9

I've seen many broad overviews of proof-of-stake mining, and descriptions, but I have not seen any good description of what goes into actually mining and verifying a proof-of-stake block, and how it accomplishes what people say. What are the technical details of this?

  • 1
    Since the accepted answer is by the asker themselves, and there is no text-book to claim in a new field, please consider the answer with a grain of salt. The PoS as described in the answer is not decentralised. – skang404 Feb 17 '18 at 0:52
13

Proof-of-stake mining is similar to Proof-of-work at a technical level. It involves a sort of lottery, similar to proof-of-work, but the difficult of this lottery is weighted depending on how many coins you are staking. The overall process for "attempting" to mine a PoS block is like so:

  1. Add a coinbase transaction, and a staking transaction (in most coins, must be hardcoded as the second transaction)
  2. Prepare block normally, with transactions from network etc
  3. Compute the PoS "kernel"
  4. Compute the "staking difficulty", which is the base difficulty, reduced by a ratio of how many coins you are staking (or in PoS version 1.0's case, the coinage of your coins)
  5. Compare the kernel's hash against the staking difficulty
  6. If the hash meets the difficulty then continue, otherwise go back to step 1 trying other UTXOs in your wallet that are suitable for staking
  7. Now you have a valid PoS block. The final step is to sign the block header, proving that you own the staking transaction from step 1.

Now I'll try to go into a bit more depth.

First, the staking transaction is a special transaction that is not possible on the normal Bitcoin blockchain. It includes the concept of negative fees. Because all stakers know the reward, they add this reward to this transaction, meaning that there are more output coins than input coins. This kind of transaction is only valid in a staking context.

Next, the PoS kernel. This is a bit complicated, but the important part is that nothing in it can be easily changed in the context of this block. In the case of blackcoin, the kernel consists of "stake modifier"(I'll explain that in a bit), current block's timestamp, and data from the "txPrev". The txPrev is the transaction of the output which is spent by the staking transaction(ie, the input to the staking transaction). The data pulled from the txPrev includes blocktime, transaction time, hash, and output number (vout 'n').

Because the txPrev data has already been confirmed in the blockchain, it is immutable. The only piece of data that is mutable is the current blocktime. The current blocktime in PoS coins is actually masked though (ie, the bottom bits are set to 0), so that there is very little entropy that can be had by making minor modifications to it. And the blocktime can not be beyond certain network drift limits, or not all nodes will accept the block. Finally the stake modifier is a value generated by taking some entropy bits from the previous (iirc) 64 blocks and hashing it together to form a relatively random number. It's primary purpose is to make computing future block's (beyond the next block) kernel difficult.

Finally, all the data for the kernel is hashed together. The staking difficulty is computed simply. It takes the standard difficulty from Bitcoin, but makes it so that this difficulty is for 1 coin. If you stake 2 coins, then it's only half the difficulty. For 4 coins only a quarter of the difficulty, etc. There are some restrictions to this. In order to prevent someone from being able to control the network for a chain of blocks with a large number of coins, there is a limit to the amount of staking coins, and thus there is a limit on how much the base difficulty can be reduced by.

Finally, a signature is made, proving that the staking transaction actually belongs to the person creating this block. The signature itself goes into the blockheader so that the signature is part of the blockhash.

All of this put together causes the following effects:

  1. PoS block "mining" does involve hashing and difficulty like PoW, but there are very few mechanisms to change the hash that is given, and so no matter how much computing power you have, it won't help any
  2. The stake modifier prevents predicting which block you will be able to successfully stake, because it adds a lot of uncontrollable entropy to the kernel hash
  3. The more coins you stake, the better chance you have at successfully creating a block, because of the weighted difficulty
  4. In case the network gets stuck due to a sudden drop in the number of people staking, the low-entropy version of the blocktime will eventually allow new kernel hashes to be generated given enough time, giving stakers left on the network a chance to have a successful PoS block

I published this in a blog post, but figured it would fit the QA format of here well and help more people when searching for this answer

  • Each wallet may contain many addresses. Does this mean your wallet has to be online for PoS to work? How else can you calculate how many coins you're holding? If your wallet is not online, then you can't earn the PoS reward? – Sun Dec 2 '17 at 0:29
  • How many hashes per UTXO is a node allowed to make? Is only 1 accepted per block, or is it any amount, except that because the block time is used, an effective lower bound is one hash per second (more frequent would merely create duplicate hashes)? – Scalextrix Mar 19 '18 at 18:09
  • How is scriptsig.size() determined I am wondering why It is required to be between 2 and 100 as in this code if (IsCoinBase()) { if (vin[0].scriptSig.size() < 2 || vin[0].scriptSig.size() > 100) return error("CTransaction::CheckTransaction() : coinbase script size"); } else { foreach(const CTxIn& txin, vin) if (txin.prevout.IsNull()) return error("CTransaction::CheckTransaction() : prevout is null"); } – Tim Baker Apr 30 '18 at 4:52
  • @Sun in the version of PoS I described, it is required to keep your node online to make blocks and thus get the stake reward – Earlz Dec 5 '18 at 5:02
  • @Scalextrix a node is allowed to make near infinite UTXOs. For each block period (16 seconds for blackcoin and Qtum) each UTXO can make 1 hash which can be compared to the difficulty – Earlz Dec 5 '18 at 5:02
1

Here are some closely related observations on the topic that might help other newbies like me to understand PoS. I spend a couple of hours trying to put things together and to be honest coming from the PoW background it was quite difficult to really grasp why PoS works the way it does. Especially difficult to understand was how does PoS prevent gaining benefits from having more available CPU power. The answer to this question is quite simple: PoS does NOT benefit from having more hash power since the inputs to the hash functions are quite "static" and therefore the output of the hash function within a given time frame is always the same. To clarify, in PoW the input to the hash function includes a nonce and also the tx's data. These inputs are constantly changing and therefore having more CPU power allows trying more combinations that will hopefully lead to generating a valid block hash. With PoS since all inputs remain the same (only the timestamp changes at regular intervals), having more CPU power does not help the miner because the result of running the hash function with the same inputs will generate the same output hash. The only thing that can be done to increase the impact of CPU is to increase the number of UTXO's that a wallet owns by splitting larger UTXO denominations into smaller ones. However, this will lead to a higher difficulty to generate a valid hash. Here are two diagrams that I drew that represent the correlation between the number of UTXO's per wallet, the individual balance of each UTXO, the number of "mining" iterations and consequently the CPU cycles.

Diagram 1 (Increasing the number of UTXO's leads to slower probability for generating a valid block hash):

enter image description here

Diagram 2 (Keeping the number of UTXO's small but with higher denominations per single UTXO increases the probability for generating a valid block hash):

enter image description here

Both diagrams represent the same correlation between the number of UTXO's per wallet and the probability to calculate a valid hash. In Proof-of-Stake the idea is to use the wallet balance as a variable in the calculation of the block difficulty. An example formula for making this calculation could be the one below: enter image description here

Using that formula, the correlations presented in Diagrams 1 and 2 could be interpreted as follows:

If the validator (miner) tries to split his UTXO's into smaller denominations and thus increasing the number of UTXO's that the wallet has, the difficulty of calculating a new hash increases. The reason for this is that the balance of each individual UTXO(i) will be smaller, thus balance(UTXO(i)) / difficulty will be a really small number and it will be harder to generate a valid hash.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.