top | item 32012352

Ethereum Proof-of-Stake

250 points| matthewsinclair | 3 years ago |0xfoobar.substack.com

325 comments

order
[+] SilverBirch|3 years ago|reply
>Let’s walk through a couple theoretical scenarios where a subset of malicious validators wants to censor transactions, say those originating in FATF-blacklisted countries.

Hang on a second. Just to be clear about this example, this example is walking through how Ethereum has been designed specifically to allow North Korea to transact Ethereum, and more than that, prevent anyone who dissents. Like, I mean ok, I get the ideological position in theory of saying "Hey, we're going to design this network so that you can't prevent any transactions." But it's quite different to go "The motivating example of why we would want to do this is so that we can help Iran and North Korea money launder in a direct attack against our own government's laws".

Here's my counter-example to the scenarios the author puts forward. You stake 32 eth to become a validator node and start signing off transactions from North Korea. Other people choose not to do that because... well. Your stake slowly goes up and they slowly bleed Eth. Then the US government smash down your door and throw you in federal prison because you're actively working to help North Korea.

[+] snapcaster|3 years ago|reply
I'm going to be really impressed and surprised if this ends up working (moving ETH to PoS). I'm still fairly skeptical. It seems like PoS has so many issues that come up with additional complexity being added to handle them. Worried it's increasing the attack surface too much and making a system that's not going to be able to be secured. That being said, I hope it works but it's been "two months from merge" for 5 years so hard to say
[+] Barrera|3 years ago|reply
The article does not even mention long range attacks in which large portions of the block chain are rewritten.

This is made extremely hard in Bitcoin through proof-of-work. To rewrite history you must re-do all of the work, which means you burn enough real-world energy to work faster than the entire rest of the network (aka majority hash rate attack). It's allowed, but expensive.

In PoS, there was never any work, so you can just rewrite history.

Every time the subject of Ethereum's move to PoS comes up, it seems this issue is there. The solutions mutate into a head-spinning kaleidoscope of different guises, all rabbit holes in their own maddening way and suspicious on that basis alone.

That this lengthy piece doesn't even mention long range attacks speaks volumes.

[+] 0xfoobar|3 years ago|reply
Article author here.

Supermajority attestations and block finalization, as well as withdrawal queues, prevent long-range attacks. To attempt to reorg a finalized block (blocks are generally finalized after 6 minutes) you have to commit to losing 1/3 of total staked ether, currently several billion dollars.

The only participants who can equivocate (vote for two blocks at the same height) are active validators so there is significant economic value at risk to pursue such an attack.

[+] codechicago277|3 years ago|reply
That you’re getting downvoted speaks to the poor quality of discussion on this thread. To me this is the core issue with PoS. I don’t know enough about it to say if the Ethereum devs have solved it or not, but this is a much more interesting topic than misguided comparisons of PoS to crony capitalism, which is just uninformed.
[+] amluto|3 years ago|reply
Following some links:

https://notes.ethereum.org/@vbuterin/single_slot_finality

> If 51% of validators start censoring, the victims and users can coordinate on a minority soft fork where they build on each other’s blocks and ignore the attacker. On the minority soft fork, the attacker’s deposits would lose millions of ETH to an inactivity leak, and after a few weeks the chain resumes finalizing.

It seems that this could easily be turned around: if enough malicious validators coordinate, they can create a soft fork that burns every honest validator’s stake until the malicious validators have an ever increasing supermajority.

New victims who aren’t validators could try to become validators to fight back, but the colluding validators can just ignore those proposed transactions.

[+] operator-name|3 years ago|reply
Yes, and thus is exactly what happens is 49% of validates start censoring. The legitimacy of the chain exists on the social level and not the protocol level - just as it does with BTC.

What's new here is the cost as it forces participants (stakers) to choose a side.

[+] redox99|3 years ago|reply
That's the social consensus, or "L0 consensus". It's a fork, so on only on this fork the attackers would lose the ETH.

The social consensus means that actual humans, in front of these 2 forks of ETH , the original chain being attacked, and the one where all the attackers stake has been deleted so it's safe (and also non-attackers "richer"), humans would call the latter "Ethereum" and use that. And the former would fall into irrelevance.

[+] jdoliner|3 years ago|reply
They can only burn the honest validators stake on the softfork though. The main chain won't be impacted.
[+] YetAnotherNick|3 years ago|reply
I have seen description like this so many times, but no guide seems to describe exactly how everything is done in decentralised way.

"The validators for each slot are assigned to committees". By whom? Also what if there is network partition for these 12 seconds. It's not very unlikely that some country could be completely cutoff from the internet for some time due to anything from natural or political reasons. Could there be recovery after this? At least in PoW, it is clear on what could be the possible scenarios.

[+] RL_Quine|3 years ago|reply
Generally we've described this sort of research as "review resistant", rather than being secure in some classical sense. How Ethereum and other cryptocurrencies actually work is often eagerly explained but completely unfathomable on closer inspection. Concerns raised are fixed with additional complexity repeatedly until the reviewer grows weary of attempting to piece it together. Consequently there's sufficient conflicting descriptions that I don't think anybody has any hope of successfully understanding the system as a whole, much less being able to come to conclusions about its security.
[+] 0xfoobar|3 years ago|reply
Article author here.

Great questions, should have explored the randomness beacon more. Ethereum uses [RANDAO](https://github.com/randao/randao), which is a distributed commit-reveal scheme where participants in the generation post a hash of their data on the commit portion and then at a later timestamp reveal the data preimage, and get slashed if they do not reveal a correct preimage. Then all participant data is aggregated together. This means if there is at least one honest participant the generation will be random.

A supermajority (2/3rds) of validators is required to finalize a block, in case of a 50-50 network partition blocks would stop being finalized and attestation rewards would stop. Non-participating validators would slowly leak stake through the inactivity leak until online validators once again had a supermajority. This is the "self-healing" mechanism that allows both safety and liveness.

[+] whatisweb3|3 years ago|reply
According to Eth docs:

> One validator is randomly selected to be a block proposer in every slot. This validator is responsible for creating a new block and sending it out to other nodes on the network. Also in every slot, a committee of validators is randomly chosen, whose votes are used to determine the validity of the block being proposed.

The annotated code for this can be found in [2].

[1] https://github.com/ethereum/annotated-spec/blob/master/phase...

[2] https://notes.ethereum.org/@vbuterin/Sys3GLJbD#Misc

[+] norswap|3 years ago|reply
Would recommend reading Ben Edgington's annotated spec: https://benjaminion.xyz/eth2-annotated-spec/phase0/beacon-ch...

It's not entirely up to date (none of the annotated specs are) but out of the three annotated specs I'm aware of, it's the one that is most focused on explaining how things work. Vitalik's annotation (linked in another comment) places a particular focus on the reason specific constants where chosen.

[+] 3np|3 years ago|reply
As for the source of randomness, they mention it briefly in the appendix:

> RANDAO: the random number generation scheme used to select block proposers, sort validators into committees, etc

Spec and implementation: https://github.com/randao/randao

[+] rgrmrts|3 years ago|reply
Heres my understanding of it: committee assignment is random, as in baked into the protocol, similar to how a validator is selected for a block (i.e. randomly).

While only one validator creates the block, others create attestations which I understand as duplicate work done to check the chosen validators produced block.

If an entire country goes down, those validators fall out of the active set and assuming some majority is still active they'll produce and verify blocks.

Incorrect state is rejected by the majority, and the minority is punished (slashing their stake).

Full disclosure, I'm not an expert - just an enthusiast interested in these protocols. Would love for someone more knowledgeable to correct my mistakes. I'm also not arguing for or against anything here.

[+] hansword|3 years ago|reply
Doesn't this just mean the rich decide?

Please correct me if I am wrong, but that is what it sounds to me.

(And yes, I understand that POW means the 'compute-rich' decide.)

[+] bhawks|3 years ago|reply
No in several ways.

1: The definition of an acceptable transaction is a part of the protocol. Being a block validator or attestor doesn't let an entity change the rules of the protocol.

2: intentionally excluding transactions from the Blockchain (essentially censorship) causes economic harm to the PoS censors and is ultimately futile.

The fine article discusses both these points in more depth (mostly in the misconception section).

Essentially stake in a proof of stake system is used to punish selfish/destructive behaviours and reward honest cooperation. Participating in that system does not create a 2 tiered system of participants where one tier has powers the other doesn't not. Nonstakers simply do not aid in the production of blocks and therefore the incentive mechanisms of block production do not have any impact on them.

[+] noman-land|3 years ago|reply
The article touches on this toward the end.

"The idea of CPUs, GPUs, and ASICs churning away in a mathematical competition to find hash preimages the fastest has an egalitarian elegance to it. Sovereign individuals where individuals running home gaming computers can compete with nation-states for the right to earn 6.25 freshly minted BTC.

Unfortunately, ASIC supply chains are easily controlled by import/export regulations, not to mention a dangerous dependency on Taiwan. The need for cheap, abundant energy is another weak point that prohibits individuals from running discreet mining setups. And because we have not yet entered a post-scarcity utopia, you need upfront capital to purchase mining rigs. Worse, technological advances mean miners are constantly required to upgrade their setups to remain competitive, meaning the supply chain dependency is an ongoing weak point if things ever go south.

PoW can be thought of as a specific instantiation of PoS, where users stake capital to purchase mining rigs that then compete for the block proposal rights. Your staked principal can be withdrawn at any time, but its value follows a decay curve corresponding to the current market value of your computer chips. The need for upfront capital is identical in both PoW and PoS, the key difference being that the capital is forced through a computer chip supply chain in PoW while it can be purely staked in PoS."

[+] whatisweb3|3 years ago|reply
Decide on what? They are not governing the protocol or restricting who can use it, only proposing blocks and submitting attestations. They have limited capabilities to make changes in the ledger, and if they do enact undesirable changes they risk their capital being slashed. If you as a user wants to participate in protocol validation and its rewards without staking 32ETH, you can use a decentralized staking pool like RocketPool.

As of yet there are no sound methods of securing a public ledger without either PoW, PoS or PoA. Bitcoin uses PoW, most central banking and traditional payment processors use PoA, Ethereum will soon use PoS.

[+] shekhirin|3 years ago|reply
I think there's two points to unpack:

1. As you said, it was compute-rich before, and native token-rich now. I see it that way: the difference is that your richness is now a part of the protocol which allows it to e.g. punish bad actors (aka slashing) which isn't possible in PoW scenario where attacks can continue indefinitely.

2. Validators don't solely decide rules of execution: full nodes do. If you, as a validator, try to break the rules (double spend, incorrect execution, etc.), full nodes won't accept this new world view and discard it. So providers like Infura which most users (currently) use will continue working as expected and the canonical chain won't be damaged.

[+] rglullis|3 years ago|reply
So what? Pardon the pun, but what is at stake here?

It's not that the those proposing blocks can change the rules of the game, validators are only there to ensure that rules of the game are being followed.

[+] NoGravitas|3 years ago|reply
Yes, that's how I understand the paragraph near the end that says "Proof-of-any-resource is centralizing".
[+] ETH_start|3 years ago|reply
No, the rich and poor get the same ROI, so relative wealth doesn't change.
[+] drdrek|3 years ago|reply
Ahh proof of stake, the nail in the coffin of decentralization.

What did you say? the more you have of the capital the more you influence the system? what a novel concept!

Monterey and legal systems based on structures that are at least partially built to take care of the needs of people of similar culture and geographic area? YUCK! Machine enforced plutocratic system where early adopters and syndicates have absolute power?! SIGN ME THE FUCK UP!

[+] xadhominemx|3 years ago|reply
It’s a lot more challenging to run a mining operation that even breaks even over the long run than it is to buy a couple eth and start staking
[+] rekoil|3 years ago|reply
Proof of Work is the same, just with more steps.
[+] bibabaloo|3 years ago|reply
> the more you have of the capital the more you influence the system

That's not how PoS works, though?

[+] syzygyhack|3 years ago|reply
The decentralization of PoS depends entirely on initial token distribution.
[+] mmastrac|3 years ago|reply
I can't see governments allowing PoW to continue to exist in our current climate (in all senses). How would Bitcoin ever move over to PoS like this? Would it just be a Bitcoin hard fork?
[+] gregwebs|3 years ago|reply
Current Bitcoin usage is literally a rounding error of global energy usage (0.1%) and if wildly successful would still be < 1% of energy usage. https://www.lynalden.com/bitcoin-energy/

If Bitcoin moved to PoS it would be fundamentally different. It might work for other coins since they aren't as decentralized.

> Instead, proof-of-stake mainly seems less suitable for a decentralized and censorship-resistant global monetary asset, especially when considered along with the issues that I’ll describe in the second half of this article about stablecoins. Proof-of-stake is inherently equity-like rather than money-like, compared to proof-of-work

https://www.lynalden.com/proof-of-stake/

[+] whatisweb3|3 years ago|reply
Yes it would need a hard fork - but Bitcoin community is notoriously resistant to change, so it probably would not happen for some years or decades.
[+] bibabaloo|3 years ago|reply
> governments allowing PoW

Is there any precedent for this? Have governments ever ruled on how people can use their computational power?

[+] cesarb|3 years ago|reply
> How would Bitcoin ever move over to PoS like this? Would it just be a Bitcoin hard fork?

I believe it would be possible for Bitcoin to migrate to proof of stake with a soft fork, similar to how they migrated to SegWit. A majority of nodes (both non-miner full nodes and miners) would have to upgrade to a version which rejects blocks which do not contain a proof of stake together with the current proof of work; non-upgraded nodes would ignore the proof of stake but would still accept the blocks as valid since the proof of work is valid (this is the key difference between a soft fork and a hard fork; on a hard fork, non-upgraded notes would reject the new chain). And to get rid of the proof of work, the block intervals would have to be tweaked to make the network appear to be running slow (for instance, making every block take one minute longer, either on reality or through clever manipulation of the block timestamps), so that the difficulty adjustment gradually reduces the difficulty, until the (now vestigial) proof of work becomes trivial to compute.

[+] TacticalCoder|3 years ago|reply
> There are two key equivocation rules a validator must follow, taken from the Gasper paper: > > Double vote - no validator makes two distinct attestations for the same target block > > Surround vote - no validator makes an attestation that surrounds or is surrounded by a previous attestation

Which are both punished by having the saked ETHs being "slashed" (32 ETHs staked, you end up losing 16 of the 32).

I never understood that: it opens a door for a huge attack in that it's now impossible to safely "stake". Ethereum devs says you can safely stake in that staked ETHs aren't at risk of being stolen (the key to stake and to move the ETHs aren't the same, so it's impossible for an attacker to steal the 32 ETHs) but...

An attacker accessing a staking node can, on purpose, double vote or surround vote to get the ETH slashed. The difference between losing 32 ETHs or 16 ETHs is not that big (sure, in the case of slashing at least the attacker doesn't get them, but for the person losing the ETHs, it doesn't make a huge difference).

So it's impossible to stake without risking your ETHs getting slashed, even if the staker is honest.

Here's my prediction: we'll see exactly that attack on slashing nodes, people are going to lose ETHs and we'll see excuses to the tune of "you didn't securize your node well enough".

I do think it should be possible to stake without that risk (just as it is possible to hold the private keys to cryptocurrencies on hardware wallets because, well, computers are all too often insecure).

Here's another prediction: some are going to come up with HSM to stake ETHs (maybe they already exist?). The risk of getting people's ETHs slashed is just too big.

[+] kobieyc|3 years ago|reply
Something that always trips me up about PoS is how a system that determines the transactional chronology (i.e. sequence of valid blocks) that uses, as a weighted input, the current transactional chronology (valid blocks determine your stake) isn't a logically a circular definition.
[+] wmf|3 years ago|reply
Everyone does have to agree out of band on the genesis block or some equivalent. Once you have that, the protocol can progress automatically.
[+] Baopab|3 years ago|reply
Great article, it put an end to many misunderstandings that I had. The technology is truly marvelous.
[+] ck2|3 years ago|reply
I mean it's going to be just absolutely fascinating to see what happens in real life vs all the theories.

I guess if you are heavily invested it's rather dread than intellectual curiosity.

There are plenty of other options if it all goes south.

[+] jl2718|3 years ago|reply
This is an opinion piece supporting POS. Simple question: if blockchains of similar (large) market cap are compared, which has the best Gini coefficient: PoS or PoW?
[+] icevoid|3 years ago|reply
Leaving behind the technical details and the energy consumption aspect, it seems to me that the main economic difference between PoW and PoS is that in the former miners are forced to sell their earned tokens due to a high cost of keeping their equipment up and running. This sounds like a healthier approach.

Whereas PoS validators don't have the same burden, therefore they'd naturally tend to simply increase their shares.

[+] k2xl|3 years ago|reply
> To attempt to reorg a finalized block (blocks are generally finalized after 6 minutes) you have to commit to losing 1/3 of total staked ether, currently several billion dollars.

Hmm... Several billion dollars is not actually that much money for nation states. Am I misunderstanding something here? Shouldn't it be much more expensive than several billion?

[+] Imnimo|3 years ago|reply
> Honest validators see both forks but would built on the honest fork because it has greater weight in the LMD-GHOST fork choice rule.

I don't understand this part. Is an "honest" validator someone who follows the rules, or someone who is purely profit-motivated? If the latter, what specifically incentivizes them to obey this LMD-GHOST rule?

[+] throwaway23236|3 years ago|reply
Just so I am clear, if you want to be a validator, you need ~32,000 USD? Seems like that is out of reach for most people.
[+] dylkil|3 years ago|reply
thats why things like rocket pool exist
[+] TheDudeMan|3 years ago|reply
Talks about PoW, PoS, PoA, but totally ignores Chia's superior PoST.