2

It seems that the rationale behind the proof-of-work requirement in Bitcoin is that it creates trust in a decentralized trustless network by:

  1. helping to reach consensus on which version of the blockchain is the correct one in case that there are multiple temporary competing forks.

  2. making the accepted blockchain computationally immutable (irreversible).

Question: Why is proof-of-work required for creating trust?

If most users are honest, then they would voluntarily enforce the prohibition to rewrite the blockchain.

If most users are dishonest, they can still rewrite the blockchain, even with the proof-of-work requirement, not just by outperforming the honest miners, but even simply by creating a consensus to accept a new fork of the main blockchain as the correct version of the blockchain.

  • 1
    Possible duplicate of Why do we need Proof of Work in bitcoin? – RedGrittyBrick Aug 25 at 20:34
  • 1. The question does not explicitly point to the contradiction in the conventional justification for proof-of-work. 2. The answers given are not logically rigorous. – rapt Aug 25 at 21:00
  • The problem with your hypotheticals is the concept "most users". What does this mean? If it's the number of miners connected to the network, a single person with a computer can launch millions and become the "majority". The purpose of PoW is to define what "most" means in a way that makes the majority very invested in Bitcoin, since they must have a lot of resources dedicated to it. – André Paramés Aug 26 at 9:43
  • The question is: What exactly is a (bitcoin) user. You may think that 1 user is 1 person, but nothing prevent me from creating 100.000.000 bitcoin users. – MTilsted Aug 26 at 12:47
9

Proof of work does not create trust. It creates incentive.

Miners are paid if their block is eventually part of the main version of history ("blockchain") that the network accepts. They must irrecoverably burn electricity in order to create blocks, which costs them money; money they only get paid for if their block "wins".

These factors together mean that miners have a strong incentive to cooperate with other miners, instead of having each try to construct their own version of history, because ultimately only one version will be accepted (ignoring things like intentional forks in the network).

Proof of work is also used for a much more logistical, but equally important purpose: denial of service protection. Because the minimum difficulty for a block scales with the network's hashrate, it is enormously expensive for someone to produce more blocks than (on average) 1 per 10 minutes. Without an objective measure of work like PoW (or central trusted set of parties) anyone could spam the network with an unboundedly large amount of blocks to validate.

4

If most users are honest, then they would voluntarily enforce the prohibition to rewrite the blockchain.

Without proof of work, this is just not possible. There would be no limit to the number of blocks that could be created at about the same time, there could be thousands of them created every minute. Different servers might receive them in different orders. And a server that was down for a day would have no way to know what to accept.

You need some way to agree on which of two or more equally good ways the system can make forward progress will be agreed upon. Proof of work is not the only way to do this, but you need some way.

In addition, there would be no way to do the initial distribution of the bitcoins as they're created.

2

Question: Why is proof-of-work required for creating trust?

If most users are honest, then they would voluntarily enforce the prohibition to rewrite the blockchain.

If everyone was honest, then we wouldn't need a blockchain system at all. We could all just trust one another to remember our account balances, and update them appropriately as we transact with one another throughout the day.

Unfortunately, not everyone is honest, and so we need a system that allows everyone to remain in consensus about the current state of the network (ie the allocation of coins). Creating a system that can do this without trusting some central authority is very difficult, as exemplified by the Byzantine generals problem.

Bitcoin's PoW system provides the incentives for miners to work on extending a single chain (rather than proposing alternate histories), and as others have written here, it crucially provides a mechanism of selecting which miner will add the next block to the network.

If most users are dishonest, they can still rewrite the blockchain, even with the proof-of-work requirement, not just by outperforming the honest miners, but even simply by creating a consensus to accept a new fork of the main blockchain as the correct version of the blockchain.

Based on the comments you have made, I think you have misinterpreted the article you linked to. That article uses very non-rigorous language to explain how the network reaches consensus at a high level, but upon more rigorous inspection it fails to provide a blueprint for an alternative system. '1 user = 1 vote' is a very simplified explanation of how the networks consensus rules are chosen, but it is the miners that must extend the chain according to these rules. A network of regular users (nodes) can all agree to follow some certain set of rules, but they cannot come to consensus on which chain to follow without PoW mining. I believe this is the source of your misunderstanding: the article is not suggesting that the network's nodes can continue to remain in consensus without the miners, it just provides a simplified explanation of how users define the rules which miners must adhere to.

Even if users collectively decide to enforce a new set of consensus rules, they will still require the PoW miners to create a blockchain for them. Without the PoW mining, users will be unable to reach consensus, because there will be no mechanism for agreeing upon which block will be the next block, or for mitigating against DoS attacks.

  • I have so many objections. First, the basic logical outline I've laid out: "If most users are honest, the system works as intended, with or without X. But if most users are dishonest, X cannot prevent them from abusing the system. Hence X is either redundant or useless in terms of ensuring that the system works as intended." Can you poke a hole in this line of reasoning? – rapt Aug 27 at 6:35
  • @rapt I assume X is miners? If so, your first sentence is false: the system does not work as intended, “with or without miners”. Without PoW mining, there is no mechanism for the network to reach consensus about the network’s state. The article you linked to does not suggest otherwise. – chytrik Aug 27 at 6:48
  • Doesn't matter what X is at this point. I laid out a logical proposition. You cannot refute it by showing that the assumption is "incorrect", because it's given. You can only refute it by showing that the assumption does not entail the conclusion. – rapt Aug 27 at 8:10
  • Sorry, but I’m losing sight of how this is relevant to the original question. – chytrik Aug 27 at 8:36
  • 1
    @rapt The proposition is correct assuming the premises are correct. With this X, the premises are correct, thus the proposition is correct. However, your initial X, the proof-of-work, does not fit the premises: if most users are honest, the system still may not work as intended due to the actions of a few malicious users. I'd challenge you to create a bitcoin-like system with no proof-of-work or proof-of-stake that is nonetheless proof from a minority of malicious users. – rytan451 Sep 4 at 1:58
1

Suppose there's a zero proof-of-work cost. i.e., creating a block is free, computationally. (In practice, this is impossible, but please bear with me). If creating a valid block is free, then here's a way to "buy" something without actually spending any Bitcoin:

  1. You buy something using bitcoin. The block recording the transaction is added to the blockchain.
  2. You receive the item.
  3. You mine a lot of blocks on before your transaction. Because this is much longer than the branch containing your transaction, this means that the branch that doesn't contain your transaction becomes the valid branch.

Thus, the transaction log blockchain won't actually contain the transaction where you sent the Bitcoin to buy something.

There are two ways to prevent this sort of attack:

  1. You have an authoritative source that stores the transaction log, thus the new branch won't have been made valid. This method implies centralisation, which is contrary to the goal of a decentralised currency.
  2. You make it infeasible for a single user to generate more blocks than the other users combined, and thus make the transaction log without the attacker losing money the valid log.

Enter proof-of-work. This is an attempt to use method 2 to prevent this attack. The system of users will be generating blocks. This takes a huge amount of processing power. In order to make more blocks than the system of users, the proof-of-work forces you to use more computational power than the rest of the system of users combined.

How about a timestamp?

A timestamp is easily forged. With the above attack, you could create a block with a timestamp before the "lose money" transaction. Then, the attacker could send the Bitcoin elsewhere (another one of his/her wallets), and the next block (the "lose money" transaction) would be invalid because it's saying "Take 0.1 bitcoin from X's empty wallet to give to Y."

Two methods of preventing this from happening:

  1. The timestamp is verified by an authoritative source (which implies centralisation)
  2. The timestamp is only valid if received a fixed (short) time after the timestamp (then the vendor only needs to wait for the required time to elapse, then the block is set in stone and is not in risk of invalidation).

There's a few problems with method 2. First, a blockchain requires all the blocks to be present in memory in order to figure out how much a given wallet contains. When you're reading the block from a log, how would you know if the block was received less that fixed time after the timestamp? The log could be falsified, unless there's an authoritative source or the log takes too much computational power to create by a single malicious user. The latter is guaranteed for any long blockchain with a strong proof-of-work.

New contributor
rytan451 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Welcome friend. I see that much like me, you are quite new here. You are however repeating ideas that others on this page have already detailed. I have answered all of them already in my responses to other answers. I suggest you read them first (most of them are now in separate chat pages). Also read the article I linked to in my original question, if you haven't already. Then reconsider your answer. – rapt yesterday
-2

Proof of work is not required, there are other algorithms such as proof of stake that are still decentralized (though I don't know how it works even though Ethereum wants to use proof of stake mining). The proof of work gives a block a difficulty, saying "there must be at least X zeroes in a block." (X does not have to be an integer, if it did, difficulty could only be adjusted on orders of two, four, or sixteen; right now it is a little above 16.8) This adding zeroes controls the number of problems that can be solved, and is usually on the order of hundreds or (lower) tens of hundreds per day. When there are more miners, the network responds relatively soon by raising difficulty (in less than 2 weeks), and when there are less, it also responds by doing the opposite (in possibly more than 2 weeks). The proof of work is like a lottery, and who solves the problem is randomly selected and is then awarded the prize through the coinbase. Proof of work is basically a verification mechanism that looks at the zeroes in a hash (work) and forces a certain number (minimum) to be zero.

  • 1
    May be a valid answer to the question "How proof-of-work is implemented in Bitcoin?". – rapt Aug 25 at 21:12
  • True, I tried to answer both but I tended towards what you said. – Number File Aug 25 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.