The thing you are missing is that all these attack scenarios would apply to <insert PoW coin here> as well as any human based PoW, with the added bonus that they'd be easier to carry out as the hash rate market is much more mature than any human PoW market.

Firstly, your transaction is invalid and not accepted by the network for propagation.

Secondly, you will need to pay each one of these people you attempt to bribe more than the block reward they earn for playing by the rules. So this attack is going to be expensive.

Thirdly, your attack has an ongoing cost because you still need to outpace the rest of the honest network.

Your proposition is a simple 51% attack and achieving it is far more difficult than renting hash power because people are the ultimate limited resource.

Suppose I give you a problem, solvable only by a human, that a human performing at his best takes 10s to complete. How can you improve this solution time? You can't.

Alternatively, I give you a machine solvable problem, which takes 10s on a the best CPU to solve. How can you improve this solution time? ASIC. You can probably improve it by at least 100x.

That is the difference here. You've getting hung up on PoW being a machine solvable problem.

You're still not thinking about the problem properly. A PoW solvable only by people would be the ultimate system because you cannot sybil attack it - the best thing you can do is crowd source it, but it would still have the lowest sybil coefficient of any system possible.

You're thinking about politics when you should be thinking about consensus. Anything you can apply to politics applies to all possible consensus mechanisms since they're all controlled by people.

A truly decentralised consensus mechanism is one where humans perform the PoW. The trouble is, finding a problem that only a human can solve that is also easily verifiable by a machine is unsolved.

The person who solves this problem will be very rich indeed.

I was referring to your proposal with the staking keys.... I'm going to stop clogging up this thread with conjecture and wait for Shunsai to add some more details.

What you mean by validation? Transaction are validated by nodes on the network. That's not the show stopper, the show stopper is lite nodes. DAG based systems cannot support them without added centralisation.

If you've not read it, I recommend taking a glance at my draft white paper describing Max Kaye's original thinking in this area. You might find it enlightening:

https://github.com/wildbunny/docs/blob/master/T.E.T.O-draft.pdf

A car has wheels. A plane also has wheels.... yet I do not expect to pilot my car into the air because it shares some of the same functional components.

I agree with nothing you've said. What you're talking about is a consensus of 1, which is no consensus at all.

I disagree. You're talking about the existing, block based implementations of consensus built around PoW. PoW itself specifies no such limitations, it is simply a tool to use in building consensus designs which may or may not have the limitation you are describing.

Sorry but this is just nonsense. How are you going to prove that a 'level up' message isn't just fraudulent? You've got the exact same consensus problem here as a blockchain has in the first place.

I look forward to what you guys can come up with. Although, I have to say I'm extremely sceptical of any trustless design claiming to have no incentive system.

IMO, the 0% attack is more dangerous than just the not responding attack, because at first glance there should be no reason to expect that sending yourself a transaction could have consequences, so why would someone refuse being paid for doing so?

'Proof' is the key word here. How are you going to prove any of these achievements actually happened? More to the point, how is the blockchain going to verify them?

That would have to be a necessary condition. You might assume that bonded stake just has to mature for some period before it can start voting, but this is not enough as you say it must also not be transferable.

I think there is still an open question about objectively identifying double signing, though - why can't an attacker just use two different stake public keys to double sign?

There are a couple of problems with that idea:

1) Bonded stake systems are subject to the 0% attack in which you bribe all the bonded stake in the system to simultaneously send a transaction to themselves (an action with seemingly no consequences). With zero bonded stake remaining in the system, the chain freezes forever.

2) If you remove the stake transfer limit, the above becomes possible and not only that but you also weaken the history attack strength, which was near 99% attack proof due to the slow stake transfer combined with the epocs signatures.

Hi Shunsai,

I have some ideas for you which might help your NaS problem. I developed an aborted Proof of Burn concept ages ago(*) which I've recently revisited and it might have some ideas you can use:

This is a brief summary of how it works:

* Participants compete to win block reward by burning stake
* A block can be proposed when burnt stake >= block reward
* Block reward is divided out between all participants in proportion to their burnt amounts

An attacker attempting to dominate the block generation process by proposing a block containing only his burnt stake will always lose out once his block is published, because other participants can propose a better block containing his burnt stake AND their burnt stake. So, at the limit if he burnt the block reward in his private block, what he gets back is less than his burnt stake once he published his block due to the above possibility, so he will lose money this way.

In order to double spend his only option is create a massive chain of private blocks and then submit that later. But, if we instead adopt your slot mechanism, it would be impossible for this attack to succeed because he cannot propose more than 1 block at a time.

We can also employ your double voting exclusion mechanism so that if he burns on two chains at the same time, he will lose his stake completely.

The only major problem I can see here is that there is no objective way to verify a slot and the boundary(s) thereof, so we have history attack problems.

Anyway, hope that gives you some ideas

Cheers, Paul.

edit: I still have an open question raised by shelby, if we're discarding double votes inside a slot, why don't we just do that for double spends and scratch the entire voting process completely? This is due to the subsequent invalidation cascade which would make discarded double spends cost free for the attacker

*) https://bitcointalk.org/index.php?topic=1182677.msg12446394#msg12446394

You need to look up sybil attack. What constitutes a node? A port? So all the mining farms do is to split their existing hash rate over whatever you're defining as the limit so they're achieving the same goal.

This idea might still have some legs because arguably it would still work if weak subjectivity was an acceptable compromise since no online node would accept a historical double spend as being valid given the latest UTXO DAG. I don't think weak subjectivity should ever be acceptable, however, so I'm going to keep thinking