PoS Security and Ethylene by Emin Gün Sirer (Devcon5)

so today I want to talk to you about proof of stake proof of work and some fun ideas that we should all consider as a community so I've been thinking about this topic of course for a long long time and and it started out by us looking into this much vaulted you know this this thing that has become almost religious this notion of decentralization that's at the core of many decisions made today in cryptocurrencies so we started to look at this scientific thing just how much these cent relation this centralization is there out there and what exactly are we paying to get to that level and so and my thesis here is going to be very very simple proof of work and the decentralization that it brings is incredibly limited we have to move to proof of stake and on that front I have a suggestion for this particular audience and in an offer and I want to talk about it very openly and put certain topics some of them might be difficult for some people on the table so one of the things we did was starting in 2015 we did a very long longitudinal study of proof-of-work networks we looked at Bitcoin and aetherium and we discovered a few things so this graph shows the bandwidth available to unknown to a Bitcoin node versus an aetherium node okay so and then of course there's one line that's for tor so it's better to be to the right and you can see that tor nodes have very low bandwidth as you would expect because they get the unanimity you can see where bitcoin is and you can also see that aetherium nodes are actually doing fairly well as well so there's a lot of bandwidth available there there's a big big network when we look at the network location we discovered some interesting factoids about both Bitcoin any theory on Bitcoin turns out to have the majority of its nodes housed in data centers 58 percent of Bitcoin nodes at the time of our study were in data centers the etherium nodes tended to be geographically more distributed there are many many more of them at the time we did this there were about slightly less than 10,000 Bitcoin nodes and slightly more than 25,000 aetherium notes this community is strong its large it's huge and it's globally distributed and that's fantastic that does mean that the node to node communication latencies are a little higher as you can see on this graph the green bars are toward are more further to the right which is not good for this graph but regardless it's not so bad their communication latencies are about 100 milliseconds not that bad there are many many many of us and that's fantastic now the problem is when it comes to making decisions those nodes that we run bring no value okay the entirety of the blockchain is created and controlled by a very small number of mining pool operators at the time we did our study the Bitcoin the Bitcoin blockchain was being created by 19 mining pools the etherium block chain was being created 99 percent of it was being created at the time by 11 mining pools that's gotten a little better today I just checked and there are about 37 of them that's kinda nice if you look at the field that actually control the hash power it's tiny so Bitcoin you could launch a 51% attack on Bitcoin you could revert the chain you could rewrite it after making three to four phone calls and the same is also true for aetherium so all of that that anxiety all of those internet attacks all of those decisions and compromises made in the name of decentralization come down to a tiny amount of decentralization a tiny amount of distribution three to four people define this thing and that's it so that's a crazy crazy thing to be doing not to mention the environmental disaster that is proof-of-work so Nakamoto consensus consumes an immense amount of energy just so we can visualize this it's about the equivalent of the entire energy consumption of Austria it's the equivalent of - Denmark's 3 Ireland's and if you want to think about those cooling stacks and so forth that you see when you see a nuclear power station before nuclear power plants go into cryptocurrency mining and so there are of course two different sort of approaches to this some people are inherently concerned about this because it melts the polar icecaps it literally kills the polar bears I'm in that camp it's really really bad when I think about what I'm doing and what that's helping the world you know where that stake in the world I feel terrible about myself other people are more like well I got mine you know screw everybody else kind of mode and you know there are many other sort of justifications they use that's okay and to them you know especially the store of value crowd and to them I say well look you're leaking a lot of value out of your system so to be able to construct your your blockchain with the help of these you know whatever you want to call you the 11 to 19 minus 3/7 miners whatever they are you are paying an immense cost there was a very recent study that was issued just maybe last week that looked at the environmental the externalized costs of mining and they found that for every one dollar of Bitcoin value created there was an external cost of forty nine cents of health and climate damage in the US and 37 cents in China so this is not something we can stand behind this anybody with the conscience should be able to say look this is really really bad we should not stand for this and when it comes to the security or what's going on the security of the coin is being secured by an investment in mining rigs that is a cool equivalent to about two to three percent of the market cap of the coin okay so if I keep in mind that a mining rig is some kind of a stake it's the stake in that hash function somebody decides that I would rather mobilize my capital and and turn it into this format which is this mining rig and and the amount of money that went into that is is only two to three percent of the sum total that's tiny that is not much at all and that those rigs do not are not specific to a coin for example if you own a Bitcoin mining rig today you could take that rig use it to attack what every other coin that shares bsv crash bsv rewrite their China as well as much as you like and then after you've completely screwed over BS Li you could go back to your Bitcoin mining unaffected you simply gave up the opportunity cost of mining on BTC but you did not lose your stake that your hardware was usable afterwards now compare that to proof of stake where an attack a successful attack will burn the cash that you put into the system and compare that again to proof of stake systems where we see upwards of 60 to 70% of the coins stake in the system the security the amount of money you would have to burn to attack is much much higher than proof-of-work systems I hope these points are somehow sort of make the point that that you know the narrative that you get from the Bitcoin loudmouths is essentially just a whole bunch of security theater a whole bunch of decentralization theater so what can we do well so to sort of think about what one could do one has to understand where we are today and one has to understand one's options when we talk about well ok let's ditch proof of work that sounds like a sensible thing to do why we are all people with consciences but how are we going to do that well we have until recently we had just one choice because of the particular history this is what we had this area of distributed systems has been around for about 45 years and for the first 35 of those years we were always in this framework that we call the classical framework the two people who came up with that framework Leslie Lamport and Barbara Liskov independently received touring awards they're brilliant and within that framework hundreds maybe thousands of different consensus protocols have been proposed we knew about all these protocols 10 years ago in 2009 Satoshi knew about those protocols he looked at them and he said these protocols are no good they're very very fragile they don't lend themselves to an open permissionless system and that's why he came up with his Nakamoto consensus protocol which showed the world what was what what one can do with bft systems we showed the world what the coin could do what the permissionless coin could look like so it was a fascinating proof-of-concept but we are now beginning to see its shortcomings it is not as decentralized as it could be there is natural monopolistic effects where one miner becomes dominant over time and the amount of energy going into it is enormous and so on and so forth now what can we do we can go back to the 70s the 80s the 90s and dust up old papers and put new lipstick on on old ideas to try to make them look prettier and okay again and try to fold them in to our current context no matter what we do around that topic we will find that those protocols are incredibly fragile we knew this at that time we knew this ten years ago we know it now if you talk to various different people who talk to blades and here for example about his expectations of e - oh he will tell you that he fully expects consensus failures and that's not that's because of of the fact that these protocols are very very fragile something interesting happened last year there was a new protocol family launched its called Avalanche and it works differently from the others it is not based on voting it is not based on a single round or just a few rounds was based on repeated rounds of sampled sampling an audience and that gives us an incredible incredibly different set of of properties and I want to talk about that and what I really wanted to talk to you about today is something we built using that protocol it's called a theorem and it's a test net for aetherium okay so you can use it today and I'll show you maybe I was trying to show you a video we came up with a school logo it's alpha plus aetherium and you combine the two and you've got a theory and and at the core of it lies a very simple idea okay the idea is to take the the Avalanche consensus protocol and to adapt it for use with aetherium and just like you have multiple test nests for aetherium there's the runs this is that we can also have the a theorem test net that people could use now the properties of this test net are interesting it is very very very fast these protocols are incredibly fast we're getting three thousand decisions per second on the a theorem test net on the linear chain that we built it's totally ordered we're getting higher numbers you might have some of you might have heard me talk about avalanche we have much higher numbers for avalanche but that's a different kind of a system that has partial order and asset management and so forth that's a different different thing this is a little slower because we're creating a totally order chain and yet it's three thousand decisions per second now by the time you put it through the EVM that goes down drastically and the numbers that we're seeing today are about 200 transactions per second but that's due to our view the current EVM design that we're using which we stole entirely from get so it's not only high throughput I think the a lot of this game turns out to be centered around TPS numbers TPS numbers are incredibly easy to fake and if you want to sort of look for an example of this ask as the header hash graph people for a demo so the thing that's really important is finality and I suspect that most people have not seen just how awesome these systems can be when they when they operate with quic finality so the avalanche family gives us finality I can't give us finality in less than a second range that's our target on our current test net we're getting 90 milliseconds super fast and the most important feature of this protocol is that it can incorporate any number of participants so if you want to add a thousand more people to directly participate in the protocol it can absorb those thousands this is something that nobody else can say Libre for example is a classical protocol it's using the fastest known classical protocol designed by my student by the way who now works another and they're getting they're targeting a hundred validators that's the best they can do more than a hundred then the N squared starts to bite them so the further calls work differently and they can accommodate as I said thousands to millions of participants you and I and all of those existing nodes that I counted before that we looked at before they can be part of the network they can help the network make decisions they can help secure the network law enforcement can send a hundred subpoenas in the same day no problem they cannot send 25,000 subpoenas to all 25,000 of us and and finally the implementation that we have is byte by byte compatible with the EVM so everything that we know we can just take and run on top of this new infrastructure so the plan here or the idea here is the spoon etherium over to over to the oven network and so some of you might not have heard the word spoon before a spoon is a fork that's friendly I'll talk about why this is friendly and why this is good in a second and that creates a theorem for us in doing so we plan to of course preserve all balances okay and in doing so we plan to preserve all community tooling so things like solidity meta mask remix all layer two solutions they should continue to work untouched I'll talk about the slight exceptions and the things we discovered along this path in a second but the core idea is to preserve everything that we know to do except move it to move it but give you a platform where you can do it much much much faster not move just just give you an additional alternative so some things that there's a lot of noise out there so it's been about a year and there's been some some discussion around this I want to make sure that everybody understands the basics we're talking about a totally ordered chain you know as I mentioned before avalanche builds a partially ordered dag but within the dag we create an actual straight-up in a regular chain that looks exactly like the current blockchain today it's asynchronous there are no baked in assumptions related to timing or delivery of message of message latencies okay so it's robust it tolerates imprecise membership in network views so I could think that the network consists of this many people you could think that consist of that many people that's not exactly the same that would be catastrophic if we were using a classical protocol for avalanche it's no big deal that's totally normal it'll work beautifully even in the present presence of differing views it's secure unlike most other protocols you could actually tweak or parameterize avalanche of the Avalanche protocol to the core protocol underneath to withstand attacks that are greater than 51% of the stake now the protocol won't necessarily make progress we cannot guarantee liveness in the presence of such a big attacker but it can guarantee safety in the presence of such a big attacker this is unprecedented it is a gracefully degrading protocol so classical protocols typically I think you've heard of italic talk about three F plus one or you might have heard other people talk about the one-third cutoff there typically are our what what happens with them is they can handle attackers as big as one-third of the network 33% and if the attacker is slightly bigger than that then he is guaranteed to win okay so that's an interesting property with this new family of protocols the the greater the the degradation is graceful if we gear up the network for an attacker size of 33% and the attacker mobilizes 40% of the stake in the network to attack the network I think this is incredibly likely but suppose it happened he doesn't get to win immediately and again this is unprecedented what happens is sure because he's bigger than we anticipated it's because he's bigger than we what we what we geared the network for we can no longer make the usual security guarantees the the probability of a safety failure is not going to be once every 20,000 years but it also doesn't mean that he wins immediately instead what it means is he might have to he might be able to create a safety violation not in 20,000 years you know in the time that's a little quicker maybe in 5000 years or 2,000 years and that's a very nice situation to be in because one your assumptions violated your system doesn't just keel over so I was going to do a demo but I think what I'm gonna do well I can show you pieces of this demo let's see so I don't know what what there is look at all these demos look the same and they look kind of bad so you can see are we hearing it we're not hearing call and talk so in essence what you get to see here is on the Left we have a block Explorer and on the right we have a screen where your terminal where he's going to issue 2000 transactions and and that's my ether wallet that everybody knows and loves it took me five minutes to set it up with a drop-down so once you have the drop down you can say look I'm gonna I'm going to issue some transactions don't send them to the the regular main etherium Network send them to the a theory em test net so I don't know what's going on with this with this demo stuff is happening okay now maybe it is moving alright because we can't hear the volume or the sound we can't really tell what's gonna happen and I can't forward this fast forward through this because I don't have a keyboard on up here so what should happen is you should see an enormous flurry of activity as soon as the issues as transactions you know what I'm going to do instead of staring at an empty screen where nothing happens for a while and then things just kind of float by I'm gonna let you imagine that this thing goes really really fast okay so please bear with me it really does go very very fast and I'll give it maybe two more seconds oh yeah okay so um yeah what we were planning to do for this audience was was set up a lottery okay so we have this lottery contract and you can see that you know just for testing purposes we ended up putting 11,000 registrations there we're gonna ignore those and so as of this moment it's going to be checked pointed and you can just connect to this network and and send any message to this contract okay and you just register your public key will do a drawing and this will distribute some swag to everybody and that's calling the talking in the background and you know what I'm gonna do I'm gonna all right he's gonna issue is two thousand transactions all right Colin please okay now you can see just how fast this thing is and it's kind of amazing to watch it grow and you're super freaking happy I'm gonna skip this okay so we decided to do this two weeks ago and much of my time was spent not on technical stuff but on talking to people and saying look this is all very friendly we want to make sure that nobody's upset about what we're about to do it's a test net and and so forth it's very early for us there are no no denial of service protections okay we do have the gas logic in there but we're not using it so if any one of you decides to Dass us you can and so please don't okay it doesn't really demonstrate much the fact that you can das a test net okay big whoop so but you know it's a fun thing to play with and so my proposal to the community is that we put up this test net make this test net available for you and we play around with it that's really the entirety of the proposal on the table as of now but we are also thinking about creating a spoon so as what's the spoon again we're going to identify a height in the future at which we're going to duplicate the state of the chain at that height okay so that means all of the balances are preserved so everybody who holds eath they now hold that much ether Navas okay eat on a theory and all of the contracts that are deployed on east today are going to be deployed also on eath on a theory so this gives us a very very fast Network and scalable one right now that's a wonderful situation to be in there are lots of other groups working on making aetherium fast you know about aetherium - you heard about Vlad CVC casper work I'm sure there are others out there so it's wonderful to be in a community with so many people trying to make the infrastructure better this new infrastructure we're offering is completely optional we're not asking anybody to burn their main net coins you don't have to buy into this thing you just get it all okay and there's no lock-in and you don't have to change any piece of software we don't have to go and talk to anybody there is no permissioning step involved it's just out there you just add a different interface a different RTC endpoint and all you're off to the races it does not compete with each - OH it in fact takes the pressure off of each tool because there is now at least a test network initially and perhaps sometimes soon a real network that actually works and works at scale and as there are EVM improvements we can incorporate them now we're not EVM people we're not going to be making those improvements ourselves that's still the dot of the the domain of the etherium foundation we are simply giving a new layer one that the very very lowest layer and we're relying on the etherion foundation for the development of the EVM itself that's I think the core intellectual sort of thrust of this this endeavor here I mean demonstrates as I said that it's possible for easter scale today and and it preserves everything that's at least to me quintessentially aetherium so all balances all contracts all tooling and of course all of the colourful shorts and so forth they all remain aetherium it's just that one layer gets a little faster so spoons are nice and the one of the things that they help us do is identify future problems currently brewing on chain one of the main things we discovered immediately is there the the tooling itself is not currently geared for blocks that are lightning fast so we're getting block times that are about 90 milliseconds the tooling assumes that you're getting at most one block per second so that's a bit of an issue that we have to keep in mind because that might no longer be true we're also identifying a bunch of smart contracts that assume a certain block interval somewhere between 12 to 15 seconds between blocks that's no longer going to be true now even no matter what happens with the switch the pls those contracts will have to be rewritten and if they cannot be rewritten they will be broken so keep that in mind because this is coming and this is a good way your test net is a good way to explore these problems before they happen much more importantly and the thing that I'm most excited about is that a theorem would help bring more people into the infrastructure we are all cut out unless you own some mining rigs and I'm sure some of you do we're cut out from the infrastructure we're not participating all of that diversity at the network layer is not reflected during consensus we have no voice only the miners get to produce the blockchain and now we can all participate that's an interesting situation to begin there's no cabal formation because there's no committee selection it's not like this protocol is going to be sub selecting a small group it's not like a OS where we vote on each other and us 21 people are in and then we vote on the next person to come in etc there is none of that happening everyone gets to come in and participate because of the way the efficient way that this protocol can work so some people might object to this I worry a lot about this because you know I did right I've been there for the the Dow fork I've been there for the Bitcoin cash fork I've been there for the bsv fork and so forth one thing to keep in mind one of the things that they might object to is hey this eighth on a theorem is not the same as you and that's true but this is not a zero-sum game that is we can create excess value for everyone the fact that we're now introducing something else should or the fact that we're showing to the world that it can actually scale should indeed make everybody - all the boats go up and it's much better than a burn or a lock or an explicit transfer let's see there are existing miners that made an investment in mining rigs they won I think very vociferously be against any push like this and I don't know what to say to them but there was very clear guidance from everybody that mining was going to end for aetherium at some point so so they took a big risk so I expect them to be vocally against this idea but I do know but then again they took that risk on their own despite the the guidance of the counter and there might be people out there with ego tied up in particular solution strategies again I don't know what to do about that except to say that the etherion community distinguishes itself the and why I'm here why I love this coming to you so much it's because of its devotion to scientific study that if any any group of people are going to look at the merits of different solutions and pick accordingly it's this community so let's do it that way let's do it on the principled manner why just based on what happened yesterday there were there's this whole issue about airdrops and tax obligations and so forth this kind of spoon is explicitly mentioned in that guidance as a non tax reportable event so it's not like you suddenly have a tax obligation there are some other boneheaded things that are in that guidance but at least those those things don't affect this particular idea so then there's the final thing that I want to talk about which is why are we doing this right so there will be people who sort of are suspicious of my motivations here I don't know what to do about that I think all of you know me I've been around for long enough but let me try to enunciate sort of how what kind of a person I am and what kind of thing we're trying to do here I am here and I've done everything I ever did to make the space better to a fault and I'm proud of my record on this many the applications demand high scale right now we do need a solution and we do need to show to the world that this area can overtake Wall Street and move it to a better foundation it can overtake governments and move them to a better foundation and most importantly can overtake corporations and business logic and make them trustworthy again well so where is that well it's not in Bitcoin I assure you of that at three to five transactions per second and at the moment with 20 TPS or so it's not any Theory m1o this is one path forward of course I want to demonstrate and test my implementation our implementation of avalanche underneath and so that is one of the key motivators for us I want the creativity of this community coming in and checking the protocol implementation that we have is it there's a great way to shake out any issues we might have and I want to see it with the whole set of things that I've ever been deployed on only theorem that's a very rich set of applications I want to see those and see you see whether or not we can support them and of course I want to create awareness for the underlying our technology so you guys should all come and check it this stuff is super fast maybe use it just for this and then you go away maybe you don't touch it that's ok too but maybe some of you will stay and check out the other other features that we have we have a bunch I'm not going to go into them here but it's a cool platform so if you're interested this is the the link this is the link a theory about network there's a very long write-up on how to configure my ether wallet to point to it we've also configured meta mask it's just you don't have to change any binaries you don't have to trust any of us as trustless technology from the ground up you just add you know one RPC endpoint and you're off to the races using this test net so with that thank you very very much but thank you all for coming to talk [Applause] you