I want to put a consensus design in front of this board and have it argued with, because the part I am least sure about is the part that matters most.
The problem, with numbers.I run a chain with a free mining lane: no stake, no hardware spend, anyone with a phone earns from block one. It got farmed. Roughly a thousand fake identities, operated by two or three people on rented servers, were taking about
42% of all emission.
The interesting part is not that it was farmed. It is that every fix was structurally incapable of working.
Everything I reached for was a rule written per identity: a sequential proof of work at registration, a per-IP entry budget, a per-address identity cap, a probation period before a new identity could earn. Each raises the cost of farming. Each raises it
per identity, which means it costs an honest miner with one identity exactly what it costs a farm with a thousand, per unit. The farm amortises it and continues.
If an identity is something a script can mint, every per-identity rule is a tax the honest user pays in full and the farm books as cost of goods.
That is the same wall NANO hit with representative spam, Idena with validation ceremonies, and Nyzo with its cycle. Each answered with more per-identity rules. Each got dodged the same way.
The conclusion.You cannot fix identity farming with rules about identities. You have to change what an identity is. Only two things resist copying: capital, and a physically distinct object. Proof of Work and Proof of Stake both price identity in the first. I went with the second.
PoSEA, Proof of Secure Element Attestation.A mining identity has to be a real secure element, and one device holds one identity at a time.
On registration and on every renewal, the device generates a throwaway hardware-bound key and returns a WebAuthn attestation over a challenge the chain selected. The certificate chain terminates at a vendor root pinned in the protocol. Every node verifies it offline with the same native kernel: every signature, the validity window at the anchor block's time, the vendor extensions.
- No node ever contacts Google or Microsoft. Roots are pinned and change only by a protocol commit.
- Nothing identifying leaves the device. No serial, no account, no name. The key is used once.
- A device certificate is bound to one identity at a time, so one phone cannot hold two.
- A VM, an emulator, a software authenticator or a rooted phone cannot register.
Supported today: Android 12+ with a locked bootloader (TEE/StrongBox), and Windows with a physical TPM 2.0 via Windows Hello. Virtual TPMs are refused.
Three layers, kept separate.People collapse these and then argue past each other, so to be explicit:
- PoSEA decides who may hold a mining identity. This is the Sybil layer and the only part that changed.
- Block production did not change. There is no hash race. Each slot, a deterministic beacon-keyed weighted draw selects a producer from the eligible set. Attestation only decides who is in the draw, so faster hardware still buys nothing.
- Finality is separate again: a bonded stake quorum with Casper-style epoch checkpoints, equivocation slashable by portable proof. Attestation and presence weight deliberately do not touch it. Presence earns rewards, it never buys a say in what is final.
What it costs, said by me rather than discovered by you.Vendor attestation roots are now in the trust path. Rooted and unlocked devices cannot mine, and those are disproportionately owned by exactly the people most likely to care about a chain like this. That is a real loss and I do not have a way around it.
The mitigations are honest but partial: verification is offline against pinned roots, so no service can revoke you and nothing phones home, and the stake-bonded lane requires no device at all.
Every Sybil mechanism trusts something. Proof of Work trusts that no one controls a majority of hash power, which looks weaker every year. Proof of Stake trusts that concentrated holders will not collude. This trusts pinned vendor roots. I think that is a defensible trade, but it is a trade.
What I actually want from this thread.- Is vendor attestation a genuinely worse trust assumption than a mining cartel, or only a more legible one? I can argue either side depending on the day.
- What is the real cost curve on TEE key extraction? If it is per-model and expensive, device scarcity holds. If one break generalises across a chip family, this collapses back into a cheap Sybil farm, and I would rather learn that now.
- Is there prior art I have missed? I know remote attestation is used for validator integrity in places, but not as the primary Sybil resistance for open block production.
This is the mechanism running on NADO, which I build. It is betanet, not mainnet, and there is nothing to buy. The second question above is a live design risk and this board has never been shy.
Spec:
doc/device-attestation.mdCode:
github.com/hclivess/nado
