Date: Wed, 17 Jul 2019 08:11:26 +0000
To: "Kenshiro \\[\\]" <tensiam@hotmail.com>,
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <D-LJd2MDCfyPvBy7Px7FFjsh6ZrD2fmCCZ66tKQEMpBf5VEJ2RTh6GsE24uu4ow4bD_O-a_vyZh6qLaWOJIpkfO4EzOKbvO_xW5Bwjf_yPI=@protonmail.com>
In-Reply-To: <DB6PR10MB1832257D676DDA7B4F55E658A6CE0@DB6PR10MB1832.EURPRD10.PROD.OUTLOOK.COM>
References: <DB6PR10MB183264613ED0D61F2FBC6524A6F30@DB6PR10MB1832.EURPRD10.PROD.OUTLOOK.COM>
	<CAO7Y_eWDcFHWQMSL3h4Nz1a4FVsMq04YsGph5RR6khWzzdAyOg@mail.gmail.com>
	<DB6PR10MB1832257D676DDA7B4F55E658A6CE0@DB6PR10MB1832.EURPRD10.PROD.OUTLOOK.COM>
Feedback-ID: el4j0RWPRERue64lIQeq9Y2FP-mdB86tFqjmrJyEPR9VAtMovPEo9tvgA0CrTsSHJeeyPXqnoAu6DN-R04uJUg==:Ext:ProtonMail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Secure Proof Of Stake implementation on Bitcoin
Precedence: list

Good morning Kenshiro,

> 4 - In any given block, only one staker gets the authorization to create =
that block, so other stakers can't spam the network with many different blo=
cks as they are illegal.=C2=A0

This leaves the consensus algorithm liable to stake-grinding attacks.
Often, the selection of the "single staker" for each block is based on some=
 hashing of some number of the previous headers.

This allows the single staker to do some trivial grinding of the `R` of som=
e signature of some transaction of some money from itself to itself.
This grinding is likely to change the hash of the current block.
Changing the hash of the current block is enough to change the hash that is=
 used in the selection of the **next** single staker.
Note that the staker will of course only publish the version of that block =
that makes itself the **next** staker.

This is the well-known stake-grinding attack; did you not encounter it in y=
our proof-of-stake research?
This is a basic objection to proof-of-stake, together with the nothing-at-s=
take.

Suppose the staker owns 49% of the staked funds.
It is now trivial for it to continuously grind so that it is again the next=
 staker for the next block, as 49% of the time, it would be selected as the=
 next staker.
Further, this is easily hideable, as the staker can simply run 100000 maste=
rnodes and split its funds to all of them, so that it becomes very non-obvi=
ous that there is in fact only one staker running the entire network.

(Did you consider how much energy such a staker would be willing to spend o=
n grinding so that it remains the next staker forevermore?
In particular, the staker would be willing to spend energy up to the block =
reward in such grinding --- a property that proof-of-work has, and ***openl=
y*** admits it has.)

In particular, this allows that one staker to impose any censorship it like=
s.
Thus, Bitcoin cannot support any kind of proof-of-stake that is vulnerable =
to this stake-grinding attack.

Regards,
ZmnSCPxj