Spacemint: a Cryptocurrency Based on Proofs of Space∗
Total Page:16
File Type:pdf, Size:1020Kb
SpaceMint: A Cryptocurrency Based on Proofs of Space∗ Sunoo Park: Albert Kwon: Jo¨elAlwen; Georg Fuchsbauer; Peter Gaˇzi; Krzysztof Pietrzak; :MIT ;IST Austria Abstract an extensive game, and prove that following the pro- tocol is an equilibrium, thereby arguing for the cur- Since its introduction in 2009, Bitcoin has become rency's stability and consensus. the most successful cryptocurrency ever deployed. However, the currency's dramatic expansion has also raised serious concerns about its long-term sustain- 1 Introduction ability: (1) Bitcoin mining dynamics have shifted away from decentralization, as dedicated hardware E-cash was first proposed by Chaum [12] in 1983, but and entry of governments and energy producers has did not see mainstream interest and deployment un- gradually placed most mining power in the hands til the advent of Bitcoin [32] in 2009. Today, with a of a select few, and (2) the network's growth spurt market cap of over 6 billion US dollars, Bitcoin has has come with accompanying, vast amounts of energy given a sweeping, unprecedented demonstration that constantly \wasted" solely for the purpose of sustain- the time is ripe for cryptocurrencies. Bitcoin moves ing the currency. millions of dollars in transactions per day, inspired In this work, we propose SpaceMint, a cryptocur- hundreds of \altcoins" and start-ups [4, 2], and re- rency based on proofs of space instead of wasteful ceives regular popular press coverage (e.g., [7, 8]). proofs of work. Mining in SpaceMint is designed to Widespread deployment of cryptocurrencies has have low setup and overhead costs, yielding a fairer the potential to transform the traditionally corpo- reward structure for small and large miners. Miners rate, centralized structure of financial systems; and in SpaceMint dedicate disk space rather than com- to facilitate secure micro-payments and micro-loans putation. In our design, we adapt proof-of-space reaching rural and developing areas, to small-scale for the cryptocurrency setting, and propose a new artists and content creators, and beyond [39, 21]. The block chain format and transaction types that pre- block chain structure underlying Bitcoin is consid- vent attacks that exploit the inexpensiveness of min- ered a promising tool in areas as diverse as insurance, ing (from which alternative non-proof-of-work-based stock markets, and land registry [29, 38]. Moreover, proposals have suffered). Our prototype shows that amid concerns about mass surveillance of individuals, initializing 1 TB for mining takes about a day (a one- cryptocurrencies may be the financial system most off cost), and miners on average spend just a fraction amenable to respecting civil rights. of a second per block mined. We also provide a for- However, Bitcoin's dramatic expansion has pro- mal game-theoretic analysis modeling SpaceMint as voked serious questions about the currency's long- term sustainability, including particular concerns ∗In a previous version, this cryptocurrency proposal was called \Spacecoin" rather than \SpaceMint", but this has been over the emergence of a \mining oligarchy" controlled changed due to name conflicts. by a handful of powerful (corporate or governmental) 1 entities, and over the steeply increasing amount of re- (and thereby mint coins and confirm transactions), sources being consumed by the Bitcoin network. miners must invest disk space rather than computa- Both of these problems spawn from Bitcoin's block tional power, and prove to the network that they are chain, which provides its mechanism of keeping a dedicating certain amounts of disk space. public ledger of transactions. In Bitcoin, members In SpaceMint, miners who dedicate more disk space of the network are rewarded for adding blocks con- have a proportionally higher expectation of success- taining transaction information to the block chain. fully mining a block and reaping the reward. It is An essential property of the chain is that all parties therefore clear that miners will be incentivized to in- in the network are guaranteed to eventually agree on vest in hard-drive capacity, just as Bitcoin miners the same chain (i.e., reach consensus). Miners in Bit- are incentivized to invest in electricity. However, we coin add blocks by solving computationally difficult highlight three key differences: puzzles.1 Accordingly, a Bitcoin block is considered 1. In SpaceMint, the investment is in the form of to be a proof of work [15]: i.e., a proof that a certain capital expenditure, and the mining process af- amount of computational resources was invested. ter hard-drive initialization incurs negligible on- One of the original ideas behind basing Bitcoin going monetary and natural-resource cost. In mining on computational power was that anyone contrast, in Bitcoin, the mining process requires could participate in the network by dedicating their perpetual energy expenditure. spare CPU cycles, which incurs little cost since it uses 2. In Bitcoin, resources are \used up" by mining: the idle time of already-existing personal comput- electricity is a depletable resource which once ers. However, modern Bitcoin mining dynamics have used is gone; and Bitcoin mining hardware is a become starkly different [40]: the network's mining specialized, single-purpose resource that is not clout is concentrated in large-scale mining farms, of- useful for anything once the need for Bitcoin ten in collaboration with electricity producers. Cur- mining is removed. In contrast, the resource rently, mining with your spare CPU cycles will result consumed by SpaceMint is recyclable, in that it in net loss, due to electricity costs: newcomers must can be used again and again, and multi-purpose, make a rather substantial initial investment in hard- since hard drives have intrinsic value in their ware, usually in the form of dedicated ASICs, to enter ability to store useful data.2 the game. This phenomenon is sometimes known as 3. Ordinary people have (many) personal devices the mining oligarchy, and it undermines much of the with unused disk space available, which can be motivation (stability and security) behind the decen- repurposed for SpaceMint mining with very low tralized system design. set-up and maintenance costs. Since mining is Bitcoin also depletes large amounts of natural re- cheap, and even small players get a proportional sources. The Bitcoin network constantly consumes fair share of rewards, we argue that we can ex- electricity at a massive scale, in the order of hun- pect large amounts of space in the network and dreds of megawatts [34], as it mines a block every 10 a more distributed, decentralized miner body. minutes or so. Moreover, most mining is currently [40] analyzed mining profit vs. invested resources done by specialized ASICs, which have no use be- in modern Bitcoin mining, as shown in Figure 1. yond mining Bitcoins. For these reasons, Bitcoin is We have added predicted cost and profit curves of considered an \environmental disaster" [22] by some. SpaceMint mining, based on our reasoning above. To address these issues, we propose SpaceMint, a cryptocurrency that replaces the costly proofs 1.1 Challenges and our contributions of work underlying Bitcoin with proofs of space When replacing PoW with PoSpace, there are two (PoSpace) [17]. In SpaceMint, in order to mine blocks important challenges. 1Currently, mining a Bitcoin block requires about 265 hash 2In x 6, we argue that specialized storage devices tailored computations [1]. for SpaceMint mining are unlikely to arise. 2 cally) with larger space. Finally, we provide a game-theoretic analysis of SpaceMint modeled as an extensive game, showing that adhering to the protocol is an equilibrium for rational miners (that is, cheating does not pay off), and we thereby argue the stability and consensus of SpaceMint. To our knowledge, this is the first analy- sis of a cryptocurrency formally modeled as an exten- sive game, with rigorous proofs of equilibrium stabil- ity.4 Our game-theoretic model could also be adapted Figure 1: Mining profit vs. invested resources to cover other similar cryptocurrencies. • Interactive PoSpace: Proof-of-space, as pro- posed in [17], is an interactive protocol between Summary. We believe that designing an energy- a prover and a verifier, and thus unsuitable for efficient cryptocurrency with a reward structure that cryptocurrency settings where each individual in incentivizes decentralization and participation will be a decentralized network should be able to behave instrumental to realizing the future potential of cryp- as the verifier instead of a single entity. tocurrencies. Our contributions are: • Nothing-at-stake problems: When replacing • Cryptocurrency from proofs of space: We mod- PoW with a different type of proof that is com- ify PoSpace [17] for the cryptocurrency setting putationally easy to generate (such as PoSpace), and design SpaceMint, a cryptocurrency based a series of problems arise which are collectively purely on proofs of space, which avoids the ma- known as nothing-at-stake problems [19]. Intu- jor drawbacks of existing proof-of-work-based itively, because mining is cheap, miners can (1) schemes (x3 and x4). mine on multiple chains, and (2) try multiple • Addressing the \nothing-at-stake" problem: We 3 blocks per chain, at very little additional cost. propose novel approaches to solving nothing-at- These two problems potentially allow for double- stake problems that arise in non-proof-of-work- spending attacks and slow down consensus (de- based cryptocurrencies. Our solutions can be ex- tails in x4). tended to other cryptocurrencies based on easy- SpaceMint tackles both of these issues by (1) mod- to-generate proofs (x4). ifying PoSpace from [17] to a non-interactive variant, • Evaluation of proof of space: We evaluate our and (2) introducing a new block chain structure and modified PoSpace in terms of time to initialize transaction types that prevent miners from taking space, time to generate and verify blocks, and advantage of the nothing-at-stake problems.