6 ms·

A Formulation of the Trilemma in Proof of Work Blockchain

86 points by bikenaga 2y ago

throw0101d 2y ago
Vitalik Buterin, one of Ethereum’s co-founders, is credited with this trilemma, and this (AFAICT) is where he first posted about it: The trilemma claims that blockchain systems can only at most have two of the following three properties: * Decentralization (defined as the system being able to run in a scenario where each participant only has access to O(c) resources, i.e. a regular laptop or small VPS) * Scalability (defined as being able to process O(n) > O(c) transactions) * Security (defined as being secure against attackers with up to O(n) resources) In the rest of this document, we'll continue using c to refer to the size of computational resources (including computation, bandwidth and storage) available to each node, and n to refer to the size of the ecosystem in some abstract sense; we assume that transaction load, state size, and the market cap of a cryptocurrency are all proportional to n. The key challenge of scalability is finding a way to achieve all three at the base layer. * https://vitalik.eth.limo/general/2017/12/31/sharding_faq.html#this-sounds-like-theres-some-kind-of-scalability-trilemma-at-play.-what-is-this-trilemma-and-can-we-break-through-it https://vitalik.eth.limo/general/2017/12/31/sharding_faq.htm...
- wslh 2y ago
  The CAP theorem is a precursor of that, even if they are different [1][2][3] and Micali from Algorand claims they solved it (it is included in the original article). [1] https://www.reddit.com/r/kaspa/comments/18ieda0/there_is_a_folklore_that_the_blockchain_trilemma/ https://www.reddit.com/r/kaspa/comments/18ieda0/there_is_a_f... [2] https://dl.acm.org/doi/10.1145/3615871 https://dl.acm.org/doi/10.1145/3615871 [3] https://x.com/0xmert_/status/1748768344080023805?s=46 https://x.com/0xmert_/status/1748768344080023805?s=46
  - treyd 2y ago
    I feel like there's a way to directly derive the blockchain trilemma from the CAP theorem (or probably the more formal PACELC). Reasoning through it in my head makes sense so I've been saying that it's a corollary to CAP but I haven't actually seen it written out formally.
    - josh2600 2y ago
      Cap is different because cap is about network planning constraints and doesn’t take into account things like security per se. I think parts of Vitalik’s points are kinda moot and break down when you examine them through the lens of “any sufficiently complicated system can and will break.” In the case of bitcoin, the breaks are few now because it is basically static. I’m sure there’s some bugs in that codebase though… (and they’re worth a very pretty penny if you can find them!!).
    - barnacs 2y ago
      I think it all comes down to relativity and the speed of light. There is no single, universal, true ordered state (ledger/db). Participants need a conflict resolution mechanism to figure out whose truth is correct. One must rely on a localized consinstent state of some authority (leader/consensus).
      - api 2y ago
        The fact that every human society ends up with some kind of centralized oligarchy is probably also due to this effect. Something has to resolve disputes about the state of the system. A solution that somehow goes around these limitations could have implications beyond computing. It could enable “headless” large scale cooperation. This would be a fundamental innovation in the evolution of intelligence generally. Proof of work is the only one we have that kind of works and it’s massively expensive. You could argue that it’s just a way to make economically irrational or short sighted collusion prohibitively expensive rather than a true solution and might only work in a domain like a currency where there is a direct mapping to cost.
        barnacs 2y ago
  - josh2600 2y ago
    Algorand’s solution as originally stated is predicated on a non-colluding majority. At IACR when this algorithm was proposed, Silvio famously said as a counterpoint to the very apt criticisms that a colluding majority could defraud the protocol “my proof is that society exists!” In the end I believe Algorand changed their algorithms to a more centralized approach for the sake of performance as fully distributed validation did not perform adequately. Please correct me if I’m wrong.
    - sibeliuss 2y ago
      Network keeps getting faster, and more decentralized: https://algorandtechnologies.com/technology/solving-the-blockchain-trilemma https://algorandtechnologies.com/technology/solving-the-bloc... > Currently, Algorand blocks are produced in less than 3 seconds with instant finality. The network can process 10,000 transactions per second, and at a cost of a fraction of a cent per transaction.
    - Mistletoe 2y ago
      https://www.reddit.com/r/AlgorandOfficial/comments/u0n0mt/is_algorand_truly_centralized/ https://www.reddit.com/r/AlgorandOfficial/comments/u0n0mt/is... Unless this has changed since two years ago, the relay nodes are quite centralized.
    - wslh 2y ago
      Yes, full relay nodes were few and very centralized historically. Source: we have been working with Algorand since the beginning. BTW: we publish updated information about the protocol that you cannot find in the original papers [1]. [1] https://www.coinfabrik.com/blog/uncovering-a-trove-of-algorand-research-and-tools/ https://www.coinfabrik.com/blog/uncovering-a-trove-of-algora...
cryptica 2y ago
Yes, but this doesn't account for the fact that a cryptocurrency can be recorded across multiple blockchains (e.g. sharding). So a cryptocurrency (as opposed to a blockchain) can have all three properties of decentralization, scalability, and security. Also, the problem can be solved even more simply and elegantly than sharding by having a multi-cryptocurrency ecosystem which supports fast, decentralized, and low friction conversions exposed via the same (interoperable) transaction APIs. If the on-chain volume is sufficient on all chains, it's possible to automatically determine relative prices of tokens... In the same way that tourists from different countries can spend their native country's currency locally (conversion is not always necessary if the relative prices and volumes are somewhat stable). If the on-chain transaction volumes of different cryptocurrencies are similar (or above a certain threshold that corresponds to the size of the businesses accepting the cryptocurrency as payment), then a business can effectively accept payment in any cryptocurrency which they know/trust the existence of since the API would be the same across all chains. So you could use the same passphrase to log into all the different chains (including ones you never heard of) and you would already have an account there. You don't need to trust the chains themselves with your passphrase, you only need to trust your wallet app since the passphrase should never be sent over the wire. Wouldn't it be great if you could just walk up to a local business and offer to pay them in some new cryptocurrency they've never heard of which supports the same API? They could verify whether or not it meets their volume/stability and exposure requirements automatically in a couple of minutes. We're so close to achieving this ideal. The tech already exists in various forms. We just need regulatory/taxation clarity and a bit of willpower.
- latchkey 2y ago
  > So you could use the same passphrase to log into all the different chains (including ones you never heard of) and you would already have an account there. The UX on this has improved significantly in just the last year or so. We have wallets, like Rabby, which interact seamlessly across multiple (many!) chains and can even switch within the same dapp on a per transaction basis. It just works.
- yao420 2y ago
  > Wouldn't it be great if you could just walk up to a local business and offer to pay them in some new cryptocurrency they've never heard of. Not being snarky but why would this be great for anyone? What would be the point?
gregwebs 2y ago
The lighting protocol works on top of Bitcoin to be able to support orders of magnitude more transactions off chain with final settlement performed by Bitcoin. Using off chain layers like this avoids needing to solve an unsolveable trilemma. Certainly though bitcoin should be improved to allow a few more transactions per second :)
- lordofgibbons 2y ago
  So why is nobody actually using the lightning network after all these years? Multiple large vendors that support lightning network vendors are seeing practically no usage by anyone: https://x.com/CoinCards/status/1809702144288882870 https://x.com/CoinCards/status/1809702144288882870
  - ProllyInfamous 2y ago
    Background: I was around for August 2017 hard-fork, running one of (then) ~2000 worldwide verification nodes (i.e. not mining, rule-setting): I can assure you the lack of offchain usage was predictable. For the diehard technologists, it's interesting to note that Satoshi's original whitepaper called for a much larger blocksize (32MB, verse 1MB pre-SegWit/Lightning); myself, I ran BitcoinUnlimited with 16MB block acceptance well into 2018 (I'm anti anti anti SegWit/Lightning). For some reason, years of BIPs have claimed that "1MB is necessary due to bandwidth limitations..." which even in 2017 was horseshit... but now it's 2024 and I can get 300mbps fiber for $57.99/month (with a ping <3ms). HODL.
    - api 2y ago
      My understanding is that miners wanted small blocks and have hobbled the protocol for them.
      - ProllyInfamous 2y ago
        I'm not sure what caused your belief, but: Miners are (and always have been) allowed to mine blocks containing zero transactions (i.e. ~0kB, not including necessities). It's us nodes that choose to reject/accept (of course there is Venn overlap). This was common until block congestion actually started encouraging senders to include transaction fees; these [still!-]voluntarily fees represent a healthy addition to the blockreward, so most miners incur the minimal overhead for much-greater profit. Yet zero-transaction blocks continue to be mined (albeit less-frequently).
ddggdd 2y ago
kaspa is running 1 bps and 10s confirmation now, and 10bps on testnet, it's amazing nobody seems to know it, it's the closest thing to say we solved this 'trilemma'.

86 points by bikenaga 2y ago

Vitalik Buterin, one of Ethereum’s co-founders, is credited with this trilemma, and this (AFAICT) is where he first posted about it: The trilemma claims that blockchain systems can only at most have two of the following three properties: * Decentralization (defined as the system being able to run in a scenario where each participant only has access to O(c) resources, i.e. a regular laptop or small VPS) * Scalability (defined as being able to process O(n) > O(c) transactions) * Security (defined as being secure against attackers with up to O(n) resources) In the rest of this document, we'll continue using c to refer to the size of computational resources (including computation, bandwidth and storage) available to each node, and n to refer to the size of the ecosystem in some abstract sense; we assume that transaction load, state size, and the market cap of a cryptocurrency are all proportional to n. The key challenge of scalability is finding a way to achieve all three at the base layer. * https://vitalik.eth.limo/general/2017/12/31/sharding_faq.html#this-sounds-like-theres-some-kind-of-scalability-trilemma-at-play.-what-is-this-trilemma-and-can-we-break-through-it https://vitalik.eth.limo/general/2017/12/31/sharding_faq.htm...

wslh 2y ago
The CAP theorem is a precursor of that, even if they are different [1][2][3] and Micali from Algorand claims they solved it (it is included in the original article). [1] https://www.reddit.com/r/kaspa/comments/18ieda0/there_is_a_folklore_that_the_blockchain_trilemma/ https://www.reddit.com/r/kaspa/comments/18ieda0/there_is_a_f... [2] https://dl.acm.org/doi/10.1145/3615871 https://dl.acm.org/doi/10.1145/3615871 [3] https://x.com/0xmert_/status/1748768344080023805?s=46 https://x.com/0xmert_/status/1748768344080023805?s=46
- treyd 2y ago
  I feel like there's a way to directly derive the blockchain trilemma from the CAP theorem (or probably the more formal PACELC). Reasoning through it in my head makes sense so I've been saying that it's a corollary to CAP but I haven't actually seen it written out formally.
  - josh2600 2y ago
    Cap is different because cap is about network planning constraints and doesn’t take into account things like security per se. I think parts of Vitalik’s points are kinda moot and break down when you examine them through the lens of “any sufficiently complicated system can and will break.” In the case of bitcoin, the breaks are few now because it is basically static. I’m sure there’s some bugs in that codebase though… (and they’re worth a very pretty penny if you can find them!!).
  - barnacs 2y ago
    I think it all comes down to relativity and the speed of light. There is no single, universal, true ordered state (ledger/db). Participants need a conflict resolution mechanism to figure out whose truth is correct. One must rely on a localized consinstent state of some authority (leader/consensus).
    - api 2y ago
      The fact that every human society ends up with some kind of centralized oligarchy is probably also due to this effect. Something has to resolve disputes about the state of the system. A solution that somehow goes around these limitations could have implications beyond computing. It could enable “headless” large scale cooperation. This would be a fundamental innovation in the evolution of intelligence generally. Proof of work is the only one we have that kind of works and it’s massively expensive. You could argue that it’s just a way to make economically irrational or short sighted collusion prohibitively expensive rather than a true solution and might only work in a domain like a currency where there is a direct mapping to cost.
      - barnacs 2y ago
- josh2600 2y ago
  Algorand’s solution as originally stated is predicated on a non-colluding majority. At IACR when this algorithm was proposed, Silvio famously said as a counterpoint to the very apt criticisms that a colluding majority could defraud the protocol “my proof is that society exists!” In the end I believe Algorand changed their algorithms to a more centralized approach for the sake of performance as fully distributed validation did not perform adequately. Please correct me if I’m wrong.
  - sibeliuss 2y ago
    Network keeps getting faster, and more decentralized: https://algorandtechnologies.com/technology/solving-the-blockchain-trilemma https://algorandtechnologies.com/technology/solving-the-bloc... > Currently, Algorand blocks are produced in less than 3 seconds with instant finality. The network can process 10,000 transactions per second, and at a cost of a fraction of a cent per transaction.
  - Mistletoe 2y ago
    https://www.reddit.com/r/AlgorandOfficial/comments/u0n0mt/is_algorand_truly_centralized/ https://www.reddit.com/r/AlgorandOfficial/comments/u0n0mt/is... Unless this has changed since two years ago, the relay nodes are quite centralized.
  - wslh 2y ago
    Yes, full relay nodes were few and very centralized historically. Source: we have been working with Algorand since the beginning. BTW: we publish updated information about the protocol that you cannot find in the original papers [1]. [1] https://www.coinfabrik.com/blog/uncovering-a-trove-of-algorand-research-and-tools/ https://www.coinfabrik.com/blog/uncovering-a-trove-of-algora...

cryptica 2y ago

Yes, but this doesn't account for the fact that a cryptocurrency can be recorded across multiple blockchains (e.g. sharding). So a cryptocurrency (as opposed to a blockchain) can have all three properties of decentralization, scalability, and security. Also, the problem can be solved even more simply and elegantly than sharding by having a multi-cryptocurrency ecosystem which supports fast, decentralized, and low friction conversions exposed via the same (interoperable) transaction APIs. If the on-chain volume is sufficient on all chains, it's possible to automatically determine relative prices of tokens... In the same way that tourists from different countries can spend their native country's currency locally (conversion is not always necessary if the relative prices and volumes are somewhat stable). If the on-chain transaction volumes of different cryptocurrencies are similar (or above a certain threshold that corresponds to the size of the businesses accepting the cryptocurrency as payment), then a business can effectively accept payment in any cryptocurrency which they know/trust the existence of since the API would be the same across all chains. So you could use the same passphrase to log into all the different chains (including ones you never heard of) and you would already have an account there. You don't need to trust the chains themselves with your passphrase, you only need to trust your wallet app since the passphrase should never be sent over the wire. Wouldn't it be great if you could just walk up to a local business and offer to pay them in some new cryptocurrency they've never heard of which supports the same API? They could verify whether or not it meets their volume/stability and exposure requirements automatically in a couple of minutes. We're so close to achieving this ideal. The tech already exists in various forms. We just need regulatory/taxation clarity and a bit of willpower.

latchkey 2y ago
> So you could use the same passphrase to log into all the different chains (including ones you never heard of) and you would already have an account there. The UX on this has improved significantly in just the last year or so. We have wallets, like Rabby, which interact seamlessly across multiple (many!) chains and can even switch within the same dapp on a per transaction basis. It just works.
yao420 2y ago
> Wouldn't it be great if you could just walk up to a local business and offer to pay them in some new cryptocurrency they've never heard of. Not being snarky but why would this be great for anyone? What would be the point?

gregwebs 2y ago

The lighting protocol works on top of Bitcoin to be able to support orders of magnitude more transactions off chain with final settlement performed by Bitcoin. Using off chain layers like this avoids needing to solve an unsolveable trilemma. Certainly though bitcoin should be improved to allow a few more transactions per second :)

lordofgibbons 2y ago
So why is nobody actually using the lightning network after all these years? Multiple large vendors that support lightning network vendors are seeing practically no usage by anyone: https://x.com/CoinCards/status/1809702144288882870 https://x.com/CoinCards/status/1809702144288882870
- ProllyInfamous 2y ago
  Background: I was around for August 2017 hard-fork, running one of (then) ~2000 worldwide verification nodes (i.e. not mining, rule-setting): I can assure you the lack of offchain usage was predictable. For the diehard technologists, it's interesting to note that Satoshi's original whitepaper called for a much larger blocksize (32MB, verse 1MB pre-SegWit/Lightning); myself, I ran BitcoinUnlimited with 16MB block acceptance well into 2018 (I'm anti anti anti SegWit/Lightning). For some reason, years of BIPs have claimed that "1MB is necessary due to bandwidth limitations..." which even in 2017 was horseshit... but now it's 2024 and I can get 300mbps fiber for $57.99/month (with a ping <3ms). HODL.
  - api 2y ago
    My understanding is that miners wanted small blocks and have hobbled the protocol for them.
    - ProllyInfamous 2y ago
      I'm not sure what caused your belief, but: Miners are (and always have been) allowed to mine blocks containing zero transactions (i.e. ~0kB, not including necessities). It's us nodes that choose to reject/accept (of course there is Venn overlap). This was common until block congestion actually started encouraging senders to include transaction fees; these [still!-]voluntarily fees represent a healthy addition to the blockreward, so most miners incur the minimal overhead for much-greater profit. Yet zero-transaction blocks continue to be mined (albeit less-frequently).

ddggdd 2y ago

kaspa is running 1 bps and 10s confirmation now, and 10bps on testnet, it's amazing nobody seems to know it, it's the closest thing to say we solved this 'trilemma'.