Minting with constant per-block reward

General
21

[quote=“irigi, post:20, topic:2424”][quote=“sigmike, post:19, topic:2424”]The “nothing at stake” problem appears when there’s a fork of the network. Since you don’t consume anything while you mint, when you find a new block you can propagate it on all forks. If a lot of people do that then reaching a consensus on the main chain takes more time.

It becomes much easier to double spend because everyone minting on all forks basically helps you doing that. So the more people doing that, the more confirmations we need to be certain to reach a consensus. And if everybody mints on all chains the coin is dead because there’s no consensus at all.[/quote]
Thanks. What does the current protocol do to prevent that? Is this the reason to hold the coins of a stake that just successfully minted for some time? Is it any different for the constant per-block reward protocol?[/quote]

To prevent that the protocol rejects a block if the stake has already been seen in another block.
So if you mint on 2 chains the other nodes will only accept one of your blocks.
If a part of the network accepted one block while the other part accepted the other one, then the network is split. Some nodes will mint (and mine) on top of one of your blocks while the others will mint on the other block. The first new block that comes will decide which is the main chain (unless it’s also a double mint in which case to problem continues).
So if you mint on all chains, at first only one block will be accepted by the network. But if the other chain ever becomes the main chain, your other block will still be accepted.
There was a discussion about that here: http://www.peercointalk.org/index.php?topic=1956.0

Right now the only thing you gain by doing that is variance reduction and compounds interests.
If the reward becomes constant then the gain becomes the reward amount.

22

The “nothing at stake” problem appears when there’s a fork of the network. Since you don’t consume anything while you mint, when you find a new block you can propagate it on all forks. If a lot of people do that then reaching a consensus on the main chain takes more time.

It becomes much easier to double spend because everyone minting on all forks basically helps you doing that. So the more people doing that, the more confirmations we need to be certain to reach a consensus. And if everybody mints on all chains the coin is dead because there’s no consensus at all.[/quote]

You do have to use resources while you mint. If you want to follow 100 forks you would need 100 blockchains and 100x times more packages exchanged over network. Because of that people are following only chain with biggest weight. And more important, value is only in biggest chain, similar to bitcoin if somebody launch bitcoin clone it will not be important as main chain even if it is same protocol.

All people would mint on top of main chain and some could also mint on smaller forks.
I understand the problem but to me forks with smaller weight are like new clones and it would be impossible for smaller fork to take over main chain like it is impossible for alt-coin to takeover bitcoin if they are pure clone.

23

Thank you for this great reference. I am no expert in cryptography, but I understood that there is still unresolved problem related to the all forks minting. Under current system, we rely on fact that the incentive to do that is just the compound interest, which is negligible, while in the constant per-block chain, it could be much more serious. Correct? This could be major argument against adoption of the constant per-block reward system. (And it would actually mean that POS is weaker than I thought it was.) I hope Sunny King knows some way how to avoid the problem, if he was talking about the possibility of adoption of constant per block reward system. He should probably let us know what is his proposed solution before this issue can be properly discussed by the community. I will add it to the list of potential problem.

Compared to POW mining, the POS minting is very cheap. In constant per block reward, it could very easily be much cheaper to store 100 blockchains and run the minters compared to expected reward. (Moreover, you can use the same mint for every of the competing blockchains, if you can propagate them through the network. So you don’t even need more minting machines.) If 1 PPC = $1000, for example, the block reward is 4 PPC, one extra block pays most of your expenses for a long time.

Sure, but during the minting, it is not clear which chain will the longest at the end. Let’s say there is 50 competing forks with some common history. Each of them can happen to be the longest in future (with certain probability according to their length). So it can be beneficial for you to mint on all of them just in case some of the smaller chains would become the longest in the future…

24

Sure, but during the minting, it is not clear which chain will the longest at the end. Let’s say there is 50 competing forks with some common history. Each of them can happen to be the longest in future (with certain probability according to their length). So it can be beneficial for you to mint on all of them just in case some of the smaller chains would become the longest in the future…[/quote]

Well if there is a need for somebody to have 50 or 5000 forks I don’t see problem with it. Just like if somebody would want to have bitcoin1, bitcoin2, bitcoin3… At the end only one can really survive. If fork ever gets bigger then main chain then it is double-spend attack. But for that to happen it would require 100% minting power just as main chain, everybody would have to mint alt-chain. I don’t know if there is enough incentive for everybody to do that but I have to say I didn’t really thought about this scenario…

25

I am not sure if you use the word fork in the same meaning as I do. Fork is not completely alternative blockchain with different starting block, i.e. peercoin1, peercoin2, etc. Time to time, there appears orphaned block. Let’s say that the blockchain looks like this:

b1->b2->…b100000->b100001

and now two blocks are found by the network, A1 and B1. For a moment, there are two blockchains:
b1->b2->…b100000->b100001->A1
b1->b2->…b100000->b100001->B1

Decent client decides (I think) according to total coinage, which blockchain of these is the longest and ads its mint X to it. Let’s say it is the first one, since StakeCoinage(A1) > StakeCoinage(B1). The decent client extends only one blockchain:

b1->b2->…b100000->b100001->A1->X
b1->b2->…b100000->b100001->B1

It considers the other block, B1, orphaned.

Indecent client will try to extend both, since it has nothing to lose, only gain, since it doesn’t know for sure which one of these will be the longest at the end. So when it finds stake Y, it will broadcast

b1->b2->…b100000->b100001->A1->Y
b1->b2->…b100000->b100001->B1->Y

and both blockchains, called forks, grow. Decent clients are programmed to refuse Y on more than one blockchain, so the indecent client cannot easily broadcast Y everywhere. But if there is more indecent clients, it might be beneficial to them to broadcast block Y on all forks for other indecent clients. (The reason, as I understand it, that while Y on more blockchains will be refused by decent clients, combination Y->Z, where Y and Z are from different clients, will not be refused, so the indecent clients can help each other to mint on all forks.)

I am sure I am wrong in some detail, since I do not quite understand it myself, but hopefully this explains it a bit.

26

Yea I understand what you are saying but I think it’s the same thing.

Only difference in my opinion would be that “forks” have common genesis block and clones have their own genesis, but other then that it’s the same thing.

If bitcoin would fork now and if both chains are accepted by community then they would have to be renamed as bitcoin and bitcoin_fork or bitcoin1 and bitcoin2 etc.

27

Also if people start doing this and are successful in doing so, people will loose faith in PoS and the value of the coin drop. So basically what you would have to do is to buy many coins, use them to attack the network and them sell them very quickly before the value crashes; perhaps by succeeding with a double spend to an exchange. If the exchange fail to accept your coins, you might loose money because of your own dirty deed.

Probably one would do this kind of thing to attack the network, willing to sacrifice the coins it will cost, because one thinks its simply worth it to crash the market value of the coin. War costs money, so it wouldn’t be a first.

I’m to ignorant to know how big this risk is though. Is it a bigger risk, then having 3-5 big Bitcoin mining pools and the risk of them being compromised by the military?

28

[quote=“irigi, post:25, topic:2424”]Indecent client will try to extend both, since it has nothing to lose, only gain, since it doesn’t know for sure which one of these will be the longest at the end. So when it finds stake Y, it will broadcast

b1->b2->…b100000->b100001->A1->Y
b1->b2->…b100000->b100001->B1->Y

and both blockchains, called forks, grow. Decent clients are programmed to refuse Y on more than one blockchain, so the indecent client cannot easily broadcast Y everywhere. But if there is more indecent clients, it might be beneficial to them to broadcast block Y on all forks for other indecent clients.[/quote]

I followed that scenario a couple of steps further and posted some thoughts here http://www.peercointalk.org/index.php?topic=2743.msg24350#msg24350 .

It does seem that the concurrent minters will face resource limitation, be forced to drop some alt-chains (“forks” above), and get into tricky competing situations among themselves. But I didn’t have a solid conclusion mainly because it become difficult to get my head around it :puke: A simulation may help.

29

That’s what I think yes.

I made a proposal on the cold minting thread that may remove the incentive though: when we receive a block with an already seen stake, we reject both blocks instead of only the second one. That means we move the blockchain one block backward.
We would still accept the block if the new main chain depends on it.

30

The indecent minter does not need both forks to be accepted by the community. He knows that only one of them will be accepted, he just doesn’t want to risk not having his mint block in the victorious chain, so he tries all reasonable forks.

There is conflict of interest between long-term prosperity of the currency and short-term gain. When only few people do all forks minting, it will probably not cause many troubles and the currency doesn’t have to lose its value immediately - people will not even notice. The first indecent minters benefit from it. Only later, when this behavior spreads, the currency would lose value, but then nobody can easily stop it, since it doesn’t depend only on one person.

It might also depend on size of the investment. Investor who has 100,000 PPC and intends to keep them will very likely not risk destabilizing the currency by all forks minting. He has not that much to gain, but a lot to lose. On the other hand, for someone who has 20 PPC, this is only handy nice lottery and he would be tempted to try all forks minting. He has not much to lose, after all, and he does not have almost any impact. (It doesn’t depend on him whether the network will be damaged by the all forks minting by many users - typical tragedy of commons.) But there is many small-stakers and this behavior can spread and become security problem.

[quote=“mhps, post:28, topic:2424”]I followed that scenario a couple of steps further and posted some thoughts here Cryptoblog - notícias sobre bitcoin e criptomoedas! .

It does seem that the concurrent minters will face resource limitation, be forced to drop some alt-chains (“forks” above), and get into tricky competing situations among themselves. But I didn’t have a solid conclusion mainly because it become difficult to get my head around it :puke: A simulation may help.[/quote]
I am almost sure they would be dropping old altchains (forks). As soon as the altchain is sufficiently behind the main chain is size, there is no point in keeping it. But already the competition of few longest chains will cause many orphaned transactions. Moreover, it turns POS into POW and the energy efficiency of POS is lost. (Only partially, of course, but still.) Personally, it doesn’t seem to me to be such a terrible security thread (someone was mentioning that “there will be no consensus at all” - I don’t think it would be that bad), but it is still thing we would probably like to avoid or take some reliable measures against.

[quote=“sigmike, post:29, topic:2424”]I made a proposal on the cold minting thread that may remove the incentive though: when we receive a block with an already seen stake, we reject both blocks instead of only the second one. That means we move the blockchain one block backward.
We would still accept the block if the new main chain depends on it.[/quote]
This is very interesting. I will think about it and I will get back to it.

31

Agreed, size does matter. :pbjt:

32

I am cross-linking to topic in which I propose alternative, which is very similar to constant per-block reward for big stake-holders and in which small stake-holders have no incentive to mint on all forks:

33

That’s what I think yes.

I made a proposal on the cold minting thread that may remove the incentive though: when we receive a block with an already seen stake, we reject both blocks instead of only the second one. That means we move the blockchain one block backward.
We would still accept the block if the new main chain depends on it.[/quote]

Interesting idea. I think it deserves investigation. irigi’s capping proposal has some merits as well.

34

[quote=“Sunny King, post:33, topic:2424”][quote=“sigmike, post:29, topic:2424”]I made a proposal on the cold minting thread that may remove the incentive though: when we receive a block with an already seen stake, we reject both blocks instead of only the second one. That means we move the blockchain one block backward.
We would still accept the block if the new main chain depends on it.[/quote]

Interesting idea. I think it deserves investigation. irigi’s capping proposal has some merits as well.[/quote]

Another less radical option is reducing the POS reward if a coin owner doesn’t mint often. Minting frequency can be measured with various levels accuracy. The reduced amount of reward can be distributed to the next block in order not to disturb the economy.