• Abstract and Figures
• Public Full-text

Proof of Activity: Extending Bitcoin’s Proof of Work via Proof of Stake y [Extended Abstract] Iddo Bentov Charles Lee Alex Mizrahi Computer Science Dept., Technion Litecoin Project chromawallet.com [email protected] [email protected] [email protected] Meni Rosenfeld Israeli Bitcoin Association [email protected] ABSTRACT probable security threats, in the sense that an attack on We propose a new protocol for a cryptocurrency, that builds the extended protocol would be much more expensive. Es- upon the Bitcoin protocol by combining its Proof of Work sentially, our analysis and proposed remedy stem from the component with a Proof of Stake type of system. Our Proof proposition that PoW miners do not have the right economic of Activity protocol offers good security against possibly incentives to be solely in charge of securing the network, and practical attacks on Bitcoin, and has a relatively low penalty that stakeholders are fitted to assist in this task. The Proof in terms of network communication and storage space. of Activity (PoA) protocol that we propose is also likely to have other features, such as promoting an enhanced network topology and less overall energy consumption. In exchange 1. INTRODUCTION for the desirable properties that we argue that the PoA pro- The Bitcoin [9] cryptocurrency continues to gather suc- tocol achieves, nodes in the PoA network are required to cess since its launch in 2009. As a means of exchange, do more work and communication relative to nodes in the Bitcoin facilitates fast worldwide transactions with trivial Bitcoin network. fees and without identity theft risks. As a store of value, The purpose of the PoA protocol is to have a decentral- Bitcoin entails no counterparty risk and no exposure to ma- ized cyrptocurrency network whose security is based on a nipulation of the money supply by central banks, due to combination of Proof of Work and Proof of Stake. In gen- its decentralized nature. Many other features can be de- eral terms, Proof of Work based protocols give the decision- rived from Bitcoin's cryptographic foundations, including: making power to entities who perform computational tasks, resilient forms of secret sharing via multi-signature control while Proof of Stake based protocols give the decision-making over an address, various types of contracts that are enforced power to entities who hold stake in the system. While we by the distributed network, trust-free gambling and multi- contend that Proof of Stake based protocols offer consequen- party computation [1,4], decentralized stock exchange and tial advantages, Proof of Stake is neither trouble-free nor prediction market via colored coins [5], and so on. effective at mitigating all the major risks that a successful Thus it is natural to ask which kinds of attacks on the cryptocurrency faces. One major risk is centralization, as Bitcoin network are likely to be practical, and which ideas data centers that are dedicated to PoW computations and would be the most effective in mitigating plausible attacks transactions verification may outcompete hobbyist miners, on a successful cryptocurrency. Since Bitcoin has proven due to economies of scale. With Proof of Stake systems, to be quite capable of resisting attacks up until now, our the particular risk of PoW data centers is indeed reduced, focus is on long term sustainability. More specifically, we though other risks remain intact (see Section 2.1), and new are especially concerned with the attack environment after kinds of centralization risks are introduced (large stakehold- Proof of Work (PoW) mining is no longer subsidized via ers may try to exhibit control over the system, as well as the block reward, and the network needs to be secured via the more subtle risks that are presented in y). Another ma- transaction fees acquired from the commerce taking place. jor risk is an erosion of fungibility due to blacklisting of A robust cryptocurrency protocol should strive to pro- \tainted" coins. This risk is orthogonal to Proof of Stake, vide an incentives structure under which it is in the self- and could be mitigated by mixing [8] or SNARKs [6]. interest of the different participants in the system to sustain its health. In this work, we offer an elaborate extension to 2. MOTIVATION the Bitcoin protocol as a remedy to what we argue to be There are different ways in which direct attacks on Bit- coin's pure PoW protocol can be attempted. One kind of y A full version of this paper is available at http://eprint. an attack is the infamous >50% hashpower attack, where iacr.org/2014/452 the attacker invests in hardware equipment (ASIC) to ob- tain more PoW hashpower than all the other Bitcoin miners combined [2,3,9{11]. This attacker could then double-spend Copyright is held by author/owner(s). by reversing the recent ledger history to defraud merchants, or carry out a PoW-denial-of-service (PoW-DoS) attack by curity, while low enough for the market to bear - which is refusing to include transactions in the blocks that she gener- desirable). However, the agreement is not stable - it is in ates, unless perhaps the transactions conform with the pol- the interest of each miner to defect and accept low-fee trans- icy that the attacker imposes. In case the attacker is mali- actions, as this action boosts the revenue of this individual cious and wishes to destroy or harm the Bitcoin network, she miner. If all the miners do so, the bargaining power of min- may achieve her objective because either double-spending or ers will be eroded and they will no longer be able to force PoW-DoS can cause a loss of confidence in the Bitcoin proto- high fees, reducing the total revenue. col. In the case of a greedy self-interested attacker, she can Since the total mining revenue is what funds the overall make direct financial gains via double-spending, or extort network security, in this case the network security will be others and demand higher fees by carrying out PoW-DoS. weak. For this reason, maintaining a healthy network re- If an attacker has enough resources to obtain >50% of quires some protocol-enforced rules protecting miners, as a the total hashpower, then it is not unreasonable to assume group, from themselves - such as, a cap on the total value that she could also obtain e.g. 90% of the total hashpower, transferred in transactions in each block. If the cap is prop- which would increase the effectiveness of the PoW-DoS at- erly chosen, miners will actually earn more with this kind of tack. While it is true that the attacker depletes her resources a cap in place - by making block space a scarce resource, its as she carries out PoW-DoS, and therefore the Bitcoin net- price goes up; transactions will have to compete with others work can survive this attack by simply waiting until the for admission, and pay high fees for the privilege. An indi- attacker gives up, in practice there could be a snowball ef- vidual miner cannot break the market by accepting low-fee fect where honest miners quit as confidence in the network transactions, as she can only put so many in the block. is being lost, thus making it easier for the attacker to obtain For example, let us say there exist in the market 1000 users the vast majority of the total hashpower. wanting to send a transaction of 1 BTC each, and willing to pay 1% of the transaction value in fees (the amount per 2.1 Tragedy of the Commons related attacks transaction is irrelevant as long as the total BTC and per- centage fee stay the same). In addition, there are 1000 users It is likely that PoW mining will become significantly less wishing to send 1 BTC, for whom the transaction is not as lucrative when the block reward subsidy becomes negligi- important and so they are only willing to pay 0:1% in fees. ble, and the reward consists almost entirely of transaction If there is no cap, every miner will want to include all trans- fees. The rationale behind this stems from an economic actions, even if their fee is only 0:1%. There is no way to phenomenon known as the \Tragedy of the Commons" [7], effectively segment the market, so with 0:1% fee transactions which is a prevalent problem in the study of economics and being accepted, this is what will be paid also by those willing game theory. In its most general form, it is a system in to pay more. The total transaction value will be 2000 BTC which participants have an opportunity to act selfishly, tak- and the fee paid is 0:1%, for a total of 2 BTC. If, however, ing action to benefit themselves at the cost of harming their a cap is placed at 999 BTC, the miners are no longer free to peers. A selfish rational agent will always take such action include all transactions. They must choose which 999 trans- because she is interested only in her own well-being; but if actions to include, and the equilibrium is that those users everyone acts selfishly, everyone will be worse off than if ev- who can bear it will pay 1% (if they pay less, a user whose eryone cooperates. Any agreement to mutually cooperated transaction is excluded will offer a higher fee to get ahead for the benefit of all will not be stable, because every ratio- of the others, and so on). Thus, 999 BTC will be transacted nal participant will prefer to enjoy the fruit of both everyone but with a fee of 1%, and the total revenue is 9:99 BTC.

Load more

  4

Copy Link