Taking the simple case of Bitcoin here:

If all nodes can validate published transactions by checking the signature (created using the private key of the sender) of the transaction against the public key of the sender, why isn't that sufficient to validate a block?

I understand that we also solve the puzzle of finding a nonce that when combined with a block's contents, gives us a hash that has N number of leading zeroes. Why do we need this at all? Isn't it enough to check the validity of each transaction in the block?

As for double spending, if a miner decides erroneously to include both transactions, nodes can see there isn't enough balance and reject such blocks. As for which transaction of the two to take, the code could have a way to order transactions and if an attacker decides to do the opposite intentionally and decides to spam the network (since there's no proof of work cost) but how does the attacker benefit from that?


the code could have a way to order transactions and if an attacker decides to do the opposite intentionally and decides to spam the network

This is the crux of the issue: how do you achieve this? It isn't a trivial problem to solve in a decentralized network. The more generalized version of this non-trivial problem is called the Byzantine General's Problem, it describes the ability of participants to come to an agreement in an untrusted network. The invention of bitcoin provides an economically-incentivized game-theoretic framework that could be considered a probabilist solution to this problem. As @PieterWuille mentioned in the comments, there is no absolute guarantee of eventual consistency: there is only a (continually increasing, thus far) economic incentive for participants to consider.

The solution that proof of work provides is to rate-limit spamming via the requirement for expenditure of a scarce resource: energy. It is hard to create a new block (it takes some amount of energy, on average), but it is easy to verify if a block is valid. And remember that the method for choosing the next valid block must be perfectly consistent across all nodes in the network, or else you risk a network split/fork, which is very undesirable.

but how does the attacker benefit from that?

There are many ways an attacker could benefit. As a simple example: the attacker takes a 'short' financial position, betting against the price of bitcoin. They then attack the network, assumedly causing the network's value to drop, and thus they would profit from their short position.

  • just to add to your answer, split chain can still happen in PoW by honest miners and we fix this by taking the longer chain. So it seems like the main benefit of PoW is to solve transaction order problem (called "double spending"), is there any other benefit? – SpaceMonkey Apr 2 at 23:06
  • @SpaceMonkey I added a bit more to my answer. Chain splits can indeed happen, proof of work helps to guarantee an eventual consensus. The few blocks at the chain tip would not be considered as secure as much older blocks in the same chain. – chytrik Apr 2 at 23:09
  • Proof of work is not eventually consistent, at least if you mean the technical term from distributed systems - that would imply that after a finite amount of time a certain state is irreversibly agreed upon by all participants. Under PoW, there is always a chance of reorganization, regardless of how deep it is buried. What PoW adds is an incentive for miners to cooperate on a single chain rather than work against each other, and under certain economic assumptions, that means the chance of reorgs goes down exponentially as time passes - but it still never becomes zero. – Pieter Wuille Apr 2 at 23:13
  • @PieterWuille what is the incentive for miners to cooperate on a single chain? if miners receive transactions in different orders and create a split chain, what is the incentive for one group of miners to discard their version of the chain and adopt the other one? – SpaceMonkey Apr 2 at 23:43
  • Only the subsidy/fee income miners receiving in the winning chain matters. If miners build competing chains, only one of those will win. – Pieter Wuille Apr 2 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.