The Satoshi Social ContractBitcoin core developers speak of the Satoshi Social Contract as those features of Bitcoin that have been promised by Satoshi, and upon which the integrity of Bitcoin rests. For example, releasing a new version of the Bitcoin Core client that increases the upper limit of mined coins breaks the social contract between the core developers and bitcoin using public.
In this project, proof-of-work will be replaced by proof-of-stake, and a pure decentralized peer-to-peer asynchronous mesh network will be replaced by a hierarchical peer-to-peer synchronous network.
To what degree of severity, does this project break Satoshi's promises, and can the result be called Bitcoin despite claimed advantages?---------------------------------------------------------------------------------------
Here are the notable promises extracted from the defining whitepaper
Bitcoin: A Peer-to-Peer Electronic Cash System by Satoshi Nakamoto.
From the Abstract . . .* Bitcoin is a purely peer-to-peer version of electronic cash that allows online payments to be sent directly from one party to another without going through a financial institution.
Retained as-is.* The Bitcoin network timestamps transactions by hashing them into an ongoing chain of hash-based proof-of-work, forming a record that cannot be changed without redoing the proof-of-work.
The data structure is retained with a zero-difficulty proof-of-work.* Bitcoin messages are broadcast on a best effort basis, and nodes can leave and rejoin the network at will, accepting the longest proof-of-work chain as proof of what happened while they were gone.
Bitcoin messages are routed along fault-tolerant paths from the originating peer to a certain peer having the role of temporary mint, which echos each received transaction back to the network as instant acknowledgment that it will be included according to order received in the ongoing record chain. From section 1. Introduction . . .* Bitcoin is an electronic payment system based upon cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.
Retained as-is.* Transactions that are computationally impractical to reverse would protect sellers from fraud, and routine escrow mechanisms protect buyers.
Mechanism changed - to be explained.* Bitcoin is a solution to the double-spending problem using a peer-to-peer distributed timestamp server to generate computational proof of the chronological order of transactions.
Retained as-is.* The system is secure as long as honest nodes collectively control more CPU power than any cooperating group of attacker nodes.
Mechanism changed - to be explained.From section 2. Transactions . . .* Bitcoin defines an electronic coin as a chain of digital signatures. A payee can verify the signature of a received transaction by computing the transaction payer's digital signature and the payer's public key.
Retained as-is.* [Because the private key is required by the payer to sign the transaction, if the private key is lost, then the transaction cannot be performed.]
Retained as-is.* Bitcoin transactions are publicly announced.
Retained as-is.* In the event of multiple transactions from the same address, the earliest issued transactions counts, and subsequent others are dropped.
Retained as-is.* Bitcoin is a system whereby the participants agree on a single history of the order in which transactions were received.
Retained as-is.* The payee has proof that at the time of each transaction, the majority of nodes agreed it was the first received.
Retained as-is.From section 3. Timestamp Server . . .* Transaction are gathered into blocks.
Retained as-is.* The blockchain consists of timestamped blocks whose embedded hash includes the hash of the previous timestamped block, forming a chain.
Retained as-is.From section 4. Proof-of-Work . . .* The block contains a SHA-256 hash having a certain number of leading binary zeros, determined by increment a number-used-once until a value is found that gives the block's hash the required zero bits.
Retained as-is for backwards compatibility, but the zero-difficulty means the effort is trivial.* Proof-of-work difficulty is determined by a moving average targeting an average number blocks per hour.
Changed - the difficulty is always one, which is the lowest value.From section 5. Network . . . Changed - to be explained.* The steps to run the network are as follows:
- New transactions are broadcast to all nodes.
- Each node collects new transactions into a block.
- Each node works on finding a proof-of-work [with specified difficulty] for its block
- When a node finds a proof, it broadcasts the block to all nodes.
- Nodes accept the block only if all transactions in are valid and not already spent.
- Nodes express their acceptance of the block by working on creating the next block in the chain using hash of the accepted block as the previous hash.
* Nodes always consider the longest chain to be the correct one.
* Nodes receiving two different version of the next block, work on the first version received, but abandon that branch if a longer chain is received from any peer node.
* Transactions reaching many nodes have a high probability of being included in a block.
* Nodes missing a broadcast block may subsequently know to ask for it by number when the next block is received the gap recognized.
From section 6. Incentive . . .* The first transaction in a block is a special transaction that starts a new coin owned by the creator of the block.
Retained as-is.* The new coin awarded to the block creator is the only way to initially distribute coins into circulation.
Retained as-is.* The transaction fee is equal to the transaction's input value minus its output value and is added to the block reward received by the block creator.
Retained as-is.* The incentive may help encourage nodes to stay honest.
Retained as-is.From section 7. Reclaiming Disk Space . . .* Transactions are stored within the block in the configuration of a Merkle Tree, with only the root included in the block's hash.
Retained as-is.* Once the latest transactions in a coin is buried under enough blocks, the spent transactions before it can be discarded to save disk space.
Retained as-is.From section 8. Simplified Payment Verification . . .* It is possible to verify payments without running a full node.
Retained as-is.* Verification is performed by querying network full nodes until the SPV node probably has the longest chain of block headers. The transaction timestamp indicates which chronologically ordered block must contain the transaction. The SPV node requests that block's Merkle branch and determines the presence of the transaction to be verified.
Retained as-is.* The number of following blocks is a measure of confidence that the chain will not be reverted back to before the transaction was accepted into its block.
Changed - to be explained.* A SPV node is more vulnerable to attack as it depends upon the honesty of its connected full nodes.
Retained as-is.From section 9. Combining and Splitting Value . . .* To allow value to split and combined, transactions contain multiple inputs and outputs.
Retained as-is.* [The inputs must be unspent to create a valid transaction. When the transaction is accepted by the network, its inputs are regarded as spent, and its outputs are regarded as unspent in the absence of a subsequent transaction having that coin as an input.]
Retained as-is.* Despite the recursive chain of dependency on a transaction's inputs, there is never the need to extract a complete standalone copy of a transaction's history.
Retained as-is.From section 10. Privacy . . .* Privacy can be maintained by keeping public keys anonymous.
Retained as-is.* New public / private key pairs may be used by the receiver of each transaction to keep them from being linked to common owner.
Retained as-is.* Multiple inputs to transactions indicate common ownership of the inputs due to the necessity of the owner signing each of them with private key corresponding to the input's contained public key.
Retained as-is.From section 11. Calculations . . .* Honest nodes do not accept an invalid transaction as payment.
Retained as-is.* Honest nodes do not accept a block containing an invalid transaction.
Retained as-is.* An attack is possible in which the attacker changes one of his own transactions to take back the money he recently spent.
Changed - to be explained.* In order for the double spend attack to work, the attacker must control a majority of the full node connections, i.e. the 51% attack.
Changed - to be explained.From section 12. Conclusions . . .* Nodes work all at once with little coordination.
Changed - to be explained.* Nodes do not need to be identified, since messages are not routed to any particular place and only need to be delivered on a best-effort basis.
Changed - to be explained.* Generating full Nodes vote with their hashing power expressing their acceptance of valid blocks by working on them at will, and rejecting invalid blocks by refusing to work on them.
Changed - to be explained.* Any needed rules and incentives can be enforced with this consensus mechanism.
Retained as-is.From the released Bitcoin Core program, as described by Wiki: Controlled supply . . .* The rate of block creation is approximately constant over time: 6 per hour.
Retained as-is.* The number of Bitcoins generated per block is set to decrease geometrically, with a 50% reduction every 4 years.
Retained as-is.* the number of Bitcoins in existence will never exceed 21 million.
Retained as-is.From Satoshi's comment in Bitcoin 0.3.2 released* There are checkpoints to prevent very probably needless verification of the oldest portions of the blockchain.
Changed - to be explained.