The only viable long term solutions that I have seen for a flexible blocksize limit also require a tail emission. That being said this does not mean, I have a proof that a long term solution for a flexible blocksize limit without a tail emission is not possible.
This is a quote from Arcticmine's comment he made earlier from another thread. My question is, what is the theory behind needing a tail emission for dynamic block sizes?
He also mentioned that he does not have proof that a long term solution for not having a tail emission for dynamic block sizes is not possible. So meaning dynamic block sizes even with a capped number of coins with no tail emission could also be possible? Please explain.
I posted the theory behind this in this post here on BCT back in January of this year.
ArticMine PMed me after I wrote
that flaming post, and said he would reply after studying my posts. He has not yet replied. Does that mean I am correct and there is no solution for Monero. I think so.
It is fundamental. Afaics, you'd have to completely rewrite Moaneuro.
Rewrite Monero, is not necessary at all but some documentation on how the Cryptonote adaptive blocksize limits actually work is needed, especially given the formula in section 6.2.3 of the Cryptonote Whitepaper is wrong.
https://cryptonote.org/whitepaper.pdf. My response will come in time.
I will start by examining the Cryptonote Penalty Function for oversize blocks. This is critical to understand any form of spam attack against a Cryptonote coin. From the Cryptonote whitepaper I cited above the penalty function is:
Penalty =
BaseReward (
BlkSize / M
N - 1)
2The new reward is:
NewReward =
BaseReward -
PenaltyWhere M
N is the median of the blocksize over the last N blocks
BlkSize is the size of the current block
BaseReward is the reward as per the emission curve or where applicable the tail emission
NewReward is the actual reward paid to the miner
The Maximum allowed blocksize,
BlkSize, is 2M
NThe penalty is only applied when
BlkSize > (1 + B
min) M
N Where 0 < B
min < 1 In the Cryptonote whitepaper B
min = 0.1.
The error in the Cryptonote Whitepaper was to set
NewReward =
PenaltyFor simplicity I will define:
BlkSize = (1+B) M
NBaseReward = R
basePenalty (for a given B) = P
BNewReward (for a given B) = R
BThe penalty for a given B becomes:
P
B = R
baseB
2While the new reward for a given B becomes:
R
B = R
base(1 - B
2)
The first derivative of P
B with respect to B is
dP
B /
dB = 2R
baseB
In order to attack the coin by bloating the blocksize the attacker needs to cause at least over 50% of the miners to mine oversize blocks and for an expedient attack close to 100% or the miners to mine oversize blocks. This attack must be a maintained over a sustained period of time and more importantly must be maintained in order to keep the oversized blocks, since once the attack stops the blocks will fall back to their normal size. There are essentially two options here:
1) A 51% attack. I am not going to pursue this for obvious reasons.
2) Induce the existing miners to mine oversize blocks. This is actually the more interesting case; however after cost analysis it becomes effectively a rental version of 1 above. Since the rate of change (first derivative) of P
B is proportional to B the most effective option for the attacker is to run the attack with B = 1. The cost of the attack has as a lower bound R
base but would be higher, and proportional to, R
base because miners will demand a substantial premium over the base reward to mine the spam blocks due to the increased risk of orphan blocks as the blocksize increases and competition from legitimate users whose cost per KB for transaction fees needed to compete with the attacker will fall as the blocksize increases. The impact on the coin is to stop new coins from being created while the attack is going on. These coins are replaced by the attacker having to
buy coins on the open market in order to continue the attack. The impact of this is to further increase the costs to the attacker.
It at this point where we see the critical importance of a tail emission since if R
base = 0 this attack has zero cost and the tragedy of the commons actually occurs.
This is the critical difference between those Cryptonote coins that have a tail emission, and have solved the problem, such as Monero and those that do not, and will in a matter of time become vulnerable, such as Bytecoin.At the heart of this issue lies the question of securing a POW coin after the emission runs out. In Bitcoin the implicit theory is that a "fee market" would somehow develop. The question of how this fee market was supposed to develop however was left un-answered. The source of scarcity in BItcoin to have the market force fees up is the fixed blocksize, and in my opinion this lies at the heart of the small block argument in Bitcoin.
Monero deals with the fee market, POW security and adaptive blocksize issue in two ways.
1) Securing the coin is left entirely to the emission. hence the need for the tail emission
2) Fees are now freed to address the adaptive blocksize. The fee market arises from the total amount of fees per block having to compete against the emission in order to increase the blcoksize. The net effect of all of this is that fees per KB are effectively set by the ratio of the emission to the blocksize.
The point that I must emphasize is that the Monero solution to the adaptive blocksize question will not work in a coin without a tail emission. It could in principle be applied for a limited number of blocks with say the constraint the the emission be above a certain amount after which the blocksize is no longer allowed to increase.
Edit 1: Technically a coin such as Freicoin
http://freico.in/ still has a tail emission for the above purposes even though the tail emission in offset by demurrage keeping the max number of coins constant.
Edit 2: To clarify my point about other than "Monero like" possible solutions for an adaptive blocksize limit in Bitcoin is that I have not seen any, and many very smart people have been looking for one without success. I actually suspect that one may in fact not exist without some external source of control; however I am also not aware of a rigorous mathematical proof that such a solution does not exist.
