Vitalik: Three key factors for PoS to be superior to PoW
source|vitalik.ca
Author | Vitalik Buterin
source|
Thanks to Chih-Cheng Liang and Hsiao-wei Wang for reviewing this article
Chinese translation
There are three key factors why Proof of Stake (PoS) is superior to Proof of Work (PoW) in terms of blockchain security.
Proof-of-Stake offers greater security at the same cost
The easiest way to understand this is to put Proof of Stake and Proof of Work together. Assuming that there is a block reward of $1 per day, what is the cost of attacking this network.
GPU-Based Proof-of-Work
You can rent GPUs cheaply, so the cost of attacking the network is just renting enough GPU computing power to outnumber existing miners. For every $1 of block reward generated, the cost to existing miners is almost $1 (if the cost is higher than $1, the miner will quit because it is unprofitable, otherwise new miners will join to make a profit). Therefore, the cost of attacking the network only needs to be above $1/day, and probably only for a few hours.
ASIC-Based Proof-of-WorkhereASICs are really a capital cost: when you buy an ASIC you expect it to last about two years as it wears out or is replaced by better performing hardware. If a chain is attacked by 51%, the community will probably change the PoW algorithm to respond, and your ASIC will lose value at this time. On average, mining costs are approximately 1/3 recurring costs and 2/3 capital costs (see
here
). Thus, for every $1 in block rewards, miners spend ~$0.33 per day on electricity and maintenance, and ~$0.67 on their ASICs. Assuming that the ASIC can be used for about 2 years, the miner will need to spend $486.67 for a unit of ASIC hardware.
Annotation: $486.67 = 365 days x 2 x $0.67 capital cost
Total attack cost: $486.67 (ASICs) + $0.08 (power and maintenance) = $486.75Annotation: The power and maintenance costs here are also assumed to last for 6 hours。
Having said that, it is worth noting that the higher security brought about by ASICs (compared to GPUs) comes at the high cost of centralization, so
The threshold for joining ASIC mining is also very high
Proof of stake Proof of stake
The cost of Proof-of-Stake is almost 100% capital cost (collateralized coins); the only operational cost is the cost of running a node. So how much money would people be willing to lock up for every $1 of block rewards per day? Unlike ASICs, the staked currency will not depreciate, and you can get back the pledged deposit within a short period of time when you don't want to stake. Therefore, participants should be willing to pay a higher cost of capital for the same level of incentives than is the case with ASICs.
Let's assume that ~15% rewards are enough to attract people to stake (this is the desired reward for eth2). So a block reward of $1 per day would attract a stake equivalent to 6.667 annual rewards, or $2,433. The cost of hardware and electricity consumed by the nodes is very small, and every thousand yuan of computers can mortgage thousands of assets, and the electricity and network fees of ~$100 per month are also sufficient. But to be conservative, let's assume these recurring costs are ~10% of the total cost of staking. So we only have a block reward of $0.90 per day corresponding to the cost of capital, so we have to reduce the above number by ~10%.
Annotation: 6.667 years = $1 / (15% annual remuneration); $2,433 = $1/day x 365 x 6.667
Total attack cost: $0.90/day * 6.667 years = $2,189In the long run, this cost of attack is expected to be higher as staking becomes more efficient and lower reward rates are more acceptable. I personally expect that number to eventually climb to the $10,000 mark.。
The only "price" to achieve such a high level of security is that it is inconvenient to transfer the deposit at will during the pledge period. It is even possible that the total amount of currency in circulation in the community, or funds that can be used for productive investment, can remain unchanged because people realize that these locked coins will cause the value of coins to increase. In contrast to PoW, the "cost" of maintaining consensus is
crazy power consumption
More security or lower cost?
Note that there are two ways we can apply this 5-20x increase in safety per unit cost. One way is for the block reward to maintain the status quo and benefit from increased security. Another way is to maintain the current level of security and reduce block rewards by a large amount (that is, to reduce the "waste" of consensus mechanism costs).
Either way will work. I personally prefer the latter, because as we'll see below, a successful attack can do less damage in Proof-of-Stake than in Proof-of-Work, and it's easier to recover from it.
Proof-of-Stake is easier to recover from attacks
In a proof-of-work system, what would you do if your chain suffered a 51% attack? So far, the only practical response has been to "wait until the attacker gets bored". But this ignores a more dangerous attack called "spawn camping attack", where the attacker can attack the chain again, with the explicit goal of making the chain unusable.
Annotation: Ambush at the respawn point is a game term. It is an ambush at the place where the opponent player is killed and reborn, causing the opponent player to die again as soon as he is reborn, without the ability to fight back.
GPU-based systems are completely defenseless, and persistent attackers can easily render a chain permanently useless (or, more practically, move to proof-of-stake or proof-of-authority). In fact, in the first few days after the attack begins, the cost of the attacker will become very low, and the honest miners will leave because they have no way to obtain block rewards under the continuous attack.
In an ASIC-based system, the community has the means to deal with the first wave of attacks, but subsequent attacks are made easy. After the first wave of attacks, the community can hard fork to replace the proof-of-work algorithm, that is, "brick" all ASICs (including ASICs of attackers and honest miners). But if the attacker is willing to bear the cost of bricking his own ASIC, then the situation is the same as that of the GPU (because there is not enough time to manufacture and produce ASIC for the new algorithm), so after that the attacker can cheaply Continuous respawn point ambush attack.Annotation: Brick is a slang term for electronic products, which means that it cannot be used after damage, like a brickIn the case of Proof of Stake, the situation becomes very bright. For some kinds of 51% attacks (especially those who want to overturn the finalized blocks), proof of stake
Consensus is built in
The "slashing" mechanism of , a large proportion of the attacker's stake will be destroyed automatically (and will not destroy other people's stake). For other types of attacks that are more difficult to detect (especially 51% collusion to intercept other people's information), the community can coordinate a "minority user-activated soft fork (UASF)", which can destroy a large number of Attacker's funds (in Ethereum, this can be done by "passively punishing inactivity leak"). No "hard fork to remove currency" action is required. Except that UASF needs to manually coordinate which few blocks to choose, the rest of the things are automated, as long as they follow the rules of the agreement.
Annotation: A minority block is a block decided by verifiers with less than 51% of the total mortgage
Thus, the first attack on the chain can cost the attacker millions of dollars, and the community can be on its feet in a matter of days. The second attack would still cost the attacker millions of dollars as they would need to buy new coins to replace the old burned coins. Hit it a third time, and burn more millions of dollars. The situation is extremely asymmetrical, and the advantage will not be with the attacker.
Proof of Stake is more decentralized than ASICs
GPU-based proof-of-work is reasonably decentralized, since GPUs are not too difficult to obtain. But as mentioned earlier, it is difficult for GPU-based mining to meet the criterion of "security under attack". ASIC-based mining, on the other hand, requires millions of dollars in capital (and if you bought your ASIC, most of the time, the manufacturer will take advantage of it)
This capital threshold will be the answer to the common argument that “Proof of Stake means the rich get richer”: ASIC mining also means that the rich get richer, and in this situation, the rich have an advantage. The minimum stake threshold for Proof of Stake is relatively low, and many ordinary people have more opportunities to enter.
Annotation: Judging from the current price of 440 USD/ETH when the article is completed, the minimum mortgage threshold is about 93,000 RMB.
Further, proof of stake is more resistant to censorship. GPU mining and ASIC mining are easy to detect, they require a lot of power consumption, expensive hardware purchases, and large factories. Proof-of-stake, on the other hand, can run on a humble laptop, or even over a VPN.
Potential Proof-of-Work Advantages
I think there are two main advantages of PoW, but these advantages are actually quite restrictive.
Proof of Stake is more like a "closed system" and wealth is more concentrated in the long run
In Proof of Stake, if you have some coins, you can stake those coins and get more coins of the same kind. Whereas in Proof of Work, you can always get more coins, but you need some external resources to do so. Therefore, one would expect the distribution of proof-of-stake coins to be more concentrated in the long run.
My response is that in PoS, rewards will generally be low (and therefore validators will be less profitable). On eth2, we expect validators to earn an annualized rate of return equivalent to ~0.5-2% of the total ETH supply. And the more validators mortgage, the lower the interest rate. Thus, it may take a century for the overall concentration of assets to double, and over that time span, other distributive pressures (people wanting to spend what they have, distribute assets to charity or their own descendants, etc.) comparison is likely to prevail.Proof of Stake requires "weak subjectivity" while Proof of Work does notSee this for the concept of "weak subjectivity"
original introduction
. Essentially, when a node goes online for the first time, or goes online again after being offline for a long time (several months), the node must use third-party resources to determine where the correct chain head is. This third party can be their friend, an exchange or a blockchain browser, or the client developer itself, or other roles. PoW has no such requirement.
But even if these risks eventually materialize, for me the benefits of the PoS system still outweigh the disadvantages: greater efficiency, greater ability to respond to and recover from attacks.
Disclaimer: ECN's translation work aims to deliver high-quality information and learning resources for the Chinese Ethereum community. The copyright of the article belongs to the original author. Reprints must indicate the source of the original text and ethereum.cn. For long-term reprints, please contact ethereumcn@gmail.com Authorize.
Reference source: My previous article on Proof of Stake
