Transactions as Proof of Stake White Paper

[bytemaster]

Transactions as Proof-of-Stake & The End of Mining
http://the-iland.net/static/downloads/TransactionsAsProofOfStake.pdf

The concept behind Proof-of-Stake is that a block chain should be secured by those with a financial interest in the chain.  This paper will introduce a new approach to Proof-of-Stake that utilizes coin-days-destroyed by every transaction as a substitute for the vast majority of the security currently provided by Proof-of-Work.   Unlike prior Proof-of-Stake systems in which only some nodes contribute to the proof-of-stake calculation, we present a new approach to Proof-of-Stake whereby all nodes generating transactions contribute to the security of the network.  The result is that the network immune to known attacks against Bitcoin or Peercoin.

Every transaction on the network carries with it an implicit Proof-of-Stake in the network. The creator of the transaction wants the network to accept it and the receiver of the transaction is making decisions on whether or not to ship goods based upon whether or not the network has accepted the transaction.    It is clear that those behind the transaction have a stake in the health of the network.  After all, the network is worthless if transactions cannot be executed as expected.   A well functioning network will have thousands of transactions every single block.   This represents thousands of stake holders who could be contributing to the security of the network.

In order for a 51% attack to be successful in a Proof-of-Work system, the attacker must keep their alternative chain secret.   Once they have locked in the profits from their first spend, they can broadcast the longer secret block chain which will invalidate the original transaction.   Keeping solved blocks secret is also used in the selfish-mining attack which can be effective with much less than 51% of the hashing power.  

In order to prevent this kind of behavior we must make it impractical for miners to maintain secret block chains.  If every transaction that is broadcast contains the hash of  a recent block and the block chain enforces the rule that the transaction can only be included in block chains that build off of that block then no one will be able to build secret block chains that leverage the coin-days-destroyed of transactions in the public chain.
  

So the basic idea is that the more coin-days destroyed in a given block, the lower the difficulty. But even if someone had enough computing power to find blocks that only destroyed a few coin-days, their chain would still be rejected, because proof of stake is used as the primary judge of chain size, not proof of work. Therefore, the fastest growing chain will be the one that includes the most transactions, which keeps the network healthy.

Please read my paper for further details, but I believe that I have a Proof-of-Stake system that requires no explicit mining and for which mining is never 'profitable'.   If the security model holds review then this could dramatically change the future of all DACs and crypto-currencies, eliminate mining pools, lucky mining, vesting, ASICs, the 51% attack, selfish-mining, merged-mining, denial of service, etc.  

Please review and give me your feedback.

[1715284266]

1715284266

[Come-from-Beyond]

Please read my paper for further details, but I believe that I have a Proof-of-Stake system that requires no explicit mining and for which mining is never 'profitable'.   If the security model holds review then this could dramatically change the future of all DACs and crypto-currencies, eliminate mining pools, lucky mining, vesting, ASICs, the 51% attack, selfish-mining, merged-mining, denial of service, etc.  

Please review and give me your feedback.

Have u compared ur concept to existing PoS currencies?

[bytemaster]

Please read my paper for further details, but I believe that I have a Proof-of-Stake system that requires no explicit mining and for which mining is never 'profitable'.   If the security model holds review then this could dramatically change the future of all DACs and crypto-currencies, eliminate mining pools, lucky mining, vesting, ASICs, the 51% attack, selfish-mining, merged-mining, denial of service, etc.  

Please review and give me your feedback.

Have u compared ur concept to existing PoS currencies?

I have compared it to Peercoin and the methods described on the bitcoin wiki as well as Nxt.      I am looking for people who know about this to point out any other prior art or problems that are not obvious to me.

[super3]

Good stuff. Love to see this running.

[Impaler]

I'm very hopeful that this solution proves workable as I would like to see it used in Freicoin.  I will bring it to the attention of our lead programmer maaku and possibly Luke-Jr too.  We have long desired a solid PoS system which would allow for a decentralized distribution of the demurrage fee, but we have always been stymied by possible PoW attack vectors that our designs were vulnerable too.

[sangaman]

Really interesting. I have a few questions though:

I like the idea of putting the hash of the previous block into a transaction. What happens if you broadcast a transaction for a certain previous block and then a new best blockchain is published before your transaction can be confirmed? Are the coin-days from the transaction wasted? And when transactions are migrated from one chain to another such that their previous block hash doesn't match up, are the coin-days for those transactions just destroyed and never count to the difficulty of the chain? If so, would this cause any long term problems where one chain has too many transactions that were migrated into it and can be overtaken by another chain? What incentive does someone have to include transactions in their block if they don't match the previous block's hash?

Regarding the double spend vulnerability, that does seem like a pretty real concern whenever you don't trust the party sending you the coins. It seems like you may have to wait quite some time before you can be certain that your transaction won't be reversed.

What is a DAC? You don't define it anywhere as far as I can tell.

I'd love to see details for the protocol of a specific implementation of this idea. More details on how the POW will work (still not sure how target intervals are maintained) and how block rewards and transaction fees might look would be good.

And on a mostly unrelated note, is there any explanation about how Nxt works? I couldn't find a whitepaper or even a coherent explanation of how their system secures the blockchain with 100% POS. Is it similar to this whitepaper?

[AnonyMint]

This proposal appears to be flawed, unless I am missing something. I have only read the first 4 pages thus far.

1. You propose to decrease the coin rewards as coin-days-destroyed volume increases, so this makes it less costly for an attacker to obtain > 50% of the hash rate assuming the attacker includes all the transactions. You apparently are attempting to imply there is no useful attack to do if the attacker is including the most coin-days-destroyed? Please confirm or deny then I will dig into more analysis of this vector.

2. Also how do you choose between someone who generates a proof-of-work hash with lower coin-days-destroyed several times sooner than the network propagation delay versus another who generates it that much delayed with a higher coin-days-destroyed? If you choose the latter, then you've killed the proof-of-work incentive because it means it will always pay to be later and wait for more transactions to arrive.

3. You claim to defeat my Transactions Withholding Attack, by blacklisting those who send blocks with transactions that were not recently seen by all miners. I retorted against this recently. This centralizes the network (all for one and one for all outcome) by requiring every miner to be responsible for the incoming network connectivity of other miners. And it centralizes the network in other ways, such it can't tolerate a temporary partitioning of the network due to connectivity outages.

P.S. By coin-days-destroyed, I assume you mean coin value x days, otherwise you would motivate proliferation of dust.

[AnonyMint]

The most significant flaw of any proof-of-stake system and any system that diminishes coin rewards, is it can't distribute currency from the hoarders to the users of the currency, thus it will end up with the hoarders (the banksters) accumulating all the coin and the currency usage dying.

This is because the wealthy spend a much lower % of their net worth than the masses do.

Freicoin if I am not mistaken, sends the demurrage into the ether, so those who transact more often see their coin balances decline less fast, thus it effectively redistributes relative coin value to the users of the currency. That could in theory be combined with a proof-of-stake system. The problem is correctly as Impaler described it, how to secure the public ledger.

Although I admire how demurrage distributes directly to those who transact the most, it suffers from the fact that spenders are not necessarily doing anything to secure the coin (except perhaps increasing its long-term value, thus value of mining if coin rewards do not diminish). Spending can even be wasteful and misallocation of capital. Indiscriminately subsidizing spending (or anything) is not good economics. Zero transaction fees would already be a significant gift to spenders. Demurrage also reduces the balances of holders, I find it difficult to conceive how it will be popular. Whereas coin rewards do nothing to balances, and also apparently nothing to coin value since Bitcoin is rising in price while the debasement is currently 12.5% new coins in the money supply this year.

Whereas those who actually mine are proactively using their time, ingenuity, initiative and capital to secure the network, thus it seems more capitalistic they should receive the redistribution from the hoarders. Besides it may be the only viable way to secure the public ledger.

[AnonyMint]

The other attacks you describe all derive from the fundamental reason I declared all non-proof-of-work systems to be insecure back in April.

My logic was mathematically fundamental. The input entropy set is quite deterministic and well known and thus can be preimaged. For example, accumulating a lot of coin-days-destroyed and then targeting them in clever ways to subvert the security.

The randomness (entropy) of each proof-of-work is fundamental and mathematical and it can not be preimaged. It can only be surely defeated with > 50% of the network hash rate. Note I recently offered what I believe to a solution to the selfish-mining attack (the one at hackingdistributed.com that claims 25 - 35% attack).

I am skeptical that you can characterize all possible attack vectors of proof-of-stake in one coherent mathematical proof. Thus you will not know formally what the security is; instead a list of adhoc attacks and counter-measures.

Nevertheless I am not bagging on Peercoin. Everyone should be free to decide for themselves which coin they prefer. Perhaps there are unknown attacks on Bitcoin as well, yet I am somewhat comforted by the clear math for security of proof-of-work. I will not say I will never be convinced to support a non-proof-of-work coin, I will correct myself if someone explains such a system convincingly. It is on my TODO list to study more Peercoin.

Edit: Perhaps coin-days-destroyed in some attack vectors motivates not transacting for long periods of time.

[sangaman]

This proposal appears to be flawed, unless I am missing something. I have only read the first 4 pages thus far.

1. You propose to decrease the coin rewards as coin-days-destroyed volume increases, so this makes it less costly for an attacker to obtain > 50% of the hash rate assuming the attacker includes all the transactions. You apparently are attempting to imply there is no useful attack to do if the attacker is including the most coin-days-destroyed? Please confirm or deny then I will dig into more analysis of this vector.

2. Also how do you choose between someone who generates a proof-of-work hash with lower coin-days-destroyed several times sooner than the network propagation delay versus another who generates it that much delayed with a higher coin-days-destroyed? If you choose the latter, then you've killed the proof-of-work incentive because it means it will always pay to be later and wait for more transactions to arrive.

#2 seems like an important concern. And I'm still a bit confused as to how difficulty/block rewards are calculated, an example would be helpful with that.

The most significant flaw of any proof-of-stake system and any system that diminishes coin rewards, is it can't distribute currency from the hoarders to the users of the currency, thus it will end up with the hoarders (the banksters) accumulating all the coin and the currency usage dying.

This is because the wealthy spend a much lower % of their net worth than the masses do.

This I disagree with. Do you think bitcoin is flawed in this regard as well? It also has diminishing rewards. Even if it didn't, the coin rewards go to people who can afford mining hardware. Even freicoin's demurrage goes straight back to the miners. Poor people that spend most of their income on consumption aren't going to be saving up for ASICs, so their is not necessarily distribution of currency from the hoarders to the users as you describe. Precious metals have this characteristic as well.

I don't think a large amount of hoarding necessarily leads to the currency usage dying, just as gold and bitcoin haven't died. Where a currency has advantages over other mediums of exchange, its use has value..

[AnonyMint]

Freicoin if I am not mistaken, sends the demurrage into the ether, so those who transact more often see their coin balances decline less fast, thus it effectively redistributes relative coin value to the users of the currency. That could in theory be combined with a proof-of-stake system. The problem is correctly as Impaler described it, how to secure the public ledger.

Although I admire how demurrage distributes directly to those who transact the most, it suffers from the fact that spenders are not necessarily doing anything to secure the coin (except perhaps increasing its long-term value, thus value of mining if coin rewards do not diminish). Spending can even be wasteful and misallocation of capital. Indiscriminately subsidizing spending (or anything) is not good economics. Zero transaction fees would already be a significant gift to spenders. Demurrage also reduces the balances of holders, I find it difficult to conceive how it will be popular. Whereas coin rewards do nothing to balances, and also apparently nothing to coin value since Bitcoin is rising in price while the debasement is currently 12.5% new coins in the money supply this year.

Whereas those who actually mine are proactively using their time, ingenuity, initiative and capital to secure the network, thus it seems more capitalistic they should receive the redistribution from the hoarders. Besides it may be the only viable way to secure the public ledger.

Add if demurrage was paid out as negative transaction fees instead, the problem is this encourages transaction spam (sending to yourself). However the design required to allow zero transaction fees solves this.

So it would be possible to offer a balance between demurrage and perpetual coins. I don't know what the best balance is.

I am actually excited to realize this, and I think Impaler will be too.

The most significant flaw of any proof-of-stake system and any system that diminishes coin rewards, is it can't distribute currency from the hoarders to the users of the currency, thus it will end up with the hoarders (the banksters) accumulating all the coin and the currency usage dying.

This is because the wealthy spend a much lower % of their net worth than the masses do.

This I disagree with. Do you think bitcoin is flawed in this regard as well? It also has diminishing rewards.

I very much do. Rather than repeat my past 2 weeks of posts, I will just refer you to click my name and then Show Posts.

Even if it didn't, the coin rewards go to people who can afford mining hardware.

ASICs are not fungible.

ASICs scale too well and result in centralization of mining:

http://www.kotaku.com.au/2013/11/bitcoin-mining-is-getting-out-of-control/

Even freicoin's demurrage goes straight back to the miners.

I didn't know that. I thought it went to ether and there were separate coin rewards. Indeed that makes sense.

Poor people that spend most of their income on consumption aren't going to be saving up for ASICs, so their is not necessarily distribution of currency from the hoarders to the users as you describe.

That is one of the problems with ASICs.

Precious metals have this characteristic as well.

All hard money is horrible for all of us. Impaler and I have been agreeing on this.

I don't think a large amount of hoarding necessarily leads to the currency usage dying, just as gold and bitcoin haven't died. Where a currency has advantages over other mediums of exchange, its use has value..

Gold has died as a base money. And it has never been a hard currency.

[Impaler]

Mint:  I'm disappointed in you, you have clearly failed to do your research on Freicoin and have completely misunderstood our demurrage system.

The Transaction volume of the user has ZERO effect on their demurrage costs, their are the normal transaction fees of the BTC system in each transaction yes, but we have these only for the prevention of spamming attacks not as a meaningful source of revenue for miners and are independent of demurrage.  Users can not increase or decrease their demurrage costs by transactions, only the amount of coins held and the time they are held determine demurrage.

Demurrage in FRC is deducted every block regardless of if a coin is spent or not, as soon as a coin moves the new holder begins paying the demurrage on that coin.  Behind the scenes the TECHNICAL implementation is to shave coins when they are moved proportional to the coin-blocks (not days) destroyed, but the protocol mandates this such that we can always consider a wallets spendable sum to be declining every block in predictable manor.

Miners receive newly created coins that are mathematically equal to the totality of all demurrage payments.  But we do this by knowing the total monetary base and the demurrage rate rather then attempting to tabulate the demurrage paid by individual users.

Lastly I am very disappointed that you would make such basic economic errors as describing low or zero-transaction fees as a subsidy to the BUYER and a source of possible over-investment.  Basic economics show that transaction fees hit the BUYER AND SELLER equally and are a pure drag on the economy.  Transaction that the buyer and seller would otherwise find mutually fruitful are prevented by high transaction fees.  No economic school calls low transaction fees the source of over-investment, it is rather 'artificially' low interest rates that the Austrian school claims cause this.

[bytemaster]

This proposal appears to be flawed, unless I am missing something. I have only read the first 4 pages thus far.

1. You propose to decrease the coin rewards as coin-days-destroyed volume increases, so this makes it less costly for an attacker to obtain > 50% of the hash rate assuming the attacker includes all the transactions. You apparently are attempting to imply there is no useful attack to do if the attacker is including the most coin-days-destroyed? Please confirm or deny then I will dig into more analysis of this vector.

2. Also how do you choose between someone who generates a proof-of-work hash with lower coin-days-destroyed several times sooner than the network propagation delay versus another who generates it that much delayed with a higher coin-days-destroyed? If you choose the latter, then you've killed the proof-of-work incentive because it means it will always pay to be later and wait for more transactions to arrive.

3. You claim to defeat my Transactions Withholding Attack, by blacklisting those who send blocks with transactions that were not recently seen by all miners. I retorted against this recently. This centralizes the network (all for one and one for all outcome) by requiring every miner to be responsible for the incoming network connectivity of other miners. And it centralizes the network in other ways, such it can't tolerate a temporary partitioning of the network due to connectivity outages.

P.S. By coin-days-destroyed, I assume you mean coin value x days, otherwise you would motivate proliferation of dust.

After some consideration I have decided to replace proof-of-work all together and use transaction fees to regulate block production.  A new block is produced once enough transaction fees have been accumulated.  The node that generates the transaction with sufficient fees broadcasts it.   Ultimately all that matters is that the network reaches consensus and orphans are no issue.  Nodes in the network can even stop propagating new blocks for a couple of minutes after the previous block.  If transactions are coming to quickly I simply up the transaction fee like you would adjust the difficulty in BTC.  These fees are then destroyed to pay dividends rather than paid to a miner. 

As a result it doesn't matter how much hash power you have because you must *pay* to submit a block and the best-fit block is the one with the most coin-days destroyed so even if you pay to submit a block with no transactions, it will be rejected.

3. Does not centralize the network, it is a local calculation performed by all nodes relative to their peers.

Yes, coin value * days.

[bytemaster]

The most significant flaw of any proof-of-stake system and any system that diminishes coin rewards, is it can't distribute currency from the hoarders to the users of the currency, thus it will end up with the hoarders (the banksters) accumulating all the coin and the currency usage dying.

This is because the wealthy spend a much lower % of their net worth than the masses do.

Freicoin if I am not mistaken, sends the demurrage into the ether, so those who transact more often see their coin balances decline less fast, thus it effectively redistributes relative coin value to the users of the currency. That could in theory be combined with a proof-of-stake system. The problem is correctly as Impaler described it, how to secure the public ledger.

Although I admire how demurrage distributes directly to those who transact the most, it suffers from the fact that spenders are not necessarily doing anything to secure the coin (except perhaps increasing its long-term value, thus value of mining if coin rewards do not diminish). Spending can even be wasteful and misallocation of capital. Indiscriminately subsidizing spending (or anything) is not good economics. Zero transaction fees would already be a significant gift to spenders. Demurrage also reduces the balances of holders, I find it difficult to conceive how it will be popular. Whereas coin rewards do nothing to balances, and also apparently nothing to coin value since Bitcoin is rising in price while the debasement is currently 12.5% new coins in the money supply this year.

Whereas those who actually mine are proactively using their time, ingenuity, initiative and capital to secure the network, thus it seems more capitalistic they should receive the redistribution from the hoarders. Besides it may be the only viable way to secure the public ledger.

Actually, I eliminate coin rewards by design to eliminate inflation (aka) demurrage.   Your economics against hoarding are unfounded and we will have to agree to disagree here.    Mining is waisting electricity and always concentrates power in those with economies of scale. 

[bytemaster]

I'm very hopeful that this solution proves workable as I would like to see it used in Freicoin.  I will bring it to the attention of our lead programmer maaku and possibly Luke-Jr too.  We have long desired a solid PoS system which would allow for a decentralized distribution of the demurrage fee, but we have always been stymied by possible PoW attack vectors that our designs were vulnerable too.

How is demurrage different from inflation?   In the case of bitcoin, there is 12% inflation per year that is masked by appreciation.   Demurrage would just make the inflation more obvious, but if Bitcoin were to switch to using 'PERCENT OF MONEY SUPPLY' as the basic unit of account then Bitcoin would technically be implementing demurrage.   All you are achieving with your coin is to make it more obvious. 

[Impaler]

I did not want to get into Freicoin on your thread but it seems to have confused people so I will explain it again.

In Freicoin you nominal coins decrease every block such that your annualized rate of loss is 5%.  Simultaneously each block an amount equal to the amount lost from all wallets is awarded to the miner.  Thus each year miners mine an amount equal to 5% of the money supply.  The money supply itself never grows or shrinks.

Based on your statement that BTC is 'inflating' at 12% I see that you confuse Inflation with change in money supply.  Inflation and Deflation mean change in prices, not the change in money Supply.  You can not begin to have a rational discussion if you continue to use these terms incorrectly no matter how common it is for people to do so on these forums.

Now ultimately we want to see 0% inflation OR deflation in Freicoin, aka a hamburger will cost the same number of coins now as next year and the year after.  This may or may not actually happen under the fixed supply we have programmed, it was largely a technical hold-over from BTC and lack of a dynamic response mechanism that lead us to keep the fixed supply.  In any case while we wish that nominal prices of goods will not change the user will because of demurrage experience a decline in how much then purchase IF they HOARD.  This is as it should be, 5% is the cost of removing money from circulation because hoarded money is liquid and liquidity has a value that the user should pay for.  People will preserve their purchasing power by lending money at a 0% interest rate, giving the liquidity and the demurrage cost to the borrower.

Now I don't expect you to agree with this as your clearly weeded to the Goldbug belief that people should be able to sit on money indefinitely and enjoy the liquidity of it free of charge.  While this might seem fair for some Rip-Van-Winkle who was asleep and wasted his liquidity, in the real world liquidity value will always be rented out to other people, resulting in positive interest rates that allow the lender to amass ever larger sums of money, aka they become a bank.  But even if you reject this argument their are still benefits over the use of a comparable 5% growth in money supply each year and a 5% targeted inflation rate.

First money supply growth can easily disappear into miners pockets and fail to cause actual inflation in the short term (this is particularly likely during a speculative bubble making increased money supply very ineffective at halting such a bubble).  Because actual inflation is caused only by circulating money that gradually bids up prices new money which is in a deep freeze can fail to cause inflation.  Demurrage on the other hand is stable and instantly transmitted to the user so the incentive to circulate money dose not occur in unpredictable stop and go manner.

And naturally their is the long term price stability, which while not guaranteed under Demurrage, is by definition impossible under Inflation.  Prices are of paramount importance in a Free-Market because they are the main information that we rely on to make our economic decisions, changing prices destroy the ability to make informed choices.  In Hyper-inflation or Hyper-deflation its so bad as to crash the economy, but even slow changes are bad because they require us to constantly re-send and re-learn information every year and this obscures the real underlying cost changes that may be occurring over the course of decades.

[Impaler]

After some consideration I have decided to replace proof-of-work all together and use transaction fees to regulate block production.  A new block is produced once enough transaction fees have been accumulated.  The node that generates the transaction with sufficient fees broadcasts it.   Ultimately all that matters is that the network reaches consensus and orphans are no issue.  Nodes in the network can even stop propagating new blocks for a couple of minutes after the previous block.  If transactions are coming to quickly I simply up the transaction fee like you would adjust the difficulty in BTC.  These fees are then destroyed to pay dividends rather than paid to a miner. 

As a result it doesn't matter how much hash power you have because you must *pay* to submit a block and the best-fit block is the one with the most coin-days destroyed so even if you pay to submit a block with no transactions, it will be rejected.

If the node that will transmit the winning block get zero rewards for doing so then it will need to be virtually cost-less to create and send it.  But if it is cost-less then every node in existence if acting in good-faith and trying to support the system will try to transmit a block virtually simultaneously as the transaction list reaches the threshold.  Mass chain forking will result as every competing block will be equally valid as they contain the full transaction list.  I think in focusing only on blocking an attacker you've rendered the honest network unable to reach a consensus.

Some methodology of 'culling' the honest nodes willingness or ability to create a block is needed so they don't all try to transmit a thousand competing blocks.  It may be some kind of semi-random selection rather then a PoW solution, and it needs to be adjustable such that this culling factor can adjust to keep block times stable.  I would NOT try to adjust transaction fees, that's a commerce killer and a terrible idea.

Lastly, what are these dividends (from transaction fees) you speak of and who are they being paid too?  If your paying them to the node that creates the winning block then you DO have a mining prize and standard BTC terminology would refer to your winning node as a miner, your just trying to skip to the end phase of BTC when it is 'transaction fee supported'.

[AnonyMint]

Mint:  I'm disappointed in you, you have clearly failed to do your research on Freicoin and have completely misunderstood our demurrage system.

I only followed some of your early forum posts describing your coin (or planned coin at that time) and for me reading those in April when I was building up understanding of everything.

The Transaction volume of the user has ZERO effect on their demurrage costs, their are the normal transaction fees of the BTC system in each transaction yes, but we have these only for the prevention of spamming attacks not as a meaningful source of revenue for miners and are independent of demurrage.  Users can not increase or decrease their demurrage costs by transactions, only the amount of coins held and the time they are held determine demurrage.

Demurrage in FRC is deducted every block regardless of if a coin is spent or not, as soon as a coin moves the new holder begins paying the demurrage on that coin.  Behind the scenes the TECHNICAL implementation is to shave coins when they are moved proportional to the coin-blocks (not days) destroyed, but the protocol mandates this such that we can always consider a wallets spendable sum to be declining every block in predictable manor.

I have a more holistic view of all the options available. I put all the variables which can be tweaked into my mind and consider the range of possible altcoin designs. So my taxonomy for demurrage as distinct from debasement is that user balances decline. I apologize for confusing your confusing explanation of the deduction w.r.t. coin-days-destroyed only at time of transaction. Now I understand you are obscuring and delaying the balance deductions until the next transaction. So all coin holders receive the same proportional reductions in their balances, and these are recorded in the block chain implicitly and then explicitly on next transaction. Thanks for the clarification.

Miners receive newly created coins that are mathematically equal to the totality of all demurrage payments.  But we do this by knowing the total monetary base and the demurrage rate rather then attempting to tabulate the demurrage paid by individual users.

I see. Makes sense since we wouldn't want different mining blocks to have different rewards based on the level of transactions since that could be highly variable block-to-block. That of course would have become obvious to me had I actually focused on the possible demurrage designs for a short-time.

Lastly I am very disappointed that you would make such basic economic errors as describing low or zero-transaction fees as a subsidy to the BUYER and a source of possible over-investment.  Basic economics show that transaction fees hit the BUYER AND SELLER equally and are a pure drag on the economy.  Transaction that the buyer and seller would otherwise find mutually fruitful are prevented by high transaction fees.  No economic school calls low transaction fees the source of over-investment, it is rather 'artificially' low interest rates that the Austrian school claims cause this.

I described negative, not zero, transaction fees as a subsidy. Please re-read my upthread posts more carefully. Where I referred to zero transaction fees upthread, I said they were already a sufficient motivation to use the coin (a gift) as compared to Bitcoin and Freicoin that charge a transactions tax. I did not write that zero transaction fees are a subsidy. I clearly made a line-in-the-sand demarcation distinction between negative and zero transaction fees.

Negative transaction fees would indeed be a subsidy to both the buyer and the seller.

No where did I write the subsidy was exclusive to the spender aka buyer. Perhaps you thought I implied it because I did not mention the seller whereas I felt that implied subsidizing transactions benefits also the seller.

My last post remains valid that if we want to subsidize transactions in a chosen balance with security, I now see a way to do it although the variability on mining rewards block-to-block limits that chosen balance to a small factor.

[AnonyMint]

This proposal appears to be flawed, unless I am missing something. I have only read the first 4 pages thus far.

1. You propose to decrease the coin rewards as coin-days-destroyed volume increases, so this makes it less costly for an attacker to obtain > 50% of the hash rate assuming the attacker includes all the transactions. You apparently are attempting to imply there is no useful attack to do if the attacker is including the most coin-days-destroyed? Please confirm or deny then I will dig into more analysis of this vector.

2. Also how do you choose between someone who generates a proof-of-work hash with lower coin-days-destroyed several times sooner than the network propagation delay versus another who generates it that much delayed with a higher coin-days-destroyed? If you choose the latter, then you've killed the proof-of-work incentive because it means it will always pay to be later and wait for more transactions to arrive.

3. You claim to defeat my Transactions Withholding Attack, by blacklisting those who send blocks with transactions that were not recently seen by all miners. I retorted against this recently. This centralizes the network (all for one and one for all outcome) by requiring every miner to be responsible for the incoming network connectivity of other miners. And it centralizes the network in other ways, such it can't tolerate a temporary partitioning of the network due to connectivity outages.

P.S. By coin-days-destroyed, I assume you mean coin value x days, otherwise you would motivate proliferation of dust.

After some consideration I have decided to replace proof-of-work all together and use transaction fees to regulate block production.  A new block is produced once enough transaction fees have been accumulated.  The node that generates the transaction with sufficient fees broadcasts it.

As far as I can see, the problem will always remain the preimageable entropy because you are relying on factors that can be adjusted deterministically by the participants, e.g. propagation, transaction fee amounts and timings. For example, there is no way to converge to consensus over conflicts over who was first in this design.

It is rationally better for you have critical feedback sooner than later.

3. Does not centralize the network, it is a local calculation performed by all nodes relative to their peers.

There is no way to escape the fact that senders of data can't be responsible for the receipt of data. Nor can the recipients of data be responsible for the senders of data to send.

The genius of proof-of-work is that it eliminates those impossible responsibilities.

I'm very hopeful that this solution proves workable as I would like to see it used in Freicoin.  I will bring it to the attention of our lead programmer maaku and possibly Luke-Jr too.  We have long desired a solid PoS system which would allow for a decentralized distribution of the demurrage fee, but we have always been stymied by possible PoW attack vectors that our designs were vulnerable too.

How is demurrage different from inflation?   In the case of bitcoin, there is 12% inflation per year that is masked by appreciation.   Demurrage would just make the inflation more obvious, but if Bitcoin were to switch to using 'PERCENT OF MONEY SUPPLY' as the basic unit of account then Bitcoin would technically be implementing demurrage.   All you are achieving with your coin is to make it more obvious.  

Conflating inflation with M in the Quantity Theory of Money is a fundamental error.

You can also see the following linked discussion between Impaler, CoinCube, and myself:

https://bitcointalk.org/index.php?topic=342007.msg3788782#msg3788782
https://bitcointalk.org/index.php?topic=342848.msg3789022#msg3789022

Also you can see that Bitcoin can not agree with Austrian economics definition of money:

Gary North who is allied with Ron Paul, Lew Rockwell, the Mises Institute, and Austrian economics, says Bitcoins: The Second Biggest Ponzi Scheme in History.

Follow-on discussion of that:

https://bitcointalk.org/index.php?topic=342007.msg3781517#msg3781517
https://bitcointalk.org/index.php?topic=342007.msg3788271#msg3788271

[Impaler]

I described negative, not zero, transaction fees as a subsidy. Please re-read my upthread posts more carefully. Where I referred to zero transaction fees upthread, I said they were already a sufficient motivation to use the coin (a gift) as compared to Bitcoin and Freicoin that charge a transactions tax. I did not write that zero transaction fees are a subsidy. I clearly made a line-in-the-sand demarcation distinction between negative and zero transaction fees.

Negative transaction fees would indeed be a subsidy to both the buyer and the seller.

No where did I write the subsidy was exclusive to the spender aka buyer. Perhaps you thought I implied it because I did not mention the seller whereas I felt that implied subsidizing transactions benefits also the seller.

My last post remains valid that if we want to subsidize transactions in a chosen balance with security, I now see a way to do it although the variability on mining rewards block-to-block limits that chosen balance to a small factor.

Then I was in error, sorry about that, a negative transaction fee would indeed be an unjustified subsidy and economically disastrous (not least of which because users could generate huge numbers of transactions to milk it).