What went wrong with Proof of Stake (PoS)?

Using computers to manage assets is nothing new. In fact, this is the main purpose of computers. So the question is, what is the difference between Bitcoin and blockchain?

The account book written in cuneiform on clay tablets records who owes me how many sheep

All digital financial assets before Bitcoin are called IOU systems, and this system and database itself do not hold such assets. What is recorded in the database is the bills of these external assets. This kind of bill record has existed since the emergence of human writing, and it has not changed fundamentally due to the emergence of computers.

With this IOU database, the marginal cost of adding an additional record is zero. Once I spend money on a stick and a clay tablet (I mean a 1U server and a copy of MySQL), the cost of adding records and tracking new assets becomes zero. The reason we use this record-keeping tool is that the cost of this record-keeping tool is much lower than the value of the assets we track and manage.

The disadvantage of such IOU systems is that no matter how solid your records are, they are tied to real-world assets. Just because my clay tablet says you have three sheep and owe me two, it doesn't mean you control three sheep or have the ability to repay two sheep. This is the so-called counterparty risk, which is also the basic principle of the IOU calculation system, and it also led to the establishment of the government-regulated central contract clearing center (DTCC, the US Securities Depository and Clearing Corporation).

Why is Bitcoin different? Because the database record is the asset. In other words, it is the first digital bearer bond, and the "distributed database" gives it the ability to hold bearer bonds. Centralized databases cannot hold bearer bonds, nor can they be removed from the central database.

Bitcoin's consensus mechanism is based on the Proof of Work (PoW) mechanism. Under this mechanism, miners compete to generate new blocks and update the ledger. This process consumes a lot of real-world assets. This process is a competition for hash power. This process itself is not a process of generating value. The bitcoins it allocates to miners have a certain degree of randomness. In addition, this process provides an anchor point for real-world assets.

Let me reiterate the point I made at the end of this post because I think a lot of people missed the point:

Mining provides a value anchor for crypto assets through real-world spending.

Mining costs a certain amount of money, and while mining is ongoing, miners are calculating their balance sheet in their heads: how much money is invested in mining hardware, how much electricity is consumed, what is the current price of Bitcoin? Although there are cryptographic signatures and proofs, the transfer of coins on a protected chain requires this initial infrastructure capital. This is also why no one spends money to add records to a SQL database, its marginal cost is zero. This is also why it is a challenge for blockchains to quickly process IOU note assets, and there are still many problems with blockchain processing post-trade settlement. The reason why Bitcoin can achieve counterparty-free contract risk settlement is that this database record itself is an asset, and only an asset that is issued by a cryptographic manager will be given the ability to have no counterparty risk by the blockchain. This is also why it is a good idea for the issuance of private securities to be taken over by Symbiont and Nasdaq Linq. These database records themselves must be assets. These database records must be the only format in which these assets exist; these assets are not IOUs.

Database records are assets in themselves.

Whether mining is a waste is controversial, and environmentalists are understandably concerned about this issue, which is why many people are pinning their hopes on an alternative model called Proof of Stake (PoS).

Proof of Stake (PoS)

The purpose of the proof of stake mechanism is to allow so-called "stakeholders", "forgers" or "validators" to replace miners. They are essentially holders of relevant coins, holding coins to prove that they are working in order to maximize their "stake". Let's call them validators. The profit maximization strategy in Bitcoin includes consensus rules and coin distribution. Bitcoin combines these two strategies. Let's analyze them separately.

consensus

There is a lot of literature on creating Byzantine Fault Tolerant (BFT) databases, including the more advanced Honey Badger BFT. This is a topic that has been neglected by the industry for a long time, and no one wants to share their databases, so the industry currently only sells non-BFT databases, such as those for crashed nodes. This literature provides reliable methods to solve Byzantine faults without economic incentives.

Let's assume that the profit maximization strategy can be applied to a coin, assuming that the coin has value at first. However, as we have argued, the marginal cost of database records is zero, and even if they are now cryptographic signature records, the value of database records with a maximum value of zero is still zero. There is an economic description of this situation called "interest irrelevance". The profit maximization calculation can be started, the cost of creating a block is zero (so they are worth zero), and the cost of forking is also zero.

Because there is no cost to create a branch chain, some coins will try to prevent being incorporated into the block, since the cost is zero anyway. This results in the two chains above a certain height block (look at NXT's 720 block) being unable to be incorporated into the main chain, or using the "asset freeze" method to make the validator pay a certain deposit or asset in order to become a validator. This asset must be guaranteed not to be moved for a period of time (Ethereum's Casper proposal is 4 months). This method does not solve the fundamental problem. Doing so will only tell me how large the fork attack must be to launch. Let's call this the equity fork time F.

This notion of consensus is based on a circular argument: I have consensus on block F, so I can use that to determine consensus on F+1. This argument is circular and logically incorrect. It is easy for an attacker to create 10,000 forks at block F, and finding the right one is a matter of luck, which has led some in the Ethereum community to embrace the concept of "weak subjectivity", which basically means: I think I can search for which is the most recent block hash and find the right answer. If there are 10,000 potentially valid forks, then this approach is fatally flawed and is a sociopolitical solution to a technical problem. This is equivalent to an attacker having the willingness and ability to set up fake websites for their attack, and history shows that costless vectors fail.

There is a common belief among Ethereum and Tendermint enthusiasts that one can punish attackers by destroying their deposits. However, one can only punish them in a ledger that contains the rules for punishing them, and an attacker will never create a ledger that contains a punishment for themselves. I think this belief is a logical application of turning a non-fungible accounting system into a fungible accounting system. Coins cannot be deducted from one fork and added to another chain. This is not how forks work. A fork is a completely different history. Coins are not fungible between forked chains, so it is impossible to "punish" an attacker. All one can do is freeze the deposit for a little longer, which is back to the circular argument.

Finally, there is an argument that “proof of stake coins have been around for so long, doesn’t that prove their success?” Indeed, proof of stake coins such as Peercoin, NXT, BitShares, etc. have been around for several years, but the problem is that they have very negative incentives. Take NXT as an example. Obviously, one person can become a validator and create 720 blocks. To complete this task, I must hold a bunch of coins that I cannot sell. This negative incentive prevents these coins from experiencing attack levels like the level of attack that Bitcoin has suffered, which is rare but not impossible.

Coin Distribution

For proof-of-work coins like Bitcoin, coins are distributed through the mining of each block. Each miner will make a rational economic calculation to decide whether to mine, thereby providing a value anchor for the real world. People will not create "Genesis Mining" (a mine in Iceland) for altruism, nor will they build a mine because they need "world computer fuel".

Ethereum mining farm in Iceland

Each coin has an allocation schedule. For Bitcoin, it is allocated according to an exponential decay. The coins allocated to each block of Ethereum are a constant. This allocation schedule must be consistent with the operations of miners with a proportion higher than 50%, otherwise there will be a loss of computing power. Once more than 50% of the computing power is separated, there is a high possibility that the separated miners are planning a 51% attack.

For this reason, I think even Bitcoin's distribution schedule is flawed. The anchor for the asset in this case is the proof-of-work hashrate, and the coins awarded should be proportional to the difficulty of computing those hashes. This is pretty much the case with Bitcoin, except for the halving, where the coins awarded per block are halved approximately every four years. This has been heavily criticized by the bankrupt mining company KnCMiner. Not many industries can withstand a sudden reduction in revenue by half. If Bitcoin continues with its halving distribution schedule, it is unclear whether more than 50% of the hashrate will leave.

A better approach would be to distribute coin rewards directly in proportion to difficulty. This would make cryptocurrency mining more similar to real-world mining, where energy supply is not actually fixed. The time it takes to settle on gold is 5 billion years, and we should also create crypto assets with a longer-term perspective. Coin distribution should be proportional to difficulty, so that miners with lower hashrate are not lost. Bitcoin tries very hard to remain independent, but the historically high difficulty holds it back, and it relies on a coin distribution schedule, and it would be more robust without this dependency. Future blog posts will explain this issue in more detail.

Ethereum has activated a "difficulty bomb", and its difficulty coefficient is growing exponentially, so that the PoS model has to be adopted. It can be inferred that the growth of hash rate has been linear in the past few months, and the exponential growth rate of difficulty will exceed the growth rate of hash rate in the first few months of 2018. At that time, Ethereum will lose its anchor point to the real world and continue to create new coins. At that time, it will become an inflationary currency. Its anchor point to the real world is fixed in the initial PoW stage. A potential validator competes for a fixed PoW hash pool. This is a zero-sum competition because there are some non-validator accounts. The distribution of coins is equivalent to transferring an inflationary asset from non-validator accounts to validators. So the "difficulty bomb" should be called an "inflation bomb".

If you think the above is too long and didn't read it, please read here

The whole idea of ​​PoS is a circular logic, with logical errors like "absence of proof is proof of absence", and misunderstandings of fungibility and forks. These fatal problems will not be fixed by reorganizing the deposit, in other news, I heard that the deck chairs on the Titanic were neatly arranged. Further, even if PoS works properly, such coins have no anchor to the real world, zero cost and zero value. The correct application of this Byzantine fault tolerant database is IOU assets, and such assets should represent IOU assets behind them.

The idea of ​​Ethereum switching to PoS is crude, and inflation will destroy the currency.

Changing the coin distribution schedule to distribute rewards in proportion to difficulty will allow this asset to grow naturally, which more directly reflects the original purpose of this asset.