The Case for Proof-of-Stake by Emin Gün Sirer (Devcon4)

Hello. Um, thank you very much for coming. I'm very very pleasantly surprised to see such a great turnout on the last day in one of the last uh talks. I have used the last of my voice. I'm going to try to eke out a little bit more and talk to you a little bit about steak and about protocols, consensus protocols, and so forth.

So, let's get started. Where are we at today? We're umpteen years into a about exactly 10 years into uh since the Bitcoin white paper, multiple years into this revolution, and uh and it's sort of time to sort of take stock. The word blockchain has become one of these words that doesn't even take an article. We don't talk about a blockchain.

We don't talk about the blockchain. We talk about blockchain. The only other word I know that I can easily remember that has this treatment is the word God, okay? So, this thing is really big. You cannot walk around Lower Manhattan without seeing two people in suits turn to each other and say, "What's your strategy for blockchain?"

So, every company is trying to devise a strategy. And about 8 billion of VC money, blah blah blah, lots and lots of money has gone into stuff. And if one of the interesting things is I found myself at tables where there is a very solid gentleman from the Bank of England, and there is another darknet darknet market operator right then and there. It's a fantastic crowd. This this This is what it means to to be in the middle of a disruption.

So, and then one thing I one additional thing I do on occasion as a professor to try to see like do I really have the the the pulse of the the whatever the the folks in my hand is to check sort of extraneous things. And one of the metrics I look at is you know this is the metric I looked at is the number of songs on YouTube written about different uh different cryptocurrencies, and it far exceeds the number of songs about Google, Facebook, etc. etc., right? So, even free software.

So, that's an amazing thing. But, where exactly are we? So, these are really positive things. So, I'm going to be a little bit negative now. And uh and I think you know I Well, one of the core distinguishing things about me is is I'm a scientist at heart.

And science begins by being able to observe reality and being able to admit reality. So, bear with me. The dream we've sold a very compelling dream to the masses. It's a decentralized disintermediated future It's free from the tyranny of middlemen. It's free from regulatory capture.

It's free from trusted but unaccountable parties. That is the dream that has gathered all of us into this spectrum. So, that's fantastic. But, the and the bar to succeed is actually very low. Okay, I know this community is working on a gazillion different very exciting projects.

We heard about a lot of them over the course of the last four days three days. So, uh and we will have succeeded if we fail at every single one of them except say, I don't know, one of the easiest ones, a better infrastructure for custodial assets. If stocks were slightly better managed, if we knew that the doll company actually has X shares when it says it has X shares, then we would actually be in a better place. Or if we could build better decentralized exchanges, and I know we know that we have the capability to do so. We can build better exchanges than the SEC keeps demanding of us.

We can build better technology, untrusted technology, uh than than than what the the Wall Street guys have. So, if we could only do a tiny bit, we will have succeeded. So, the bar is low. But, the technology we have to get to that bar is just not sufficient. And it fails on a multiple on a multitude of fronts.

First one is scale. You've heard this multiple times because the Bitcoin folks have been fighting over this issue. Second one is security. The state of every exchange is empty. That's their default low energy state.

That's what they seek. Um, people lose money all the time. SFYL, sorry for your loss is an acronym. You don't even have to spell it out. Performance is a big issue.

You cannot wait 15 seconds on the web. That is unheard of. You talk to a UX person and and say, "Hey, this is what you have to do." It's a big big problem. Governance, how do we actually change anything at all?

With a big fight it turns out and a lot of sock puppets. That's what I learned. And uh it's absolutely horrible. So, that's not that's no way to to build systems. And the user experience overall is you know you get excited.

I get excited. I tell somebody new and then they say, "Well, you know, then I tried to like read a paper wallet. I had to buy this and that, change it to you know, convert it to this other currency, then I had to like install this, I had to sync that and the Oh, it's just a crazy crazy user experience. Is it possible to do better? Well, okay, before I get there.

Let me also uh mention some some harsh facts that just came out. So, this is the number of top 500 e-commerce merchants accepting Bitcoin. It was 55533334444. Okay? It's not going up, okay?

We're not winning the war to replace fiat. It's not happening. Um, and the goalposts are moving. I I want to share this slide with you so you know to detect for this. If 4 years from now we've changed the Ethereum narrative, then you will know that we are failing.

So, here is Bitcoin when I first sort of heard about it it was digital cash, untraceable, da da da da That kind of gave way to a whole series of other narratives. It was a store of value for a while. Adam Back kept telling me so. And uh and then you know disruption, this and that. And uh and now you know there's yet another narrative that's that's pushing these currencies at any one time.

But, it seems as if they are realizing that the dream they sold and what they've got are not really a good match. So, what do we do? Um, So, here this report says, "Why is this not becoming part of the global financial system fabric?" It says why it's failing. The high cost of operating a fully trustless system is pushing early players to balkanize systems into trusted blockchains and distributed ledgers.

Also, they forgot to add also exchanges. But, these are becoming speculative assets. People keep their coins. You never actually touch the system. Right?

You do it's fanfare online. Then you buy and sell on an exchange without actually using it. That is not what what gets gets me excited. That is not what many of you are here for. So, uh okay.

So, what's the situation with decentralization? Well, we did a a big long study uh that came out a year and a half ago. I want to share some of the results with you. Um, the current the main result is current crop of systems are not sufficiently decentralized. They're better than a bank.

Okay, a bank you're at the mercy of a single entity, but not much better than a cartel of banks. Okay? So, they are kind of comparable. And uh So, the days of one CPU one vote in the white paper are gone. So, that was that's like a dream.

It's just gone. You all remember the days when you could use this to mine things, right? And then that got replaced by the days when we all had to hunt online. I'm not sure what's happening with my pictures. When we had had to hunt online for these things, okay, whatever, GPUs.

And then they became really expensive. Then people tried FPGAs. Then people tried these things. Uh one of my colleagues has an interesting story. redoing the data center at CMU, and underneath the floorboards of the data center they found another data center that was mining Bitcoin.

And uh So, uh but this gave way to uh as you read in the in the famous New York Times article of the the the fly-by-night operations in China that were doing mining at you know in like makeshift locations, and they got suddenly uh more professionalized. It's not in China. There's another installation. But, uh but then ultimately turned into this. This is the state of mining, right?

So, this is a I think a BitFury uh water-cooled setup. And uh these are professional transaction processing machines type things, but they're not really processing transactions. They never touch a transaction. I'm I'm sure everybody here realizes this. The public at large does not.

They think that these things are actually touching or validating transactions. They are not. They're all they're doing is trying to win the lottery so they can say, "I am the one who determines what's happened in the last 10 minutes." So, why are we doing this? Because, okay, we need this hardware because of the way the Nakamoto consensus protocol operates.

It ensures that the single participant cannot masquerade as n others. If I were to sort of um you know pester you with a gazillion crossword puzzles, you'd only be able to solve them at a particular rate, and therefore you would not be able to to claim that you're a million other people um million other people. That's that's the civil control problem. It is not there to try to establish consensus. It is solely there to make sure you don't pretend to be who you're not, okay?

Civil control is what it really provides. The consensus part of Nakamoto consensus is the longest chain rule. That's what allows people to snap onto the same reality, the longest hardest chain rule. It is not the proof of work side of things. So, in addition the investment ensures that the miners will seek to maximize the long and short-term value of the coin.

They're there to try to sort of you know ensure that you know that their incentives are aligned with everyone else. I would like to note that hardware is simply a specialized kind of state a stake. Okay, it's just like it's one way of ensuring that you have skin in the game, but it's a very specialized way of ensuring that you have skin in the game. It's It's production is monopolized by a few manufacturers. Nobody in this room I suspect knows except maybe a couple of people know how to actually build these things at scale and and make them fast.

And uh and most importantly being able to to procure hardware and run it effectively has absolutely nothing to do with ordering transactions. One of them is a CAPEX OPEX management problem. The other is a serialization problem. So, um so that is one of the main issues that's going to be that's has been in the back of my mind for a bunch of time now that that decoupling leads to a very strange scenario. So we looked at in our study we looked at a over I think a span of 2 and 1/2 years what happened to hash power in Bitcoin and Ethereum.

This is a paper that came out a while ago and so this shows each each cluster of bars is the is the hash rate of a single single miner. You can see it change over time. And you can see what has happened in both Ethereum and Bitcoin. And I think the most important thing to take away from this graph is the fact that I only have 20. Okay?

I don't have more than 20 miners that I need to show to you. So the entirety of the management of the blockchain is essentially in the hands of these people. Here is the same data shown differently. You can see that about 100% of the of the almost 99.something% of the hash power is in the hands of 20 or fewer entities.

And for let's see, I think I have some numbers here. Uh 11 mining pools in Bitcoin, seven mining pools in Ethereum control 90% of the of the hash power. Uh if you look at the 50% value, it's four for Bitcoin, three for Ethereum as of that time. This has gotten worse. This is like a year and a half ago's dated stuff.

So um I posit to you that a Byzantine quorum system with 20 nodes would have been much more decentralized. EOS, which a lot of people make fun of for various different things, is 21 block producers. Okay? So so this is kind of interesting. All of this expenditure and for what?

Could we not ever had this better? Now I know some of you are going to go, "Oh, he doesn't know what he's talking about blah blah blah." You know, the whatever the Twitter trolls will come out because they always do. They're going to say, "Oh, but we have in invisible decentralization. These mining pools are made up of many miners and and if the mining mining operator were to misbehave, then they would actually rise up and blah blah blah."

There's a whole lot of arguments over there. I'm not going to repeat them. Um this is the invisible decentralization argument. Well, as with any sort of invisible argument, this doesn't hold water if you it's just false, okay? So a pool is a common enterprise, okay?

So these are people who have who have purchased stake for a singular purpose. They have a profit share sharing arrangement. They are essentially a corporation in every aspect except they don't they haven't filed corporation papers, okay? So why to a lot of series of libertarians this is actually a big deal that oh, but they didn't file papers and therefore I mean that doesn't make sense to me. I don't understand.

So in every every material way they are operating together. And much more importantly, they actually misbehavior that they would have to detect is not readily identifiable, okay? And as a BTG got attacked as a result, NiceHash was used and people who participated in those attacks had no idea that their hash power was being used to attack. They're just not geared up to actually detect any of this stuff. And there is recentralization going on.

Cryptocurrencies are experiencing this. This is because ASIC manufacturer is hard, cheap electricity finding it is hard. You need proximity to other miners. You need to have a spy mining network. Typically you have to be a part of a mining cartel.

So you hear of other people's blocks before before so you don't get orphaned yourself. And you of course need know-how. The mining game also in the long term favors the miner with the lowest CapEx OpEx cost, okay? So this is a game where if the miners are reinvesting their their income back in mining, the one who has the best the highest profit margin typically comes out ahead with much more hash power and ends up outcompeting others. So if I were to look at half of my Okay, here we go.

Full the entire slide. The left side of this slide is from 2 years to 3 years ago and the other one is from this year right now. And there's almost nothing in common in terms of mining pools except two. I think one of them is is Slush and the other one is I think AntPool. So there's been complete churn in the mining space because this is really not a stable industry.

And uh what happened here? Okay. And the energy usage is immense. As of 2018, it's about one Austria, one Czech Republic. You look around, it's a big industrial nation.

All the equivalent of its energy is going into mining. Two Denmarks, three Irelands, you know, that's a lot of energy. And maybe like some people actually don't care, right? As long as you make money, we're all good. Fine.

I mean I care. I would like to see polar polar bears still live. But if you don't care about the polar bears or the ice caps or the Floridians and so forth, then you should care. I mean those people care deeply about their pockets about the leakage out of the store of value. We're going you're losing money out of out of this thing that's supposed to hold, you know, the your wealth.

So question, can we do better? So I want to talk to you a little bit about about why I think I'm generally very very hopeful that we can actually reach the dream. So from the same study we looked at what resources are available. And this is an interesting graph. It shows the amount of bandwidth available to both Bitcoin and Ethereum nodes.

So if you look at the I think the important lines are the the red dashed line. That's Ethereum. And the comparable line is the let's see, the blue solid line Bitcoin. So Bitcoin nodes actually have more bandwidth available than Ethereum. Ethereum is running its network at a higher pace and and and and so yeah, it's running at a high pace.

Maybe a different slide that's interesting is but the point here is the protocol is unable to take advantage of improvements on this graph. So over time over the course of a year we observed all of the bandwidth go up by a factor of 1.7. But the protocol cannot take advantage of it. It requires a hard fork for Bitcoin, which isn't going to happen.

Requires a whole lot of changes for any pal setup, any Nakamoto setup. Um but here is a different one. So look at this Ethereum graph. This is the peer-to-peer latency in Ethereum. There is a a lot of Ethereum nodes, more than 20,000 at the time we did the study.

And you can see that they're far away from each other. There's a lot of people who are sort of distributed around the world. There's a grassroots network. You guys connect, you guys sync. Stuff happens on this network.

Except you're not really participating in the mining, okay? If we could somehow harness your input, then we could actually go and propel ourselves towards a much better future. So this gives me hope, but the protocol is unable to take advantage of it. So the next question then is um is is what's missing. Well, a better consensus protocol is what's what's missing.

So I want to summarize for you the last 40 plus years of consensus protocols. And it's actually fairly straightforward. Um there have only been two consensus protocol families in that whole time frame, okay? There have been more, but two main ones. One of them is Nakamoto consensus.

You know exactly how it works. I'm not going to rehash it. It's very robust, okay? Anybody could join at any time. That's nice.

There is no need for precise membership. Okay, nobody there's no gatekeeper. But it has high latency, low throughput, does not scale, wastes energy, not green, not sustainable, and it completely breaks down if you go over the Byzantine threshold. If if you have more than say actually if you have more than 33% people could start mining selfishly. If you have more than 50%, then they could actually start doing even more malicious things to your to your blockchain.

So in contrast to this, even before Nakamoto, was what we call the classical family. This was developed by Barbara Liskov at MIT who has retired and Leslie Lamport. Both of them have Turing Awards. Nakamoto of course has $6 billion. And classical consensus protocol I mean uh um classical is a is a classical protocols are very very nice because they give you quick finality, but they don't scale, okay?

So they typically require quadratic message complexity. Everybody has to talk to every one of them. You know, there are some optimizations that you know, in the end you trade off latency for uh for message complexity. They typically require precise membership or close to precise membership. In essence, what you're doing is you're building something like a senate.

Here is the 100 of us. When I do a write, I write to 67 of you. When he does a read, he reads from 67 of you. And then he does that guarantees that there are 34 people in common. And if 33 of them are Byzantine, there's at least still one good guy to carry my message over to him.

That's really the core of all of these complicated proofs, okay? So that's the classical world. Casper, Interledger, Fabric, you know, whatever Hyperledger Fabric. Not Interledger. Corda, etc.

All of these protocols are based on classical classical consensus. Algorand, Hashgraph and so forth. And they of course completely break down if the Byzantine threshold is exceeded, right? If you have 34 people Byzantine or you and I disagree in too much of the of the membership of the room, then suddenly the whole thing breaks down. I want to tell you about a new approach to consensus that that actually combines the best of these two worlds and works entirely differently.

It involves a different mechanism and I'll try to explain to you how it works in about 3 minutes or so. This is the Avalanche consensus protocol. It was dropped on IPFS in May of this year. And it gives us quick finality, okay? So it works it achieves finality in 1 to 2 seconds.

It gives us high throughput, about 1,000 to 10,000 transactions per second. It scales. And this is I think the most important part. It can accommodate tens of thousands to millions of nodes. You too can participate.

You could be the Jihan Wu of an Avalanche protocol, okay? And Jihan, you know, he's wonderful at building machinery. He's wonderful at running it. But when it comes to serializing transactions, he's no different than you or me, okay? And you can do the job that he does.

So let's see, it's robust. There is no need for precise membership. Da da da da da. Let me tell you how it works. Okay, it's inspired by gossip networks.

It's fairly straightforward. And uh here's how it works. Here's Here's it's designed to be deliberately metastable. It's a network that will fall one way or the other and make a decision. How does it work?

Well, let's assume that we're making a decision between red and blue. Okay? And uh we're making that in a room this big, and I don't know how many people are here. Let's say a few hundred. And you know, you all know some of them.

I know some of them, but we don't all know everyone precisely. Okay? There's overlap, but not precise knowledge. What you do is you pick five people at random. It's the you, you, you, you, you.

Okay? And you say, "Hey, what color card do you like? Is it red or blue?" And so you ask them, five of them. No Not much more than that.

Maybe 10, depending on how you want to parameterize your protocol. But you're not going to ask everybody else. Okay? In fact, we could do this in a crowded stadium of 50,000 or 100,000 people. Let's do it in this room.

I pick five of you and I say, "Which color would you like to go for?" And they say red or blue. I get back red, red, red. Well, let's see. Let's color this.

Yeah, red, red, blue, red, blue. At the end of this, I go, "Okay, it looks like the at least based on my sampling, people are going towards red. I'm going to go towards red." Okay? You do the same thing.

She does the same thing, and so forth. And uh and that happens at the you know, simultaneously in the first round. And uh at the end of this process, um what what will happen? Well, when we started, the worst thing that could have happened is we were split 50/50, intermixed, you know, there was blues and red and and blues and reds intermixed in the room. After one round of everybody asking five people, we will have over-sampled the reds or the blues.

It's incredibly unlikely that we will remain at 50/50. It's possible. If we remain at 50/50, there'll be another round. In fact, there'll always be another round. Uh subsequent rounds, we will fall to one side.

But more than likely, we will end up over-sampling one of the colors. And the color distribution will now be, I don't know, 51/49. Second round, we do the exact same process. But you can see now that we have this we have started to descend down a hill. And uh and now the second round is much more likely to go in the direction that got favored in the first round.

So if it was 51/49 red in the first round, it's going to be probably 53/47 at the end of the second round uh of uh of uh polling. You repeat this for a third time. You repeat this for a fourth time. And so on and so forth. And the math shows that for really large networks of 50,000 or so, somewhere between 13 to 17 rounds is sufficient for the entire network to topple over.

So you do this process, and after the 17th round, this incredibly dumb-sounding protocol uh you do this, and you hold your card on your forehead, and you flip it every time you hear something. You don't even keep track of history. You don't try to attribute malice to anybody. You just go you do you do the what I just said. And at the end of the 17th round, you look around, and the entire room will be looking around with the same colored card saying, "Hey, you've got red.

I've got red, too." And that is consensus. You have made a decision, and the the the likelihood of somebody choosing red, somebody else choosing blue at the same time are minuscule. That's what the proofs show. That's what the simulations have all shown.

So uh it's naturally sharded. It creates a graph. And uh and uh oh, one of the most important things is an egalitarian ecosystem. There are no miners. There are no special nodes.

You can participate in this even with a cell phone. If you were to try to use a traditional protocol, a classical protocol, all all you know, and if if if we're in a stadium, all 50,000 people would have to talk to all 50,000 other people. If you use this protocol, you end up doing five polls of you know, in 17 rounds. So 85 messages instead of 85 messages per node instead of uh 50,000 messages. So it's an enormous enormous improvement.

It's green. When there is nothing to do, you do nothing. Okay? That's uh what we call a quiescent protocol. I'll very quickly talk about this protocol this uh coin that we're building on top of it.

We're building a coin called Ava on top. It will have multiple virtual machines. There's going to be a token called Ava. And uh it's going to use stake, and people will stake, and they will get a mining reward. There is no such thing as slashing conditions.

Okay? So we could identify them and try to punish them, and so forth. Classical algorithms typically have to do this. We don't have to do it, and we will not be doing it. Okay?

So if you if you stake with Ava, well, then uh you will there is no no risk of losing your funds should your machine misbehave, should you get hacked, and so forth. One of the most interesting things is that we can use this system, the protocol, uh to actually poll the audience and figure out uh and determine parameters of the system itself. Okay? So that leads us to uh uh to to techniques that sort of uh play into this one individual, one one vote. Let me talk a little bit about this governance.

So, there will in any system, there are critical system parameters like the minting rate. Satoshi had to fix the minting rate. You all know about the 21 million. You all know about the halvenings, and so forth. In Ava, we don't have to do this.

There'll be an initial default minting rate that you you know, the award reward rate that you make for stake. But uh but over time, you can actually say something like, "Hey guys, uh we're currently minting at a rate of, let's say, 1% to compensate for coins lost. But it looks like we're minting too fast." Okay? Ask Zcash folks about minting too fast, right?

They're They're coins out there that are minting a little too fast. Um so can Do you think that we should go back down to, say, 0%? Or vice versa, we would like to get more nodes into the system. Let's improve the reward rate to, you know, 4%. And so you can propose this transaction.

And if enough If it's acceptable to enough people, if there is social consensus to be found, then the protocol itself will actually achieve consensus on this meta transaction and change the system parameters. So um of course, you know, every economic system has to be subject to hysteresis, and you shouldn't be able to change the system from, you know, one number to another huge number, you know, from one 1% to a 10,000% or whatever uh overnight. So there's all sorts of hysteresis that's going to be built in. Um and we also are thinking about uh or have been developing techniques for equitable representation. So people with more resources will always get more resources.

I don't know how to fix that. If I were to fix that, then this would be a completely different kind of talk, and I would be the next, you know, Marx plus plus. Um but uh instead, what we will do is uh is come up with techniques to uh uh to do this. That is, people with more resources will make more rewards. Yes.

But when it comes to these kinds of decisions over the the fate of the system, they still have one vote like every other individual. So um we're going to build a token platform on top of this. Uh we're thinking about how to layer it on top of proof-of-work systems. And there's been some interest from existing coins on how to do that. Um I won't say too much about this, but uh there's a lot of movement afoot about how to build side chains built on top of public uh uh blockchains.

And uh and so Ava can actually be a good protocol for these side chains. Um and uh so just a couple sentences. Uh we plan to support multiple virtual machines. I don't know why, but everybody else is in this uh mode where they just think in one one token, one scripting language. Um I think we were the first ones to say, "Hey, that's kind of silly.

Uh we can support multiple and many." And uh if you want to create a new token, and you you you want your token to have ring signatures and zero knowledge proofs, and also something else, you should be able to do that. And then we will support exactly that. Um it supports asynchrony. Um just one word for if for Vlad, if he's in the audience.

Uh as an academic, it's kind of odd to say this. All my colleagues love asynchrony. They demand it because academics love Sunday puzzles that are hard, and we try to hold each other to difficult difficult questions. Um the that infatuation with asynchrony is kind of silly. I find it to be uh uh what I call academic, really.

Um asynchrony helps if your network partitions itself into non-trivial partitions. If you expect the US to be decoupled from Europe, then you should by all means support asynchrony. And uh and uh we haven't seen that in my lifetime. So uh and to give up from your best case because you want to to handle this worst case is actually a bad bad idea. But nevertheless, um because we got questioned about this, uh we decided to add um asynchrony to to the Avalanche protocol.

So um to summarize, there is a new tool in our arsenal for building the dream that we all share. Avalanche gives us a new kind of a protocol. And there's been a lot of false narratives out there about Bitcoin. It achieves this and that. It finds social consensus.

It does this and It doesn't do those things, right? And in Bitcoin, the only voice you have is as a miner. Otherwise, you don't you know, the only thing you can do is exit. Right? And that's what we've been seeing from the Bitcoin ecosystem.

And um and so in this system, you actually get to have a have a voice. You get to participate directly in the decision, the serialization of of uh transactions, and the decisions over the financial future of the network. And overall, the area will rise or sink together. I would love to see I think we're going into a phase where, you know, all the crappy coins already kind of got introduced, and we're going into the phase where we're going to see more and more sort of worthy, interesting projects uh introduced. And I would like to see the top 10 be a competition among those kinds of projects.

And uh and I believe the area will either rise together or sink together. And I'm looking forward to working with all of you to build a an exciting new platform. Thank you. Mhm.