V God: Why did Ethereum choose PoS?

What are the advantages of POS compared to POW?

Written by: Vitalik Buterin

Compiled by: Tyronepan - Bifrost Finance

Editor's Note: Today, September 15, Ethereum will undergo the largest protocol upgrade in its history, The Merge. After completion, the consensus mechanism will switch from POW to POS. On this special day, the editor will take you to recall an article titled "Why Proof of Stake (Nov 2020)" published by Vitalik Buterin on Twitter in 2020. Vitalik Buterin believes that the blockchain network under the PoS (Proof of Stake) consensus mechanism is safer than PoW (Proof of Work), has more complete defense measures against attacks than the latter, and has a lower threshold for participating in verification.

text:

Why Proof of Stake (PoS)?

Compared with the PoW (proof of work) consensus mechanism, PoS is a better blockchain security mechanism for three main reasons:

1. PoS is more secure at the same cost

The easiest way to compare is to put the two side by side and see how much it costs to attack a network per $1 block reward per day.

- PoW based on GPU mining

Renting GPUs is cheap, so the cost of attacking the network is just to rent enough GPUs to exceed the cost of existing miners. For every $1 of block reward, existing miners should spend about $1 (if they spend more, miners will quit because it is unprofitable; if they spend less, new miners can join and make high profits). Therefore, attacking the network only needs to temporarily spend more than $1 per day, and it only takes a few hours.

Total attack cost: about $0.26 (assuming the attack takes 6 hours), which may drop to zero as the attacker receives block rewards.

- PoW based on ASIC chip mining

ASIC chips are a capital cost, and you can expect them to last about 2 years before they wear out or are made obsolete by better hardware. If a chain is attacked by 51%, the community will likely respond by changing the PoW algorithm, so that the ASIC chips will lose value. On average, mining is about 1/3 of the ongoing costs and 2/3 of the capital costs. Therefore, for every $1 of block reward per day, miners will spend about $0.33 in electricity + maintenance fees, and about $0.67 in ASIC costs. Assuming that the life of an ASIC chip is about 2 years, the miner needs to spend $486.67 on that amount of ASIC hardware.

Total cost of attack: $486.67 (ASIC) + $0.08 (electricity + repair costs) = $486.75

Not only does the cost of attack in PoW mining using ASIC chips increase, but providing protection against this high-cost attack also makes the entire network more centralized because the threshold for miners to join has also increased.

- Proof of Stake (PoS)

Proof of Stake is almost entirely about capital costs (deposited coins), and the only operational costs are the costs of running nodes. Now, how much capital are you willing to lock up to get a $1 per day reward? Unlike using ASICs, deposited coins do not depreciate, and when the stake is completed, the staked coins can be withdrawn after a short waiting period. Therefore, participants should be willing to pay a higher capital cost for the same amount of rewards.

We assume that a return of about 15% is enough to motivate people to stake (this is the expected return of Ethereum 2.0). Then, a reward of $1 per day will attract a deposit return of 6.667 years, or $2433. The hardware and electricity costs of a node are very low, and the cost of a thousand-dollar computer can support the staking of hundreds of thousands of dollars. The electricity and network fees of about $100 per month are enough to meet such needs. But conservatively speaking, these ongoing costs account for about 10% of the total cost of staking, so there is only a reward of about $0.9 per day, which ultimately corresponds to the cost of funds, so the above data needs to be reduced by about 10%.

Total cost of attack: $0.9 per day*6.667 years = $2189

In the long run, as the collateralization rate increases, this cost is expected to be higher. I personally expect this number to eventually rise to around $10,000.

The only “cost” of maintaining this security system is that the assets at stake are illiquid. It may even happen that the public knowing that these assets are locked up will cause the price of the coin to rise, so the total amount of funds floating in the community ready to invest remains the same! In PoW, the “cost” of maintaining consensus is the consumption of a lot of electricity.

- More security or less cost?

There are two ways to achieve a 5-20x security gain at a low cost. One is to keep the block reward unchanged and benefit from the increased security; the other is to massively reduce the block reward (thereby reducing the "waste" of the consensus mechanism) and keep the security level unchanged.

Both approaches are fine. I personally prefer the latter, because as we will see below, even a successful attack in Proof of Stake is much less harmful and much easier to recover from than an attack in Proof of Work!

2. Under the PoS consensus mechanism, it is easier to recover from attacks.

In a PoW network, if your chain is attacked by 51% of the chain, what can you do? So far, the only practical response is to "wait until the attacker actively withdraws the attack." But this ignores a more dangerous attack possibility, which is called a Pawn Camping Attack, where the attacker attacks again and again with the clear purpose of paralyzing the entire chain.

In a GPU-based system, without any defenses, a persistent attacker can easily bring the entire chain down permanently (or switch to PoS or PoA). In fact, after a few days of the attack, the attacker's cost may drop to very low, because honest miners cannot get block rewards in the attacked chain and thus exit.

In an ASIC-based system, the community can handle the first attack, but then it becomes helpless. The community will first respond to the first attack by changing the PoW algorithm through a hard fork, thereby "locking out" all ASICs (attacker's and honest miners'). But if the attacker is willing to bear this initial cost, after that the situation will return to the same as the GPU situation (because there is not enough time to build and distribute the new algorithm for ASICs), so the attacker can continue to spawn attacks cheaply, which is inevitable.

Of course, it is much better in the case of PoS. For certain types of 51% attacks (especially rolling back finalized blocks), there is a built-in "Slashing" mechanism in Proof of Stake, by which most of the attacker's stake (not including others) will be automatically destroyed. For other attacks that are more difficult to detect (51% alliance censorship-A 51% coalition censoring everyone else), the community can coordinate on a soft fork activated by a few users (UASF), and the attacker's funds are again mostly destroyed (in Ethereum, this is done through the "Inactivity Leak Mechanism"). There is no need for explicit "hard fork currency elimination", except for the requirement to coordinate the selection of a few blocks on the UASF, everything else is automatic and only needs to be executed according to the protocol rules.

Therefore, the first attack on the chain will cost the attacker millions of dollars, and the community will return to normal in a few days. The second attack will still cost the attacker millions of dollars because they need to buy new coins to replace the old coins that were destroyed, and the third will cost even more. This game is asymmetric and very unfavorable to the attacker.

3. Compared with ASIC, PoS is more decentralized.

PoW based GPU mining is reasonably decentralized, and it is not difficult to get a GPU. But GPU based mining basically fails the “security” standard we mentioned above. And ASIC based mining requires millions of dollars of capital to enter (if you buy ASICs from others, most of the time, the mining machine manufacturing company will make more profit).

This is also the correct answer to the common “Proof of Stake means the rich get richer” argument. ASIC mining also means the rich get richer, and this game is limited to the rich. At least in PoS, the minimum amount required to stake is quite low and many ordinary people can afford it.

Additionally, PoS is more censorship-resistant. GPU and ASIC mining are both very easy to detect: they require a lot of electricity consumption, expensive hardware procurement, and large warehouses. PoS can be done on a humble laptop or even through a VPN.

Advantages of PoW

I think PoW has two real advantages, although I think they are weak.

1. PoS is more like a “closed system” and it takes a long time for wealth to be concentrated.

In PoS, if you have some coins, you can stake them to get more rewards. In PoW, you can keep earning more rewards, but you need more external resources. Therefore, we can say that in the long run, the distribution of coins in PoS is likely to become more and more centralized.

In PoS, the general rewards (validator income) are low; in Ethereum 2.0, we expect annual validator rewards to be equal to about 0.5-2% of the total supply of ETH, and the more validators there are, the lower the interest. Therefore, it may take more than a century for centralization to double, and on such a timescale, other pressures (people wanting to spend money, divide it among charity or children, etc.) are likely to dominate.

2. PoS requires “weak subjectivity”, while PoW does not

Regarding the concept of "weak subjectivity", (please see Vitalik's original introduction). Essentially, when a node comes online for the first time, or any node comes online after being offline for a long period of time (i.e. many months), the node must find some third-party source to determine the correct chain head. This may be their friends, exchanges, block search websites, client developers, etc. But PoW does not have this requirement.

It can be said that this requirement is easy to achieve. Users need to trust what the client developers or the community provide to some extent. At the very least, users need to trust someone (usually the client developers) to tell them what the protocol is and any updates to the protocol. This is inevitable in any software application. Therefore, the marginal additional trust requirement brought by PoS is still quite low.

Even though there may be certain risks here, I still believe that the PoS network has efficiency and resilience far superior to the PoW network.