3 ms·
They are not really verified by full nodes either. Computation is done by a Prover and duplicated by a Verifier. If the Verifier finds the computation result t
by tromp 3y ago
They are not really verified by full nodes either.
Computation is done by a Prover and duplicated by a Verifier. If the Verifier finds the computation result to be wrong, then they can identify a single gate (e.g. a NAND-gate) in the circuit doing the computation whose output bit(s) is wrong for its input bits, and expose this by engaging in an on-chain gate fraud proof, consisting of an alternation of transactions by Prover and Verifier that ends with one of them taking funds (the Prover in case the single gate computed correctly, the Verifier otherwise).
- lxgr 3y agoHow does this work game-theoretically? Couldn’t a Verifier assume that most Provers are honest and just skip doing the computation themselves?
- tromp 3y agoThe verifier would normally have a financial stake in the correctness of the computation. For example, 2 parties could use this model to play a game on-chain for some amount of bitcoin. Then for every move, the party making the move commits to some move and new game state (acting as Prover) while the other party checks that the new state is correct (acting as Verifier). So the roles of Prover and Verifier are swapped at every move.