Opinion | Don't just look at TPS, look at the guarantee of transaction settlement

特邀专栏作者

2019-08-25 16:00 (UTC+8)

This article is about 12346 words, reading the full article takes about 18 minutes

The higher the value accumulated by a public chain per unit time, the higher the security and settlement efficiency of the public chain.

AI Summary

The higher the value accumulated by a public chain per unit time, the higher the security and settlement efficiency of the public chain.

Editor's Note: This article comes fromChain News ChainNewsEditor's Note: This article comes fromMediumChain News ChainNews

, Translator is delicious haichao; the original text comes from

, by Nic Carter; reproduced by Odaily with permission.

How long does it take for the state of mainstream blockchains to reach finality? How long do I have to wait for confirmation that a bitcoin transaction is actually settled? What risk factors might cause me to need additional trade confirmations? How does the number of transaction confirmations affect transaction settlement?

Surprisingly, even in 2019, 10 years after the first Bitcoin block was mined, there are still no good answers to these questions.

Rigorous investigation of the properties of Proof-of-Work (PoW) mechanisms has stalled due to a number of viewpoints. Some believe that Proof of Work is just a temporary mechanism that will replace it when better consensus/Sybil resistance mechanisms emerge. There are also some Bitcoin fundamentalists who believe that the quality of Bitcoin cannot be questioned.

First, let me explain why I think settlement guarantees are the number one consideration for any public chain.

What's so interesting about Bitcoin?

This is actually a difficult question to answer. If you ask ten different bitcoin users, you will get ten different responses. Disagreement over the use and purpose of Bitcoin nearly split the entire community during 2014-2017.

Hasu and I have attempted to write and summarize the history of the debate over these visions. Others have noticed this as well, and have documented them in detail. I especially like the ideas of Murad Mahmudov and Adam Taché. Daniel Krawisz also covered this topic neatly in 2014.

So if you think settlement guarantees for transactions are the most interesting thing about this system, how should we evaluate it? How should we make standards-consistent comparisons between Bitcoin and other systems under the premise of open verification?

Billing Assessment

So what exactly is settlement guarantee? It refers to the ability of the system to assure the recipient of a transaction received by the system that the transaction will not be tampered with. Wire transfers using messaging systems like SWIFT are very mainstream because the transactions they process are virtually tamper-proof. SWIFT is safe for the recipient because the originating bank releases the funds only after verifying the integrity of the funds in the sender's account.

That’s why the thieves behind the Bangladesh bank heist chose to use SWIFT and bank wires: they wanted to take advantage of the transaction settlement guarantees of these systems. In other words, they have chosen to use a system that is difficult to tamper with to carry out their theft. As a result, the $61 million involved remains unaccounted for to this day.

This is not proof that SWIFT and bank transfers are a failure, but rather a testament to the strengths these systems possess. Even in this case, almost every participant would like to be able to reverse the transaction, but they still cannot. This illustrates that the system is resistant to operations such as rollbacks, free changes, and postmortem edits. That doesn't make it a bad system. This in turn makes it a system that provides good guarantees to counterparties that trades will eventually be settled.

Bitcoin is a similarly useful system because it also provides users with strong settlement guarantees. Just how good it is, we don't quite know yet.

LaurentMT has written perhaps some of the most scientific explorations to date in his excellent Gravity series. But in general, the properties of Bitcoin PoW are still understudied. It has had some block reorganization events in history, but as far as we know, there has been no reorganization for the purpose of malicious theft. And we know that miners put a lot of real-world resources into transaction mining.

This means that the recipient of a Bitcoin transaction can have an extremely high level of confidence that once its transaction is buried under a few blocks, it is impossible to reverse it.

But that's not the case for many competing cryptocurrencies. While they appear similar to Bitcoin in many ways, none of them have the same settlement guarantees as Bitcoin. This is not necessarily because of any design flaw, but simply because each block of Bitcoin accumulates more cost per unit of time (aka attack cost), and also because Bitcoin is more expensive for its hash function. Said to be a near-monopoly role, and also has dedicated hardware.crypto51.appSomewhat surprisingly, many of the weaker chains have not yet been attempted to attack, even if doing so is cheap. This is likely because post-51% cashouts require the use of exchanges, which introduces some additional complexity. And frankly, most of the smaller coins start out cheap (and don't have much liquidity to short), which limits the gains from the attack.

If you want to understand how vulnerable many cryptocurrencies are, you can check out

this site. The site calculates the probability of a blockchain being hacked by assuming that an attacker can rent enough hardware on Nicehash, which is a bit unrealistic, but it still does a good job of showing a lower bound on the cost of attacking these systems.

So what are the key variables to evaluate the settlement efficiency in the public chain system? Let's break them down into easy-to-quantify variables and hard-to-quantify variables.Understanding (and Mitigating) Reorgs。
Before we get started, let's do a little literature review, citing some previous work in this area:Beyond the doomsday economics of「proof-of-work」in cryptocurrencies。
For a more succinct description of the problem, read Anthony Lusardi'sA Lower Bound on Miner Rewards。

For the specific implementation of the model containing some variables, you can refer to Kevin Lu from BKCM.

Quantifiable Settlement Related Variables

bookkeeping cost

Ledger cost is the most useful and straightforward variable in our assessment of blockchain settlement assurance. In simple terms, it is equivalent to the amount paid to transaction validators/selectors per unit of time. In Bitcoin, miners are rewarded with block rewards and transaction fees for every block they mine as an incentive to stay honest and "follow the rules." In proof-of-work, miners attach an unforgeable proof that they have expended some energy, so for each block each miner pays a corresponding price. Every time a block is won, unless they are very lucky, miners must expend resources roughly equal to the block's value (of which the marginal profit is usually small). Therefore, miners are incentivized to create valid and rule-abiding blocks.
The Anatomu of Proof of Work

You can think of it like a school assignment, like having to read a book and make a book report. You need to prove to your teacher that you read the book, so you make a book report (a valid block hash with a sufficient number of zeros in the prefix), only if you actually read the book (calculate enough hash value), you can create it. Because your teacher is a stickler, you also have to format your book report correctly (produce a well-structured and valid block). It would be very tragic if you read the entire book but only submit one malformed report and you end up getting an F. The same is true for proof-of-work: the work needs to be done upfront, and the rewards can only be earned afterwards. Now that you've borne the actual costs, and your business requires you to perform the last few rote steps to get your rewards, you don't want to screw that part up. Something similar happened recently where a miner did all the necessary work to qualify to submit a block, but in the last hurdle they created an invalid block.

So why does a higher bookkeeping cost per unit of time mean higher security? Because if (honest) miners are paid more, it means you need to hire more mercenaries to beat them. These resources to be consumed have to come from somewhere: you need to manage the hardware that produces the hashing power, electricity, etc. (There is an argument that only transaction fees can provide PoW security since the attacker gets the block reward when doing a 51% attack. I don't have enough time to fully discuss this here, for now , I would argue that blockchain rewards, especially dedicated mining hardware, are a huge barrier in and of themselves that must be addressed before 51% attack theory can be discussed.)

All in all, it is very difficult to outbid honest miners who dutifully produce blocks on Bitcoin. They are now generating $6.9 billion a year in revenue, and many of them may invest in other businesses in their industry in anticipation of future profits (meaning there may be a premium for miners that are being mined on the blockchain network The price of the mining machine may even be higher than the value it produces).

image description

-Bitcoin Miner Revenue/USD, Data: Coinmetrics.io-

Thus, Bitcoin is protected not only by the daily wages paid to miners by the Bitcoin protocol, but also by the discounted earnings these miners expect to earn in the future. This means that Bitcoin is not only protected by today's status quo, but also by miners' expectations of future rewards.BitConfWe didn't find an easy way to simulate expectations here, so the easiest way is to get miner revenue per unit of time and compare different blockchain systems on this basis. At this point, if you choose to stop reading this article now and just remember the last sentence, you have gained a better understanding of security than most people. Few teams, even those as high-stakes as exchanges, evaluate blockchains like this.

Fortunately, Anthony Lusardi has done some good expository work on this topic. he introduced

. This work shows how many confirmations are required on other blockchains (such as Litecoin) to achieve the same value for one transaction confirmation on Bitcoin.

However, I would venture to say that most people are not using BitConfs, or attempting to index the transaction settlement costs required across blockchains. On the contrary, "minke" believes that settlement is a linear function of the number of transaction confirmations. What's even more regrettable is that this is actually a very common view. Even the Litecoin Foundation website cryptically expresses this sentiment:

Litecoin transactions are confirmed faster than other cryptocurrencies, such as Bitcoin, because it produces a block every 2.5 minutes, compared to Bitcoin's 10 minutes. This means your funds can be delivered faster.

If it is compared to the initial speed of selecting transactions from the memory transaction pool and including them in the chain, then Litecoin is much faster, but in cryptocurrencies, probabilistic transaction settlement efficiency must be taken into consideration. In other words, Litecoin is "faster" if you only care about the first confirmation, but when you care about settlement in the long term (multiple confirmations), it's obviously much slower.

If you consider that Litecoin and Bitcoin provide the same degree of settlement assurance per confirmation, then you might consider Bitcoin to be significantly slower and draw a graph like this:

But this is wrong. Litecoin will generate more blocks per unit of time, but it will accrue ledger costs more slowly. In effect, Bitcoin provides higher income to its miners, so they provide more security in the form of hashes per minute.

Compared with Litecoin, the cost of Bitcoin block accumulation will be "heavier". Even with Litecoin's 10-minute block interval, a Bitcoin block is still 14.5 times more expensive than a Litecoin block. The number of confirmations is actually irrelevant, the opportunity cost of the miners per unit of time is what matters.

We can try to visualize the process of increasing the cost of bookkeeping. As the blocks are stacked, the transaction will be buried under more and more blocks, and it will be closer and closer to its final settlement state.

The point here is that the settlement in the blockchain system has a process. The block interval is basically irrelevant. Ethereum produces more blocks per hour than Bitcoin, but settlement efficiency between the two should be compared based on bookkeeping costs rather than confirmations.

Profit of reversing a trade: the amount of the trade

Bookkeeping costs are not the only factor affecting the efficiency of transaction settlement. Equally important is the possible payoff from a successful reversal trade. The purest way to measure this incentive is by the amount of the transaction. If you are the recipient of a 50,000 BTC transaction, you may have to wait more than six blocks for the transaction to be confirmed. If you are receiving 1000 Satoshi, that one confirmation is enough. In short, the settlement of each transaction is more or less affected by the amount involved in it.In articleElaine Ou in a wonderful Bloomberg

In article

Elaine's formula neatly combines two of the most important quantifiable variables in blockchain settlement: bookkeeping costs and the benefits of reversing transactions. If you want to settle a receiving transaction worth $10 million in BTC, according to its rules, you need to wait 60 blocks, or 10 hours. (It's a neat coincidence that, at $13,330, Bitcoin would accrue bookkeeping costs at a rate of $1 million/hour). In what follows, I will refer to this simple formula as the Ou rule.

Now that we've enumerated the two most critical settlement-related variables, let's do some calculations and compare these mainstream PoW networks.

image description

-Statistics as of 2019/07/15, data: Coinmetrics.io-How Many Confs?Needless to say, Bitcoin is by far the fastest blockchain for settlement (just considering these two variables and not considering other less mainstream blockchains). Even a $1 million incoming transaction can be very slow on many blockchains. With the exception of Bitcoin, Ethereum, and Litecoin, all distributed ledgers take at least a day (I'm excluding Ripple and Stellar in these examples because they don't actually have distributed verification). Smaller chains simply don't have enough miner rewards for settlement to be done in a reasonable amount of time.

Luke Childs

A dynamically updated version of some of this table is provided.

It's also an interesting case study of how Bitcoin resists imitation. You can create something that looks similar to Bitcoin, but you can't replicate the settlement guarantees that are based on bookkeeping costs. Miners follow economic realities, and they won't be coaxed into supporting a protocol that doesn't provide them income well. In fact, as we'll see, BCH and BSV fared even worse than this table suggests due to a third variable.

monopoly on its hash function

So far I haven't mentioned a third key variable that will directly affect a blockchain's settlement guarantees: namely, whether it has a monopoly on the hardware capable of doing its hashing. As I mentioned above, BCH and BSV are at a huge disadvantage relative to Bitcoin because they only have a small fraction of all SHA-256 ASICs. This means that even a medium or small Bitcoin mining pool could temporarily point its hash power at one of Bitcoin's smaller forks and 51% attack it at will.

image description

- Relative share of miner revenue, BTC (orange), BCH (green), BSV (red), source: Coinmetrics.io -

The fact that these blockchains have not been attacked is not evidence of their security. It's possible that no miner on Bitcoin would be willing to maliciously harass today's minority, but relying solely on the goodwill of miners would result in an extremely weak security model. Since this risk is always present, it can be argued that these blockchains will not produce valid transaction settlements, regardless of the number of confirmations. This is because, for example, there are enough mining pools on Bitcoin to easily perform a 100+ block reorganization on BSV.

This variable brings more complexity to the analysis in this paper. It doesn't mean that more computing power will mean that the blockchain is more secure, it must also occupy a large part of the hardware corresponding to the hash function.

So I consider this variable to be a boolean value: whether or not the blockchain is a monopoly on the computing power of its hash function. If it is unlucky enough to share mining hardware with many other blockchains, and only have the support of a small percentage of miners, it is likely to be fundamentally insecure. But it's hard to say exactly how insecure it is, and the risk of an attack will depend on an attacker's ability to muster enough power and hardware.

Less quantifiable settlement variables

The three variables mentioned above are not exhaustive, they are just the easiest variables to quantify. With these variables, you may already be able to build a better model than many exchanges use today. But there are still many factors to consider.

Gains from reversing trades: cheating attacks

The risk of such an attack is almost impossible to quantify, as attackers have various motivations and are often not a priori (revealed prior to the attack). Here, I will go further and give two examples where the return on reverse trades increases dramatically and settlement guarantees become less certain.

upper layer is too heavy

This refers to the situation where a large number of high-value assets are created as Tokens on top of some base layer protocols, such as Omni assets on Bitcoin or ERC20 assets on Ethereum. Since the security of these Tokens comes from its Layer 1 and completely depends on Layer 1 to operate, they will be vulnerable to attacks on Layer 1.

As the asymmetry between the attack cost of the underlying protocol and the asset value of the upper layer becomes increasingly prominent, the problem of the upper layer being too heavy will also begin to emerge. When this asymmetry becomes large enough, attackers may seek opportunities to short some assets on the upper layer and attack the underlying protocol at the same time, mine empty blocks and conduct DOS attacks on related Tokens, or reorganize and confuse them.

I don't think any blockchain today will face this problem, but as more assets are tokenized and deployed on top of the blockchain, the rewards of attacking the base layer will increase significantly.

Liquid Derivatives Market

This is more intuitive. Derivatives, especially options, allow financial market participants to gain leverage and amplify their returns even when the underlying securities fluctuate only slightly. Under the problem of the upper layer being too heavy, when there is a significant asymmetry between the cost of carrying out the attack and the benefit of the attack, the risk of blockchain finance will appear.

Of course, a balancing factor here is that if an exchange suspects that the trader of a transaction is collaborating with an attacker to interfere with the blockchain, then they may not be willing to take the risk of condoning the transaction easily.

hardware-related considerations

Therefore there should always be additional transaction confirmations for GPU mined coins and blockchains. Although the ratio between the mining cost of one unit of GPU and the mining cost of one unit of ASIC is difficult to be calculated exactly. But the security generated by GPU mining must be compromised. After all, getting hardware for GPU mining is really easy.

Case Study: Kraken's Transaction Confirmation Requirements

Surprisingly, even for exchanges, these types of trade settlement rule-setting mistakes can cost them a lot. But from my conversations with them, they don't seem to care much about the mechanism of transaction confirmation. I didn't find much information on how many confirmations an exchange waits for a trade to be settled. But luckily Kraken made their standards public.

I decided to contrast Kraken's transaction confirmation rules with a simple implementation of Lusardi's BitConf, which requires all chains to provide transaction guarantees equivalent to Bitcoin's six confirmations:

image description

-Confirmation time of Kraken processing deposits of various currencies predicted by the data agency Coin Metrics-

The results blew my mind. Depending on how you look at it, either Kraken is extremely strict with Bitcoin transactions, or it is extremely lenient with non-Bitcoin chains. Although Kraken requires 6 block confirmations for Bitcoin transactions before the settlement is complete, it only requires 12 block confirmations for Litecoin (174 should be required for the same security as Bitcoin), and only requires 30 (173 should be required for the same security as Bitcoin), and only 15 are required for Monero (2000 should be required for the same security as Bitcoin).

Of course this is just a very simple implementation of the model. A more complex version should include high security requirements for "non-monopoly chains", GPU-mined coins, and receiving large transactions. I would suggest that exchanges like Kraken that have not yet systematically considered transaction settlement guidelines make some changes. But no matter what standard is chosen, they should require fewer transaction confirmations for Bitcoin and more transactions for other smaller chains.

some key points

What is the practical significance of all this? Although we still need some work to combine these variables into a model that can be used for everyday applications of cryptocurrencies, we can now summarize some key points as follows:

1. The block interval is variable, but the change is small

The only thing that a shortened block interval will affect is when a transaction gets its first confirmation. If you're not that patient, you might prefer a block interval of 2.5 minutes, but that doesn't mean transactions settle faster. As a function of the number of coins issued and the unit price, the cost of bookkeeping is always accumulating at that rate.

For some small transactions, the first confirmation is really useful, because only after your transaction is included in a block and mined, can it be suppressed by subsequent blocks. Moreover, a smaller block interval can reduce the fluctuation of daily issuance. But beyond that, the block interval can be completely arbitrary. For settlement, the security expenditure per unit of time is the key issue besides the accounting cost quality. A smaller block interval just divides the granularity of the security accumulation process into smaller ones. It doesn't make settlement complete any faster.

2. Either Bitcoin is providing too much security, or other blockchains are at risk

This is the most obvious conclusion that can be seen from the various comparisons in this paper. If you just measure blockchain security in terms of the salaries paid to transaction selectors (miners or block validators) per unit of time, then they are very vulnerable compared to Bitcoin in most cases. This can be seen from this chart. Apart from Bitcoin, Ethereum, and Litecoin, hardly any other chains are visible on the chart. This is because they spend so little on security.

image description

- Daily dollar income of mining machines of each currency (7-day moving average), source: Coin Metrics-

So for smaller blockchains, this data doesn't necessarily represent the end of the world. After all, despite Satoshi's rule of six blocks, 1 or 2 blocks is enough for most transactions. This will lighten the heavy load on blockchains trying to catch up to Bitcoin’s security payouts.

3. Settlement is always probabilistic

I promise I get a little pissed off every time a new blockchain brags about the "absolute finality" of their transactions. The real way to get the finality of the transaction is to let an organization guarantee the transaction and effectively support the transaction. But when that happens, sovereigns who want the transaction rolled back (for example, when they suspect criminal activity is involved) will usually ask the guarantor organization to roll back the transaction, poking a bullet at the final state that appears to have been reached. hole out.

Let's use EOS as an example. According to the information provided by EOS Canada, EOS has a concept called Last Irreversible Block (LIB), which means that you can use 100% confidence to believe that the transaction has reached the final state, is fully confirmed and cannot be changed of. If the block height corresponding to a transaction is lower than the block height of the Last Irreversible Block (LIB), it means that the transaction is considered to have reached the final state.

According to EOS Network Monitor, there are 330 blocks ahead of the current LIB block, equivalent to about 2 minutes and 40 seconds. This means that the settlement time claimed by EOS is very short.

But here's a problem. EOS (was?) has a government process through which individuals can apply to the "EOS Core Arbitration Committee (ECAF)" to freeze or return stolen coins. This process effectively reverses transactions that were settled a long time ago. Such a transaction reversal occurred in June 2018. This process was possible at the time because there were only 21 entities (block producers) responsible for processing transactions, and they all had leaders who could be held accountable.

Perhaps many onlookers would give a standing ovation to something like the return of stolen funds, but from a transaction settlement standpoint, it would take away some of the qualities that users value in the blockchain. In practice, any mechanism that enables transaction reversal can be abused. It's because chargeback fraud is rampant that credit cards add some transaction fees to transactions.

There are many other such examples, and here I will only provide this one as an example. In fact, many blockchains will claim that they have a complete and effective method of obtaining transaction finality, but at the same time add methods that can autonomously roll back transactions and freeze accounts in their systems. At this time you still need to consider the possibility of the transaction being reversed, even if it is not explicitly coded into the system.

4. Bitcoin's transparent PoW mechanism discloses its security evaluation model

In contrast, other blockchains hide their security models beneath their complexity through vagueness about their design, or some opaque finality mechanism. For example, the five hash functions that Verge integrated in its proof-of-work mechanism became the last straw that broke the camel's back. An attacker discovered that it was possible to reduce the mining difficulty to 1 by performing a "timing attack" against one of the hash functions. Instead of providing higher security for the system, the complexity introduced brings more attack surface to the system.

Summarize

Here are some key points of the article in my opinion. Don't think of the settlement process of a transaction in the proof-of-work mechanism simply as a function of the number of transaction confirmations, but as a slow process like the petrification of wood. It will proceed at a given rate and cannot be accelerated. This rate is determined by the variables listed above: mainly accounting costs, transaction size and the difficulty of obtaining its mining hardware. Once settled, the wood is completely replaced with minerals and becomes rock-hard instead of soft and malleable as before. The characteristics of this piece of wood will be preserved forever.

Similarly, as Nick Szabo said, the blockchain is amber that can be computed. Amber was born just as tree sap, and then slowly hardened, and some information was stored in the process (such as insect DNA, etc.). This process of burying past changes to the ledger under an unforgeable proof of cost also provides slowly growing guarantees of transaction settlement. As more and more blocks are accumulated, the "gravity" of the blockchain kicks in and makes rewriting transactions from long ago very expensive and cumbersome.

Miners get rewards (source of cost) depending on the number of coins issued, unit price and transaction fees. None of these can be programmed except for distribution. Only a relatively high circulation cannot guarantee security, and investors must pay for the future of this chain and support its value. In this sense, the strong transaction guarantees provided by the proof-of-work system cannot be designed, they can only emerge by themselves. Whether this is a gloomy conclusion depends on how you look at it.

In this article, I try to enumerate the key variables that affect the settlement assurance of blockchain transactions, especially those based on proof-of-work. But you should notice that I didn't provide any formal model and recommended solution. Many of these variables are not easily quantified, and there may be some that I have missed. Maybe the next author after me can provide a more comprehensive, or more implementation-focused model.

开发者

公链

智能合约

ETH

Welcome to Join Odaily Official Community