Why doesn't Bitcoin migrate to proof-of-stake?

Question

After reading a little bit about different consensus algorithms, I am just trying to understand why Bitcoin still uses proof-of-work. This consensus algorithm being exponentially expensive, and resource intensive, doesn't it make more sense for Bitcoin --the most expensive cryptocurrency out there-- to migrate to proof-of-stake?

Currently, Bitcoin transactions are so expensive that day-to-day transactions, like buying a cup of coffee, can be more expensive than the good/service itself in some parts of the world, which fails to deliver one of the original goals of Bitcoin. That is to be the common person's every-day money.

Why does Bitcoin stick to the proof-of-work consensus algorithm?

Answer 1

Proof of Stake is basically a case of having your cake and eating it, too.

PoW is a simple work-around to a coordination problem that was previously thought to be unsolvable. It sort of "cheats" by providing an economic solution to a distributed systems challenge, by introducing a real cost as a disincentive to unwanted behavior as well as using a reward system both to bootstrap itself and to incentivize security. The advantages of Bitcoin's PoW system include that the group of block authors is truly open to anyone with computational resources, that the system converges on one ground-truth because there is a real cost in producing a competing chaintip, and that it is simple enough for its security model to be well understood.

PoS is more similar to the approaches that were pursued before the publication of Bitcoin. PoS is naturally divergent as there is no real cost in staking. The "Nothing at Stake problem" allows stakers to work on multiple chaintips and only publish the next block from the chain most favorable to them. There are different ways of approaching the vastly different security model of PoS.

_{Source: Bram Cohen describing ETH's PoS research}

For example, ETH's effort to switch to PoS has been in research since at least 2015. The latest I've read, ETH's current PoS proposal piles multiple layers of complexity on top of the staking to achieve convergence. Stakers have to register as "Validators" of which there are a limited number, put up a sizeable collateral that can be slashed in retaliation for misbehavior, and additionally maintain frozen capital to stake in the first place. More mitigations are in place to punish validator malfunction and recover the system from such breakdowns.

Other approaches to and issues with PoS include:

• Some systems introduce a central party that rubberstamps the latest block (e.g. Peercoin). A central coordinating party costs the system its censorship resistance.
• It's difficult to fairly launch a PoS system since stakers have to hold funds in the system to author blocks. Many PoS systems get either started as airdrops, Initial Coin Offerings (ICOs), or a proof of burn auction.
• Staking requires some representation of the private key to be online at all times, which may mean that it is easier to redirect some of the staking power (in early PoS systems it had to be the actual private key, so not only staking power but actual funds could get stolen). Not participating in staking means that your share in the monetary supply is being inflated away.
• Some systems require coins to have a certain amount of confirmations before being allowed to be used for staking, so spending funds interrupts your staking revenue.
• Some people expect that staking revenue will be taxed differently than mining revenue.
• Some PoS systems can be gamed for profit by trying a vast number of block candidates to cause the staker to get blocks more often than their stake should qualify them for. Such an incentive may turn such PoS systems just into PoW schemes under the hood.
• Some researchers argue that "by depending only on resources within the system, proof of stake cannot be used to form a distributed consensus, since it depends on the very history it is trying to form to enforce loss of value".

So, while the Ethereum Foundation keeps giving (and missing) new delivery dates for an incomplete research project, there seems to be less interest among Bitcoin contributors to discuss Rube Goldberg contraptions.

And then, beyond the general skepsis for PoS, it wouldn't be feasible to just switch to it:

"Even if there somehow was a workable solution that had desirable properties and security proofs, it would be working under a vastly different security model than PoW… and nobody can just decide to make such a change without enormous community consensus for such an invasive change." –Pieter Wuille

Answer 2

I think there are at least four reasons:

1. The miners are stakeholders in the bitcoin ecosystem. Mining solves a problem for them. Taking away PoW mining would make bitcoin no longer work for one of its most important group of stakeholders.

2. Non-miners are in bitcoin because they like what bitcoin is. If they want some other consensus scheme, they know where to find it. There is certainly room in the market for at least one PoW chain and that's what bitcoin is.

3. Major changes impose costs on every participant in the ecosystem. Every implementation has to implement the new rules. Everyone has to test that the new stuff doesn't break anything they're relying on.

4. There isn't a consensus in the community that PoS can provide the same level of security as PoW at lower cost. That's the claim PoS advocates make, but it's far from an accepted truth.

Answer 3

I think there are some very convincing theoretical arguments to be made, but there is also just a very practical consideration:

Right now, a very large portion of BTC is being held in the cold wallets of popular exchange platforms. Hardcore bitcoiners will shake their heads and declare "Not your keys, not your coins!", but this apparently has not stopped traders and normal users alike from keeping their coins stored with a custodial third party. Looking at the 'bitcoin rich list', we can confirm the huge number of coins held by exchanges.

This fact would put exchange operators in an undue position of power over the network: by staking coins owned by their users, the exchange operators can obtain a large, centralized point of control over the network's consensus operations.

There are already risks present when allowing a third party custodian to manage your coins/private keys, but switching to a POS system adds an entirely new and very serious type of risk! This is a very serious risk because it is existential in nature: if an exchange operator were to abuse their control of this huge number of coins somehow (by staking maliciously in some way or another), it would affect every user of the system, not just the users of that exchange.

This problem is only amplified by the fact that you have to not only trust the exchange operators to not act maliciously, you also have to trust them to secure their system against theft and intrusion. It is bad enough when hackers steal funds, giving hackers the ability to attack the network consensus as well is, in my opinion, an untenable addition of risk.

In case you aren't convinced: This risk is not theoretical, an attack like this recently happened on an altcoin network (Steem, mid-late Feb 2020). It appears that exchanges colluded to stake the coins they held custody of, in an effort to disrupt network consensus. A quick websearch brings this article about it up.

Answer 4

Bitcoin should switch to BFT (Byzantine Fault Tolerant) PoS which is secure by definition. Most people that don't like PoS are thinking in "vanilla" or "chain based" PoS protocols which are certainly more insecure than PoW.

Ethereum 2.0 is using Casper currently in the Beacon Chain, and other coins are also using BFT PoS protocols. I will try to resume BFT PoS in a few lines:

• Each block must be signed by 2/3 of validators based on staking power. That provides absolute finality in just one block.
• There is a penalty system that punish evil behavior or validator inactivity which makes it MUCH MORE secure than PoW. If you sign 2 blocks with the same height, that's evil behavior and your staking deposit is burned automatically. If 1/3 of validators are inactive and the network halts, the penalty system start to burn slowly the deposits until the network can restart.
• Even if you have 99,9% of staking power you can't censor transactions for free because as far there is a single honest validator in the network he will include the transaction you want to censor in his block. If the attacker doesn't want to sign the block of the honest validator, his staking deposit receives a small percent of penalty, but a small percent of millions of dollars is too much money. The honest validator receives also a penalty, but his deposit is small so it's not a problem.
• If somehow the attacker has ALL staking power and start to censor for free and don't allow other validators register their staking deposits to create blocks, the community as a whole would agree to burn all staking deposits and restart the network, which makes every coin holder much richer than before.

Regards

Answer 5

In addition to other answers, Bitcoin investors would also like to have a very conservative approach to updating bitcoin. Messing with the core idea will increase the perceived risk for something wanting to be a store of value.

Answer 6

Proof of stake just doesn't work the same as mining from an economic incentive standpoint.

Miners make real-world investments, in advance, in equipment that becomes less valuable as difficulty increases.

Miners have no guarantee that their investment will pay off, they merely have a probability of finding a good proof of work.

Staking chains are vulnerable to new attacks, like "long range" attacks, "fake stake" attacks, etc. Staking is just as easy to pool and manipulate as mining.

Proof of stake systems have some good solutions, but they aren't all solved. Until they are solved, Bitcoin definitely won't transition.

A more realistic transition would be to a proof-of-burn, where a p2sh burn is locked to a height, and gets you a decaying probability of being able to mine some future block.