Transaction Fee Alternative for Bitcoin, Proof of Individual Work

[ir.hn]

I proposed an altcoin design here called blockvault: https://bitcointalk.org/index.php?topic=5377321.new#new

But here I want to talk about one aspect that can be applied to Bitcoin, a transaction fee alternative.

Here is an excerpt from the archive: https://web.archive.org/web/20211217023208/https://www.naturevault.org/wiki/pmwiki.php/CryptoProjects/Blockvault

The primary way that miners are incentivized to hold the blockchain and provide proof of work (profun work) is the block reward which ever so slightly increases with time to make sure they stay incentivized forever. Miners also earn the small transaction fees. Unless there are 10 million transactions every 7 seconds on the network, the fees collected would be (much) smaller than the block reward.

So the only real reason we need to collect fees for transactions is to prevent spam transactions, people maliciously trying to slow down the network.

Well as an optional alternative to transaction fees (transaction fees are still accepted and are convenient and cheap), we can achieve spam prevention by allowing people to provide thier own proof of work to make spamming impractical.

Factoring a large number (over around 120 digits) is very challenging thing to do even with the technology we have today. In fact it is the proof of work in the CollectBit project. It is so hard that despite decades of research, GPU's and ASIC's have never been created that can do it, and no inventions have even been able to come up with a way it could be done practically. CPU's, the things in your desktop computer, smartphone, or servers can do it however. So what this means is that you can use your desktop to provide this proof of work and bypass paying a fee to post/transact on blockvault.

Here is how it would work: ↑

The network agrees on a difficulty per kilobyte. For example a 1 kb transaction could require factoring a 145 digit number. Each additional kb in the transaction could increase the digit requirement by 1. So for a 10kb transaction it would require factoring a 155 digit number. So this individualized proof of work would only be practical for a transaction smaller than a few kb. If you need to add more data to the blockchain just do it in several transactions.

1.You hash your proposed transaction and a random 6 digit nonce using shake256-1024.

2.Then you convert to base-10 (numbers).

3.Truncate this number to the first 145 digits (or whatever the length needs to be).

4.Factor this number (see DCN mining for more info).

5.Make sure the factorization meets the network requirements, if not go back to step 1 and pick a different nonce until it does.

The network requirements not only specifies the digit length of the number to factor, but also the requirements of the prime factors themselves. In CollectBit, we determined that the prime factorization must be only 2 prime factors, the smaller of the two must be at least 36% of the digit requirement. We should use this requirement here too, 36% was chosen because a GPU can ECM to 34%, and we don't want GPU's hunting for easy to factor numbers and not have to use CPU's.

For example if we are factoring a 145 digit number then the prime factorization must be exactly 2 factors and the length of the smallest factor must be greater than or equal to 0.36*145 so 52.2 rounded up to 53 digits. This makes sure that the factorization you perform as the proof of work really took you some time to complete.

Every year the network should revisit the requirement and make sure that it takes roughly a given timeframe on a decent desktop per kilobyte, say 8 hours for 1kb (so you could run it while you sleep).

So basically a person hashes their transaction details, then converts that hash into a very large number, and then factors it to prove work.  This would replace the "spam prevention" aspect of the transaction fees.  If there was a small permanent subsidy per bitcoin block (say 0.01 bitcoin) then transaction fees need not pay for the miners work and this could be a low cost alternative to that transaction fee, whereas power users could just pay the fee.

[1715031058]

1715031058

[1715031058]

1715031058

[1715031058]

1715031058

[1715031058]

1715031058

[ranochigo]

The cost of the work done per transaction has to match with the amount of fees being paid per transaction. Or else, this doesn't make sense because it becomes cheaper for an adversary to spam the network or for people to offer their computing power for this. This also means that transaction that relies on the POIW (by your definition) would potentially take more time because your computing power expended has to match with both the current fees and be prohibitively expensive.

In essence, this scheme wouldn't be very useful for the average joe because they would very much rather just pay for the transaction. Botnets can easily circumvent these hurdles while the average joe finds it more of a hassle.

[odolvlobo]

BTW, your transaction fee alternative proposal is basically a variation of HashCash. So, he obvious question is how it is better.

[ABCbits]

Every year the network should revisit the requirement and make sure that it takes roughly a given timeframe on a decent desktop per kilobyte, say 8 hours for 1kb (so you could run it while you sleep).

Decent computer shouldn't be standard since most people use smartphone (which have less computational power) or old hardware (e.g. 10 years old laptop or RPi 3).

Question: won't this mean that no one will use coins to pay transaction fees? ↑

No, this process is designed to take time and so just paying the very small transaction fee will probably almost universally be done, especially for financial transactions which people need done quickly.

If the protocol discourage people from batching transaction, this will lead to bloated blockchain. Wallet and services will make lots of smaller transaction to reduce computational usage.

[ir.hn]

Thank you all for the responses, I am trying to vet the design so I appreciate the hard looks.

Ranochigo -

Yes the poiw (or ipow) should match  the cost of the transaction fee as best as possible.  It could be possible for this to automatically scale up or down.  One other point I do want to make though is that time is money and you have to take into account PC opportunity cost and the opportunity cost of waiting 8 hours or whatever number to complete your transaction.  People will pay more just to not have to wait, since factoring a large number is non-parallelizable they will have to wait no matter how powerful computer they are using (powerful computers can do it faster though,)

Odolvlodo -

Great point, this is basically an upgraded hashcash in terms of serious asic and gpu resistance, but it is not parallelizable like hashcash is so cannot be used for mining itself.  That is why I think its best use is proof of individual work as a transaction fee alternative.

ETFbitcoin -

Good points, perhaps it should be tuned to smartphone completion time.

In terms of lots of small transactions, that is fine for my altcoin design but I agree if this idea is used in bitcoin it would need to be tuned to not bloat the blockchain so larger transactions should be a bit cheaper than a bunch of smaller ones.

[ranochigo]

Yes the poiw (or ipow) should match  the cost of the transaction fee as best as possible.  It could be possible for this to automatically scale up or down.  One other point I do want to make though is that time is money and you have to take into account PC opportunity cost and the opportunity cost of waiting 8 hours or whatever number to complete your transaction.  People will pay more just to not have to wait, since factoring a large number is non-parallelizable they will have to wait no matter how powerful computer they are using (powerful computers can do it faster though,)

What stops large farms or botnets from dominating this by hunting through different nonce each set of transaction? Does this impose additional penalty on each node since the factorization has to be done on each transaction when it gets relayed?

Another point that I'd like to highlight is with the block rewards. Would the total supply of the coins be capped or have an increased inflationary trend? The compensation for this has to be adequate to maintain network security while allowing a proportion of the transactions to be essentially free.

[ir.hn]

Yes the poiw (or ipow) should match  the cost of the transaction fee as best as possible.  It could be possible for this to automatically scale up or down.  One other point I do want to make though is that time is money and you have to take into account PC opportunity cost and the opportunity cost of waiting 8 hours or whatever number to complete your transaction.  People will pay more just to not have to wait, since factoring a large number is non-parallelizable they will have to wait no matter how powerful computer they are using (powerful computers can do it faster though,)

What stops large farms or botnets from dominating this by hunting through different nonce each set of transaction? Does this impose additional penalty on each node since the factorization has to be done on each transaction when it gets relayed?

Another point that I'd like to highlight is with the block rewards. Would the total supply of the coins be capped or have an increased inflationary trend? The compensation for this has to be adequate to maintain network security while allowing a proportion of the transactions to be essentially free.

Great questions.  So for the first point, all verifying nodes need to do is multiply the two proposed factors together and see that it equals the first say 145 digits of the hash of the proposed transaction.  In that way it is super similar to RSA encryption which is much easier to verify than crack.  In fact this method basically is a very small RSA problem.  You create a small RSA problem, crack it to prove work, and the verification is super easy and fast.

You can hunt through nonces to find an "easy to factor" number like you say but it wouldn't be a valid proof of work.  The requirement is that there are only exactly 2 factors to the number and the smaller of which is at least 36% of the total number length.  This guarantees that the number is of relatively the same difficulty to factor as the hardest ones.  So every ipow creating node will have to run through about 100 nonces at this difficulty level to find a single number that would meet the difficulty requirement.  I have actually done this process with 150 digit numbers and it does take about 100 nonces and running through those is very fast.  What I do is generate about 100 numbers via different nonces, then try to factor them all.  About 90 would factor in milliseconds, then you ecm the rest up to 34% the bit length, and any that pass that (which takes a couple mins) is a candidate for full GGNFS factorization.  When you get to that step nearly all the candidates left will provide a factorization that meets the 36% rule.  So the overhead is actually pretty low, and by that I mean that at least ~97% of the time spent is the ggnfs factorization of the best candidate number, and only 3% rooting out primes and candidate numbers that end up not meeting the requirements.  This means there is no significant speedup to either botnets or gpu's.  If you did use botnets it would use 100% cpu and only one core of one processor could work on any one transaction.

In my altcoin it is designed to have a 1% inflation rate.  But with bitcoin the majority of transactions would be tuned to use a transaction fee, and that can be tuned by tuning the difficulty of the ipow.  So if you want 10% of transactions to be ipow, you can tune difficulty so that goal is reached.  So whatever your inflation goal is you can make this work for it while providing a slower but free option for less well endowed people to still be able to use it for small transactions.

[larry_vw_1955]

I like this idea of individual proof of work. Plus it's old school i.e. based on infeasibility of factoring. Problem is it's vulnerable to quantum computers.

Another potential issue is when you try and mix "free" and non-free transactions, miners are always going to favor including the non-free ones in a block so the ones that are "free" are not prioritized and might get ignored. Which would mean that the person that did the individual proof of work wasted cpu. What's the incentive of a miner to include a transaction that doesn't have a fee attached? if there is none then it doesn't seem like this could work.

[ir.hn]

I like this idea of individual proof of work. Plus it's old school i.e. based on infeasibility of factoring. Problem is it's vulnerable to quantum computers.

Another potential issue is when you try and mix "free" and non-free transactions, miners are always going to favor including the non-free ones in a block so the ones that are "free" are not prioritized and might get ignored. Which would mean that the person that did the individual proof of work wasted cpu. What's the incentive of a miner to include a transaction that doesn't have a fee attached? if there is none then it doesn't seem like this could work.

Good points.  To address the first one, quantum computers have been around for about as long as normal computers (50 years) and have only got up to factoring 2 digit numbers with shors algorithm wheras standard computers can do 200+ digit numbers in the same timeframe.  So there are fundamental scaling issues with shor capable quantum computers.  You can't use fuzzy qbits and every qbit must be clean, which to scale is exponential.  Regular computers can scale linearly or polynomialy which is why they are way ahead.  So that leaves me thinking quantum computers will, for all intents and purposes, never catch up to regular ones in terms of factoring because of the infeasibility of physically scaling the quantum entanglement.  Quantum computers are better than normal computers for other things, but factoring large numbers is not (and never will be, imo) one of them.

There is no incentive for a miner to mine free transactions, but we can remove any disincentive.  Something similar to what I am thinking has been done before in bitcoin, basically there (used to be?) A portion of every block that was set aside for free transactions.  What this means is the code can enforce say 10% of every block (100kb) be reserved for free transactions only.  If the miner fills this up with paid then they would have an invalid block.  With our idea here it can be enforced even better since the free transactions would carry cryptographic proof so miners can prove they are free transactions thus being in that 10% reserved space checks out.  Kind of like an HOV lane on the highway. So one thing miners can do to get around this is just always propose blocks that have empty free transactions space.  However at least some miners will elect to instead of leaving the space unfilled, to fill it with the free iPoW transactions.  So if any miners accept it, then it will be a viable thing to do cause eventually it will get included in a block.  This comes at the cost of removing some block space for paid transactions.  So in bitcoin, we would probably want only 1-3% of a block delegated to free transactions so as to not mess up the fees collected per block too much.  The iPoW difficulty can be dynamically adjusted so as to not have too much of a mempool backlog for free transactions.

[pooya87]

Something similar to what I am thinking has been done before in bitcoin, basically there (used to be?) A portion of every block that was set aside for free transactions.

Not exactly. Some years ago there weren't enough transactions to fill the block so the choice was either to leave the block not-full or include all transactions in mempool that included transactions with 0 fee. Nowadays the mempool is crowded with transactions and blocks are almost always full so there is no reason to include "free" transactions.

[ir.hn]

Something similar to what I am thinking has been done before in bitcoin, basically there (used to be?) A portion of every block that was set aside for free transactions.

Not exactly. Some years ago there weren't enough transactions to fill the block so the choice was either to leave the block not-full or include all transactions in mempool that included transactions with 0 fee. Nowadays the mempool is crowded with transactions and blocks are almost always full so there is no reason to include "free" transactions.

Thanks for that, but the reason you would want to include free transactions is to improve BTC utilization in poorer countries, or do you like loosing (so far 62%) of the crypto marketshare to altcoins mainly because they have cheap transaction fees?

[pooya87]

Thanks for that, but the reason you would want to include free transactions is to improve BTC utilization in poorer countries, or do you like loosing (so far 62%) of the crypto marketshare to altcoins mainly because they have cheap transaction fees?

That is not marketshare, it is market capitalization and it does not represent utility. It simply represents a gambling world where a lot of people participate in with a lot of money to make bets on useless virtual objects hoping to win big if they get pumped. The more casinos open (ie. the more number of coins and tokens created) the lower that ratio (62%) will become.
Otherwise bitcoin is dominating the real world when it comes to real usages.

[larry_vw_1955]

Quantum computers are better than normal computers for other things, but factoring large numbers is not (and never will be, imo) one of them.

That's an interesting outlook, I must say I never heard anyone else take that stance. Everyone always says that things like ECDSA and RSA will be the first things to fall victim to quantum computers.

There is no incentive for a miner to mine free transactions, but we can remove any disincentive.  

yeah that may still not be enough though. as you pointed out, miners might just elect to make the "free transactions" section empty. People that do the required PofW would need some kind of guarantee that their transaction was going to be mined especially if the proof of work process took a significant amount of computing resources (time mainly). You can't really offer incentives to miners for including free transactions because then they might just start stuffing their own transactions in there to game the system...