Proof of work - lottery approach

Question

I'm sure I am missing something here. But not sure what ...

Proof of work - after all is said and done, when a hash is found (about 10 min), it is said to be like someone hitting the lottery. Anyone that wins the lottery should be able to prove that a cost was incurred. So there are two things:

1. Include a cost to finding the hash.
2. The winner is considered "random" because finding the hash is an iterative guessing process.

The result is a huge energy burn and the result "mimics" a random winner.

QUESTION: Can the bitcoin network randomly select a subset of the existing nodes, for each block, who then compete to solve the hash? For example, if there are 100,000 nodes, the network randomly selects 10% or 10,000 nodes who are allowed to compete to find the hash. Or take it to a smaller number like 1% or 1,000 nodes, etc.

The burning question is: Why can we not mimic the proof of work process and save a ton of energy along the way?

Why not have all the nodes that wish to enter each block lottery pay a small fee. They all currently incur electricity cost so from a financial standpoint, does it matter whether they pay a small lottery fee or pay a small fee to the electric company?

EXAMPLE: for the next block, here is the process:

1. All 100,000 nodes pay (arbitrary number for now to make point) 1000 satoshis.
2. The bitcoin network randomly (maybe this is tricky part) selects a subset percentage. Say 10% or 10,000 nodes. These are the nodes that compete for the next block entry.

BENEFITS:

1. There is still a cost incurred by each participant without the energy usage.
2. The energy usage is now a fraction of the total network participation for the iterative hash search.
3. It can allow more node participation by less powerful computers. A laptop will still be at a disadvantage, but is now competing against 9,999 other computers instead of the hashing power of the entire network.

To make sense of this is the fact that the end result of the current process is a "random" winner that can prove a cost has been incurred.

Can the lottery fee approach achieve the same goal without sacrificing security?

Answer 1

There's a lot going, but I'll do my best.

QUESTION: Can the bitcoin network randomly select a subset of the existing nodes, for each block, who then compete to solve the hash?

Selecting a subset of existing nodes isn't easy as it seems. The vast majority of bitcoin nodes aren't reachable at all, in fact. That's why every website that counts those are different from each other. (The best probably being Luke Dashjr's one).

So you might: "Well, you could make it so that in order to participate you have to public announce your node". But that opens up (from the top of my head) a big attack vector: DDoS's. If every node participating in the consensus is known and reachable then you could hit them once they are selected and cause a network failure.

But that's not even the most important part: This approach would be extremely easy to gamble. Any person could run thousands or millions of nodes (Amazon Web Service has 1 million business customers) and change the odds to their favor.

Proof-of-Work is not a consensus algorithm, but rather an Anti-Sybil protocol. Sybil being the attack that I described in the last paragraph.

Can the lottery fee approach achieve the same goal without sacrificing security?

Absolutely and 100% no, if you take "without sacrificing security" serious. And (1) I'm not sure if it can be done at all or (2) if it would work, but regardless: no.

The result is a huge energy burn

This is a little off-topic but I feel that might be worth commenting. Bitcoin energy usage is far from "deadly" or something like that. Most researches point to +70% use of renewable energy in the industry, highest than any other.

Answer 2

QUESTION: Can the bitcoin network randomly select a subset of the existing nodes, for each block, who then compete to solve the hash?

No.

Consider this: if there were a way to fairly and reliably 'select a subset of miners', then why not just select a single miner, and allow them to create the next block without any PoW energy expenditure? Why even have the mining process at all? Well... the answer is that it is very hard to randomly elect a peer in a distributed network, in a provably 'fair' way that is not game-able. And so we have slightly contrived solutions, like Bitcoin's PoW process.

---

First of all, there is the problem of how to randomly select a subset of nodes, in a way that isn't game-able. Whats to stop me from just running/spoofing 1 million nodes? Stopping sybil attacks is not trivial in a network like this.

Further, what is the definition of a 'selected node'? Is it a mining pool? An actual network node? An individual? A single ASIC mining rig? Even if you decide on a definition, how on earth would you enforce it? Having some sort of registry is antithetical to Bitcoin's design. Some of the above definitions may also create a trend towards miner centralization, which is bad for maintaining censorship resistance.

But lets just imagine that there is a technical solution, that allows a perfectly fair selection process that maps nodes 1:1 to 'actual miners'. In that case, if my node weren't selected for a mining round, then I would still have a few options: rent my hashing power out to a node that was selected (as @Nate Eldridge suggested), or just continue mining, and if I find a valid block, I sell it to a node that was selected, so that they can publish it to the network. In both examples, the network's energy usage hasn't diminished, but rather it has likely increased, due to the increased friction of participation.

BENEFITS: There is still a cost incurred by each participant without the energy usage.

Downside: this doesn't actually solve the issue of a Sybil attack, it just makes a sybil attack more expensive to pull off, and generally we want to avoid any game theoretical situations that favour one user over another for extrinsic economic reasons.

The energy usage is now a fraction of the total network participation for the iterative hash search.

This is false, as mentioned we should expect rational miners to rent their hashpower out to one another, etc.

It can allow more node participation by less powerful computers. A laptop will still be at a disadvantage, but is now competing against 9,999 other computers instead of the hashing power of the entire network.

This is false, a laptop would still be useless, especially considering the ability of miners to rent out hashpower, etc.

---

This question seems to stem from the narrative that "Bitcoin mining uses energy and that is bad!", but this narrative ignores the fact that the benefits of Bitcoin are perhaps worth the costs of running the system. Security cannot be faked, and PoW offers what is perhaps the most efficient and transparent method of creating security for a decentralized network in this regard.

Answer 3

Your suggestion 'proof of lottery win' replaces one of the features of bitcoin, but there are other security features which are provided by proof of work.

To be the next node to certify a block you need to be lucky to hit the right hash, but you also need to expend an awful lot of work to find it. The next block after that has a lot of work invested in it too, and so forth up the chain of blocks.

If you want to start an 'alternative history attack' where you go back in time down the block chain to when you had heaps of bitcoin and fork off a new block in front of that block and start processing transactions, with the objective being to get longer than the existing blockchain so that you can claim it as the authoritative ledger, then you are going to struggle under the proof of work algorithm because you will need a lot of colluding cpu's to catch up to the existing chain.

With proof of lottery - you would be able to re run the lottery on a historical block of your choosing (very quickly as there is no proof of work component) - if the winner of the corrupt lottery did not comply for whatever reason you could re run the lottery on that block again until you found a corrupt accomplice and continue this process up the chain until you had the authoritative ledger.

Your suggestion would work in reducing cpu cycles, and would replace the 'next person picked at random' feature, however there would be another set of issues that you would need to consider to make this fly.