Ethereum Proof-of-Stake and Our Solar Punk Future - Danny Ryan | ETHDenver 2022

okay cool um i'm danny ryan i work at the ethereum foundation on uh research and specification writing and a lot of coordination around uh major consensus upgrades for ethereum to make it more sustainable scalable and secure so today i want to talk about the transition of ethereum to proof of stake this is this uh the subtext is a nod to kevin great conference yesterday really appreciate it our solar punk future um eat denver 2022. thank you for having me um this is how a lot of people conceive of ethereum today uh this isn't like totally 100 accurate but it's not that great the consensus mechanism of ethereum proof of work is archaic at this time at this point in time and needs to go [Music] so after the merge which is the transition from proof of work to proof of mistake we're going to be in an environment much more like this a blockchain but in a cooler more sustainable more secure home is ubuntu telling okay it's done there was an error up top but i think we're good uh so the first thing i want to talk to you about is to give you an intuition for like what does it actually mean what is this what is the merge what is this transition to proof proof-of-stake how can i think about it as an ethereum user as an ethereum community member and my what i want you to get from this is really uh from your perspective other than like having a more secure more sustainable home nothing changes that's excellent so this is what ethereum looks like after the merge we have the consensus layer we have this thing giving uh giving ethereum a home and giving it security and we have the execution layer that's what we call the environment that most users and most community members interact with and the execution layer is where state is where the transactions are and where all the all the fun stuff happens um so the theorem after the merge this is this is the model we're working on today so we can drill into this uh after the merge it's going to look like the execution layer the things that you know and love i got the state route got the base fee for 1559 got transactions and uh and nfts and like all the mad stuff you all do in that layer um and then in this outer shell which most of the time you don't even have to think about how often are you thinking about the proof of work difficulty probably very minimally but we have this outer shell that's not proof of work anymore but is the proof-of-stake consensus layer what we call the beacon chain and this has all sorts of fun stuff like uh attestations and deposits and exits sometimes some slashings when people do bad stuff and really this is what kind of is the outer shell of the execution layer that people know and love and people interact with so after the merge this execution layer really you know from the from the perspective of a user it's very unchanged it looks exactly like we know and love this is this is what the train the chain looks like today it looks very similar to what the chain is going to look like after proof of work shell uh this this kind of outer security element and then the the execution layer embedded and this is what the consensus layer looks like today which the proof of stake in census layer is live today it's been live for 14 months uh in in in 2020 december how many years has it been the pandemics really screwed up time in my head but the beacon chain launched and it exists and this is what it is it's essentially this consensus mechanism it's coming to consensus on itself and is primed you notice that there's some extra space in here that's what we're going to be leveraging in the merge we're going to be leveraging that extra space inside the consensus mechanism and so really what ethereum is today is is the unification of these two systems running in parallel so when you're hanging out with uh with uniswap or when you're uh trading some crazy nft like you're in this proof of work chain today and you're you're being secured by uh by the traditional mining proof work mechanism and in parallel all these validators are hanging out they're hanging on the beacon chain they're building the beacon chain they're securing the beacon chain and they're priming it they've been working their asses off to get it ready for you so i want to give you an intuition for the merge the merge isn't that scary the merge isn't that crazy the merge is continuous the merge is for and by users and and and gives them continuous landscape to ethereum the beautiful thing that we have so we have we have these two chains right before you know we have the perforate chain we have this this beacon chain and they're running in parallel but it's some terminal condition at some uh difficulty that the validators coordinate upon they they're watching the beacon chain the validators are watching the beacon sorry the validators are watching the proof of work chain and at this terminal condition they all point to the execution layer inside of that proof of work chain and the next time something's built instead of being built by the miners it's built by the proof of stake validators and so this this dotted line this sub chain inside of the chain continues forward and so all of the all of the user apis except like get difficulty because that it becomes meaningless at that point um all of the user apis continue to exist all the state continues to exist at point a when you're in the proof of work chain and at point b when you're in the proof of stake chain that just looks like the building of another block that just looks like you know the continuation of your nfts that just feels like uh you know did my transaction get in and over here or transaction get over here you know um so that that is what the merge is i mean it's on some level and over simplification but another level like it's literally exactly what's happening and this continuous heart of ethereum the execution layer continues forward just in this new secure and sustainable environment so this is actually what ethereum looks after the merge it actually is what it looks like before the merge and it actually half of those blocks could be performed blocks and then the further half could be proof of stake blocks because it feels it looks continuous and then sharding well we can talk about that later so that's a mental model for the merge that is what's happening that is the the final you know we've been talking about proof of stake it's so close it's so close it's so close it literally is so close and that's what we're going to talk about now so over the summer we had this really fun event a development workshop called amphora where we got uh 10 client teams and bunch of developers in a room to take the merge from specifications and prototypes to something that begins to look like production um this was like a very exciting moment we were all in the room together at we we had like t-minus 15 minutes to this final dinner and we and the the merge the transition happened um and and on this test net and everyone was very excited you know even uh vitalik's clapping there in the middle very good time um that we called amphora that although vetted and began to put all the machinery in place for all these clients uh it did not uh you know there there were things we learned there so we had we had a next iteration of specifications and the next iteration of productionizing this um and that's what we call kinsugi kinsugi is the art of uh taking well maybe smashing pottery wear and then making it more beautiful with gold um i don't know if you're actually supposed to break it you're probably supposed to find broken pottery and then glue it together with gold but it's pretty nice so the idea is uh it's all the pieces coming together for this thing um so at the end of mid-december the kinsugi testnet launched um this has been like a major excellent effort uh lots of lots of community members engaged with testing and began to really put their hands on this new this new iteration of the software um to see look see and feel how this thing works interjection this is what an ethereum client looks like uh post merge so what i call an execution engine you might think of as an eth1 client or you might think of as a proof of work client and so it's called call it geth called another nethermine called aragon call it besu um it's probably another one there's many of them um that becomes an execution engine that becomes like its purview becomes state it becomes transactions it becomes that layer drives the thing um whereas the things you think about as an e2 client or a beacon node or or you know a proof of state client that becomes this like the brain of the operation so instead of proof of work driving the beacon node drives the execution engine via this engine api i won't get into too many details around it but in the future it's really the unification of these two pieces of software that do very complex things in isolation but together they come in together to be a proof-of-stake ethereum um i mentioned earlier like the user apis they don't change just because you know if you're running guest you're still running death and you're still having access to those apis you're still you know the interfaces are still able to use these things exactly as the as they did before i bring this up because uh this engine api uh there's something with pretty this this is one of the although it is simple it's one of the most important and critical parts of this whole thing so i just wanted to give you a little problem we ran into in kinsuki that birthed the current sprint called kilm so in kinsugi we had this a bit of a semantic mismatch between what we thought was correct and reality so there's two key methods in the engine api um one is execute payload so i take uh i i'm the beacon chain and i have this like bundle of execution goods so like transactions and other things related to the execution layer and i pass it to the to the execution layer client to the to the execution engine um and it will execute it like it does today when it gets a block from the network um and it will get the post state and it will pretty much say is this valid and am i willing to incorporate it locally and then there's this other method that's very important called fork choice updated and that's you know we think of a block chain but what is a block chain a block chain is the canonical route through a block tree a black tree is can be any number of blocks in this in this hash chain structure but one thing that we have to do is we have to use the fork choice to find the tip and the tip then defines what is canonical defines the canonical history um and with in in proof of work this this fork choice is very native to the difficulty into mining whereas in proof of stake the in the uh consensus layer dictates via its own algorithm to the the execution engine uh what its fork choices so the interplay between these two methods was subtly off in kinsuki and led to some some interesting scenarios so this is uh this is a normal blockchain there's no forking we have a head it's very easy sometimes we get alternative branches um and this this will build up into the issue with the semantics here but you know sometimes we have an alternative branch it hasn't overtaken the head clients will incorporate it in the block tree and do certain things that alternative branch could continue to be grown uh maybe it doesn't overtake the head yet but then finally all of a sudden that alternative branch for some reason uh took over the head the interesting thing about the semantics of execute payload before fork choice updated is sometimes you know i have this forking and i have this alternative branch and it looks like a block that probably could be good but execute payload was saying to the execution engine execute now and so that was actually causing sometimes in weird scenarios like undue burden and undue load on the execution engine because the execution engine often are designed today with proof of work to not actually execute this alternative branch until it actually overtakes it with difficulty then it finally executes all those blocks sees if the thing is in fact valid and then sets that as the new head point being is only when we had chaos in a test net did we realize we had these semantics slightly off and we're inducing in certain forking scenarios undue burden on the execution engines thus not quite back to the drawing board but modified here so the semantics more purely on the execution engine are or not execute payload every time there's a new payload but instead insert it into the block tree it's new if it overtakes the previous head by a fork choice updated or if it builds on the canonical chain almost certainly execute so kiln was born out of these slight we're like so near production but slight modification of the semantics to handle these things more optimally and by the same more optimally i mean very importantly more optimally um thus kiln we're in kiln right now this is the final hardening this this is where we're taking these specs we've run through multiple sprints we've been battle testing them and our in this final sprint we're building up devnets and in a few weeks we'll be inviting the community to a long-standing test net to really test their before we fork gourley before we fork sepolia and whatever test that still exists before we finally finally finally kill proof of work [Applause] so when this is a fun screen grab from amphora entered proof of stake stage remember that picture where we're all like half happy and clapping that's because of this tiny little piece of the screen um so when when when when i've been working on this for quite a while i honestly when i jumped into this thing towards the end of 2017 i thought it was right around the corner i thought it was right around the corner i believed it and i really believed it for a long time but it's really actually very close the difficulty bomb which has been our our our tried and true friend for um many many years we've defused him we've added him back we've defused him we've added him back i think he's going to be impeccably timed uh the the difficulty bomb is set to go off to be begun to be felt sometime in june sometime in july somewhere around there um and then to ramp up from there uh that is the target that is what all of these client engineers are working on um and i do believe that that is very realistic um and someone asked me to say this i think i will say it if it does not happen this year something insanely catastrophic that i did not unexpect did not expect you know showed up you know something fundamental something crazy broken which like that's not where we're at in this cycle i do not expect that so you can quote me on that um i'm gonna get a bit into the why i think i made way too many slides for the amount of time i have uh proof of stakes more secure more sustainable more scalable proof-of-stake actually isn't more scalable that's why we're kind of like moving in this direction because proof-of-stake allows us to design more scalable mechanisms a bit easier so you don't get it for free but you get the other two immediately um lack of economies of scale highly liquid and available pure function return on capital essentially the ability to take eth and stake it is much more pure and easy or the ability to even acquire that capital to participate in the crypto economic mechanism compared to proof of work is very much simpler function whereas to really participate in proof of work i need economies of scale i need to be entrenched in hardware cycles i need to i need to get the hardware before everyone else you know i need to have special energy there's all sorts of like things that the more capital i have likely the more return i can get in proof of work where that that is very much a diminishing thing in proof of stake uh security higher security margin so we have all this crypto economic capital in proof of stake and proof of work um that secures essentially people show up with their capital put it in the converted into the crypto economic asset of that consensus mechanism call it mining harbor call it uh the native asset itself eth um and you and you post it essentially collateral to participate in this game uh and and potentially be rewarded or potentially be uh have some losses so on top of that there's some sort of issue and some sort of return and also transaction fees and in proof of work you know the security margin and what you can kind of dictate uh is essentially just this return so you have a carrot which is great people show up for the carrot i think it's tried and true been doing this for quite a while now whereas in proof-of-stake it's not just the return we actually the crypto economic capital itself is at risk i cannot well the protocol cannot go burn your mining farm down somebody probably could but the protocol cannot and thus on the left side with proof of work you know the only thing you really have is the carrot whereas in proof of stake there are attributable faults where you if you try to construct alternate realities or you try to um contradict yourself your capital can't actually be at loss it's actually at stake and such you have the carrot and you have the stick that's an intuition for why uh why these things are more secure why proof of stake is more secure um better emergency recovery in proof of work once you're at 51 it's all over like they literally own the chain they own you and whereas in proof of stake because of the the the stick we have here uh you can conduct an attack but then your capital is literally burned it's literally lost uh you have a one-time one-time uh attempt at that and then you know everyone loves burned ether so like people might celebrate after um stop spawn killing us please stop spawning um [Music] better emergency recovery this is kind of uh the same thing the crypto economic capital is either burned or in the event that you have like some seventy percent uh censuring majority this socially you can intervene whereas again in proof of work like the only thing you can do is really change the fundamental algorithm which bricks the good guys and the bad guys there's not not as much emergency recovery there uh sustainability that's a big one these are smoke stacks we don't want the future to look like that there's a much better and interesting and fun future so proof of work i honestly believe will become after the merge seen as kind of an archaic technology and i i don't think it's going to be socially tenable for for much longer um this is what we're going for uh and i have some napping math to show you so this is from kyle mcdonald there's a number of these like estimations on how much energy proof of work in ethereum uses this one i've been told good sources is uh pretty good so call it 25 26 terawatt hours per year that's a lot um that ranks up in at least definitely like top 100 countries it might be like top 30 i need to look uh but then we have computers computers use like 400 kilowatt hours per year i don't it varies that's an estimate that old computer might use a little less but i don't i might use more actually um but then you know what is ethereum ethereum is a network of nodes and network of computers essentially you know how many are there i don't know ten thousand five thousand twenty thousand uh lots of different estimates there but call it four gigawatt hours for this whole network uh and really what we go from is twenty five thousand gigawatt hours to just a network of computers just a network of laptops a network of servers uh call it four gigawatt hours so really like that's actually a 99.98 energy reduction which is insane but very importantly very importantly is there's no like sure add a node double the amount of nodes like that's great we want more people to run those but those are just computers they're just this like you plug it into the wall and there's nothing that like with the value of the asset like you know maybe we're not there today with ethereum proof of work but like if it if the asset 10x in value or 100x in value then like you you actually get there because the amount of energy you want to burn scales with the value of the asset we no longer have that feedback loop with the real-world energy consumption so definitely some good stuff here there uh and then you know we end up there i kevin o'key told me that's where we're gonna go um scalability there are 10 percent faster block times in proof of stake compared to proof of work today so a little bit of scalability again but that's not actually what i mean um what scale what proof-of-stake actually opens up is the ability to architect more sophisticated consensus mechanisms uh usually called sharding sometimes called scalable data data availability sampling essentially like very advanced cryptographic techniques uh that allow us to to bring in more scale without compromising on decentralization and security but those are very hard techniques to construct in a proof of work environment so really proof-of-stake becomes requisite to move into this more scalable zone um get more out of your consensus mechanism dank sharding that's actually uh paying homage to uh donkrud i don't know if he's in the audience hello don crowd you're probably upstairs hacking uh but the the current sharding construction uh which brings in a lot of simplifications we call dank sharding which i mean we're in colorado so good place to be um there was if you're interested in this stuff i'm not gonna have time to talk about sharding today uh there was a really good dank sharding workshop the video is online you can check it out if you want to know what the situation is i don't know if i have any okay this is my last slide huge shout out to all engineers and researchers i'm just like one guy there's literally hundreds of people working on this thing i can see some of y'all in the audience um like i i'm honored to be able to sit here and talk about like the the the iceberg of of work going on here um and if you want to contribute come find me we're definitely looking for p2p experts uh we've got some fun fun problems to solve with the uh the sharding stuff coming up uh but really like if you're into layer one uh and you wanna talk come talk to me thank you sure yeah so we have time for a few questions if you guys have questions for danny line up at the mic right here i'll give you like a two minute warning and i can ask myself questions if you want i've never seen that man before client incentives there's probably two big categories one would be like a pay for data model which like people are bearish on but i i would say that it hasn't fully been built out and so i i would say that it's definitely worthwhile to see if we can get the light client server payment model done there's a little bit of a bootstrapping problem there and then the other model is no one's ever the other model has the assumption no one's ever going to pay for light client data and so you need to build a more like distributed web uh to architect it and that so piper's exploring the uh the portal network which essentially takes you know if you assume that there's tons of tons of light clients that want to participate and have a little bit of resources then you can construct like a a dht to serve and kind of hang out with each other i think that both both are very promising like clients are always a little bit disappointing because we wish they existed five years ago and they barely exist today but i'm glad your company's working on them talk about vdfs oh yeah can you talk about bdfs um so randomness is uh pretty important in proof-of-stake protocols you kind of get that in proof-of-work for free for free well not for free it costs a lot of energy uh but the like random process of competing with hashing gives you kind of the randomness decide who the leader is who gets to make a block whereas in proof-of-stake you need you need some in protocol randomness to dictate uh shufflings dictate who's the proposer dictate these committees and different things so there's this construction called randall where each time a block proposer makes a block they reveal some private uh information that they cannot bias other than the fact that they're revealing it or not so like they can either mix in into the randomness and help dictate the protocol or if they really wanted to bias it they could they could not um and so i say that because randall exists uh randall is what the protocol uses we have a lot of models showing that randall is not that biasable and it's very difficult in practice to bias but it is biasable to some capacity so what a vdf does is it takes that uh with a crazy hardware project uh assumes that an attacker cannot build a piece of hardware faster than some maximum speed up than commodity hardware and uses that to harden the randomness there's all sorts of things you can do with vdfs theoretically this is the one that we're kind of interested in pursuing um that problem is hard because it's a hardware problem so the vdf has like a an honesty assumption of one so there only needs to be one person in the world honest actor actually running like you know a piece of hardware like this so it's not like some crazy proof-of-work thing that you like attached to it but there is like a whole r d project to investigate these hardware is to investigate which actual uh mathematical and cryptographic construction you embed in the hardware and then to like prove very rigorously how even in a note a no expense spared attacker you know take all the money and resources in the world what the theoretical speed up is and if you can bound that this is a very exciting project i think bdfs open up lots of really interesting crypto economic constructions uh in protocols like ethereum and protocols like filecoin and others uh but you know i think we're at a minimum a few years out from having anything worthwhile um truly secure and ready there and maybe many more years out than that but some people are much more deep into the vdf project than i am uh is the marriage going to affect gas prices great question so i talked about that a little bit um does the merge affects gas prices so scalability affects gas prices the merge does not inherently bring more scale you're still bottlenecked in proof-of-stake by the same things in proof-of-work the merge does open up sharding and versions of sharding i believe which could give us some more scale could be released really within the next year but one thing that does help with scale is starting combined with these layer two constructions so teams like optimism teams like arbor trampolines like uh zk sync they are are they are deploying moist scalable environments into ethereum today and what we plan to do with uh upgrades after the merge is supercharge those scalable environments with more data but yeah we're working on it cool uh yeah dank sharding um this is the thing oh no it's not up there my don't put it up there uh we're actually there's a number of people working on a quote mini dank sharding this weekend uh so hopefully we'll have a fun prototype and and be able to share more with you at the end of the weekend uh look out for it on the internet all right cool i'm gonna call it unless anybody else wants to talk to me i'm happy to chat alright thank you appreciate it