Pros and cons of PoS
Original title: "Viewpoint | PoS Defense Opinion Encyclopedia"
Original source: Ethereum enthusiasts
I once wrote a A paper on PoS that wants to demonstrate the general conclusion that PoS is doomed.
After sharing that article with many people interested in PoS technology, I received many different feedbacks. The purpose of this article is to bring together various points of view in favor of PoS, so that we can see why different people believe that PoS can succeed.
If you think your opinion has been misrepresented here, or if you have changed your opinion, please feel free to contact me and I will revise this for you literature.
Vitalik Buterin
For core views, see: https://vitalik.ca/general/2020/11/06/pos2020.html (Chinese translation).
He tried to use the following two points to demonstrate why PoS is a cryptoeconomically secure consensus mechanism.
With the same cost, PoS is more secure than PoW.
PoS is more resilient to attacks than PoW.
Let me try to prove that these two views are wrong.
On point 1, he's comparing the cost of bribing PoW miners to temporarily censor all transactions on a PoW blockchain to buying 51% of validator stake amount to permanently destroy the cost of the PoS blockchain. Putting these two very different attacks together, and comparing the cost of carrying them out, is completely unreasonable. It's like me saying my bicep is bigger than the muscle on an athlete's pinky and then trying to use that to prove that I'm stronger.
Regarding point 2, beware of rhetorical tricks. Note that the PoW attack here is no longer bribing 51% of the miners for a temporary review, but an attacker who successfully bought more than 51% of the ASIC mining machines, which is a more expensive attack. Owning 51% staked tokens is much cheaper than owning 51% mining hardware because the market for staked tokens is much more liquid than the market for ASIC miners. Buying 51% staked tokens is only equivalent to buying around 5% of the total token volume of the PoS blockchain, since not all tokens are staked. If an attacker buys 5% of all PoS tokens, it costs him the same to buy the last token as the first token. And if he buys 51% of the existing ASIC mining machines, then as they buy more mining machines, the price of ASIC mining machines will rise rapidly, and the price they will pay will be very expensive. Because the ASIC mining machine market is much less liquid than the PoS token market.
In the discussion of part 1, Vitalik discussed the use of bribery attacks (bribery attack) to achieve a (very cheap) temporary review, because he To appear cheaper to attack PoW. Similar to this attack in PoW, in PoS, by paying a high transaction fee to completely fill each block with transactions, in order to achieve the purpose of reviewing all other people who send transactions.
And in the second argument, in order to show that PoW is difficult to recover from attacks, he prefers to discuss very expensive respawn point attacks (spawn- camping attack, ambush near the opponent's death and respawn point in competitive games), and this requires the purchase of 51% of PoW mining machines. An analogy is buying more than 51% of the tokens in a PoS network to launch an attack.
The reason why PoS is doomed to fail is largely because of the symmetry in PoS: the attacker alliance and the defender alliance have no inherent advantages and disadvantages , is symmetrical. If the defender wins, they punish the attacker in exactly the same way they punish the defender if the attacker wins. Defenders can inject security deposits to improve defense, and attackers can also inject deposits to increase attack power, and the cost is exactly the same for both parties.
To prove that PoS can work, Vitalik tried to find a way to break this symmetry. He wanted to make defense seem cheaper than attack. The way to break the symmetry is to adopt a very problematic assumption: that the community can use an external mechanism that has not yet been defined to reach a consensus on which side is the attacker and which side is the defender. Users can then agree on which version of the protocol is the official version.
But there is a circular argument here. If we start from the assumption that the community itself can reach a consensus on what should be updated in the protocol, it is easy to prove that they have a consensus mechanism. In fact, what content to update is very controversial. Users cannot agree on what constitutes a beneficial update and what constitutes a malicious attack. Especially when the attack is accompanied by publicity, it is easy for the community to believe that the attacker's version is a good update. And once the community believes this, they will burn 49% of the security deposits of honest validators, which is equivalent to sending another red envelope to the attacker.
PoS will inevitably end in the following two ways:
A) Once the attacker obtains If more than 51% of the validator seats are taken, they can keep the attack going forever. Because they also control who can join the validator team. They can censor everything, and they can use censorship to implement any soft fork upgrade, including changing the consensus mechanism to PoW. Users who don't like the new rules also have an incentive to sell coins to those who like the new rules.
B) Another, if the user believes that the vast majority of the current validator team is an attacker, then these people will be punished; if this recovery mechanism is established, then the attacker can also use Propaganda to kill with a knife (with the knife of the recovery mechanism). As long as the attacker can convince the user that the current validator team is malicious, the user will rob the deposit of those honest validators. Neither A nor B is a secure consensus mechanism.
Jae Kwon
In Jae's view, the security of PoS is based on "social legitimacy".
However, this is a much slower timescale than how many confirmations you need to achieve to withdraw from an exchange.
If we use a slower mechanism to resolve disagreements on the state, then our chances of being double-spending attacks will inevitably increase.
As long as the attacker sells coins on the exchange and exits in fiat currency, there is no way to roll back history and restore these coins. And if we can get benefits from double spending, then we will keep double spending, keep double spending until the chain is completely exhausted. In the end, the attacker can reap huge benefits from this, and every time the transaction is rolled back, your money is likely to be rolled back. Not to mention the destructiveness.
Alfred
Alfred Regularly contributes to Amoveo's telegram channel.
Alfred's claim is similar to Jae's, but Alfred also thinks that a rule can be added so that the sum of all deposits is large enough that we delete all bribers When the deposit is made, it is impossible for the attacker to make a profit.
To prevent someone from profiting from the rollback, we need (total amount of currency transferred in one cycle of social consensus) * 2 < (stake and online value) so that once we do, we have enough bribe-takers deposits to remove so that less money is stolen than their deposits are burned.
It is not a good model to entrust funds to online people, because it is easy to bribe the trustee, resulting in your deposit being deleted, which means that the agreement is not not safe.
Eventually security will become like Augur, with enough fees to convince enough people to lock their funds and stay online to validate blocks , to ensure that our money will not be stolen.
In the Augur prediction market, each information input mechanism has slow demand, so validators only need to go online at irregular intervals. If we use this mechanism to achieve consensus, they need to be online every block.
As far as I know, no PoS blockchain uses this rule. For example, this model limits the amount of coins that can be transferred per block.
This model is also susceptible to parasitic contracts, like Augur. If there is a contract developed on such a protocol (like colored-coin is parasitic on Bitcoin), and they don't pay validators a fee proportional to the value transferred, then the protocol becomes not safe.
As long as there are sub-currencies, it will make it difficult to calculate the handling fee.
Maigoh91
Maigo believes that participants are also risking the value of their goodwill, so they will not accept bribes. However, the form of value is not important, whether it is a deposit locked on the blockchain, or business reputation, or something else, because the game situation has not changed, and the amount of bribery is still much smaller than the value that can be destroyed by an attack.
Anonymous Ethereum researcher who is designing Eth2.0
Assertion 1:
“Soft fork cannot change the fork selection rules.”
I don't understand how this kind of assertion can help PoS defend against soft fork bribery attacks. But I can prove that statement is wrong.
If an attacker can redistribute funds at will, they can cancel any spending within the system by redistributing funds. So, if some fork choice rule would give an advantage to the side that spends more, a soft fork could prevent those payouts. (Translator's Note: What is discussed here may be a method of defense against PoS long-range attacks that someone once imagined: in the fork selection, the block containing more transaction value is always the legal block. The distribution of long-range attacks Unless the fork can contain more transaction value, it will not be accepted. That is, which chain is always determined by which chain everyone spends money on.)
< /p>
If the fork selection rule takes into account expenditures outside the system, then the system is a PoW system, not a PoS system.
Assertion 2:
"A small number of non-consensus participants can make the attack cost Higher"
Saying that an attack is "expensive" doesn't solve anything, if the attacker has the power to redistribute all funds and all expenditures are endogenous to the system, Then the validator can change the rules to make it less expensive.
LionLikesCookies
From Members of the Cardano community. See this reddit post for his explanation.
Lion's claim is that in this (bribing the participant) attack, PoS is game theoretically the same as Bitcoin's PoW. So Bitcoin has no problem, which proves that PoS can also deal with it.
This is the same point Vitalik made in his January 2015 paper "P+epsilon Attacks", in the "Further Consequences" section .
I also explain why bribing attacks do not work against PoW in the "Censorship can be good" section of this paper.
sebastiengllmt
Also A Cardano community member gave his explanation on Reddit.
Sebast's argument is that it is impossible to know how much to bribe each validator because there is no way of knowing how many stakers there are in the system.
The solution is for the attacker to write a smart contract dedicated to bribes, which will slowly provide higher and higher bribes until it is verified have a sufficient share in the investor pool. In this way, the attacker only needs to spend the minimum bribe amount required.
Josh
Josh is the third Cardano community member who has given a completely different explanation for why PoS works.
According to Josh, "You have to bribe 51% of the value of the entire network to destroy the entire network".
It sounds reasonable at first glance. But game theory has taught us since at least 1833 that this is not necessarily true.
Assume first that Josh is right, then we'll use proof by contradiction to show that it can't be true.
A: Let us assume (the cost of bribing a user) = (the value of Ada it holds)
B: We Know: (bribe cost) = (position value) * (possibility they have key votes)
Substitute A into B to get: (position value) = (position value) * (they have key votes Possibility) divided by (position value) at the same time: 1 = (possibility of them having key votes)
In summary, all users’ votes are all critical. Therefore any independent user must have 100% control over the voting results.
However, as long as the number of users is greater than 1, this cannot be the case. If two users disagree on the outcome they want, they cannot both have 100% control over the outcome.
Therefore, we prove his initial premise (the cost of bribing a user) = (the value of Ada they hold) to be wrong, since this would lead us to contradict ourselves.
petko
petko From the NXT community, NXT is one of the oldest PoS blockchains. Interested petko made his point through this tweet.
petko's argument is that if one of you doesn't trust the other to run away with money, it's impossible to bribe them (only if you trust them You are willing to bribe them if you don’t take money or do nothing).
However, the blockchain smart contract system is designed to implement trust-free contracts, including bribery. petko's second point is the same as Josh's.
Lior Yaffe
Lior Yaffe is an excellent developer, leading the development of NXT, Ardor and Ignis.
About the impossibility of bribery soft fork attacks, he expressed his views through this tweet:
According to Lior, such an attack is "ridiculous" and could never actually happen. To clarify his position on this issue, he cited the example of a "NoS" attack.
I'm assuming the "NoS" he's talking about is nothing-at-stake-attack, a problem solved as early as November 2014 Question:
https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/. This makes me think that Lior has not paid attention to research in the PoS field since at least 2014. I think this also makes sense, because NXT was launched in 2013, and it is based on our understanding of PoS in 2013.
I don't understand what Lior is trying to make, nor if he actually read the paper he was commenting on. I suspect Lior is just trying to signal that PoS is great and isn't really interested in learning from it or educating us about anything.
Veil
About Why bribery soft fork attacks can't break their system, Veil's point of view is as follows: we can add privacy features, by hiding the identity of validators so that attackers cannot know who to bribe.
If the user wants to maintain privacy, the ring signature scheme works well.
The problem here is that block producers intentionally expose data to break privacy, because only then can they accept bribes. You may think that it is possible to invent a complex encryption mechanism so that you cannot reveal the result of your vote even if you wanted to. But I have a strong argument that this mechanism is impossible.
An ideal property of the consensus mechanism is that it will not stop the consensus because of a participant's disconnection. Because it means that whether I participate in creating the next block or not, I should have the ability to calculate the next consensus state.
This means that block creators can utilize any subset of transactions within a block to recalculate the next consensus state. By comparing results containing subsets of available transactions, they can ultimately learn how each transaction affects the consensus state.
An attacker who has access to all private keys and the entropy used to generate all encrypted votes must be able to retrace the production process of each encrypted vote.
Maximilian Roszko
He communicated with me through a telegram group, and his first argument was that bribes are hard to coordinate.
But this is a solvable UX problem.
We must assume that users want more value, not less. Calculating the expected return of different strategies is a mathematical problem. Therefore, calculating user behavior (what strategy to adopt) is also a mathematical problem. This also means that security is a mathematical problem.
His second argument is: "There is a very simple way to defend against bribery attacks, and that is anti-bribery attacks, I bribe more than you A little bit, so that the agreement is soft forked, so that all your funds belong to me. In this way, I have defended the network without loss, and in fact I can even make a small profit from it..."Defend Investors can try to fight bribery, so the system degenerates into a game where whoever pays more wins, and this model is doomed to fail.
If anyone is willing to give more money, he will have complete control, and complete control allows you to create more tokens for yourself, In this case, then, the network cannot agree on a definitive single version of history.
He also makes a third and fourth argument, the same as petko and Josh.
Alfred
Alfred The point is: if a soft-fork bribery attack is successful, then we can roll back the attack block through a slower social consensus, and then delete all the attacker's pledged amount.
Emin Gun Sirer
Emin is the founder of Avalabs, who launched the cryptocurrency Ava using the Avalanche PoS consensus mechanism.
He responded to the soft fork bribe attack proposal: "In fact, the vast majority of validators, like miners, are very friendly and willing to follow protocol, without being clever. It's fun to imagine attacks, but in reality over 90% of the participants were typically honest and simple-minded."
However, if it can be assumed that 90% of the participants are honest, then it is trivial to write a secure PoS consensus mechanism. In cryptographic engineering, this assumption makes no sense.
Usually we make the following assumptions about user motivations: 10% of participants are attackers who are willing to take a loss to compromise the protocol, 1% are Altruists, they are willing to take losses in order to help the agreement, and the remaining 89% are egoists, only doing what is best for themselves.
The cost of confusion is a solvable user experience problem. A motivated attacker can create enough tools to reduce the cost of confusion to 0.
For example, the attacker can use the prediction market as a lie detector, so that we have an economic guarantee: the software provided by the attacker is indeed have some kind of function. Even if the stakers themselves do not understand the software. If understanding what a piece of software does is as easy as checking stock prices from the market, then you don't need technical expertise.
We must assume that users want to have more value, not less, which means that security is a computational problem.
Charles Hoskinson
Charles is the founder of Cardano, a blockchain powered by Ouroboros. His response to the proposed soft-fork bribery attack was: "This type of attack cannot happen."
Conclusion
Support The rhetoric of PoS varies. Many people believe that PoS is a secure consensus mechanism that is resistant to bribery soft fork attacks, but they all have different reasons for this, and none of them convince me.
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
