22

After reading a little bit about different consensus algorithms, I am just trying to understand why Bitcoin still uses proof-of-work. This consensus algorithm being exponentially expensive, and resource intensive, doesn't it make more sense for Bitcoin --the most expensive cryptocurrency out there-- to migrate to proof-of-stake?

Currently, Bitcoin transactions are so expensive that day-to-day transactions, like buying a cup of coffee, can be more expensive than the good/service itself in some parts of the world, which fails to deliver one of the original goals of Bitcoin. That is to be the common person's every-day money.

Why does Bitcoin stick to the proof-of-work consensus algorithm?

  • 3
    Was everyday use ever really a goal of Bitcoin? The number of transactions it can process per hour is hard-limited by its design. Either Satoshi Nakamoto didn't understand the order of magnitude of the world financial system or replacing it was never the intention. – Philipp Apr 20 at 12:13
  • 6
    According to the whtepaper, everyday use was the goal. At the time when the limit was introduced the number of transactions was order of magnitudes lower; and the code was basically in the alpha/prototype stages. I'm sure replacing the limit was the intention, but Satoshi didn't know of a viable solution. – csiz Apr 20 at 15:04
  • @Philipp Scaling to everyday use is clearly a difficult task, but its worth noting that on-chain transactions per second =/= payments per second. Finding nuanced ways to create bitcoin transactions which allow us to pack a huge number of payments into a single on-chain transaction is an interesting approach that may be viable. The lightning network is an example of this. – chytrik Apr 20 at 21:41
  • Because it's not Ethereum. – VSO Apr 22 at 14:41
  • Oh, I thought micro transactions are the most important application of Bitcoin. – Volker Siegel Apr 23 at 6:35
28

Proof of Stake is basically a case of having your cake and eating it, too.

PoW is a simple work-around to a coordination problem that was previously thought to be unsolvable. It sort of "cheats" by providing an economic solution to a distributed systems challenge, by introducing a real cost as a disincentive to unwanted behavior as well as using a reward system both to bootstrap itself and to incentivize security. The advantages of Bitcoin's PoW system include that the group of block authors is truly open to anyone with computational resources, that the system converges on one ground-truth because there is a real cost in producing a competing chaintip, and that it is simple enough for its security model to be well understood.

PoS is more similar to the approaches that were pursued before the publication of Bitcoin. PoS is naturally divergent as there is no real cost in staking. The "Nothing at Stake problem" allows stakers to work on multiple chaintips and only publish the next block from the chain most favorable to them. There are different ways of approaching the vastly different security model of PoS.

"Casper summany: FIx stuff with Staking. FIx the problems in that with bonding and checkpoints. Fix problems with that with being fuzzily forgiving about slashing. Make it all 'rigorous' by doing real proofs of something somewhere" – Bram Cohen -src

For example, ETH's effort to switch to PoS has been in research for over five years. The latest I've read, ETH's current PoS proposal piles multiple layers of complexity on top of the staking to achieve convergence. Stakers have to not only hold capital to stake, but register as "Validators" of which there can only be a limited number. Validators have to put up a collateral that can be slashed if they attempt to work on more than one chaintip at the same time.

Other approaches to and issues with PoS include:

  • Some systems introduce a central party that rubberstamps the latest block (e.g. Peercoin). Existence of such a coordinating party costs the system its censorship resistance.
  • Since stakers have to hold funds in the system to author blocks, it's difficulty to have a fair launch of a PoS system. Many PoS systems get either started as airdrops, ICOs, or a proof of burn auction.
  • Staking requires some representation of the private key to be online at all times, which may mean that it is easier to redirect some of the staking power (in early PoS systems it had to be the actual private key, so not only staking power but actual funds could get stolen).
  • Some systems require coins to have a certain amount of confirmations before being allowed to be used for staking, so spending funds interrupts your staking revenue.
  • Some people expect that staking revenue will be taxed differently than mining revenue.
  • Some PoS systems can be gamed for profit by trying a vast number of block candidates to cause the staker to get blocks more often than their stake should qualify them for. Such an incentive may turn such PoS systems just into PoW schemes under the hood.
  • Some researchers argue that "by depending only on resources within the system, proof of stake cannot be used to form a distributed consensus, since it depends on the very history it is trying to form to enforce loss of value".

So, while the Ethereum Foundation keeps giving (and missing) new delivery dates for an incomplete research project, there seems to be less interest among Bitcoin contributors to discuss Rube Goldberg contraptions.

And then, beyond the general skepsis for PoS, it wouldn't be feasible to just switch to it:

"Even if there somehow was a workable solution that had desirable properties and security proofs, it would be working under a vastly different security model than PoW… and nobody can just decide to make such a change without enormous community consensus for such an invasive change." –Pieter Wuille

| improve this answer | |
  • 3
    Thanks a lot for the great explanation! So, for what I can conclude from your post, PoS is interesting in theory, but very hard to implement into practice because of its divergent nature, which leads to the need of extra layers on the protocol, which also means more complex mechanism and therefore less secure/efficient? – Oscar Serna Apr 20 at 8:08
  • 4
    @OscarSerna to reply to your second comment. Proof of stake doesn't solve high transaction costs; that is controlled by the transaction limit and desire of people to have their transactions finalised soon. To fix that you need to get logarithmic scaling with transactions. Ethereum's solution to that is sharding, which is a different beast than POS; but equally complex. – csiz Apr 20 at 15:17
  • 2
    OscarSerna: The transaction cost is not closely related to the consensus mechanism as csiz explained. – Murch Apr 20 at 22:45
  • 2
    The lightning network allows you to send payments to any other participant it can find a route to. It does work better for small payments, though. See for example bitcoin.stackexchange.com/q/43700/5406 – Murch Apr 21 at 14:12
  • 1
    @OscarSerna .. there's nothing that says you need to open the lightning network when you want to do the payment and close the lightning network once you've done the payment. You can open it as long as you like. You can spend bitcoins on the lightning network for as long as you haven't closed the network but those bitcoins cannot be spent on the main bitcoin blockchain. Once you close the network you can no longer spend those bitcoins on the lightning network but you can now spend it on the bitcoin blockchain. Think of it like a prepaid card for bitcoin – slebetman Apr 21 at 20:02
15

I think there are at least four reasons:

  1. The miners are stakeholders in the bitcoin ecosystem. Mining solves a problem for them. Taking away PoW mining would make bitcoin no longer work for one of its most important group of stakeholders.

  2. Non-miners are in bitcoin because they like what bitcoin is. If they want some other consensus scheme, they know where to find it. There is certainly room in the market for at least one PoW chain and that's what bitcoin is.

  3. Major changes impose costs on every participant in the ecosystem. Every implementation has to implement the new rules. Everyone has to test that the new stuff doesn't break anything they're relying on.

  4. There isn't a consensus in the community that PoS can provide the same level of security as PoW at lower cost. That's the claim PoS advocates make, but it's far from an accepted truth.

| improve this answer | |
11

I think there are some very convincing theoretical arguments to be made, but there is also just a very practical consideration:

Right now, a very large portion of BTC is being held in the cold wallets of popular exchange platforms. Hardcore bitcoiners will shake their heads and declare "Not your keys, not your coins!", but this apparently has not stopped traders and normal users alike from keeping their coins stored with a custodial third party. Looking at the 'bitcoin rich list', we can confirm the huge number of coins held by exchanges.

This fact would put exchange operators in an undue position of power over the network: by staking coins owned by their users, the exchange operators can obtain a large, centralized point of control over the network's consensus operations.

There are already risks present when allowing a third party custodian to manage your coins/private keys, but switching to a POS system adds an entirely new and very serious type of risk! This is a very serious risk because it is existential in nature: if an exchange operator were to abuse their control of this huge number of coins somehow (by staking maliciously in some way or another), it would affect every user of the system, not just the users of that exchange.

This problem is only amplified by the fact that you have to not only trust the exchange operators to not act maliciously, you also have to trust them to secure their system against theft and intrusion. It is bad enough when hackers steal funds, giving hackers the ability to attack the network consensus as well is, in my opinion, an untenable addition of risk.

In case you aren't convinced: This risk is not theoretical, an attack like this recently happened on an altcoin network (Steem, mid-late Feb 2020). It appears that exchanges colluded to stake the coins they held custody of, in an effort to disrupt network consensus. A quick websearch brings this article about it up.

| improve this answer | |
  • 3
    I do not think that the Steem scenario is very realistic for BTC; it started with a single exchange being dominant, and the Steem story highlights that this would ultimately kill the entire ecosystem of the coin in question. BTC had a similar problem in the past, where a majority of miners would in located in China; after some discussion, the Chinese miners agrees to stay well below 50% because they knew that BTC could break down anytime if they continued to grow, losing more than they could gain from growing. – toolforger Apr 20 at 3:21
  • This is a really interesting theory. I also think that toolforger is right about ecosystem regulating itself. Some good game theory applied here. Thanks for enriching the thread. – Oscar Serna Apr 20 at 8:16
  • @toolforger right, it is a different situation, but I think this is still a foundational problem that is slightly different than miner centralization: With PoW, every effort is made to ensure the protocol does not favour or promote miner centralization. With PoS, centralization of coins seems unavoidable (exchanges hold a huge portion, and the fact that 'the rich get richer' under PoS only exacerbates this). Additionally, a hacker that steals coins could attack and incur almost no cost (other than lost value of the stolen coins), the same cannot happen in PoW. – chytrik Apr 20 at 21:48
  • I am not so sure about that "the rich get richer" aspect of PoS. If it's proportional to the amount held, the minting reward will be distributed accordint to the current money distribution and relative wealth remains unchanged. This changes if you have to allocate your money for PoS - the poor won't be able to allocate anything, and the rich will want to keep their money in cold wallets; I don't know how this plays out in practice. – toolforger Apr 21 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.