somewhat simplified but the the blocks are finalized if 2/3rd of the validators validated the last 64 blocks. So, normally after about 13 minutes you can be sure if the transactions are set in stone or not. If the cut off validators are reunited after not too long, they won't have been able to finalize any blocks and then they will just throw away the part of the chain they have been building since they were separated from the majority. As far as I understand it that's quite similar to a reorg on a POW blockchain. The other case, if they've been separated for a very long time, the situation is a bit different. If you don't follow your duties as a validator, you get penalized. A little of your staked ETH is burned. Note, that's not the same as slashing (which is much harsher) and if your staked ETH balance falls below 16 ETH, you're kicked off the list of validators. This is so that active validators will be able to reach again a 2/3rd majority after a while and be able to finalize blocks. If this happens to our cut off validators, even if they get access to the other validators data again, they can't reorg the blockchain as their blocks have been finalized. In this case, the admins need to manually reset the data so the validators can rejoin the correct chain. This is a known issue which POW networks don't have. There you can always rely on the chain that has the most work done. But the work is cheap and fast in POS networks so you sometimes need to get external info and verify it by hand.
- whatisweb3 4y ago
  According to Eth docs: > One validator is randomly selected to be a block proposer in every slot. This validator is responsible for creating a new block and sending it out to other nodes on the network. Also in every slot, a committee of validators is randomly chosen, whose votes are used to determine the validity of the block being proposed. The annotated code for this can be found in [2]. [1] https://github.com/ethereum/annotated-spec/blob/master/phase0/beacon-chain.md#compute_proposer_index https://github.com/ethereum/annotated-spec/blob/master/phase... [2] https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc
  - niemandhier 4y ago
    Maybe I am stupid, but at least to me its not obvious how one would randomly select a member in a decentralized way, assuming some actors are malicious?
    - capableweb 4y ago
      There are tons of different ways of doing so, with their own set of pros/cons. I'm not familiar with exactly how Eth2 does it, but I suppose your curiosity is a general one, not specific to Eth2, so here is how it works for Algorand as an example using VRFs (Verifiable Random Function): > The VRF takes a secret key and a value and produces a pseudorandom output, with a proof that anyone can use to verify the result. The VRF functions similar to a lottery and is used to choose leaders to propose a block and committee members to vote on a block. This VRF output, when executed for an account, is used to sample from a binomial distribution to emulate a call for every Algo in a user’s account. The more Algos in an account, the better chance the account has of winning – it’s as if every Algo in an account gets its own lottery. This method ensures that a user does not gain any advantage by creating multiple accounts. https://www.algorand.com/Algorand%20Protocol.pdf https://www.algorand.com/Algorand%20Protocol.pdf The search term you're looking for is "decentralized leader election", searching for that on Google or Google Scholar gives you bunch of results ranging from random musings to academic papers.
      - 4y ago
- ricochet11 4y ago
  https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-chain/#compute_committee https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-ch...
- norswap 4y ago
  Would recommend reading Ben Edgington's annotated spec: https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-chain/ https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-ch... It's not entirely up to date (none of the annotated specs are) but out of the three annotated specs I'm aware of, it's the one that is most focused on explaining how things work. Vitalik's annotation (linked in another comment) places a particular focus on the reason specific constants where chosen.
- 0xfoobar 4y ago
  Article author here. Great questions, should have explored the randomness beacon more. Ethereum uses [RANDAO](https://github.com/randao/randao https://github.com/randao/randao), which is a distributed commit-reveal scheme where participants in the generation post a hash of their data on the commit portion and then at a later timestamp reveal the data preimage, and get slashed if they do not reveal a correct preimage. Then all participant data is aggregated together. This means if there is at least one honest participant the generation will be random. A supermajority (2/3rds) of validators is required to finalize a block, in case of a 50-50 network partition blocks would stop being finalized and attestation rewards would stop. Non-participating validators would slowly leak stake through the inactivity leak until online validators once again had a supermajority. This is the "self-healing" mechanism that allows both safety and liveness.
mmastrac 4y ago
I can't see governments allowing PoW to continue to exist in our current climate (in all senses). How would Bitcoin ever move over to PoS like this? Would it just be a Bitcoin hard fork?
- whatisweb3 4y ago
  Yes it would need a hard fork - but Bitcoin community is notoriously resistant to change, so it probably would not happen for some years or decades.
  - RL_Quine 4y ago
    It's actually a soft fork to change the consensus method believe it or not, even changing to a new proof of work scheme is completely backwards compatible. It's not a good idea and it's sort of ridiculous, but it is technically doable. If you felt inclined, we could change the transaction format, switch the scripting language to x86 assembly, issue new currencies- all in a soft fork.
    - whatisweb3 4y ago
      How is it backwards compatible? Clients cannot continue to secure the protocol by hash mining after switching the protocol from PoW to PoS. Bitcoin moving to PoS would probably lead to a hard fork and split - two protocols, one where some group want to stay on the PoW fork, and another where some group want to migrate to the new PoS fork.
      - RL_Quine 4y ago
        You define a consensus rule in NewStakeChain that it must include within it a valid block for OldChain that contains no transactions, or otherwise causes damage to the network by making it unusable such as a reorganization proof. Once the OldChain network has been destroyed by the new one, the consensus rule can be relaxed and there no longer needs to be POW completed by anybody. This specific example works and is economically rational because miners could make a PoW block and get its reward, or they could make the no transaction attack block and get its reward, plus the reward on NewStakeChain for submitting the proof.
TacticalCoder 4y ago
> There are two key equivocation rules a validator must follow, taken from the Gasper paper: > > Double vote - no validator makes two distinct attestations for the same target block > > Surround vote - no validator makes an attestation that surrounds or is surrounded by a previous attestation Which are both punished by having the saked ETHs being "slashed" (32 ETHs staked, you end up losing 16 of the 32). I never understood that: it opens a door for a huge attack in that it's now impossible to safely "stake". Ethereum devs says you can safely stake in that staked ETHs aren't at risk of being stolen (the key to stake and to move the ETHs aren't the same, so it's impossible for an attacker to steal the 32 ETHs) but... An attacker accessing a staking node can, on purpose, double vote or surround vote to get the ETH slashed. The difference between losing 32 ETHs or 16 ETHs is not that big (sure, in the case of slashing at least the attacker doesn't get them, but for the person losing the ETHs, it doesn't make a huge difference). So it's impossible to stake without risking your ETHs getting slashed, even if the staker is honest. Here's my prediction: we'll see exactly that attack on slashing nodes, people are going to lose ETHs and we'll see excuses to the tune of "you didn't securize your node well enough". I do think it should be possible to stake without that risk (just as it is possible to hold the private keys to cryptocurrencies on hardware wallets because, well, computers are all too often insecure). Here's another prediction: some are going to come up with HSM to stake ETHs (maybe they already exist?). The risk of getting people's ETHs slashed is just too big.
- capableweb 4y ago
  > So it's impossible to stake without risking your ETHs getting slashed, even if the staker is honest. I mean, the entire point of staking your ETH is to say "Hey, I'm willing to risk these ETH to \"prove\" that I'm a honest validator and that my node is secure. If I fuck up, I'm willing to accept the punishment". Without risking those ETH, it means nothing to stake ETH, and would break down the idea behind it. I'm not sure if you fundamentally miss the idea behind staking, or if I'm missing something obvious in your critique of staking.
  - TacticalCoder 4y ago
    Wait... Couldn't the same argument be used simply to move coins? "My keys, my coins. If I fuck up by holding my keys on an insecure computer, I deserve my coins to be stolen.". Yet there are HSM / hardware wallet so that it becomes way harder to "fuck up". There's a difference between a nefarious actor having its own ETH slashed and a nefarious actor finding a way to have an honest actor's ETH slashed. Isn't it possible to imagine secure hardware device to stake ETHs instead of having to run validation code on general, insecure, purpose computers which gets owned all the time? I literally mean that: the same as hardware wallet to stake/validate instead of sign transactions. I think you got my critique right: I find it's folly to stake on general purpose computers.
hansword 4y ago
Doesn't this just mean the rich decide? Please correct me if I am wrong, but that is what it sounds to me. (And yes, I understand that POW means the 'compute-rich' decide.)
- shekhirin 4y ago
  I think there's two points to unpack: 1. As you said, it was compute-rich before, and native token-rich now. I see it that way: the difference is that your richness is now a part of the protocol which allows it to e.g. punish bad actors (aka slashing) which isn't possible in PoW scenario where attacks can continue indefinitely. 2. Validators don't solely decide rules of execution: full nodes do. If you, as a validator, try to break the rules (double spend, incorrect execution, etc.), full nodes won't accept this new world view and discard it. So providers like Infura which most users (currently) use will continue working as expected and the canonical chain won't be damaged.
  - __alexs 4y ago
    Who defines what a "bad" actor is?
    - DennisP 4y ago
      Objective protocol rules. If you send staking transactions that conflict with each other in certain specific ways, then you get slashed.
- NoGravitas 4y ago
  Yes, that's how I understand the paragraph near the end that says "Proof-of-any-resource is centralizing".
- whatisweb3 4y ago
  Decide on what? They are not governing the protocol or restricting who can use it, only proposing blocks and submitting attestations. They have limited capabilities to make changes in the ledger, and if they do enact undesirable changes they risk their capital being slashed. If you as a user wants to participate in protocol validation and its rewards without staking 32ETH, you can use a decentralized staking pool like RocketPool. As of yet there are no sound methods of securing a public ledger without either PoW, PoS or PoA. Bitcoin uses PoW, most central banking and traditional payment processors use PoA, Ethereum will soon use PoS.
mike8889 4y ago
Baopab 4y ago
Great article, it put an end to many misunderstandings that I had. The technology is truly marvelous.
- dimgl 4y ago
  What's so marvelous about it? Also, how is proof of stake hard to understand? People with a lot of Ethereum are now validators. ???
  - stackedinserter 4y ago
    Name a thing that you consider "marvelous".
    - dimgl 4y ago
      I keep seeing this kind of retort online whenever I ask someone to describe what is "great" about something. Why does it matter what I consider "great"/marvelous?
drdrek 4y ago
Ahh proof of stake, the nail in the coffin of decentralization. What did you say? the more you have of the capital the more you influence the system? what a novel concept! Monterey and legal systems based on structures that are at least partially built to take care of the needs of people of similar culture and geographic area? YUCK! Machine enforced plutocratic system where early adopters and syndicates have absolute power?! SIGN ME THE FUCK UP!
- xadhominemx 4y ago
  It’s a lot more challenging to run a mining operation that even breaks even over the long run than it is to buy a couple eth and start staking
  - bombcar 4y ago
    Like many decentralized systems, it's not actually decentralized but can have the appearance of such. All these systems have "whales" such that the individual can't do much except align with a whale. Applies to more than just crypto, too.
    - flatline 4y ago
      The internet is this way. The reality is more about peering agreements and CDNs than a neutral decentralized computer network. But it is still decentralized, just primarily among a few big players.
      - bombcar 4y ago
        Yeah, but people hear "decentralized" and think "I can do whatever I want" - not the reality of what it actually is and how it works.
  - cowtools 4y ago
    Why is it necessary to break even? Ordinary users can mine on their home hardware and make a return on their existing hardware before it depreciates.
SilverBirch 4y ago
>Let’s walk through a couple theoretical scenarios where a subset of malicious validators wants to censor transactions, say those originating in FATF-blacklisted countries. Hang on a second. Just to be clear about this example, this example is walking through how Ethereum has been designed specifically to allow North Korea to transact Ethereum, and more than that, prevent anyone who dissents. Like, I mean ok, I get the ideological position in theory of saying "Hey, we're going to design this network so that you can't prevent any transactions." But it's quite different to go "The motivating example of why we would want to do this is so that we can help Iran and North Korea money launder in a direct attack against our own government's laws". Here's my counter-example to the scenarios the author puts forward. You stake 32 eth to become a validator node and start signing off transactions from North Korea. Other people choose not to do that because... well. Your stake slowly goes up and they slowly bleed Eth. Then the US government smash down your door and throw you in federal prison because you're actively working to help North Korea.
- hprotagonist 4y ago
  https://www.bbc.com/news/business-61090064 https://www.bbc.com/news/business-61090064 you don’t even need to go that far!
- capableweb 4y ago
  Yes, if you actively and knowing break the law, you might get punished for it. Not sure what's new here? If you don't want to connect to North Korea, block connections coming from North Korea, it's like one or two commands of iptables.
  - bluGill 4y ago
    Ignorance of the law is not a valid defense. It might get you a lighter sentience, but don't count on that. You are expected to know all the laws that apply to all the activities you do.
    - deleted 4y ago
      [deleted]
Barrera 4y ago
The article does not even mention long range attacks in which large portions of the block chain are rewritten. This is made extremely hard in Bitcoin through proof-of-work. To rewrite history you must re-do all of the work, which means you burn enough real-world energy to work faster than the entire rest of the network (aka majority hash rate attack). It's allowed, but expensive. In PoS, there was never any work, so you can just rewrite history. Every time the subject of Ethereum's move to PoS comes up, it seems this issue is there. The solutions mutate into a head-spinning kaleidoscope of different guises, all rabbit holes in their own maddening way and suspicious on that basis alone. That this lengthy piece doesn't even mention long range attacks speaks volumes.
- 0xfoobar 4y ago
  Article author here. Supermajority attestations and block finalization, as well as withdrawal queues, prevent long-range attacks. To attempt to reorg a finalized block (blocks are generally finalized after 6 minutes) you have to commit to losing 1/3 of total staked ether, currently several billion dollars. The only participants who can equivocate (vote for two blocks at the same height) are active validators so there is significant economic value at risk to pursue such an attack.
  - naveen99 4y ago
    Wasn’t there a recent attack on solana/ solend, where the attacker was willing to lose more than 30% for the chance to cash out and crash solend at the same time ?
    - 0xfoobar 4y ago
      The Solend drama was at the app-layer rather than the protocol-layer. Solana also runs PoS but its variant is a bit more handwavy and weaker imo, slashing rules are applied in a post-hoc human decision-making process rather than clear rules enshrined within the protocol.
  - camjohnson26 4y ago
    Theoretically, if somebody forked the Ethereum PoS blockchain and faked timestamps to catch up to the real chain’s height, would there be any way to know which was the original other than community agreement? Seems like PoW makes it impossible since duplicating the original chain is prohibitively expensive. Not challenging the solution, just genuinely curious in how PoS works.
snapcaster 4y ago
I'm going to be really impressed and surprised if this ends up working (moving ETH to PoS). I'm still fairly skeptical. It seems like PoS has so many issues that come up with additional complexity being added to handle them. Worried it's increasing the attack surface too much and making a system that's not going to be able to be secured. That being said, I hope it works but it's been "two months from merge" for 5 years so hard to say
- ruuda 4y ago
  The Merge has been a pipe dream for a long time, but at this point, the implementation exists. Multiple testnets have already undergone the PoW -> PoS transition. Some minor implementation issues came up that have been fixed. I'm pretty confident it will happen, it's more a matter of more extensive testing and coordination at this point. As for when, Metaculus thinks 5 months from now [1], Polymarket thinks 2-3 months from now. [2] If you are truly skeptical about that timeline, you can make money on Polymarket (or virtual internet points on Metaculus). [1]: https://www.metaculus.com/questions/7971/ethereum-consensus-mechanism/ https://www.metaculus.com/questions/7971/ethereum-consensus-... [2]: https://polymarket.com/market-group/ethereum-merge-pos https://polymarket.com/market-group/ethereum-merge-pos
- lazzlazzlazz 4y ago
  I have been professionally close to the situation for more than four years, and it has never been "two months from the Merge" before. It was expected to be in about four years about five years ago. That's the most it's been delayed so far, which is impressive in my view given how much novel research has been required. For anyone curious about an academic explanation of the problems being solved by ETH 2.0's consensus model, see this paper[1] out of David Tse's lab at Stanford. [1]: https://arxiv.org/abs/2009.04987 https://arxiv.org/abs/2009.04987
  - snapcaster 4y ago
    I'm not closely involved, and was speaking a little off the cuff referencing the perceptions given by casual observers by the hype crowd. Thanks for the info will read the paper linked
throwaway23236 4y ago
Just so I am clear, if you want to be a validator, you need ~32,000 USD? Seems like that is out of reach for most people.
- dylkil 4y ago
  thats why things like rocket pool exist
- alex_suzuki 4y ago
  It used to be a lot more expensive. :-)
icevoid 4y ago
Leaving behind the technical details and the energy consumption aspect, it seems to me that the main economic difference between PoW and PoS is that in the former miners are forced to sell their earned tokens due to a high cost of keeping their equipment up and running. This sounds like a healthier approach. Whereas PoS validators don't have the same burden, therefore they'd naturally tend to simply increase their shares.
amluto 4y ago
Following some links: https://notes.ethereum.org/@vbuterin/single_slot_finality https://notes.ethereum.org/@vbuterin/single_slot_finality > If 51% of validators start censoring, the victims and users can coordinate on a minority soft fork where they build on each other’s blocks and ignore the attacker. On the minority soft fork, the attacker’s deposits would lose millions of ETH to an inactivity leak, and after a few weeks the chain resumes finalizing. It seems that this could easily be turned around: if enough malicious validators coordinate, they can create a soft fork that burns every honest validator’s stake until the malicious validators have an ever increasing supermajority. New victims who aren’t validators could try to become validators to fight back, but the colluding validators can just ignore those proposed transactions.
- jdoliner 4y ago
  They can only burn the honest validators stake on the softfork though. The main chain won't be impacted.
  - amluto 4y ago
    I can think of plenty of ways to profit that don’t require burning an honest validator’s stake as the source of profit.
- redox99 4y ago
  That's the social consensus, or "L0 consensus". It's a fork, so on only on this fork the attackers would lose the ETH. The social consensus means that actual humans, in front of these 2 forks of ETH , the original chain being attacked, and the one where all the attackers stake has been deleted so it's safe (and also non-attackers "richer"), humans would call the latter "Ethereum" and use that. And the former would fall into irrelevance.
  - cowtools 4y ago
    Why not just ditch the whole Proof-of-Stake system and use a classical consensus system then?
ck2 4y ago
I mean it's going to be just absolutely fascinating to see what happens in real life vs all the theories. I guess if you are heavily invested it's rather dread than intellectual curiosity. There are plenty of other options if it all goes south.
kobieyc 4y ago
Something that always trips me up about PoS is how a system that determines the transactional chronology (i.e. sequence of valid blocks) that uses, as a weighted input, the current transactional chronology (valid blocks determine your stake) isn't a logically a circular definition.
- wmf 4y ago
  Everyone does have to agree out of band on the genesis block or some equivalent. Once you have that, the protocol can progress automatically.
k2xl 4y ago
> To attempt to reorg a finalized block (blocks are generally finalized after 6 minutes) you have to commit to losing 1/3 of total staked ether, currently several billion dollars. Hmm... Several billion dollars is not actually that much money for nation states. Am I misunderstanding something here? Shouldn't it be much more expensive than several billion?
TheDudeMan 4y ago
Talks about PoW, PoS, PoA, but totally ignores Chia's superior PoST.
jl2718 4y ago
This is an opinion piece supporting POS. Simple question: if blockchains of similar (large) market cap are compared, which has the best Gini coefficient: PoS or PoW?
Imnimo 4y ago
> Honest validators see both forks but would built on the honest fork because it has greater weight in the LMD-GHOST fork choice rule. I don't understand this part. Is an "honest" validator someone who follows the rules, or someone who is purely profit-motivated? If the latter, what specifically incentivizes them to obey this LMD-GHOST rule?

I have seen description like this so many times, but no guide seems to describe exactly how everything is done in decentralised way. "The validators for each slot are assigned to committees". By whom? Also what if there is network partition for these 12 seconds. It's not very unlikely that some country could be completely cutoff from the internet for some time due to anything from natural or political reasons. Could there be recovery after this? At least in PoW, it is clear on what could be the possible scenarios.

RL_Quine 4y ago
Generally we've described this sort of research as "review resistant", rather than being secure in some classical sense. How Ethereum and other cryptocurrencies actually work is often eagerly explained but completely unfathomable on closer inspection. Concerns raised are fixed with additional complexity repeatedly until the reviewer grows weary of attempting to piece it together. Consequently there's sufficient conflicting descriptions that I don't think anybody has any hope of successfully understanding the system as a whole, much less being able to come to conclusions about its security.
- whatisweb3 4y ago
  The spec is open and documented pretty clearly.[1] [1] https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc
  - capableweb 4y ago
    Considering that Eth2 also have about 7 clients that work today (with more being worked on), the specification is clearly understandable by at least 7 different entities, further eroding the argument that Eth2 specification is so complicated no one actually understands it.
    - ben-schaaf 4y ago
      Most of the linked spec is pseudocode - actually it looks like valid python code. So to be fair I highly doubt you'd need any understanding of what it's actually doing to successfully implement that spec. Just like I still have no clue how Quaternions work, yet I've implemented them multiple times.
      - freemint 4y ago
        How much would one need to pay you to test your hypothesis? That is you try to implement a standard complaint new Eth2 implementation from scratch ( and possible record yourself while doing so.
  - YetAnotherNick 4y ago
    That's just a random function description. The main thing here is how is seed calculated and analysis of whether it seed is safe from network partition, DDoS, malicious attack, nodes being offline, forks etc.
    - whatisweb3 4y ago
      Also clearly documented and open to researchers to examine. The full code for the various Eth2 clients is open source. [1] https://eth2book.info/altair/part2/building_blocks/randomness https://eth2book.info/altair/part2/building_blocks/randomnes... [2] https://eth2.incessant.ink/book/06__building-blocks/02__randomness.html https://eth2.incessant.ink/book/06__building-blocks/02__rand...
- capableweb 4y ago
  That's a gross misrepresentation of how it works in the real-world. Do you believe the same about cryptography? Since you can't understand it, and few really understand the full system, algorithms and functions, it must be "review resistant" rather than actually safe to use?
  - josh2600 4y ago
    Cryptography has mathematical proofs of the underlying math that are rigorous. There are constraints such as breaking if a proof of an attack against the discrete log were to emerge or other constraints related to p=np. The implementations are also very close to formally verified if not fully formally verified. Nothing is perfect but cryptographic code has to be pretty bulletproof or a lot of systems would get owned. The descriptions of how to verify cryptographic systems are academically and professionally rigorous especially compared to eth. Caveat: sometimes the underlying systems that cryptographic implementations utilize change degrading their guarantees. There have been times where the compiler will get updated and cause what was a branchless process to branch which could lead to information leaks against a dedicated attacker. Thankfully such examples are rare in the literature.
    - capableweb 4y ago
      > The implementations are also very close to formally verified if not fully formally verified. So is Eth2, see "Formal Verification of the Ethereum 2.0 Beacon Chain" by Franck Cassez, Joanne Fuller, Aditya Asgaonkar, paper (https://arxiv.org/abs/2110.12909 https://arxiv.org/abs/2110.12909) and source code (https://github.com/ConsenSys/eth2.0-dafny https://github.com/ConsenSys/eth2.0-dafny). More efforts to formally verify Eth2 is ongoing as well, by different entities. > Nothing is perfect but cryptographic code has to be pretty bulletproof or a lot of systems would get owned Same with Ethereum. The chance of having a major impact with a vulnerability is even higher I'd argue, as you can easily extract currency you can trade for USD, and the entire network is inter-connected, so finding targets to exploit becomes even easier. Point still stands that cryptography goes over a lot of peoples head, but you don't hear those people complaining that because they don't understand it, no one does.
- bowsamic 4y ago
  "I don't get it so it must be false" that's what you sound like right now
- douglaswlance 4y ago
  All popular Ethereum clients are open-source. If you really want to know how it works, go read the code.
- pa7x1 4y ago
  How can this argument be made in good faith? The spec is open source, all the clients are open source. Furthermore, it's implemented and running. You could argue that someone in particular has made a poor or incomplete explanation of how it works but not that they way it works is unfathomable or being patched as your speak. It's already implemented, go look at the code if you don't want to believe what anyone says.
  - jayd16 4y ago
    If the spec is open source, how can you say all the clients are open source? Or do you simply mean there are open source clients one can inspect and use?
    - pa7x1 4y ago
      There is a specification of the protocol, which is open source: https://github.com/ethereum/consensus-specs https://github.com/ethereum/consensus-specs And there are over 5 interoperable, independent and open source implementations of said specification: - https://github.com/sigp/lighthouse/ https://github.com/sigp/lighthouse/ - https://github.com/ChainSafe/lodestar https://github.com/ChainSafe/lodestar - https://github.com/status-im/nimbus-eth2 https://github.com/status-im/nimbus-eth2 - https://github.com/prysmaticlabs/prysm https://github.com/prysmaticlabs/prysm - https://github.com/ConsenSys/teku https://github.com/ConsenSys/teku - https://github.com/sifraitech/grandine https://github.com/sifraitech/grandine ...
      - deleted 4y ago
        [deleted]
- Humdeee 4y ago
  But isn't that a great description of our current banking system as it is today? Not everyone knows everything, somehow it works, complex, etc. However, still so woefully insecure.
- aaaaaaaaata 4y ago
  Spoken like somebody who doesn't read Buterin.
3np 4y ago
As for the source of randomness, they mention it briefly in the appendix: > RANDAO: the random number generation scheme used to select block proposers, sort validators into committees, etc Spec and implementation: https://github.com/randao/randao https://github.com/randao/randao
rgrmrts 4y ago
Heres my understanding of it: committee assignment is random, as in baked into the protocol, similar to how a validator is selected for a block (i.e. randomly). While only one validator creates the block, others create attestations which I understand as duplicate work done to check the chosen validators produced block. If an entire country goes down, those validators fall out of the active set and assuming some majority is still active they'll produce and verify blocks. Incorrect state is rejected by the majority, and the minority is punished (slashing their stake). Full disclosure, I'm not an expert - just an enthusiast interested in these protocols. Would love for someone more knowledgeable to correct my mistakes. I'm also not arguing for or against anything here.
- bhaak 4y ago
  > Incorrect state is rejected by the majority, and the minority is punished (slashing their stake). That's wrong. Also the state of those validators that are separated from the larger network is not wrong it's just not the same as what the majority considers the state. They will be on a forked chain of the network. But for being on a fork, no validator is slashed. They will only lose out on the rewards they would have gotten on the majority chain. Validators are only slashed if they try to vote for the same slot/blockheight on different forks of the chain.
  - rgrmrts 4y ago
    Ah, thanks. How does the forked chain reconcile with the rest of the network once the networks sync back up?
    - bhaak 4y ago
      I think that depends on how long the validators were cut off from the majority of validators. Ethereum's POS has a concept called finality which means that under certain conditions the blockchain gets checkpoints that can't ever be reverted. Somewhat simplified but the the blocks are finalized if 2/3rd of the validators validated the last 64 blocks. So, normally after about 13 minutes you can be sure if the transactions are set in stone or not. If the cut off validators are reunited after not too long, they won't have been able to finalize any blocks and then they will just throw away the part of the chain they have been building since they were separated from the majority. As far as I understand it that's quite similar to a reorg on a POW blockchain. The other case, if they've been separated for a very long time, the situation is a bit different. If you don't follow your duties as a validator, you get penalized. A little of your staked ETH is burned. Note, that's not the same as slashing (which is much harsher) and if your staked ETH balance falls below 16 ETH, you're kicked off the list of validators. This is so that active validators will be able to reach again a 2/3rd majority after a while and be able to finalize blocks. If this happens to our cut off validators, even if they get access to the other validators data again, they can't reorg the blockchain as their blocks have been finalized. In this case, the admins need to manually reset the data so the validators can rejoin the correct chain. This is a known issue which POW networks don't have. There you can always rely on the chain that has the most work done. But the work is cheap and fast in POS networks so you sometimes need to get external info and verify it by hand.
whatisweb3 4y ago
According to Eth docs: > One validator is randomly selected to be a block proposer in every slot. This validator is responsible for creating a new block and sending it out to other nodes on the network. Also in every slot, a committee of validators is randomly chosen, whose votes are used to determine the validity of the block being proposed. The annotated code for this can be found in [2]. [1] https://github.com/ethereum/annotated-spec/blob/master/phase0/beacon-chain.md#compute_proposer_index https://github.com/ethereum/annotated-spec/blob/master/phase... [2] https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc
- niemandhier 4y ago
  Maybe I am stupid, but at least to me its not obvious how one would randomly select a member in a decentralized way, assuming some actors are malicious?
  - capableweb 4y ago
    There are tons of different ways of doing so, with their own set of pros/cons. I'm not familiar with exactly how Eth2 does it, but I suppose your curiosity is a general one, not specific to Eth2, so here is how it works for Algorand as an example using VRFs (Verifiable Random Function): > The VRF takes a secret key and a value and produces a pseudorandom output, with a proof that anyone can use to verify the result. The VRF functions similar to a lottery and is used to choose leaders to propose a block and committee members to vote on a block. This VRF output, when executed for an account, is used to sample from a binomial distribution to emulate a call for every Algo in a user’s account. The more Algos in an account, the better chance the account has of winning – it’s as if every Algo in an account gets its own lottery. This method ensures that a user does not gain any advantage by creating multiple accounts. https://www.algorand.com/Algorand%20Protocol.pdf https://www.algorand.com/Algorand%20Protocol.pdf The search term you're looking for is "decentralized leader election", searching for that on Google or Google Scholar gives you bunch of results ranging from random musings to academic papers.
    - 4y ago
ricochet11 4y ago
https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-chain/#compute_committee https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-ch...
norswap 4y ago
Would recommend reading Ben Edgington's annotated spec: https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-chain/ https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-ch... It's not entirely up to date (none of the annotated specs are) but out of the three annotated specs I'm aware of, it's the one that is most focused on explaining how things work. Vitalik's annotation (linked in another comment) places a particular focus on the reason specific constants where chosen.
0xfoobar 4y ago
Article author here. Great questions, should have explored the randomness beacon more. Ethereum uses [RANDAO](https://github.com/randao/randao https://github.com/randao/randao), which is a distributed commit-reveal scheme where participants in the generation post a hash of their data on the commit portion and then at a later timestamp reveal the data preimage, and get slashed if they do not reveal a correct preimage. Then all participant data is aggregated together. This means if there is at least one honest participant the generation will be random. A supermajority (2/3rds) of validators is required to finalize a block, in case of a 50-50 network partition blocks would stop being finalized and attestation rewards would stop. Non-participating validators would slowly leak stake through the inactivity leak until online validators once again had a supermajority. This is the "self-healing" mechanism that allows both safety and liveness.

mmastrac 4y ago

I can't see governments allowing PoW to continue to exist in our current climate (in all senses). How would Bitcoin ever move over to PoS like this? Would it just be a Bitcoin hard fork?

whatisweb3 4y ago
Yes it would need a hard fork - but Bitcoin community is notoriously resistant to change, so it probably would not happen for some years or decades.
- RL_Quine 4y ago
  It's actually a soft fork to change the consensus method believe it or not, even changing to a new proof of work scheme is completely backwards compatible. It's not a good idea and it's sort of ridiculous, but it is technically doable. If you felt inclined, we could change the transaction format, switch the scripting language to x86 assembly, issue new currencies- all in a soft fork.
  - whatisweb3 4y ago
    How is it backwards compatible? Clients cannot continue to secure the protocol by hash mining after switching the protocol from PoW to PoS. Bitcoin moving to PoS would probably lead to a hard fork and split - two protocols, one where some group want to stay on the PoW fork, and another where some group want to migrate to the new PoS fork.
    - RL_Quine 4y ago
      You define a consensus rule in NewStakeChain that it must include within it a valid block for OldChain that contains no transactions, or otherwise causes damage to the network by making it unusable such as a reorganization proof. Once the OldChain network has been destroyed by the new one, the consensus rule can be relaxed and there no longer needs to be POW completed by anybody. This specific example works and is economically rational because miners could make a PoW block and get its reward, or they could make the no transaction attack block and get its reward, plus the reward on NewStakeChain for submitting the proof.

TacticalCoder 4y ago

> There are two key equivocation rules a validator must follow, taken from the Gasper paper: > > Double vote - no validator makes two distinct attestations for the same target block > > Surround vote - no validator makes an attestation that surrounds or is surrounded by a previous attestation Which are both punished by having the saked ETHs being "slashed" (32 ETHs staked, you end up losing 16 of the 32). I never understood that: it opens a door for a huge attack in that it's now impossible to safely "stake". Ethereum devs says you can safely stake in that staked ETHs aren't at risk of being stolen (the key to stake and to move the ETHs aren't the same, so it's impossible for an attacker to steal the 32 ETHs) but... An attacker accessing a staking node can, on purpose, double vote or surround vote to get the ETH slashed. The difference between losing 32 ETHs or 16 ETHs is not that big (sure, in the case of slashing at least the attacker doesn't get them, but for the person losing the ETHs, it doesn't make a huge difference). So it's impossible to stake without risking your ETHs getting slashed, even if the staker is honest. Here's my prediction: we'll see exactly that attack on slashing nodes, people are going to lose ETHs and we'll see excuses to the tune of "you didn't securize your node well enough". I do think it should be possible to stake without that risk (just as it is possible to hold the private keys to cryptocurrencies on hardware wallets because, well, computers are all too often insecure). Here's another prediction: some are going to come up with HSM to stake ETHs (maybe they already exist?). The risk of getting people's ETHs slashed is just too big.

capableweb 4y ago
> So it's impossible to stake without risking your ETHs getting slashed, even if the staker is honest. I mean, the entire point of staking your ETH is to say "Hey, I'm willing to risk these ETH to \"prove\" that I'm a honest validator and that my node is secure. If I fuck up, I'm willing to accept the punishment". Without risking those ETH, it means nothing to stake ETH, and would break down the idea behind it. I'm not sure if you fundamentally miss the idea behind staking, or if I'm missing something obvious in your critique of staking.
- TacticalCoder 4y ago
  Wait... Couldn't the same argument be used simply to move coins? "My keys, my coins. If I fuck up by holding my keys on an insecure computer, I deserve my coins to be stolen.". Yet there are HSM / hardware wallet so that it becomes way harder to "fuck up". There's a difference between a nefarious actor having its own ETH slashed and a nefarious actor finding a way to have an honest actor's ETH slashed. Isn't it possible to imagine secure hardware device to stake ETHs instead of having to run validation code on general, insecure, purpose computers which gets owned all the time? I literally mean that: the same as hardware wallet to stake/validate instead of sign transactions. I think you got my critique right: I find it's folly to stake on general purpose computers.

hansword 4y ago

Doesn't this just mean the rich decide? Please correct me if I am wrong, but that is what it sounds to me. (And yes, I understand that POW means the 'compute-rich' decide.)

shekhirin 4y ago
I think there's two points to unpack: 1. As you said, it was compute-rich before, and native token-rich now. I see it that way: the difference is that your richness is now a part of the protocol which allows it to e.g. punish bad actors (aka slashing) which isn't possible in PoW scenario where attacks can continue indefinitely. 2. Validators don't solely decide rules of execution: full nodes do. If you, as a validator, try to break the rules (double spend, incorrect execution, etc.), full nodes won't accept this new world view and discard it. So providers like Infura which most users (currently) use will continue working as expected and the canonical chain won't be damaged.
- __alexs 4y ago
  Who defines what a "bad" actor is?
  - DennisP 4y ago
    Objective protocol rules. If you send staking transactions that conflict with each other in certain specific ways, then you get slashed.
NoGravitas 4y ago
Yes, that's how I understand the paragraph near the end that says "Proof-of-any-resource is centralizing".
whatisweb3 4y ago
Decide on what? They are not governing the protocol or restricting who can use it, only proposing blocks and submitting attestations. They have limited capabilities to make changes in the ledger, and if they do enact undesirable changes they risk their capital being slashed. If you as a user wants to participate in protocol validation and its rewards without staking 32ETH, you can use a decentralized staking pool like RocketPool. As of yet there are no sound methods of securing a public ledger without either PoW, PoS or PoA. Bitcoin uses PoW, most central banking and traditional payment processors use PoA, Ethereum will soon use PoS.

mike8889 4y ago

Baopab 4y ago

Great article, it put an end to many misunderstandings that I had. The technology is truly marvelous.

dimgl 4y ago
What's so marvelous about it? Also, how is proof of stake hard to understand? People with a lot of Ethereum are now validators. ???
- stackedinserter 4y ago
  Name a thing that you consider "marvelous".
  - dimgl 4y ago
    I keep seeing this kind of retort online whenever I ask someone to describe what is "great" about something. Why does it matter what I consider "great"/marvelous?

drdrek 4y ago

Ahh proof of stake, the nail in the coffin of decentralization. What did you say? the more you have of the capital the more you influence the system? what a novel concept! Monterey and legal systems based on structures that are at least partially built to take care of the needs of people of similar culture and geographic area? YUCK! Machine enforced plutocratic system where early adopters and syndicates have absolute power?! SIGN ME THE FUCK UP!

xadhominemx 4y ago
It’s a lot more challenging to run a mining operation that even breaks even over the long run than it is to buy a couple eth and start staking
- bombcar 4y ago
  Like many decentralized systems, it's not actually decentralized but can have the appearance of such. All these systems have "whales" such that the individual can't do much except align with a whale. Applies to more than just crypto, too.
  - flatline 4y ago
    The internet is this way. The reality is more about peering agreements and CDNs than a neutral decentralized computer network. But it is still decentralized, just primarily among a few big players.
    - bombcar 4y ago
      Yeah, but people hear "decentralized" and think "I can do whatever I want" - not the reality of what it actually is and how it works.
- cowtools 4y ago
  Why is it necessary to break even? Ordinary users can mine on their home hardware and make a return on their existing hardware before it depreciates.

SilverBirch 4y ago

>Let’s walk through a couple theoretical scenarios where a subset of malicious validators wants to censor transactions, say those originating in FATF-blacklisted countries. Hang on a second. Just to be clear about this example, this example is walking through how Ethereum has been designed specifically to allow North Korea to transact Ethereum, and more than that, prevent anyone who dissents. Like, I mean ok, I get the ideological position in theory of saying "Hey, we're going to design this network so that you can't prevent any transactions." But it's quite different to go "The motivating example of why we would want to do this is so that we can help Iran and North Korea money launder in a direct attack against our own government's laws". Here's my counter-example to the scenarios the author puts forward. You stake 32 eth to become a validator node and start signing off transactions from North Korea. Other people choose not to do that because... well. Your stake slowly goes up and they slowly bleed Eth. Then the US government smash down your door and throw you in federal prison because you're actively working to help North Korea.

hprotagonist 4y ago
https://www.bbc.com/news/business-61090064 https://www.bbc.com/news/business-61090064 you don’t even need to go that far!
capableweb 4y ago
Yes, if you actively and knowing break the law, you might get punished for it. Not sure what's new here? If you don't want to connect to North Korea, block connections coming from North Korea, it's like one or two commands of iptables.
- bluGill 4y ago
  Ignorance of the law is not a valid defense. It might get you a lighter sentience, but don't count on that. You are expected to know all the laws that apply to all the activities you do.
  - deleted 4y ago
    [deleted]

Barrera 4y ago

The article does not even mention long range attacks in which large portions of the block chain are rewritten. This is made extremely hard in Bitcoin through proof-of-work. To rewrite history you must re-do all of the work, which means you burn enough real-world energy to work faster than the entire rest of the network (aka majority hash rate attack). It's allowed, but expensive. In PoS, there was never any work, so you can just rewrite history. Every time the subject of Ethereum's move to PoS comes up, it seems this issue is there. The solutions mutate into a head-spinning kaleidoscope of different guises, all rabbit holes in their own maddening way and suspicious on that basis alone. That this lengthy piece doesn't even mention long range attacks speaks volumes.

0xfoobar 4y ago
Article author here. Supermajority attestations and block finalization, as well as withdrawal queues, prevent long-range attacks. To attempt to reorg a finalized block (blocks are generally finalized after 6 minutes) you have to commit to losing 1/3 of total staked ether, currently several billion dollars. The only participants who can equivocate (vote for two blocks at the same height) are active validators so there is significant economic value at risk to pursue such an attack.
- naveen99 4y ago
  Wasn’t there a recent attack on solana/ solend, where the attacker was willing to lose more than 30% for the chance to cash out and crash solend at the same time ?
  - 0xfoobar 4y ago
    The Solend drama was at the app-layer rather than the protocol-layer. Solana also runs PoS but its variant is a bit more handwavy and weaker imo, slashing rules are applied in a post-hoc human decision-making process rather than clear rules enshrined within the protocol.
- camjohnson26 4y ago
  Theoretically, if somebody forked the Ethereum PoS blockchain and faked timestamps to catch up to the real chain’s height, would there be any way to know which was the original other than community agreement? Seems like PoW makes it impossible since duplicating the original chain is prohibitively expensive. Not challenging the solution, just genuinely curious in how PoS works.

snapcaster 4y ago

I'm going to be really impressed and surprised if this ends up working (moving ETH to PoS). I'm still fairly skeptical. It seems like PoS has so many issues that come up with additional complexity being added to handle them. Worried it's increasing the attack surface too much and making a system that's not going to be able to be secured. That being said, I hope it works but it's been "two months from merge" for 5 years so hard to say

ruuda 4y ago
The Merge has been a pipe dream for a long time, but at this point, the implementation exists. Multiple testnets have already undergone the PoW -> PoS transition. Some minor implementation issues came up that have been fixed. I'm pretty confident it will happen, it's more a matter of more extensive testing and coordination at this point. As for when, Metaculus thinks 5 months from now [1], Polymarket thinks 2-3 months from now. [2] If you are truly skeptical about that timeline, you can make money on Polymarket (or virtual internet points on Metaculus). [1]: https://www.metaculus.com/questions/7971/ethereum-consensus-mechanism/ https://www.metaculus.com/questions/7971/ethereum-consensus-... [2]: https://polymarket.com/market-group/ethereum-merge-pos https://polymarket.com/market-group/ethereum-merge-pos
lazzlazzlazz 4y ago
I have been professionally close to the situation for more than four years, and it has never been "two months from the Merge" before. It was expected to be in about four years about five years ago. That's the most it's been delayed so far, which is impressive in my view given how much novel research has been required. For anyone curious about an academic explanation of the problems being solved by ETH 2.0's consensus model, see this paper[1] out of David Tse's lab at Stanford. [1]: https://arxiv.org/abs/2009.04987 https://arxiv.org/abs/2009.04987
- snapcaster 4y ago
  I'm not closely involved, and was speaking a little off the cuff referencing the perceptions given by casual observers by the hype crowd. Thanks for the info will read the paper linked

throwaway23236 4y ago

Just so I am clear, if you want to be a validator, you need ~32,000 USD? Seems like that is out of reach for most people.

dylkil 4y ago
thats why things like rocket pool exist
alex_suzuki 4y ago
It used to be a lot more expensive. :-)

icevoid 4y ago

Leaving behind the technical details and the energy consumption aspect, it seems to me that the main economic difference between PoW and PoS is that in the former miners are forced to sell their earned tokens due to a high cost of keeping their equipment up and running. This sounds like a healthier approach. Whereas PoS validators don't have the same burden, therefore they'd naturally tend to simply increase their shares.

amluto 4y ago

Following some links: https://notes.ethereum.org/@vbuterin/single_slot_finality https://notes.ethereum.org/@vbuterin/single_slot_finality > If 51% of validators start censoring, the victims and users can coordinate on a minority soft fork where they build on each other’s blocks and ignore the attacker. On the minority soft fork, the attacker’s deposits would lose millions of ETH to an inactivity leak, and after a few weeks the chain resumes finalizing. It seems that this could easily be turned around: if enough malicious validators coordinate, they can create a soft fork that burns every honest validator’s stake until the malicious validators have an ever increasing supermajority. New victims who aren’t validators could try to become validators to fight back, but the colluding validators can just ignore those proposed transactions.

jdoliner 4y ago
They can only burn the honest validators stake on the softfork though. The main chain won't be impacted.
- amluto 4y ago
  I can think of plenty of ways to profit that don’t require burning an honest validator’s stake as the source of profit.
redox99 4y ago
That's the social consensus, or "L0 consensus". It's a fork, so on only on this fork the attackers would lose the ETH. The social consensus means that actual humans, in front of these 2 forks of ETH , the original chain being attacked, and the one where all the attackers stake has been deleted so it's safe (and also non-attackers "richer"), humans would call the latter "Ethereum" and use that. And the former would fall into irrelevance.
- cowtools 4y ago
  Why not just ditch the whole Proof-of-Stake system and use a classical consensus system then?

ck2 4y ago

I mean it's going to be just absolutely fascinating to see what happens in real life vs all the theories. I guess if you are heavily invested it's rather dread than intellectual curiosity. There are plenty of other options if it all goes south.

kobieyc 4y ago

Something that always trips me up about PoS is how a system that determines the transactional chronology (i.e. sequence of valid blocks) that uses, as a weighted input, the current transactional chronology (valid blocks determine your stake) isn't a logically a circular definition.

wmf 4y ago
Everyone does have to agree out of band on the genesis block or some equivalent. Once you have that, the protocol can progress automatically.

k2xl 4y ago

> To attempt to reorg a finalized block (blocks are generally finalized after 6 minutes) you have to commit to losing 1/3 of total staked ether, currently several billion dollars. Hmm... Several billion dollars is not actually that much money for nation states. Am I misunderstanding something here? Shouldn't it be much more expensive than several billion?

TheDudeMan 4y ago

Talks about PoW, PoS, PoA, but totally ignores Chia's superior PoST.

jl2718 4y ago

This is an opinion piece supporting POS. Simple question: if blockchains of similar (large) market cap are compared, which has the best Gini coefficient: PoS or PoW?

Imnimo 4y ago

> Honest validators see both forks but would built on the honest fork because it has greater weight in the LMD-GHOST fork choice rule. I don't understand this part. Is an "honest" validator someone who follows the rules, or someone who is purely profit-motivated? If the latter, what specifically incentivizes them to obey this LMD-GHOST rule?