[Music]
hello okay we are moving on to the the
panel and this panel is about Casper and
distributed consensus my name is Alicia
I'm a professor Cornell and I'm very
honored to moderate this panel we have
four distinguished panelists and I'm
going to begin by having the panelists
each means each spent two minutes to
introduce themselves and also and maybe
a short concise statements are pitched
that you would like to make regarding
distributed consensus and then I'm going
to ask questions and I'm going to open
it up for the audience to ask questions
so because we have a big room for those
of you who want to ask questions I'm
going to ask you to move to the front so
everyone can hear you when you're asked
questions ok all right
let's maybe start from so hello everyone
who here does not know my name ok I see
some hands right it's good I'm Vitalik
chief scientist of the etherium
foundation so earlier this morning I
gave an introduction to it basically
what if Theory M is from a technical
standpoint but I also mentions that in
later today I'd be talking a bit more
about some of the projected things that
we wants to do in the future of etherium
and one of the big threads that of kind
of research and developments that we
have at the etherion foundation is
Casper
so Casper is this kind of category of
proof of stake consensus protocols that
we have been thinking about and
developing researching over the last few
years that are based around a couple of
principles and so one of them is
obviously decentralization and visiting
fault tolerance which is really a
synonym for decentralization because
both words basically mean that one
single guy can't screw up and break the
whole thing then we also have this idea
of economic security that I'm sure if I
will talk about much more and can we
don't really cry
him for and of pushing hard on putting
that at the front of the agenda so
personally I have been spending my time
more specifically on movie pushing
forward with a Casper the Friendly
finality gadget or I can't wear a Casper
FFG so this is what one of the two and
if algorithms in the Casper family and
the goal of Casper FFG is to be
something that's as simple as possible
and as simple to graft onto the existing
proof of work chains as possible while
at the same time theoretically being a
fully fledged and provably safe safe
under asynchrony a busy teen
fault-tolerant consensus algorithm so
the idea is that it really it takes sort
of pbft like like i you know we imports
a Byzantine generals paper like ideas
and it's basically translates them into
a blockchain context and like really
simplifies them substantially to the
point we are as a chunk we showed
earlier today the kind of consensus
rules swashy condition fortress walls
are fairly simple to implement so the
goal of casper FFG is to basically be a
proof of stake that can be implemented
fairly quickly overlaid onto any proof
work chain today within i - in leader
stages of the roadmap and like
implementing more advanced things like
full proof of mistakes so getting at
getting rid of the proof of work
completely as well as know things like
some of the more advanced features that
Vlad wants to include yeah I think
thanks for thanks for talking yeah so I
mean I definitely you know feel like the
proof stake research that we've been
doing over the years has like you know
to kind of bifurcation is like the
economic stuff and the consensus stuff
and you know they're really kind of at
the end of the day end up being really
tightly connected because the limits to
our ability to incentivize the knows is
to infer that what behavior they
actually did and the limit and the
limits there are actually limits to
fault attributions and that has to do
with like the really the mechanics of
the protocol right which is why we need
we want not just say prove that it's
fault tolerant but prove that when there
are faults we can find them right so
that we can penalize the faulty nodes so
that not only
you know can we tolerate faults but we
also disincentivize them so you know and
I think that like the both sides of the
research have kind of come a long way
and actually feed into each other
actually in a very kind of tight way to
me like today the thing that's the most
exciting to me is kind of the stuff that
I kind of just showed right I like the
fact that I think we can get like I mean
I'm sure we can get asynchronous safety
with any like you know just like pick
your fault tolerance threshold with an
overhead of nakamoto consensus is I
think really cool and something that you
know is I think new technology and I
kind of want to echo what Alex said that
I think the simplicity of the protocol
specification and this is implicitly of
the proofs is the kind of paramount to
our like design philosophy or our design
goal hello I am Peter from priority
technologies so at parity we've been
implementing we've been working on
consensus and on implementation in
particular of consensus for a while and
we kind of taken a step by step approach
now it's somewhat converging to a lot of
a lot of research that is coming out but
we started off by separating the
validator set so that piece that decides
who who is the current set of validator
so when if it might be determined by the
start by their stake or by support of
other parties so that would be proof of
Authority and then the consensus
algorithm itself and then we started off
with a very kind of simple consensus
algorithm that was based on a basically
issuing proposals in in around so it is
somewhat similar to what what Vlad
talked about at the end were validators
kind of issuer blocks
sequentially and then then we added
finality so that was basically a module
that then looks at the blockchain and
any and any particular point and sees
who signed off on on which chain and
basically if someone signed off on a
chained and the knot contributes to
finalizing that particular chain and now
I think we the other things that that
will be interesting is introducing new
message type so enabling not only
validators to finalize blocks not only
by releasing blocks but also releasing
just simply statements on validity of a
particular chain act speeding up how how
fast the blocks can be finalized in
these types of algorithms and of course
working more on the validator set so
more working more on the economic side
of those protocols and yeah the
validator set as are right now they
support providing misbehaviour proofs
and those misbehaviour proofs can depend
on the type of consensus engine so they
might be double signing and then the
verification of them is behavior proof
happens on chain and then sloshing can
be done based on that okay well thank
you very much for having me here my name
is Amin Geun Sarah I'm a professor at
Cornell University I'm also a
co-director at the initiative for
cryptocurrencies and smart contracts so
there are a couple of things that people
should maybe know about me but the most
important one beyond anything I've done
in the past like I did play a pretty you
know early role in cryptocurrencies and
something called karma in 2002 2003 it
was one of the first implemented system
with a proof-of-work minting in it but
beyond that so many of you know that I
played a role in anticipating the Dow
hack and so forth but the most important
thing I think is is the following it's
it's I think why partly why I'm so
excited to be here this is a very
science driven community and in much of
my work what I really value is science
based design with strong guarantees so
this is a domain where there are
many many many many reasonable sounding
protocols that anybody could just come
up with at any one time
you know I essentially reach into my gut
and I give you something or any sends a
message to be sends a message to see and
there's been no shortage of white papers
containing these kinds of what we call
designed by gut or wishful thinking
design or sunny day design and those are
fine they might work but as we often
find out the the devil is in the details
and what you should all demand as a
community our actual hard proofs within
the absence of those proofs these
systems typically tend to falter so in
every answer that I give to any question
it's colored by the science driven
design I'm very much restricted in what
I can say publicly and privately because
I know I have to just say things that I
know to be true that has allowed me to
actually be very correct in you know
present in some ways but it also means
that that I demand a higher bar for for
protocol designs and I hope you will too
and I think what we're seeing happen is
kasper is gradually getting to the point
where it's actually beginning to reach
that far and we're finally getting to
the point where we understand the
workings of the protocol better and we
will hopefully soon have something thank
you so much for the excellent statements
and I'm going to begin by asking a
couple questions and if you would like
to ask a question I'm going to ask you
to maybe move to the front and at the
yellow line and then me will be able to
and pass you the mic okay so my first
question is regarding the debate which
improve our work and proof of stake
right so we all know proof of work is
probably in the longer term not what we
want because of the enormous energy
waste but there have been a lot of
debate in the community about the
security of proof of work versus the
security of proof of stake you know some
argue proof of work is more secure
others argue proof of stake is more
secure so for aetherium for instance one
reason why you guys start moving to
proof of steak I mean obviously other
other than the the energy waste you're
also you also want to have an incentive
compatible protocol but I wonder what
you guys think of this question like the
security of proof of work versus proof
of steak in particular imagine I'm not a
rational player
I just want to attack the system and
break the consistency do you think like
the proof of steak approach actually
increases the cost of such an attack so
firstly I would say like okay proof of
work is not a synchronously safe right
and that's one of the main differences
actually between proofs taken before is
a improve steak you can actually achieve
like finality right and like actually
decisions that are not be reverted and
that are safe in acing cream I think
like that increases security a lot and I
think that in terms of the the damage
that an attack could do the fact that
blocks can't be reverted arbitrarily
really mitigates that and then and then
additionally the fact that when they do
when the safety failure does happen the
faults are attributable and the knows
who attack can lose money means that the
knows who are attacking can operate a
will operate at a higher cost the nodes
who are not attacking which is like not
a cannot the case improve works I think
you know for those reasons and more like
proof steak is like gonna be more
expensive to attack and your attacks
gonna be more limited yeah so let's say
that you are just to be politically
neutral the government of the Democratic
People's Republic of Korea and you want
to just basically take to destroy a
proof of work watching right so what do
you do step one but one you know we
could just imagine a very full direct
attack right so you would get a billion
dollars and you know okay fine some of
your people can go without food but you
get a billion dollars and you buy a
whole bunch of a six and then you just
launch a 51% attack on the network now
what it would are the developers going
to do in response well they have exactly
one strategy which has changed the
proof-of-work algorithm so let's say
they do that right so what happens this
is basically kind of literally the best
possible care
because if you don't do that then they
can do what's called a spawn camp attack
which is basically they just keep on
attacking over and over again and they
make your chain permanently useless so
you changed probe work algorithm which
means the Asics become useless which
means that you know the attacker has
lost a billion dollars but all of the
good guy miners lost all of their money
as well right so that's one area where
like proof-of-work already started
social weakness because it means that if
an attack is going to happen then
there's actually fairly little incentive
to be on the attack on the non attacking
side versus being on the attacking side
so then okay it's down at GPUs now let's
say you get another billion dollars and
you basically corner the market on GPUs
well what is okay you do you launch
another 51% attack now this time GPUs
are general purpose hardware and so the
developers have no other counter move
right basically step three of the game
and that's game over you know if you can
just you know the you know the North
Korean government can just keep on you
know doing a spawn camping can keep on
the sensoring transactions doing 51%
attacks you cannot change the
proof-of-work algorithm again because if
you change it again then while for the
new algorithm GPUs are going to work for
it as well so this kind of puts an upper
balance on basically the amount of
damage that a proof-of-work chain can
take which basically means that a
proof-of-work chain has in order to
survive has to make this cost of attack
very high which is basically this kind
of doctrine of you know like survival
through the through domination and
massive hash power now let's do look at
proof of stake okay so you know uncle
Kim buys up a hundred million dollars of
ether then you know it doesn't okay fine
you know BFT 33 34 percent balance so
you can definitely launch a 34 percent
attack or a 51% attack so okay
you launch an attack and let's say this
breaks finality or this sense there's
transactions for a while well guess what
the economics of Casper are designed in
such a way that if you do this then
worst comes to worst the community can
coordinate a hard fork so this is a
totally legitimate move because you know
even the proof-of-work people agree that
changing the proof of work is a
legitimate move to count
51% attack and that's also a hard fork
so the community that's a hard fork to
hard fork away from the attack now the
difference here is first of all the
attacker actually does who is most or
all they're all or all of the money they
used to attack and second anyone who did
not participate in the attack does not
lose any money so okay step two of the
game basically three days of chaos
happened the community recovers there's
a hard Fork well okay buy up another
hundred million dollars do another
attack okay three days of chaos
community recovers do you another buy up
another hundred million dollars of ether
do another attack well soon enough the
community is going to realize that this
is what's happening eventually uncle Kim
is going to run out of money and so
they're just going to sit quietly and
people are going to start buying up
ether and each and every one of these
attacks is going to keep increasing the
price of ether because it's basically
taking 100 million dollars of ether off
the market each time and permanently
destroying it so eventually you run out
of money and the community wins right so
this is kind of basically the moral of
the story is that because in proof of
stake thus taking coins are defined in
the assets used to stake are defined
inside the system the results basically
is that you can make these rules that
yeah a huge amount of flexibility to
make these rules that are basically
extremely lopsided in the defenders
favor and that basically means that no
if but if the attacker has some amount
of money then they can basically break
the system maximum a limited amount of
times now one really nice goal for this
is of course to see if we can actually
formally prove you know what's the
balance on amount of money you have
divided by the number of times you can
break you can force the community to
hard fork which would by itself be a
very interesting challenge but we
stopping itself shows the asymmetry so
to pile on the both blood and the Telex
responses I think what's going on here
is fairly straightforward with proof of
work we're at the mercy of hardware
trends that's that's it we're the
control of the security of the system is
out of our hands as trans change as
people invent new technologies with
let's say with
various process level tricks to get to
pack more transistors to pack better
hashers into the same diarrhea as people
come up with better heat cooling
etcetera tip tricks we're going to see
hash power shift hands and we will have
absolutely nothing in our hands no knobs
we can twist to control what happens I
think everything that you heard from
metallic was like exactly fundamentally
rooted at that cause and with proof of
stake we have the ability to actually
put independent individual knobs on each
and every one of the participants in the
system this is huge it gives us an
additional multiple levels multiple
dimensions of control over the system it
also makes the problem much more
difficult that's why there are multiple
casper the world multiple casper
variants that's why it's actually hard
to figure out exactly what you should do
because the design space is so big and
and so if you could conquer the design
challenge if you could come up with a
protocol whose properties you can prove
then the potential for having a secure
protocol is much higher for proof of
stake than for proof of work yeah I
think as was mentioned previously we've
proof of stake the distribution of
control and of stake hairs can be much
wider so anyone that has any sort of use
of the network and can submit a stake
and and in a way be invested in the
security of the network and there's much
less overhead to hold and is taking the
network rather than having to buy a
miner and mine on the network or buying
a share in a mining company it's a much
more direct connection to the protocol
itself but then at the same time I think
what was another problem that can arise
is if we have many participants in the
consensus it becomes very
expensive to run the consensus process
amongst many participants so a lot of
systems have something like a delegated
proof of stake where only a few parties
actually participate in consensus while
everyone is kind of just delegating to
someone else and that can potentially
lead to issues with with very few
parties kind of having a lot of control
over the network so I think an important
thing that we'll need to think about
this how to kind of manage this balance
between distributing the power to every
single person that wants to have it and
and and maintaining security or being
able to run this consensus in an
efficient way
just a really quick add-on even if the
concentration of proof work approvers
say go the same the fact that there's
lower barriers of entry and prove a
mistake will mean that it behaves in a
more competitive way so even though I
totally agree I think like stake is
gonna be less concentrated than work
it's gonna be more competitive even if
it's the same concentration because the
lower barriers entry yes I really liked
our points and let's take a question
from the audience
cool is there concern for link rot with
Casper implementation link rot like
something maybe is staked and placed in
the chain and validated and placed in
the chain but the the chain that it's
representing is no longer exists do you
mean can no longer be downloaded or do
you mean right yeah yeah like some of
some of the people who were part of this
this chain that was then used to be
placed in the main chain that doesn't
exist anymore or the you you seem like
you're describing a scheme that involves
multiple chains so it's a good question
about sharding yeah I think so yeah okay
just the kind of fast forward ahead
about one hour before we fast rewind
back to here I guess it the answer is
that there definitely is our in general
worry is that if the system gets shorted
to the points we are a very small number
of nodes and storing each individual
piece of data then it is totally
possible that some portions of the state
could just end up getting lost now there
are ways to make the protocol more
capable of surviving that and there are
also ways of mitigating that and you can
there are also ways a bit of an
incentivizing storage and there are you
could also just basically limit the
shorting coefficients so that you still
have any like statistically speaking
like a few hundred people storing each
piece of data so that's safe enough and
this is a very active area of research
thank you okay we can take maybe one
more question from the audience and
hopefully I got to ask my last question
okay here's a question sort of on the
economic mechanics of between perf work
improves take so I mean obviously we're
now improving working in Bitcoin for
example or a theorem is the useless
outside of the community etherium I mean
you know you're just doing a bunch of
hashes or competing a hash with a dag
but say if you had a proof work like you
know to try out like if you could
somehow constructively work that wasn't
pre my novel that solves an interesting
problem like protein folding or
Traveling Salesman
then I think on whisper work you have
this nice benefit that nicer benefit
that you kind of lose interest ache that
you can say look here we have Moore's
Law and maximum processing power sorry
the maximum manufacturing capacity in
the world and say you know in the next
year like the hash rate could only grow
up to this point right and the hash sure
grows beyond that point then the if like
the price remains the same and if the
hash green is Briana beyond that point
you know means that like the growth of
the hash chains power
exceeded the Moore's Law curve so you
know like there has been more economic
interest in the chain and you know like
you can actually could have like a total
upper bound like if a hundred percent of
all you know new processors are end up
being used to the further proof of work
obviously you can't have that because
that makes less versus society
invaluable and therefore like I mean
there's there's a good balance there
there's like about like there's a parity
balance there that you can't compute and
improve a stake this isn't the case
because like the proof
yeah like say we have okay 10 percent we
either can be staked on any one time or
something like that the secure the chain
from one one to from one morning to the
other really depends on like the chains
total value come over like the ratio of
that over world's processing person
purchasing power parity right the world
GDP so the world's GDP is way high and
the chain becomes much more valuable
like then like because it's like like
the price is really a lagging indicator
or that somebody could come in and like
end up having a freedom or person attack
on the chain because it would or have
disproportionate stake in the chain
because it would be valuable for them
and if they do either way like also if
they do buy a lot of stake to do Anthony
1% attack they could short right right
before did you attack the attack which
makes it cheaper or perhaps worthwhile
so how do you sort of balance of you
know like what do you see
like doing the mechanism design so that
you balance these incentives like people
can't that like you make it harder like
expensive too short right before doing
that you do an attack and and like keep
more predictable bounds unlike like the
amount of cloud the consensus behavior
can change from one more to the next so
let me let me tackle the first part of
this question which had to do with
useful proofs of work so that's an idea
that comes up over and over again I've
seen it in many different forms so first
of all coin designers of different kinds
typically shun this idea for a very
simple reason the the main reason they
cite is if it was the case that minting
Bitcoin correspond to doing
you know 50,000 protein folds and and we
know the current cost of doing one
protein fold on Amazon Turk or whatever
that would anchor the price of a Bitcoin
and people don't want that they wanted
to go to the moon and if it is the case
that that a protein fold is five cents
then you are it's you're stuck with a
Bitcoin price being five times fifty
thousand five cents times fifty thousand
at least in people's minds and that
would create some kind of a price
barrier
so you see coin designers shunning this
idea in response academics have looked
at this and they've come up with
different ideas for using useful proofs
of useful proofs of useful work using
things like secure hardware to show that
this person actually dedicated their CPU
to doing something of importance to
themselves and it's up to you what that
was and there is some interesting work
coming out of academia on that front so
that's that maybe goes towards
addressing that issue the second part of
your question I think had to do with
what happens when somebody is shorting
and attacking and and now analyzing
those kinds of situations is always
difficult but you know what what can one
do essentially we can reason about coins
in the system and we can model the
amount of damage one can do to the
external value of the coin as well and
we haven't seen much analysis of that
kind but I hope that moving forward we
will see people take that into account
because the coins their number doesn't
matter what matters is the external
market value in terms of shorting if the
value is going away completely then then
you will not be able to close your short
anyways but in terms of like purchasing
power this is something also something
that that in general grows and you know
we could argue that it might be growing
at a similar pace to two advances in
computing hardware take one more
question from the audience
okay just a quick question about
economic finality I mean you mentioned
that an attacker might buy coins mighty
fur and lunch an attack and then the
community might realize they don't
attack and slash him and art fork and so
on but do you think that commitment to
attack yeah it's in attack the first
step i redo my attack I do it again I do
it again I'd do it again some
commitments your attacks might be
community destroying and also might for
example incentivize people to sell that
coin and leave the port O'Call
no because like as I said basically I
believe that if we can make a spur work
well enough then attacks will make the
ether price go up and so a commitment to
attack will incentivize people to buy
buy buy basically yeah in my view is
kind of those sort of crypts we can on
the Holy Grail I think I think actually
the question you're asking is if someone
commits hard enough to attack nee can
they demoralize everyone and have them
no longer believe the story that we will
just sell the coins to the attacker at
higher and higher prices right and the
question like whether people will be
demoralized or not it's kind of really
about you know there are kind of states
of knowledge and confidence in the kind
of belief that you can't conduct this
attack you know over and over again if
it costs you like a significant amount
every time and I think if people really
believe that then it shouldn't make you
lose confidence you should know that
okay this is only in having a finite and
small number of times and therefore you
won't just dump your coins in response
of the sphere of the persistent attack
basically you know can someone commit to
attacking the protocol and therefore
demoralize the etherion community to the
point where the price goes so low that
like just get security goes to zero I
mean in theory but I don't think it's
very likely okay we have time for one
last question
hey my understanding with Casper is that
if I have been offline for a while and
then I come back online
I need the Genesis block a forked choice
rule and the current validator set so I
was wondering if you could talk a bit
about sort of the attack surface of that
validator set being subjective and if
there's ways to mitigate that with
Casper when I switch over but you only
have 55 seconds yeah you don't use the
Genesis block you use something more
recent the idea is right that there is
this kind of like withdraw a revert
limit and so like there might be some
period like say for months as long as
you log in within that period of time
then you would authenticate the current
state based on the information that you
know given the previous state that you
were aware of at the last time when you
logged off so if you log on for it if
you log off for a to long period of time
then like it does become possible to
make attacks where those attacks are not
like we are the those attacks can happen
without the attack or penalties but if
you log on more frequently than that
does not happen okay all right so let's
thank the panelists for an excellent
panel and thank you very much for your
participation
thank you very much our next speaker is
Jason twitch introducing the true--but
virtual machine Thank You panelists
[Music]