Proposal: Transaction-Directed Acyclic Graphs

[mcelrath]

This isn't a need: miners will contribute to the highest work braid/chain simply because that is the one most likely to have other people contribute to it.  No extra incentive is needed.  If there exist two childless beads (blocks), it's in my best interest to name them both as parents.  That generates a higher work braid.  Naming only one of them creates a lower work braid.

This is not that simple, as Selfish Mining paper showed, a more sophisticated strategy may be more profitable.

Selfish mining works because of the asymmetry between profit of a block that gets orphaned and one that ends up in the main chain.  There's no reason to have orphans at all with a braid.  Withholding a block doesn't buy you anything.

This is a concept I put forth in my most recent talk about braids: "equal pay for equal proof-of-work".  Selfish mining is killed by a combination of braiding (no more orphans), and removing the asymmetry by ensuring all valid PoW hashes earn a block reward.

[1715142826]

1715142826

[1715142826]

1715142826

[Come-from-Beyond]

This is a concept I put forth in my most recent talk about braids: "equal pay for equal proof-of-work".

Self-reference...

Selfish mining is killed by a combination of braiding (no more orphans), and removing the asymmetry by ensuring all valid PoW hashes earn a block reward.

...and a bold claim without any proof.

Sorry for disturbing you, I'm out from this discussion because I don't have time for a discussion in TPTB's style.

[iamnotback]

This isn't a need: miners will contribute to the highest work braid/chain simply because that is the one most likely to have other people contribute to it.  No extra incentive is needed.  If there exist two childless beads (blocks), it's in my best interest to name them both as parents.  That generates a higher work braid.  Naming only one of them creates a lower work braid.

This is not that simple, as Selfish Mining paper showed, a more sophisticated strategy may be more profitable.

Selfish mining works because of the asymmetry between profit of a block that gets orphaned and one that ends up in the main chain.  There's no reason to have orphans at all with a braid.  Withholding a block doesn't buy you anything.

This is a concept I put forth in my most recent talk about braids: "equal pay for equal proof-of-work".  Selfish mining is killed by a combination of braiding (no more orphans), and removing the asymmetry by ensuring all valid PoW hashes earn a block reward.

Vitalik seemed to conclude that rewarding all branches makes a 51% attack free.

Even with or without direct monetary rewards (e.g. minted coins or non-burned txn fees), selfish mining can be conceptualized more generally as the asymmetry (for different proof-of-work participants, aka miners in Bitcoin) of the cost of effective PoW (or burned txn fees), for whatever PoW (or burned txn fees) accomplishes in the consensus system. So even for Iota or DagCoin which afair don't monetarily reward the PoW (i.e. afaik the PoW is simply burned), the asymmetry still exists in terms of the value of what PoW can effect in the system. Thus as CfB wrote, "a more sophisticated strategy may be more profitable" given some externalities such as achieving a double-spend and shorting the token's exchange value.

[iamnotback]

I spent some time on DAG based designs and this one reminds me of something that I rejected early.

As far I understand, the level of security against double-spends basically depends on the total amount spent on fees on the legit DAG.  If so, an attacker just secretly builds a subDAG that includes a few double-spends, spends more on fees in the subDAG than was spent in the legit DAG, then publishes his subDAG.  Now everybody should switch to the subDAG as it has burnt more fees.  As long as the total amount of double-spends exceeds the fees, the attack succeeds.

Smart, sorry, I'd missed that from your original post. But it seems like V. Buterin's argument from the link in the OP still applies:

"This seems weak, but in reality it isn’t; we know that in the case of Bitcoin, once the currency supply stops increasing mining will rely solely on transaction fees, and the mechanics are exactly the same (since the amount that the network will spend on mining will roughly correspond to the total number of txfees being sent in); hence, fee-based TaPoS is in this regard at least as secure as fee-only PoW mining."

@TomHolden, I agree that Satoshi's PoW has the same potential vulnerability in that if double-spends exceed the value of what was burned to provide security, then a 51% lie-in-wait attack is possible funded by the value of the double-spends (possibly also shorting the exchange value in case the successful attack craters the price).

Thus, @tonych's concern applies to every consensus design (including Satoshi's) which is based on burning some resources as the metric of the longest-chain-rule (regardless whether multiple branches are merged to form the longest-chain, e.g. a DAG).

We really don't want a crypto-currency that is too liquid into fungible monetary equivalents, as it would not be secure except by overpaying for security. This points to future of crypto-tokens more for micropayments as a more viable reasonable security cost paradigm. As block rewards wind down for Bitcoin, then this may become more apparent.

[iamnotback]

3. "The correct chain among multiple candidates is the one that has either (i) the longest coin-days-destroyed (ie. number of coins in the account * time since last access), or (ii) the highest transaction fees"

Btw, in 2013 I apparently instigated or influenced Dan Larimer to make that change to his TaPoS design (that you indicated with strikethrough).