What challenges would a pure Proof-of-stake coin face?

[Cryddit]

Okay, Gavin was helpful and explained it precisely.

The problem occurs when someone attempts to use his stake to generate blocks in more than one version of the blockchain. 

With proof-of-work, you are required to use a resource (kilowatt-hours) that cannot be used to extend more than one chain.  With proof-of-stake, your stake exists in both chains, and on the assumption that whichever chain isn't eventually given consensus simply "doesn't exist" there's no remaining evidence that you were trying to cheat. 

I think that this can be addressed.  But clearly it cannot be done on the basis of "orphaned blocks/chains simply don't become part of the shared history."  Orphaned blocks/chains need a way to be sucked back into the main chain, at least insofar as they represent sets of transactions not conflicting with one another.

But coinbase and other chain-specific transactions are by definition going to conflict, so the merge can never be total.  I will have to think about it a bit.

[wiggi]

With proof-of-work, you are required to use a resource (kilowatt-hours) that cannot be used to extend more than one chain.  With proof-of-stake, your stake exists in both chains, and on the assumption that whichever chain isn't eventually given consensus simply "doesn't exist" there's no remaining evidence that you were trying to cheat. 

Basically to make PoS save stake holders would have to destroy their coin age first (e.g. by doing a 'special' tx)
before they can attempt (just once) to mine a PoS block. If it gets orphaned, tough luck, just like PoW works.

[Cryddit]

An observation about that plan is that you wind up with a number of tx (per block) equal to the total number of coins in the universe.  And each block puts more coin into the universe, so the bandwidth requirement  per block grows linearly, and if they stay in the blockchain, then the space required by the blockchain grows geometrically.  

Hmmm, that said, until Moore's law hits the wall, bandwidth is growing exponentially, so a linear growth in bandwidth requirements isn't a huge problem.  Also, no money changes hands when someone mines unsuccessfully, so it ought to be possible to prune them from the blockchain when they get old enough.  All that needs to be remembered at a given moment, if you're regulating via coin age, is when the *last* mining attempt for (or transfer of) a given coin was made.  So the blockchain itself need not grow geometrically in the long run.

It's a good idea to regulate stake via coin age, but doesn't really solve the problem of people simultaneously mining in more than one version of the blockchain.  After all, they have the same coin age in both versions, and coin age can only be destroyed once (assuming only one chain survives) no matter in how many chains they mine.

However, the idea of having miners announce their intention with a special tx does make anti-cheating measures enforceable.  If we assume that the "I am mining" tx must announce which chain it's mining in, then that transaction can be entered in that chain for a possible mining reward, and also in other chains as a guard against cheating.  Essentially, if anyone announces mining in more than one version of the block that's at a given height, then that person is clearly cheating.  The coin they were using to mine could be simply destroyed by the protocol, or transferred to the winning miner, or whatever.

[BCNext]

Guys, I would like to hear your opinion about such PoS algorithm -- https://bitcointalk.org/index.php?topic=303898.msg3361014#msg3361014

[Cryddit]

Yes, that's basically the same plan I was talking about, except that I want to fix it so people can't tell in advance when they're going to get "lucky."  In the protocol I'm describing, there are two effects as time passes: The difficulty comes down (the target you have to meet gets larger) and you get more chances (the number of nonces you can use goes up). 

So, yah, you can solve your few hundred hashes and see when the two will meet in the middle as soon as the block starts; but someone else's chances may meet in the middle first, and you don't know when. 

Also, there's a point in sending your block around to signatories first; that's so you can't have a "winning" block (ie, one with a lower timestamp or hash than the current accepted block) that will cause a chain reorg, unless you have announced it in a timely way.  And also, it allows six different people to submit lists of all the tx they've seen, which you cannot then leave out of the block. So unless six randomly chosen stakeholders are cooperating with you, you cannot leave a chosen transaction out of the block.  That ought (I hope) to put a cramp in the style of those who want to double spend, or keep transactions out of the blockchain. 

Finally, it allows the idea of an explicit "rejected" message.  In the bitcoin protocol, a transaction which conflicts with one that's already been seen simply never confirms.  Somebody waiting for a transaction to mature might not realize there's a problem when waiting more than an hour for a transaction to mature.  But if you get explicit lists of transactions that must be included from various sources, then you are likely to get conflicting transactions in the same block.  That means that if you accept one, you have to accept the other but mark it "INVALID" or "REJECTED" or whatever, and that is likely to happen in the very first block after a double spend is made, so there's no question what's going on or complaint that the miners aren't picking up transactions fast enough, etc, when a transaction just fails to confirm. 

Anyway, as I see it, even if you're holding 50% of the stake, the odds of getting away with a double spend for even a single block, or successfully choosing to leave a particular transaction out of your block, are only about 1 in 64. 

[Cryddit]

@BCNext; It sounds very much like we're contemplating a very similar coin launch, even including some of the same longer range goals.  (native support for multiple issues in the block chain that goes well beyond 'colored coins', pure proof-of-stake, awareness of other block chains and supporting cross-chain decentralized trading, point-to-point encryption, etc). 

I'm not ready to announce a launch date though; I'm still in the process of organizing my own fork of the code  (I chose to start with Litecoin because it's simpler than most) and I don't know when it'll be ready. 

Just BTW, if you're serious about a billion-coin issue, you should be aware of exactly how wide the number you're using to record the amounts is.  Given the 1 Bitcoin / 10M Satoshi setup of Bitcoin, you don't have enough bits there to handle that many coins. 

I already ran into that when I was adding a field to keep track of coin-type.  Explanation: the basic "Crypto-Credit" coin in my system is coin type zero; but users could issue other coin types with different names, different sets of rules, and different sets of standard transactions, sharing the same block chain.  They could be other cryptocurrencies, or company stocks, or bonds, or whatever, and by default that would allow a distributed market in which issues could be traded for one another.

Anyways, I'm pointing this out because if you're amenable and have the same vision, we could cooperate. 

[BCNext]

You are welcome to join Nxt project.  In 2 months I will reveal the source code, until that you can contribute with ideas.

Colored coin amounts will be in the range from 1 to 1 billion units.  Each account will be able to issue up to 16777216 different "colors".

[chriswen]

This has been mentioned before.  To create a pure Proof-of-stake coin you would need to do an auction for coins from the genesis block before hand.  And then no transactions can be made while all the coins are maturing.

And then you would need to distribute the BTC that you get.  So, maybe you can create a site to verify you own the PoS coin and link it with a btc address.

Maybe you'll donate some of the coins to developers.  Maybe you'll use some of it to distribute to stakeholders who registered.  So if you own ppcoin not only you get stake but you also get btc stake.