Source-linked AI summary
Cryptocurrencies without Proof of Work
Iddo Bentov, Ariel Gabizon, Alex Mizrahi
TL;DR
The paper studies how decentralized cryptocurrencies can maintain security without participants depleting physical scarce resources. It analyzes existing Proof of Stake systems and develops pure Proof of Stake protocols addressing their security problems. The authors argue that their constructions mitigate weaknesses identified in existing systems, while noting important assumptions about stakeholder availability, punishment, and broader strategy spaces.
Problem
The paper addresses whether decentralized cryptocurrency systems can achieve Bitcoin-like security without depleting physical scarce resources.
Method
The paper analyzes existing Proof of Stake protocols and presents pure Proof of Stake constructions, including chain-selection mechanisms and ledger-history solidification.
Results
The authors argue that their pure Proof of Stake protocols offer better security than existing protocols and mitigate identified problems.
Takeaways & Limitations
Pure Proof of Stake can avoid physical-resource depletion, but secure operation depends on protocol mechanisms and assumptions about stakeholder behavior.
Takeaways & Limitations
The analysis assumes stakeholder availability and sufficiently severe punishment for equivocation, and its scope could be extended to broader strategy spaces.
Abstract
from arXiv · showhide
We study decentralized cryptocurrency protocols in which the participants do not deplete physical scarce resources. Such protocols commonly rely on Proof of Stake, i.e., on mechanisms that extend voting power to the stakeholders of the system. We offer analysis of existing protocols that have a substantial amount of popularity. We then present our novel pure Proof of Stake protocols, and argue that they help in mitigating problems that the existing protocols exhibit.
1 Introduction
The paper asks whether decentralized cryptocurrencies can maintain Bitcoin-level security without depleting physical scarce resources, focusing on Proof of Stake as an alternative. It analyzes existing protocols and presents pure Proof of Stake constructions intended to address their limitations.
- Bitcoin uses Proof of Work to reach ledger consensus, synchronize transactions, and protect users against double-spending.
- Miners’ decision-making power is proportional to computational power, so a miner with fraction p creates each new block with probability approximately p.
- Proof of Work converts electricity and mining-equipment erosion into cryptographically scarce coins.
- The central question is whether decentralized cryptocurrency security can match Bitcoin’s without participants depleting physical scarce resources.
- Proof of Stake gives ledger-continuation decision power to coin holders because security erosion reduces the value of their stake.
- Pure Proof of Stake uses Proof of Stake without any Proof of Work.
- The paper analyzes existing protocols, presents novel pure Proof of Stake protocols, and examines checkpointing, initial issuance, and security tradeoffs.
2 Pure Proof of Stake
Pure Proof of Stake systems face two apparent hurdles: fairly distributing initial coins and maintaining network robustness when participants are rational rather than altruistic.
- Pure Proof of Stake systems face hurdles in fair initial money-supply distribution and network fragility among rational nodes.
- Proof of Work addresses initial distribution by converting physical scarce resources into system coins.
- The paper analyzes an existing pure Proof of Stake system and presents CoA and Dense-CoA systems to mitigate network-fragility problems.
- The network-fragility hurdle is less severe in Proof of Work systems.
2.1 The PPCoin system
PPCoin uses stake-based block creation, but the paper identifies rational forks, bribery, timeweight accumulation, consecutive-block attacks, and predictable eligibility as security problems.
- PPCoin is described as pure Proof of Stake because Proof of Work is used only to distribute the initial money supply.
- PPCoin’s block condition restricts hash attempts to roughly one per second and makes block-generation probability proportional to controlled coins.
- Rational forks: Multiple blocks are solved approximately every four days, creating rational incentives to maintain competing forks and potentially diverge the network.
- Bribe attacks on PPCoin: After six confirmations, an attacker can offer bribes to stakeholders supporting a competing branch that reverses the payment.
- Bribe attacks on PPCoin: PPCoin users currently rely on Proof of Work blocks and centralized checkpoints for security because the protocol is controlled through signed checkpoints.
- Accumulation of timeweight: A 10%-stake attacker can raise consecutive-block probability to nearly 50% by waiting until controlled outputs have five times the average timeweight.
- Accumulation of timeweight: Capping timeweight after 90 days reduces this attack’s effectiveness but diminishes timeweight’s intended benefits.
- Consecutive-block attacks: A stakeholder with one-quarter of participating coins can perform a six-block reorganization once every 4096 blocks, approximately monthly at ten-minute block intervals.
2.2 The CoA pure Proof of Stake system
CoA is a pure Proof of Stake protocol that fixes near-future block-creator identities through an interleaving mechanism, aiming to prevent rational forks and make honest behavior dominant. Its security depends on seed-combination choices, punishment rules, and assumptions about stakeholder behavior, while analyses address bribe attacks and majority takeovers.
- Protocol design: CoA permits only one stakeholder identity to create the next block, with near-future identities fixed by earlier ledger history.This design targets rational forks by reducing stakeholders’ incentives to extend competing histories.
- Protocol design: The punishment scheme freezes a dishonest stakeholder’s security deposit for T0 blocks, but the deposit must satisfy C1 ≤ C0 to discourage double-signing.Stakeholders can divide coins among outputs, limiting how much of their funds becomes temporarily unspendable.
- Security tradeoffs: The parameter ℓ trades off security: large ℓ can expose consecutive future identities to double-spending attacks, while small ℓ makes seed influence easier.A comb range κ′ < κ can also let attackers see further into the future.
- Attack resistance: CoA’s fixed block-creator identities reduce selfish-mining incentives, since denying others does not increase future rewards.For bribe attacks, a merchant waiting S blocks is safe under Claim 1 when V < ε(ρ′S − δ + 1), and Claim 2 gives V < ε(ρS − K + 1) under the density assumption.
- Security guarantees: CoA seeks dominant honest behavior, but its guarantees rely on assumptions such as online scheduled stakeholders and effective punishment for exposed double-signing.A majority takeover analysis also finds hash requirements infeasible in an example requiring more than e^371 ≈ 2^535 attempts.
- Seed selection: Low-influence comb functions improve seed selection because majority is balanced but has determination probability θ(1/√w), whereas TRIBES reaches the lower bound Ω(log w/w) without known efficient deterministic construction.Iterated-majority-based KZ can handle coalitions of size c ≤ ε · (1/3 · ℓ/κ)^α, with α > 1/2, under a conservative non-oblivious-adversary assumption.
2.3 The Dense-CoA pure Proof of Stake variant
Dense-CoA modifies CoA by having groups of ℓ stakeholders jointly create blocks and hide future stakeholder identities, improving resistance to some attacks while increasing communication and storage costs.
- Dense-CoA has groups of ℓ stakeholders create each block instead of a single stakeholder.
- Future stakeholder identities are derived from the previous seed, while the next block’s participants jointly contribute to the subsequent seed.
- Stakeholders commit to hashed secrets, reveal preimages, and aggregate signatures so the block exposes a jointly formed seed.Nodes verify the block by hashing the preimages, reconstructing the commitment message, and checking the multisignature.
- Large ℓ values hinder control of consecutive seeds but can let large stakeholders delay block production through withholding participation.For a 10% stakeholder and ℓ=23, the cited analysis gives approximately 91% probability of appearing among the derived stakeholders and an average interval of about 56 minutes under the described attack.
- Dense-CoA improves double-spending security and limits disproportionate rewards, but weakens DoS resistance and efficiency relative to CoA.Its efficiency costs include storing ℓ preimages per block and using a two-round protocol with more network communication.
3 Solidification of the ledger history
Pure Proof of Stake systems face costless-history simulation because past stakeholders can create alternative ledger suffixes without physical expenditure. Periodic checkpointing mitigates this threat but leaves trust and network-split problems requiring external or manual resolution.
- Costless simulation lets adversaries prepare alternative ledger histories from earlier points without depleting physical resources.Past stakeholders may rationally collude because they no longer hold stake and incur no cost from the attack.
- The protocol proposes periodic checkpointing as a rigid rule for extending CoA and Dense-CoA.
- Checkpoint blocks occur every T1 blocks, with the genesis block serving as the initial checkpoint.
- A node solidifies an earlier candidate checkpoint after receiving a candidate checkpoint T1 blocks later, preventing changes to the history through that point.The later candidate may still be discarded because of a competing fork.
- Checkpointing mitigates costless simulation because spending coins requires an intermediate checkpoint to be solidified, assuming substantial C0.
- New nodes cannot determine whether received checkpoints are trustworthy, while propagation lag can enable competing forks and irreversible network splits.The proposed responses are a Web of Trust for initial synchronization and manual faction switching after a split; larger T1 makes the split less likely.
4 Issuance of the money supply
The paper proposes using Proof of Work only to distribute the initial coin supply, with production costs designed to anchor coin value and support a stable exchange rate during inflation.
- Initial coin issuance through an IPO or auction can leave the money supply under central control and weaken decentralization.
- The proposed alternative uses PoW only for initial issuance, pegging newly minted coins to approximately fixed electricity and equipment-erosion costs.
- If coin value exceeds production cost, additional mining equipment increases issuance and tends to reduce coin value.
- If coin value falls below production cost, miners leave, reducing issuance and tending to increase coin value.
- Removing Bitcoin’s difficulty readjustment mechanism makes each miner’s production cost independent of total participating mining power.
- The proposed distribution mechanism is described as allowing a stable exchange rate during inflation, unlike Bitcoin’s dramatic price fluctuations.
5 Conclusion
The paper argues that sustainable cryptocurrency security without physical resource depletion remains difficult. It analyzes existing protocols, proposes pure Proof of Stake constructions, and argues they provide better security.
- Designing secure decentralized cryptocurrency protocols without depleting physical scarce resources remains challenging.
- The authors argue that existing protocols avoiding physical resource depletion have insufficient security.
- The paper presents novel pure Proof of Stake constructions intended to avoid physical resource depletion and improve security over existing protocols.