I will rephrase your method quickly with my own words just to make sure I got everything right. Questions are inline.
First, we have:
- ASV = Account Stake Value: It is equal to the lowest balance that the account has had during the last N blocks.
An account that was recently created or which has won a block fewer than N blocks ago has an ASV of zero.
- BSV = Block Stake Value: The BSV of the block extending a chain equals to it's own ASV plus the ASV of all other PoS+B and PoS-B extending the same chain (
in the future or in the past? Is it just the cumulative ASV up to "now"?). No account's ASV is counted more than once in the past N blocks.
- CSV = Chain Stake Value: The CSV is the sum of the last N blocks' BSVs. (
did I get it correctly that we have sums of sums of ASV's? Counting older ASV's more often then newer?)
Then, we have two different "proof of stakes":
- PoS+B = PoS with associated block (i.e., including and confirming transactions)
- PoS-B = PoS without associated block
Now starts the so called so-called voting period:
- Nodes broadcast a PoS+B block for each of their accounts A where ASV(A)>x% * OLD_WINNER_ASV, that is, the ASV of account A is x% of the ASV of the winner of the last block or higher.
- Additionally, each Node broadcasts an PoS-B (here, without a block, i.e., without confirming any transactions) for each of their accounts A where ASV(A)>threshold. The threshold is fixed and no hash target has to be met.
Then this happens
All launched PoS (both PoS+B and PoS-B) should extend the chain with the greatest CSV, according to the launching node. (not sure I get that: all valid blocks extend that chain? Not just the "best" one? Or is it rather one best PoS+B and one best PoS-B? I fear I am not 100% aware of what exactly is added to the collateral and what is extending the chain. Also, is the collateral persistent, or is it just for the voting phase?)
The end result of all of this, is that so long as a node controls at least one account with ASV > 0, there will be at least one chain extended by a PoS+B. Any chain not so extended dies. Also a chain dies if it's CSV is less than y% of the CSV of the winning chain.
Apart from the addition of PoS-B, The new scheme differs from the previous in that an account's ASV is no longer the time integral of its balance. Instead it is equal to the lowest balance that the account has had during the last N blocks. An account that was created or which has won a block fewer than N blocks ago has an ASV of zero.
The block extending a chain has a BSV equal to it's own ASV plus the ASV of all other PoS+B and PoS-B extending the same chain. Call these other contributors of ASV to the BSV "collateral support". No account's ASV is counted more than once in the past N blocks, so if any of the PoS, including the winning PoS+B has already contributed collaterally to the BSV of an earlier block in the chain, then it is not counted again. Nor, if a block is added to a collateral supporter, does the new block add to the collateral support. In other words, collateral support is given to sisters, not aunts. The CSV is the sum of the last N blocks' BSVs.
The idea behind collateral support is that the main chain will benefit from honest PoS more than any side-chain, including a side-chain being built by an attacker. (If the attacker's chain benefits more, then it is the main chain by definition.) Moreover an attacker can gain nothing by diverting his resources into his own collateral sybils, since this will just take away ASV from his winning blocks. This is a zero-sum game for him. PoS-B allows every account-holder with any ASV at all a chance to contribute collaterally to blockchain security, though they can never win a block unless their ASV is enough to allow them to launch a PoS+B. Every PoS, with or without block, will need to has all the PoW supporting it's predecessor.
So essentially, at least from what I understand, we no longer rely on any hash. As the hash was the only random factor in the scheme we now have a deterministic order who from a subset of N "online" users will win which block.
Also, I an not yet fully sure how the ASV will be "reaccumulated" after it was dropped to 0 upon creation of a new block. Will the ASV recover fully after N blocks have passed?
If so, this could leave an attacker the possibility to create N high-stake account and winning blocks with them "round robin".
Edit ... just saw, you already thought of that
...let M be the number of blocks back to the earliest live fork point, or M=N if larger.
I have a different way to prevent the same N accounts winning over and over again. For any given chain, order the PoS+B trying to extend it by ASV. Then the one with the Highest ASV wins straight away so long as it hasn't already won in the last M blocks. (This would indicate, that in this change, the ASV does not drop to 0 after a block has been launched?) Else if it won n blocks ago with n<=M, multiply its ASV by n/N, and move on to the next. If the PoS+B with the next highest ASV hasn't won in the last M or 2N blocks (whichever is greater), then it wins straight away. Else if it won n
If no block wins straight away choose a block which has won the least number of times during the last M blocks. Usually this number will be zero. If there are several blocks tying on this metric, use the modified ASV as the tie-breaker.
With this scheme, larger stakes will win the block more often, but, so long as there is an alternative, never more than once since transaction confirmation or the oldest live fork point. Smaller stakes get to win occasionally.
Sorry if I get that wrong, bit don't we have the same problem here? Its just not that you need N accounts, but M accounts (which is less actually, as M<=N?)
Apart from that: my respect, this is a very nice and well thought approach. I think I will have to reread it like 3 or 4 more times to fully understand it
I will try to wrap it up in pseudo code once I have understood everything so we get a basic idea how we could code that.
EDIT: Just saw that you have found even more attacks with those N accounts and that you are already addressing them
Step 1. Normalise each candidate's ASV by dividing by the largest ASV of any of the last N block winners. This will not affect their rankings in any way. From now on, when I refer to a candidate's ASV, it is the normalised value I'm talking about.
Step 2. Iterate through the candidates in decreasing order of ASV. For each candidate, if the account last won more than max(M,N/ASV), or if it has never won, it wins; exit. Otherwise multiply the ASV by the number of blocks to the last win. Use this figure in the tiebreaker described in step 3.
Step 3. If no candidate won during step 2, then the winner is the candidate that has won the least number of times during the last M blocks. If there is a tie, then use the figure calculated in step 2 as a tiebreaker.
There is still a strange, though not necessarily undesirable property about this system. Sometimes more stake can hurt an attacker. For example, suppose the same honest accounts are staking throughout. An attacker with N accounts each with equal balances greater than the highest-value honest stake would win every block forever (or until a non-staking account with a higher balance decided to start staking) If these N accounts were the N highest, the attacker could permanently shut out transactions of his choice, including any transaction that might enable another account to compete.
But it would be really obvious that he was doing this. So let's suppose that the attacker had some more funds, and randomly increased the balances of some of his accounts, then he would no longer prevent accounts he doesn't control from winning the occasional block.
Maybe its just because its sunday midnight, but I don't see the point why increasing his amounts would break his monopole. Could you please explain that in 2 lines?
What also came to my mind: what he could also do is to move the funds to a different account the moment he has found a block. This of course would lock his new account down for the next N blocks (until the ASV is mature) but allowing him
then to mine a block with a new "identity" without any "past". He just needs enough "
coins in the buffer" to pull it off successfully. Calibrated correctly, every block a new account (belonging to the attacker) with a sufficiently high ACV wins.
I.e., Assuming C coins is enough to win a stake and N>M, then the attacker needs (N+2)*C coins of which N*C cannot be used as they need N blocks to get mature (we call them coins-in-the-queue), and 1*C of them are used to "be sent to a different account" one block after they staked a block, and 1*C are winning the current block.