Why Proof of Burn cannot work cleanly in practice

[monsterer]

Over the last few days I've been musing about a consensus design involving Proof of Burn (https://en.bitcoin.it/wiki/Proof_of_burn), whereby participants in the consensus process burn currency in competition for the block reward. In theory this has the same properties of Proof of Work, except that you can burn currency infinitely quickly, so block times would be fast.

However, I have come to the conclusion that this cannot be done cleanly. Rather than throw away all the work, I think it's informative to share my reasoning and conclusions here.

Here is the spec for design A, which attempts to mimic POW as closely as possible:

* participants P burn coins to compete for block reward
* once sum of coins burnt from burn transactions not yet in a block >= block reward the block closes
* the probability of any P winning the block reward is how much they burnt divided by the total amount burnt by all participants
* the hash of the block is used as a random number seed to decide which P wins the block reward
* in the case of multiple winners, only the highest burn winner receives the block reward
* in the case of no winners, the block is reopened and the round restarts
* the chain with the most burn is always selected in the case of forks
* a transaction is confirmed when it is buried under a equivalent amount of burn

It has the nice property (at first glance) that no double spend is profitable once the transaction is confirmed, because an attacker would need to burn an amount of currency equal to the transaction size in order to get a double spend confirmed.

There are two three major problems with this first design:

1) Randomness (or entropy) in a p2p system is bounded by the data present in the chain. What this means is that (at the very least) an attacker can know ahead of time whether he will win the block reward, because he has all data necessary to compute the result of the random function, no matter what components he is required to use. He can then chose not to participate if he will lose.

Simply adding a small POW to this random number generator would increase the entropy, but unless the difficulty of this POW is at maximum network difficulty, you can still sybil attack this result by precomputing many such POW and picking the most favourable and at this point you're basically doing full POW anyway, so POB becomes pointless.

2) Finney attack. It is completely trivial for an attacker to generate an infinite sequence of valid blocks in which he is the solo participant and is also the winner. Since the chain is ordered by maximum burn, this makes any double spend profitable because he can simply dump a massive pile of finney blocks on the fork containing his double spend. Using block timestamps to discard quickly submitted blocks is not a viable solution, since timestamps in a p2p system are unreliable.

3) Making the block reward equal to the burnt amount makes this functionally equivalent to Proof of Stake for the case of the single miner. However, if you don't make the block reward at least equal to the amount burnt, it is not profitable to mine.

You can try to work around these two three issues by using external randomness and trying to use a combination of POW and POB to reduce the finney probability, but these are not clean solutions IMO.

Cheers, Paul.

[1714919453]

1714919453

[1714919453]

1714919453

[1714919453]

1714919453

[1714919453]

1714919453

[rnicoll]

Proof of burn is primarily useful for seeding new currencies (see Counterparty from Bitcoin, Dogeparty from Dogecoin), forcing users to destroy value to create coins in another currency. Yeah, wouldn't want to use it for block mining!

[d5000]

Over the last few days I've been musing about a consensus design involving Proof of Burn (https://en.bitcoin.it/wiki/Proof_of_burn), whereby participants in the consensus process burn currency in competition for the block reward. In theory this has the same properties of Proof of Work, except that you can burn currency infinitely quickly, so block times would be fast.

However, I have come to the conclusion that this cannot be done cleanly. Rather than throw away all the work, I think it's informative to share my reasoning and conclusions here.

Here is the spec for design A, which attempts to mimic POW as closely as possible:

* participants P burn coins to compete for block reward
* once sum of coins burnt from burn transactions not yet in a block >= block reward the block closes
* the probability of any P winning the block reward is how much they burnt divided by the total amount burnt by all participants
* the hash of the block is used as a random number seed to decide which P wins the block reward
* in the case of multiple winners, only the highest burn winner receives the block reward
* in the case of no winners, the block is reopened and the round restarts
* the chain with the most burn is always selected in the case of forks
* a transaction is confirmed when it is buried under a equivalent amount of burn

It has the nice property (at first glance) that no double spend is profitable once the transaction is confirmed, because an attacker would need to burn an amount of currency equal to the transaction size in order to get a double spend confirmed.

Am I right that your design involves burning ''in the moment''? So participants must burn currency ''in the time interval between two blocks'' to compete for the second block?

The main problem with this approach in my opinion is that every block, the total amount of burned currency would be comparatively low because burnt coins don't accumulate over time, and so it would be really easy (=not expensive) for a malicious attacker to burn a relative large amount and have a guarantee to find the block.

The implementation used in Slimcoin (the only PoB coin at the moment, see Whitepaper) is pretty different. The burnt coins accumulate and rise the probability to find a block, called "EffectiveBurnCoins". It is more similar to Proof of Stake, so I guess it shares more properties with PoS than with your design.

Your design is interesting because it's modeled after Bitcoin's Proof of Work, but I think it's not feasible to secure a blockchain with this model.

Some comments to the attacks you describe (but I still have to read more about them):

1) Randomness (or entropy) in a p2p system is bounded by the data present in the chain. What this means is that (at the very least) an attacker can know ahead of time whether he will win the block reward, because he has all data necessary to compute the result of the random function, no matter what components he is required to use. He can then chose not to participate if he will lose.

That sounds true. But in designs where burnt coins accumulate over time like the Slimcoin design, this should be expensive to exploit because you would have to burn a large amount to be sure to have a chance to get the block (if you don't use a "fake" chain).

2) Finney attack. It is completely trivial for an attacker to generate an infinite sequence of valid blocks in which he is the solo participant and is also the winner. Since the chain is ordered by maximum burn, this makes any double spend profitable because he can simply dump a massive pile of finney blocks on the fork containing his double spend. Using block timestamps to discard quickly submitted blocks is not a viable solution, since timestamps in a p2p system are unreliable.

Why is the chain ordered by "maximum burn"? Can't this be done differently in your design?* I must read further about how PoS designs solve this problem to comment this attack.

(*I have thought about it and it seems that in this "PoW-mimicking" PoB design there is no other possibility)

3) Making the block reward equal to the burnt amount makes this functionally equivalent to Proof of Stake for the case of the single miner. However, if you don't make the block reward at least equal to the amount burnt, it is not profitable to mine.

Obviously miners would burn lower amounts than the block reward. But that is related to what I wrote above: When the participants must burn inmediately before the block is created and burnt coins do not accumulate for larger time intervals, then the security level would be very low just because of these low amounts - and so also the amounts needed to attack the system.

It is true that the alternative design used by Slimcoin, where burnt coins accumulate over time, is very similar to Proof of Stake. The main difference, for me, is that this Proof of burn design reward long time engagement. Also it's not a simple "rich get richer" game, because there is a certain probability that you won't get back the coins you burnt, while in PoS you won't lose your stake if you participate.

[clemahieu]

Also it's not a simple "rich get richer" game

Is that true in the long run?  It seems like there's preference given to the longest burn via the multiplier though there's nothing stopping someone from having multiple burns maturing simultaneously.  It seems like the richest person would be able to have the most amount of burns maturing, possibly from every block, and would always dominate anyone who doesn't have as much.

[d5000]

Is that true in the long run?  It seems like there's preference given to the longest burn via the multiplier though there's nothing stopping someone from having multiple burns maturing simultaneously.  It seems like the richest person would be able to have the most amount of burns maturing, possibly from every block, and would always dominate anyone who doesn't have as much.

In my understanding, this would be only problematic if distribution of the coin is very uneven: if there are addresses which such great wealth that they can dominate the "burning" market and so are guaranteed to get their investment back and make profit from PoB. In any other cases, even with large burn amounts, there should be at least a minimum risk to not getting it back. If it becomes a problem, I think it should be possible to minimize this problem adjusting the formula that determines probability to find a PoB block.

But the main point that makes PoB less a "rich get richer" game for me is that in most actual PoS systems there is practically no risk when "forging" or "staking", because you can retire the coins when you want, for example if you think price is about to fall. So "rich get richer" without risk. In PoB systems like Slimcoin, burning large amounts of currency is equivalent to a "locked" deposit of several months, that means you always are at risk to lose value in bear markets. So PoB is, in terms of risk, roughly equivalent to a PoS system with long-term security deposits like proposed by Vitalik Buterin and others.

@nutlldah: The Counterparty PoB process was fundamentally different from what we're talking about here. The OP's intention is to point out possible attacks on Proof of burn when used as a consensus mechanism (as alternative to Proof of work or Proof of stake), not when bootstrapping a entirely new currency.

[TPTB_need_war]

It has the nice property (at first glance) that no double spend is profitable once the transaction is confirmed, because an attacker would need to burn an amount of currency equal to the transaction size in order to get a double spend confirmed.

I believe you are stating that no one would assume a transaction is confirmed until the amount of accumulated burn was greater than all the possible transactions that could be double spent.

1) Randomness (or entropy) in a p2p system is bounded by the data present in the chain. What this means is that (at the very least) an attacker can know ahead of time whether he will win the block reward, because he has all data necessary to compute the result of the random function, no matter what components he is required to use.

2) Finney attack. It is completely trivial for an attacker to generate an infinite sequence of valid blocks in which he is the solo participant and is also the winner. Since the chain is ordered by maximum burn, this makes any double spend profitable because he can simply dump a massive pile of finney blocks on the fork containing his double spend. Using block timestamps to discard quickly submitted blocks is not a viable solution, since timestamps in a p2p system are unreliable.

The key distinction from PoW is that the PoB variant you described can be spent in more than one chain. This is the "nothing at stake" problem of PoS as well. To address this weakness, the PoS algorithms attempt to penalize applying stake (mining power) to more than one prospective chain and/or to the orphaned chain(s).

Another key distinction is you've assumed the randomness (entropy) of PoB is fully preimaged so that the attacker can set up his coins to burn such that he can burn on every block of his secret chain. PoS algorithms attempt to make the entropy larger than what could be practically computed to find the prerequisite preimage.

The popular counter-argument that "it costs more to attack than to participate in the security" is flawed.

As I was explaining in the "block lattice" thread (RaiBlocks) yesterday, if a resource is not irreversibly burned as proof of the longest chain, then the only possible objectivity is the "weak subjectivity" of social memory of historical consensus. In the long-term, the memory of (and investment in[1]) the verifiably recorded historical consensus overwhelms any alternative realities that can be conjured from "nothing at stake". In the short-term, arbitrary alternative realities are indistinguishable from reality unless there is an objective measure of the longest chain (with a sufficient penalty for not joining the longest chain to motivate convergence on one chain). In PoW, the short-term objective metric is the probability of double-spend by a given % of total network hashrate.

A non-PoW algorithm could in the short-term use an objective metric of the long-term historical consensus to limit the rate of deviation of the short-term consensus. Think of rolling checkpoints, but applying this inertia to the future as well, analogous to anti-aliasing. There is your strong hint as to what I am doing differently than other attempts to overhaul the block chain consensus algorithm.

[1] Include all the dependent transactions in that history as a social investment that won't be revertible.

3) Making the block reward equal to the burnt amount makes this functionally equivalent to Proof of Stake for the case of the single miner. However, if you don't make the block reward at least equal to the amount burnt, it is not profitable to mine.

You are (perhaps unconsciously?) identifying a more significant economic fact: there is no way to secure a block chain without centralization due to power law distribution of wealth coupled with the Iron Law of Political Economics when any resource is involved in the objectivity of the consensus. With inertia as the objectivity, I think it will be much more difficult to centralize the block chain.

Bitcoin is being raped TO DEATH by disproportionate cost of security (investor's money is being siphoned off to the electric utilities):

http://motherboard.vice.com/read/bitcoin-is-unsustainable

“a single Bitcoin transaction uses roughly enough electricity to power 1.57 American households for a day”

That electricity consumption cost per transaction will decrease as TX/s scaling increases, but currently the only way to do that is to drive centralization of mining (whether it be larger blocks or even Lightening Networks will be large corporate servers doing the glue between user level channels). But centralization is economically inevitable in Bitcoin any way...

Bitcoin pays about 1.35 million BTC to mining annually and consumes roughly 365 x 24 x 250,000 kWh annually. Thus roughly 1600 kWh per BTC in electricity cost. Thus Bitcoin mining is marginally profitable up to nearly 20 cents per kWh ($320 per BTC), which is roughly the marginal rate for residential electricity.

Yet mining farms locate where they can get subsidized water dam generated electricity for as low as 4 cents per kWh, thus $64 per BTC.

But the above assumes that all miners have the same electrical efficiency, which is not the case. Thus the mining farms are mining BTC at probably less than $50 per BTC (not counting hardware amortization).

http://www.neucoin.org/en/whitepaper/download#page=10

As a result, slowly but surely from 2010 through mid-2013, but after that in a landslide,
hobbyist and small-scale miners have gotten knocked out of business. It’s a very simple
dynamic. When a miner with access to capital enjoys lower overall costs than the competition,
he simply buys more computer power, driving up the difficulty of earning mining rewards,
and knocking the least efficient competitors out of business. Lower costs can either take the
form of lower cost hash rate or lower cost electricity. Bitcoin mining is rapidly becoming
controlled by a handful of companies with tens of millions of dollars of the most efficient
ASICs11, operating from facilities with the very lowest electricity and cooling costs on the
planet (e.g. Iceland and northern Sweden).

The point being that Bitcoin mining is economically driven to be controlled by those who have the highest economies-of-scale and are beholden to the governments which regulate utilities and subsidize cheap electricity with massive infrastructure spending with public debt.

Thus Bitcoin's mining is in effect controlled by the (oligarchy which controls the) governments, and this will become more evident over time.

Ditto PoS mining redistributes the coins over time to the largest stakeholders.

But the main point that makes PoB less a "rich get richer" game for me is that in most actual PoS systems there is practically no risk when "forging" or "staking", because you can retire the coins when you want, for example if you think price is about to fall. So "rich get richer" without risk. In PoB systems like Slimcoin, burning large amounts of currency is equivalent to a "locked" deposit of several months, that means you always are at risk to lose value in bear markets. So PoB is, in terms of risk, roughly equivalent to a PoS system with long-term security deposits like proposed by Vitalik Buterin and others.

If it becomes a widely used liquid currency, exchange volatility is minimized, so then the risk argument fades away.

In the nascent stage, what you are saying is that proof-of-deposit-at-risk coins that don't have very favorable risk will have very low security.

[d5000]

But the main point that makes PoB less a "rich get richer" game for me is that in most actual PoS systems there is practically no risk when "forging" or "staking", because you can retire the coins when you want, for example if you think price is about to fall. So "rich get richer" without risk. In PoB systems like Slimcoin, burning large amounts of currency is equivalent to a "locked" deposit of several months, that means you always are at risk to lose value in bear markets. So PoB is, in terms of risk, roughly equivalent to a PoS system with long-term security deposits like proposed by Vitalik Buterin and others.

If it becomes a widely used liquid currency, exchange volatility is minimized, so then the risk argument fades away.

That may be true or not. Even with currencies like the Euro there is a certain risk of losing at least some value (about 30% in the past 3 years or so compared to the US dollar), so even in a pretty stable cryptocurrency the risk would be always significant.

In the nascent stage, what you are saying is that proof-of-deposit-at-risk coins that don't have very favorable risk will have very low security.

No, that wasn't my intention, this part of the post was only about fairness, not about security. I think in terms of security PoS and PoB should be equivalent, they're both depending on "weak subjectivity". What is true that in both PoS and PoB the nascent stage with low value is the most risky, but that is basically the same even with PoW because of the low hash rate of nascent coins.

[TPTB_need_war]

But the main point that makes PoB less a "rich get richer" game for me is that in most actual PoS systems there is practically no risk when "forging" or "staking", because you can retire the coins when you want, for example if you think price is about to fall. So "rich get richer" without risk. In PoB systems like Slimcoin, burning large amounts of currency is equivalent to a "locked" deposit of several months, that means you always are at risk to lose value in bear markets. So PoB is, in terms of risk, roughly equivalent to a PoS system with long-term security deposits like proposed by Vitalik Buterin and others.

If it becomes a widely used liquid currency, exchange volatility is minimized, so then the risk argument fades away.

That may be true or not. Even with currencies like the Euro there is a certain risk of losing at least some value (about 30% in the past 3 years or so compared to the US dollar), so even in a pretty stable cryptocurrency the risk would be always significant.

If your unit-of-account is in Euros, then normal fluctuations in the currency are irrelevant.

Capital is fleeing Euro because EU is imploding (because they separated the unit-of-exchange from the unit-of-account for fiscal debt). Thus an example of what I said, then that the security is low.

In the nascent stage, what you are saying is that proof-of-deposit-at-risk coins that don't have very favorable risk will have very low security.

No, that wasn't my intention, this part of the post was only about fairness, not about security. I think in terms of security PoS and PoB should be equivalent, they're both depending on "weak subjectivity".

I was speaking about short-term double-spend risk where "weak subjectivity" doesn't apply. If the currency's exchange rate (to normally used units-of-account) is too volatile, then the PoB variant you described will have low security because it will be too risky to participate in the long-range PoB commitment risk.

So my point is that requiring risk does not fix the problem that rich get richer (and centralization results). When there is risk, the coin loses viability. When there is insignificant risk, the rich get richer (as they do in all block chain consensus algorithms thus far invented).

What is true that in both PoS and PoB the nascent stage with low value is the most risky, but that is basically the same even with PoW because of the low hash rate of nascent coins.

True.

Eliminating that attribute should be another coup of my "Tour de Force" of block chain consensus paradigm shifts coming soon...

[Spoetnik]

Bitcoin is being raped TO DEATH by disproportionate cost of security (investor's money is being siphoned off to the electric utilities):

That is punishment for exploiting things.
Huge operations have up'ed the ante more and more.. causing the mining arm's race.
Look at the op's in China or Iceland.

I doubt Satoshi envisioned that a handful of central points would rule Bitcoin taking all the rewards.
In that sense BTC has failed i think.. that was not anticipated i guess ?

Let's mention the downward pressure by the large mining operations too.
The guy in Washington state who started a giant farm mentioned having to get a large loan.
The guy in Iceland mentioned hardware that cost him 20k a pop per device when he started long ago..
These operations can't work unless they pay off their large loans and electrical bills.
In turn they dump like crazy onto the markets.. while few people are there to buy them all.
It equates to a pyramid scheme of sorts.
I don't see Bitcoin as a stock or a currency but more of an investors scheme.

Doomed by design and i think POB implementations mentioned here i read all seem to be ending up the same way.
And what would the future hold for a POB currency ?
The incentive is to get crappy coins to destroy so think about it.
Users are motivated to acquire shitty coins so if they run out they will create a shit coin just to burn it.
And what if i keep making them at no cost just so i can sit there and burn them ?
I will make Spoetnik Coin #1, #2, #3 and so on for no other reason than for me to burn.
Who then controls what coins get burned ? A centralized figure ?
And if a system of consensus was coded in like a voting platform that too would be exploited easily.

I like the idea in theory but in practice it has issues.

We need to go back to the drawing board.
What i imagine as a POW system would involve Ethernet / WIFI connections.. and no IPO or Premine bullshit !
I want to see the playing field evened out so the Rich can't dominate the rewards *too much.
I also think any usage of electricity should be doing something useful. (unlike say Bitcoin)

[clemahieu]

Bitcoin is being raped TO DEATH by disproportionate cost of security (investor's money is being siphoned off to the electric utilities):

I doubt Satoshi envisioned that a handful of central points would rule Bitcoin taking all the rewards.
In that sense BTC has failed i think.. that was not anticipated i guess ?

Agreed, I think PoW was the best bet for an in-band reward for supporting a small part of what a currency takes.

Cryptocurrency has more value than its mining rewards, all these side businesses that start up, exchanges, banks, merchant systems, all get value from bitcoin aside from block rewards.

I don't think block rewards will last.

[d5000]

That may be true or not. Even with currencies like the Euro there is a certain risk of losing at least some value (about 30% in the past 3 years or so compared to the US dollar), so even in a pretty stable cryptocurrency the risk would be always significant.

If your unit-of-account is in Euros, then normal fluctuations in the currency are irrelevant.

Capital is fleeing Euro because EU is imploding (because they separated the unit-of-exchange from the unit-of-account for fiscal debt). Thus an example of what I said, then that the security is low.

That wasn't euro-specific. Every currency has fluctuations, even the larger ones. It's even true for the US dollar and obviously for assets like gold and silver. So the risk never is zero, but, obviously, the more mature the market, the less the risk of a long term deposit.

I was speaking about short-term double-spend risk where "weak subjectivity" doesn't apply. If the currency's exchange rate (to normally used units-of-account) is too volatile, then the PoB variant you described will have low security because it will be too risky to participate in the long-range PoB commitment risk.

That should be subject of investigation . The nascent stage is not only the most volatile but also the stage where the opportunity to win with a low investment is the highest. In Slimcoin, for example, in the nascent stage, a large part of the mined and minted coins were burnt in the first three months (it has a hybrid model, PoW/PoS/PoB) to maximize chance of income. At this moment, there was even a "burn bubble" where there were more coins burnt than there were rewards for the next months, and many people then complained about low profits.

The problem are periods where most participants think the currency is overvalued and a bear market is about to begin, and, of course, large bear markets with sinking expectations. But if the value of the coins that you burnt increase your probability to find blocks for a large time interval (in Slimcoin, it's 1 year with linearly decreasing probability), then these fluctuations in "burn participation" should not be very large.

I have plans to investigate this phenomenon (relation "burn participation" / price trends) in Slimcoin, although results would be more meaningful in a more mature market situation (actually, there is very low trading activity and burn participation).

So my point is that requiring risk does not fix the problem that rich get richer (and centralization results). When there is risk, the coin loses viability. When there is insignificant risk, the rich get richer (as they do in all block chain consensus algorithms thus far invented).

You are right, some degree of centralization is inherent to all currently known designs. But pure PoS (without locked deposits) is the most benefitting for the rich. All they must do is not move their coins. In PoW and PoB, at least, it makes sense for them to analyze the market situation; so there will not only the "most rich" group burning large amounts of currency but also a "entrepreneur" group (comparable to the Bitcoin miners) seeking opportunities. It's a rich-get-richer game, but not that simple like in PoS.

[tokeweed]

Counterparty was a good Proof of Burn experiment.  But so far nadda.

[duuuuude]

I think proof of burn is an answer in search of  a question. as in we dont really need it, but it being different helped them get some market share(for a minute).

j

[BARR_Official]

Doomed by design and i think POB implementations mentioned here i read all seem to be ending up the same way.
And what would the future hold for a POB currency ?
The incentive is to get crappy coins to destroy so think about it.
Users are motivated to acquire shitty coins so if they run out they will create a shit coin just to burn it.
And what if i keep making them at no cost just so i can sit there and burn them ?
I will make Spoetnik Coin #1, #2, #3 and so on for no other reason than for me to burn.
Who then controls what coins get burned ? A centralized figure ?
And if a system of consensus was coded in like a voting platform that too would be exploited easily.

I like the idea in theory but in practice it has issues.

We've put a lot of thought into those issues with BARR, and we have some workable solutions.  

Voting is done using BARR coins, so the process can't be influenced by anyone who hasn't contributed to the project.  And the voting is limited to the eligible coins, which eliminates the possibility of coins being created just to burn.  

We don't burn new coins;  in the future if we run out of old coins, then we may require an Altcoin Offset Rating for coins made after 2015.  OFFS are only earned by burning BARR.

As to providing an incentive to acquire shitty coins, people have been doing that long before anyone offered to swap them.  What we can do is remove some coins from the market, and then nobody will be able to acquire those particular coins again.  It might not seem like much at first, but we see it as eliminating redundancy and freeing up resources.  If we can effect a 5% improvement in the efficiency of the overall market, the cumulative benefits could add up to a big difference.

As to the future, we use Multi-Proof-of-Burn with the price of BARR as the variable difficulty.  BARR becomes harder to earn, similar to PoW block-reward halving.  So it's not all about swapping for the cheapest and worst coins.  As our marketcap increases, we will be able to burn coins with higher marketcaps.

Unfortunately it's not yet possible to accomplish what we're doing with a fully decentralized system, given the current state of technology.  It could be argued that no cryptocurrency is fully decentralized, and certainly every coin is restricted by the rules and specs unilaterally coded into it by the devs.

But as long as we follow the plan and do what we say we're going to do, it will continually become less centralized as more people acquire BARR and less funds remain in the custodial account.  It will take time to build a solid reputation as a trustworthy project, and we think the best way is just to keep doing what we're doing and let people see for themselves.

[TPTB_need_war]

That may be true or not. Even with currencies like the Euro there is a certain risk of losing at least some value (about 30% in the past 3 years or so compared to the US dollar), so even in a pretty stable cryptocurrency the risk would be always significant.

If your unit-of-account is in Euros, then normal fluctuations in the currency are irrelevant.

Capital is fleeing Euro because EU is imploding (because they separated the unit-of-exchange from the unit-of-account for fiscal debt). Thus an example of what I said, then that the security is low.

That wasn't euro-specific. Every currency has fluctuations, even the larger ones. It's even true for the US dollar and obviously for assets like gold and silver. So the risk never is zero, but, obviously, the more mature the market, the less the risk of a long term deposit.

I don't know why I am failing to communicate my point in two prior attempts.

My point is that unless the currency fluctuation is extreme to the point of causing general economic malaise, then the users of that currency as a unit-of-account have no appreciable individualized risk risk w.r.t. to the international exchange fluctuations.

Thus if a crypto-currency is intended to become a currency (e.g. a unit-of-account), then the "nothing at risk" will apply and my point is the "rich get richer" applies.

Note the Euro's extreme fluctuation right now is a result of the suicidal decision to merge the unit-of-exchange of Europe without also merging the unit-of-account for (national fiscal) sovereign debts (e.g. thus Greece borrowed in devalued Euros when there was a mad rush to chase investment into southern Europe over a decade ago, but now has to pay back overvalued Euros as north Europe's higher productivity and the reversion of the trend, and Greece can't devalue its sovereign debt relatively due to the fact that it is not denominated in Drachmas). If a crypto-currency makes suicidal design decisions, then it will also likely have a loss of CONFIDENCE and thus a loss of security as well.

In short, I don't see how adding risk to stake or burn deposits improves the issues with "nothing at stake" and advantage to those with the most to stake.

Tangentially please note even though you didn't make this error, it is a semantic conflation error to equate "nothing at stake" with "nothing to stake" as others have (and James apparently wasn't considering that attackers with large value to stake, can short the coin as a way to make sure they have nothing at stake ... will make sure I bring this to his attention next time we exchange messages):

And if it requires actual stake to do a N@S attack, then there is definitely something at stake!

...If there is no attack without anything at stake, then it seems that something is at stake...

I was speaking about short-term double-spend risk where "weak subjectivity" doesn't apply. If the currency's exchange rate (to normally used units-of-account) is too volatile, then the PoB variant you described will have low security because it will be too risky to participate in the long-range PoB commitment risk.

That should be subject of investigation . The nascent stage is not only the most volatile but also the stage where the opportunity to win with a low investment is the highest. In Slimcoin, for example, in the nascent stage, a large part of the mined and minted coins were burnt in the first three months (it has a hybrid model, PoW/PoS/PoB) to maximize chance of income. At this moment, there was even a "burn bubble" where there were more coins burnt than there were rewards for the next months, and many people then complained about low profits.

It is a simple fact that volatility declines with increased liquidity (participation) and thus price. So by definition a more volatile and risky investment will have a smaller market cap and thus less security (relatively speaking). Even in my proposal to use "inertia" at the objective metric of consensus, the larger the participation, then the stronger the security of more inertia (at least the "inertia" I have in mind scales by n² though). Whereas, your described a design where risk declines as value increases, thus your security that depends on risk declines as the value increases which could provide more security. So you have two things working against each other in that design. Seems flawed.

The problem are periods where most participants think the currency is overvalued and a bear market is about to begin, and, of course, large bear markets with sinking expectations. But if the value of the coins that you burnt increase your probability to find blocks for a large time interval (in Slimcoin, it's 1 year with linearly decreasing probability), then these fluctuations in "burn participation" should not be very large.

The problem with the Slimcoin's PoB algorithm (as I understand it from your brief descriptions only) isn't due to volatility of risk, but rather as I explained above due to depending on risk to provide an objective metric of consensus yet risk declining as coin value increases, and overall objectivity of consensus (i.e. security) being dependent also on stability provided by larger market cap (actually participation, since some/most of these altcoin market caps are total illusions).

So my point is that requiring risk does not fix the problem that rich get richer (and centralization results). When there is risk, the coin loses viability. When there is insignificant risk, the rich get richer (as they do in all block chain consensus algorithms thus far invented).

You are right, some degree of centralization is inherent to all currently known designs. But pure PoS (without locked deposits) is the most benefitting for the rich.

The underlined is not a logical statement, if only those who can lock their coins instead of transact them will receive the mining rewards.

I don't mean to be condescending, but I really don't have time for this. I prefer to have discussions with those who I rarely have to correct their logic or repeat the same logic several times. Simply because I should be programming and not here in the forum losing time writing. I prefer it when those such as perhaps monsterer nearly always have some logical statement and then we are simply trying to add to each other's knowledge and perspectives. No one can be perfect (including myself), but the quality of the discussion determines whether I will just have to throw my hands up in the air and bow out (not for any personal animosity reason but just as a matter of prioritization of scarce time and effort). Hope I've expressed amicably and not condescendingly, my frustration with not having infinite time and wanting to interact with everyone but recognizing the reality of a finite lifespan.

All they must do is not move their coins. In PoW and PoB, at least, it makes sense for them to analyze the market situation; so there will not only the "most rich" group burning large amounts of currency but also a "entrepreneur" group (comparable to the Bitcoin miners) seeking opportunities. It's a rich-get-richer game, but not that simple like in PoS.

That simply isn't true that those with the most to stake won't benefit disproportionately just because you think you've forced them choose between more risk or lower returns. Apply some math and probability theory. I don't have time to explain in detail. Perhaps monsterer or other astute person can.

You can't escape from the fact that something to stake is nothing at stake, because the stake is not a resource that is globally consumed. Create local Coasian barrier by locking the coins, but the attacker can short the coin on the external markets (thermodynamics insures us that every such Coasian barrier is not durable as the universe trends to maximum distribution of probabilities). The reason I have chosen "inertia" as the resource of objectivity is because it consumes itself because it can only have one copy of self. There is no way to digitally reproduce "inertia", if it represents an inertia that isn't just digital.  

Inertia and space (via partitions, thermodynamics, and energy) are fundamentally an emergent phenomenon originating (that can be shown deriving) from the entropic force, i.e. the organization of microstates:

http://arxiv.org/abs/1001.0785

[monsterer]

A non-PoW algorithm could in the short-term use an objective metric of the long-term historical consensus to limit the rate of deviation of the short-term consensus. Think of rolling checkpoints, but applying this inertia to the future as well, analogous to anti-aliasing. There is your strong hint as to what I am doing differently than other attempts to overhaul the block chain consensus algorithm.

Interesting. I'm not sure what you're describing here, although it reminds me of an old idea I had about DPOS: throw away the stake elected delegates and replace them with POW elected delegates. That way, delegates become permissionless, you still get to keep the fast block times and it kind of adopts a checkpoint-alike system since the POW frequency would be lower than the block generation frequency.

You are (perhaps unconsciously?) identifying a more significant economic fact: there is no way to secure a block chain without centralization due to power law distribution of wealth coupled with the Iron Law of Political Economics when any resource is involved in the objectivity of the consensus. With inertia as the objectivity, I think it will be much more difficult to centralize the block chain.

I look forward to reading your whitepaper

[TPTB_need_war]

A non-PoW algorithm could in the short-term use an objective metric of the long-term historical consensus to limit the rate of deviation of the short-term consensus. Think of rolling checkpoints, but applying this inertia to the future as well, analogous to anti-aliasing. There is your strong hint as to what I am doing differently than other attempts to overhaul the block chain consensus algorithm.

Interesting. I'm not sure what you're describing here, although it reminds me of an old idea I had about DPOS: throw away the stake elected delegates and replace them with POW elected delegates. That way, delegates become permissionless, you still get to keep the fast block times and it kind of adopts a checkpoint-alike system since the POW frequency would be lower than the block generation frequency.

Note afaics (?) PoS isn't inherently lacking the permissionless attribute, but rather it is ill-defined as to what threshold of adversarial strategy does it break, because the "something to stake" isn't consumed because for example there are a myriad of strategies such as shorting against your own stake so you have "nothing at stake". Perhaps someone can quantify the breakage thresholds of all the myriad of adversarial strategies precisely, but I doubt it. For example, I started to read the 40 page Neucoin white paper, but there is so much verbiage to wade through as compared to Satoshi's concise elucidation.

PoW election of delegates (i.e. Bitcoin-NG except with multiple simultaneous leaders) still retains the Satoshi weaknesses that 51% can destroy the permission-less quality and the centralization directed economics of the longest chain (refer to my up thread post). The permissionless breakage point is more well-defined than PoS, nevertheless Satoshi's PoW doesn't appear to have a decentralized future. I originally also contemplated this method, as superior to stake deposits but dissatisfied that the permissionless attribute would not be durable as the network becomes more centralized. I did have one idea for battling centralization of PoW by not offering any rewards for PoW and making it required, but this still meant that the inertia of popular delegates with 51% could form an censorship clique which I wasn't totally satisfied with (although willing to attempt as an improvement over what we have now with Bitcoin and more well-defined than PoS).

My idea for "inertia" is how I think the permissionless attribute can be impossible to break unless the adversary has near to 100% of the inertia. The relevant form of inertia should have the property of a virus in that if you can't block all of it, it eventually infiltrates the other 99.9% of the inertia as kryptonite against the power of the censorship. DAG (Iota) and similar explorations (e.g. RaiBlocks block lattice) have been essentially trying to capture permissionless "inertia" but I believe they missed some key insights.

One of the key insights comes from the entropic force and the fact that the Second Law of Thermodynamics insures us that nature is always trying to route around inefficient Coasian barriers. Conceptually PoW is a Coasian barrier attempt to control inertia rather than recognize that inertia is an emergent phenomenon of the entropic force and structures itself. So I believe Iota and RaiBlocks are attempting to force non-emergent structure because they haven't identified that which is emergent and removed all the other unnecessary controlling structure which afaics renders their designs unable to provide the objective reality within the CAP theorem (interpreted with a higher level ontology as I have described in my discussions with the devs of those two coins).

Another insight derives from the fact that the world must be relative, because if everyone was forced to hold the same perspective, then no entropy could emerge. Nothing would exist. In other words, if everything is the same, then nothing exists (nothing is distinguishable). So I was searching for a way that there could simultaneously be virtual Partitions of consensus (allowing different relative perspectives), yet impossible to have multiple or ambiguous objective realities about validity (i.e. not losing global Consistency, except by absolute physical network partitioning, which is very unlikely since we do have permissionless global communication with for example shortwave radio and degrading functionality more precisely in that physical partitioning scenario). Accessibility could be forsaked on some virtual partitions for as long as it is not lost on every partition, because on the internet every partition is reached (unless there is no physical connectivity or perhaps if the anti-DoS is flawed). So essentially I think Satoshi's PoW is inflexible on gradations of tradeoffs between C, A, and P (in my ontology of that CAP theorem), thus it loses centralization (permissionless) durability because it can't model the actual inertia.

In my abstract conceptualization, Iota is essentially trying to capture the same conceptual direction, but I think they missed the insight of what the key emergent phenomenon that is the inertia, thus afaics their design suffers from conflating some other structure which I am currently thinking makes it weaker (but more precise analysis awaits after they've released a product and finalized their design and ditto me as well). For example, afaics I believe their first fundamental mistake was to introduce longest tangles of PoW as the metric of objectivity. Afaics this just mucks up capturing the true metric of inertia. PoW forces giving control to the longest chain or no objectivity, but the longest chain may deviate (centralize due to its economics) from some other more permissionless durable measure of inertia.

Another key insight is that afaik all PoS penalization mechanisms are based on the concept that it is "more expensive to attempt to cheat", which unfortunately are theoretically broken by strategies such as shorting the coin. Whereas, the inverted concept that "it is too expensive to not check for cheating" transforms the onus from the one with stake to the one who needs inertia. This is an example of the powers of discernment that recognize that "nothing at stake" is distinct from "something to stake". We should consider all the possibilities of abstraction in order to broaden our ability to discern.

Referring to the prior two paragraphs and the following self-quote, note that the incentive to be on the longest chain in PoW conflates the incentive to not be on a invalid chain with the requirement to have only one virtual partition.

with a sufficient penalty for not joining the longest chain to motivate convergence on one chain

You are (perhaps unconsciously?) identifying a more significant economic fact: there is no way to secure a block chain without centralization due to power law distribution of wealth coupled with the Iron Law of Political Economics when any resource is involved in the objectivity of the consensus. With inertia as the objectivity, I think it will be much more difficult to centralize the block chain.

I look forward to reading your whitepaper

Thanks. I am trying my best to rush, and hopefully cutting corners in implementation won't end up blowing up in my face.

The white paper will be less abstractly opaque. I have to be somewhat opaque at this point, otherwise I simply spill the beans entirely.

[monsterer]

Afaics this just mucks up capturing the true metric of inertia. PoW forces giving control to the longest chain or no objectivity, but the longest chain may deviate (centralize due to its economics) from some other more permissionless durable measure of inertia.

What is the definition of inertia in the context of consensus, though? We have POW because of the sybil problem... I guess, in idealised terms, inertia in cryptocurrencies would be directly proportional to the number of unique individuals in the voting process?

[TPTB_need_war]

Afaics this just mucks up capturing the true metric of inertia. PoW forces giving control to the longest chain or no objectivity, but the longest chain may deviate (centralize due to its economics) from some other more permissionless durable measure of inertia.

What is the definition of inertia in the context of consensus, though? We have POW because of the sybil problem... I guess, in idealised terms, inertia in cryptocurrencies would be directly proportional to the number of unique individuals in the voting process?

Inertia is an interpretation of the (history of the) UTXO. It it is the context in which it is interpreted that gives rise to my design. Sure anyone can make transactions to themselves and even avoid TX fees if they are also the confirmation delegate to Sybil attack the UTXO, but...

[monsterer]

Inertia is an interpretation of the (history of the) UTXO. It it is the context in which it is interpreted that gives rise to my design. Sure anyone can make transactions to themselves and even avoid TX fees if they are also the confirmation delegate to Sybil attack the UTXO, but...

I don't have enough info to reason about this I'll have to wait for your doc