# Panel: Casper and Consensus - Channel: [Devcon](https://streameth.org/devcon) - Date: 2018-10-07 - Duration: 31:54 - Watch: https://streameth.org/watch/yt-2r2k6awEJr8 - YouTube: https://www.youtube.com/watch?v=2r2k6awEJr8 ## Description Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more. https://archive.devcon.org/archive/watch/3/casper-and-consensus Emin Gün Sirer, Peter Czaban, Vitalik Buterin, Vlad Zamfir, and Elaine Shi discuss "Casper & Consensus" Speaker(s): Emin Gün Sirer, Peter Czaban, Vitalik Buterin, Vlad Zamfir, Elaine Shi Skill level: Advanced Track: Execution layer Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum Learn more about devcon: https://www.devcon.org/ Learn more about ethereum: https://ethereum.org/ Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. Devcon 3 was held in Cancún, Mexico on Nov 1 - 4, 2017 Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/ ## Transcript [Music] hello okay we are moving on to the the panel and this panel is about Casper and distributed consensus my name is Alicia I'm a professor Cornell and I'm very honored to moderate this panel we have four distinguished panelists and I'm going to begin by having the panelists each means each spent two minutes to introduce themselves and also and maybe a short concise statements are pitched that you would like to make regarding distributed consensus and then I'm going to ask questions and I'm going to open it up for the audience to ask questions so because we have a big room for those of you who want to ask questions I'm going to ask you to move to the front so everyone can hear you when you're asked questions ok all right let's maybe start from so hello everyone who here does not know my name ok I see some hands right it's good I'm Vitalik chief scientist of the etherium foundation so earlier this morning I gave an introduction to it basically what if Theory M is from a technical standpoint but I also mentions that in later today I'd be talking a bit more about some of the projected things that we wants to do in the future of etherium and one of the big threads that of kind of research and developments that we have at the etherion foundation is Casper so Casper is this kind of category of proof of stake consensus protocols that we have been thinking about and developing researching over the last few years that are based around a couple of principles and so one of them is obviously decentralization and visiting fault tolerance which is really a synonym for decentralization because both words basically mean that one single guy can't screw up and break the whole thing then we also have this idea of economic security that I'm sure if I will talk about much more and can we don't really cry him for and of pushing hard on putting that at the front of the agenda so personally I have been spending my time more specifically on movie pushing forward with a Casper the Friendly finality gadget or I can't wear a Casper FFG so this is what one of the two and if algorithms in the Casper family and the goal of Casper FFG is to be something that's as simple as possible and as simple to graft onto the existing proof of work chains as possible while at the same time theoretically being a fully fledged and provably safe safe under asynchrony a busy teen fault-tolerant consensus algorithm so the idea is that it really it takes sort of pbft like like i you know we imports a Byzantine generals paper like ideas and it's basically translates them into a blockchain context and like really simplifies them substantially to the point we are as a chunk we showed earlier today the kind of consensus rules swashy condition fortress walls are fairly simple to implement so the goal of casper FFG is to basically be a proof of stake that can be implemented fairly quickly overlaid onto any proof work chain today within i - in leader stages of the roadmap and like implementing more advanced things like full proof of mistakes so getting at getting rid of the proof of work completely as well as know things like some of the more advanced features that Vlad wants to include yeah I think thanks for thanks for talking yeah so I mean I definitely you know feel like the proof stake research that we've been doing over the years has like you know to kind of bifurcation is like the economic stuff and the consensus stuff and you know they're really kind of at the end of the day end up being really tightly connected because the limits to our ability to incentivize the knows is to infer that what behavior they actually did and the limit and the limits there are actually limits to fault attributions and that has to do with like the really the mechanics of the protocol right which is why we need we want not just say prove that it's fault tolerant but prove that when there are faults we can find them right so that we can penalize the faulty nodes so that not only you know can we tolerate faults but we also disincentivize them so you know and I think that like the both sides of the research have kind of come a long way and actually feed into each other actually in a very kind of tight way to me like today the thing that's the most exciting to me is kind of the stuff that I kind of just showed right I like the fact that I think we can get like I mean I'm sure we can get asynchronous safety with any like you know just like pick your fault tolerance threshold with an overhead of nakamoto consensus is I think really cool and something that you know is I think new technology and I kind of want to echo what Alex said that I think the simplicity of the protocol specification and this is implicitly of the proofs is the kind of paramount to our like design philosophy or our design goal hello I am Peter from priority technologies so at parity we've been implementing we've been working on consensus and on implementation in particular of consensus for a while and we kind of taken a step by step approach now it's somewhat converging to a lot of a lot of research that is coming out but we started off by separating the validator set so that piece that decides who who is the current set of validator so when if it might be determined by the start by their stake or by support of other parties so that would be proof of Authority and then the consensus algorithm itself and then we started off with a very kind of simple consensus algorithm that was based on a basically issuing proposals in in around so it is somewhat similar to what what Vlad talked about at the end were validators kind of issuer blocks sequentially and then then we added finality so that was basically a module that then looks at the blockchain and any and any particular point and sees who signed off on on which chain and basically if someone signed off on a chained and the knot contributes to finalizing that particular chain and now I think we the other things that that will be interesting is introducing new message type so enabling not only validators to finalize blocks not only by releasing blocks but also releasing just simply statements on validity of a particular chain act speeding up how how fast the blocks can be finalized in these types of algorithms and of course working more on the validator set so more working more on the economic side of those protocols and yeah the validator set as are right now they support providing misbehaviour proofs and those misbehaviour proofs can depend on the type of consensus engine so they might be double signing and then the verification of them is behavior proof happens on chain and then sloshing can be done based on that okay well thank you very much for having me here my name is Amin Geun Sarah I'm a professor at Cornell University I'm also a co-director at the initiative for cryptocurrencies and smart contracts so there are a couple of things that people should maybe know about me but the most important one beyond anything I've done in the past like I did play a pretty you know early role in cryptocurrencies and something called karma in 2002 2003 it was one of the first implemented system with a proof-of-work minting in it but beyond that so many of you know that I played a role in anticipating the Dow hack and so forth but the most important thing I think is is the following it's it's I think why partly why I'm so excited to be here this is a very science driven community and in much of my work what I really value is science based design with strong guarantees so this is a domain where there are many many many many reasonable sounding protocols that anybody could just come up with at any one time you know I essentially reach into my gut and I give you something or any sends a message to be sends a message to see and there's been no shortage of white papers containing these kinds of what we call designed by gut or wishful thinking design or sunny day design and those are fine they might work but as we often find out the the devil is in the details and what you should all demand as a community our actual hard proofs within the absence of those proofs these systems typically tend to falter so in every answer that I give to any question it's colored by the science driven design I'm very much restricted in what I can say publicly and privately because I know I have to just say things that I know to be true that has allowed me to actually be very correct in you know present in some ways but it also means that that I demand a higher bar for for protocol designs and I hope you will too and I think what we're seeing happen is kasper is gradually getting to the point where it's actually beginning to reach that far and we're finally getting to the point where we understand the workings of the protocol better and we will hopefully soon have something thank you so much for the excellent statements and I'm going to begin by asking a couple questions and if you would like to ask a question I'm going to ask you to maybe move to the front and at the yellow line and then me will be able to and pass you the mic okay so my first question is regarding the debate which improve our work and proof of stake right so we all know proof of work is probably in the longer term not what we want because of the enormous energy waste but there have been a lot of debate in the community about the security of proof of work versus the security of proof of stake you know some argue proof of work is more secure others argue proof of stake is more secure so for aetherium for instance one reason why you guys start moving to proof of steak I mean obviously other other than the the energy waste you're also you also want to have an incentive compatible protocol but I wonder what you guys think of this question like the security of proof of work versus proof of steak in particular imagine I'm not a rational player I just want to attack the system and break the consistency do you think like the proof of steak approach actually increases the cost of such an attack so firstly I would say like okay proof of work is not a synchronously safe right and that's one of the main differences actually between proofs taken before is a improve steak you can actually achieve like finality right and like actually decisions that are not be reverted and that are safe in acing cream I think like that increases security a lot and I think that in terms of the the damage that an attack could do the fact that blocks can't be reverted arbitrarily really mitigates that and then and then additionally the fact that when they do when the safety failure does happen the faults are attributable and the knows who attack can lose money means that the knows who are attacking can operate a will operate at a higher cost the nodes who are not attacking which is like not a cannot the case improve works I think you know for those reasons and more like proof steak is like gonna be more expensive to attack and your attacks gonna be more limited yeah so let's say that you are just to be politically neutral the government of the Democratic People's Republic of Korea and you want to just basically take to destroy a proof of work watching right so what do you do step one but one you know we could just imagine a very full direct attack right so you would get a billion dollars and you know okay fine some of your people can go without food but you get a billion dollars and you buy a whole bunch of a six and then you just launch a 51% attack on the network now what it would are the developers going to do in response well they have exactly one strategy which has changed the proof-of-work algorithm so let's say they do that right so what happens this is basically kind of literally the best possible care because if you don't do that then they can do what's called a spawn camp attack which is basically they just keep on attacking over and over again and they make your chain permanently useless so you changed probe work algorithm which means the Asics become useless which means that you know the attacker has lost a billion dollars but all of the good guy miners lost all of their money as well right so that's one area where like proof-of-work already started social weakness because it means that if an attack is going to happen then there's actually fairly little incentive to be on the attack on the non attacking side versus being on the attacking side so then okay it's down at GPUs now let's say you get another billion dollars and you basically corner the market on GPUs well what is okay you do you launch another 51% attack now this time GPUs are general purpose hardware and so the developers have no other counter move right basically step three of the game and that's game over you know if you can just you know the you know the North Korean government can just keep on you know doing a spawn camping can keep on the sensoring transactions doing 51% attacks you cannot change the proof-of-work algorithm again because if you change it again then while for the new algorithm GPUs are going to work for it as well so this kind of puts an upper balance on basically the amount of damage that a proof-of-work chain can take which basically means that a proof-of-work chain has in order to survive has to make this cost of attack very high which is basically this kind of doctrine of you know like survival through the through domination and massive hash power now let's do look at proof of stake okay so you know uncle Kim buys up a hundred million dollars of ether then you know it doesn't okay fine you know BFT 33 34 percent balance so you can definitely launch a 34 percent attack or a 51% attack so okay you launch an attack and let's say this breaks finality or this sense there's transactions for a while well guess what the economics of Casper are designed in such a way that if you do this then worst comes to worst the community can coordinate a hard fork so this is a totally legitimate move because you know even the proof-of-work people agree that changing the proof of work is a legitimate move to count 51% attack and that's also a hard fork so the community that's a hard fork to hard fork away from the attack now the difference here is first of all the attacker actually does who is most or all they're all or all of the money they used to attack and second anyone who did not participate in the attack does not lose any money so okay step two of the game basically three days of chaos happened the community recovers there's a hard Fork well okay buy up another hundred million dollars do another attack okay three days of chaos community recovers do you another buy up another hundred million dollars of ether do another attack well soon enough the community is going to realize that this is what's happening eventually uncle Kim is going to run out of money and so they're just going to sit quietly and people are going to start buying up ether and each and every one of these attacks is going to keep increasing the price of ether because it's basically taking 100 million dollars of ether off the market each time and permanently destroying it so eventually you run out of money and the community wins right so this is kind of basically the moral of the story is that because in proof of stake thus taking coins are defined in the assets used to stake are defined inside the system the results basically is that you can make these rules that yeah a huge amount of flexibility to make these rules that are basically extremely lopsided in the defenders favor and that basically means that no if but if the attacker has some amount of money then they can basically break the system maximum a limited amount of times now one really nice goal for this is of course to see if we can actually formally prove you know what's the balance on amount of money you have divided by the number of times you can break you can force the community to hard fork which would by itself be a very interesting challenge but we stopping itself shows the asymmetry so to pile on the both blood and the Telex responses I think what's going on here is fairly straightforward with proof of work we're at the mercy of hardware trends that's that's it we're the control of the security of the system is out of our hands as trans change as people invent new technologies with let's say with various process level tricks to get to pack more transistors to pack better hashers into the same diarrhea as people come up with better heat cooling etcetera tip tricks we're going to see hash power shift hands and we will have absolutely nothing in our hands no knobs we can twist to control what happens I think everything that you heard from metallic was like exactly fundamentally rooted at that cause and with proof of stake we have the ability to actually put independent individual knobs on each and every one of the participants in the system this is huge it gives us an additional multiple levels multiple dimensions of control over the system it also makes the problem much more difficult that's why there are multiple casper the world multiple casper variants that's why it's actually hard to figure out exactly what you should do because the design space is so big and and so if you could conquer the design challenge if you could come up with a protocol whose properties you can prove then the potential for having a secure protocol is much higher for proof of stake than for proof of work yeah I think as was mentioned previously we've proof of stake the distribution of control and of stake hairs can be much wider so anyone that has any sort of use of the network and can submit a stake and and in a way be invested in the security of the network and there's much less overhead to hold and is taking the network rather than having to buy a miner and mine on the network or buying a share in a mining company it's a much more direct connection to the protocol itself but then at the same time I think what was another problem that can arise is if we have many participants in the consensus it becomes very expensive to run the consensus process amongst many participants so a lot of systems have something like a delegated proof of stake where only a few parties actually participate in consensus while everyone is kind of just delegating to someone else and that can potentially lead to issues with with very few parties kind of having a lot of control over the network so I think an important thing that we'll need to think about this how to kind of manage this balance between distributing the power to every single person that wants to have it and and and maintaining security or being able to run this consensus in an efficient way just a really quick add-on even if the concentration of proof work approvers say go the same the fact that there's lower barriers of entry and prove a mistake will mean that it behaves in a more competitive way so even though I totally agree I think like stake is gonna be less concentrated than work it's gonna be more competitive even if it's the same concentration because the lower barriers entry yes I really liked our points and let's take a question from the audience cool is there concern for link rot with Casper implementation link rot like something maybe is staked and placed in the chain and validated and placed in the chain but the the chain that it's representing is no longer exists do you mean can no longer be downloaded or do you mean right yeah yeah like some of some of the people who were part of this this chain that was then used to be placed in the main chain that doesn't exist anymore or the you you seem like you're describing a scheme that involves multiple chains so it's a good question about sharding yeah I think so yeah okay just the kind of fast forward ahead about one hour before we fast rewind back to here I guess it the answer is that there definitely is our in general worry is that if the system gets shorted to the points we are a very small number of nodes and storing each individual piece of data then it is totally possible that some portions of the state could just end up getting lost now there are ways to make the protocol more capable of surviving that and there are also ways of mitigating that and you can there are also ways a bit of an incentivizing storage and there are you could also just basically limit the shorting coefficients so that you still have any like statistically speaking like a few hundred people storing each piece of data so that's safe enough and this is a very active area of research thank you okay we can take maybe one more question from the audience and hopefully I got to ask my last question okay here's a question sort of on the economic mechanics of between perf work improves take so I mean obviously we're now improving working in Bitcoin for example or a theorem is the useless outside of the community etherium I mean you know you're just doing a bunch of hashes or competing a hash with a dag but say if you had a proof work like you know to try out like if you could somehow constructively work that wasn't pre my novel that solves an interesting problem like protein folding or Traveling Salesman then I think on whisper work you have this nice benefit that nicer benefit that you kind of lose interest ache that you can say look here we have Moore's Law and maximum processing power sorry the maximum manufacturing capacity in the world and say you know in the next year like the hash rate could only grow up to this point right and the hash sure grows beyond that point then the if like the price remains the same and if the hash green is Briana beyond that point you know means that like the growth of the hash chains power exceeded the Moore's Law curve so you know like there has been more economic interest in the chain and you know like you can actually could have like a total upper bound like if a hundred percent of all you know new processors are end up being used to the further proof of work obviously you can't have that because that makes less versus society invaluable and therefore like I mean there's there's a good balance there there's like about like there's a parity balance there that you can't compute and improve a stake this isn't the case because like the proof yeah like say we have okay 10 percent we either can be staked on any one time or something like that the secure the chain from one one to from one morning to the other really depends on like the chains total value come over like the ratio of that over world's processing person purchasing power parity right the world GDP so the world's GDP is way high and the chain becomes much more valuable like then like because it's like like the price is really a lagging indicator or that somebody could come in and like end up having a freedom or person attack on the chain because it would or have disproportionate stake in the chain because it would be valuable for them and if they do either way like also if they do buy a lot of stake to do Anthony 1% attack they could short right right before did you attack the attack which makes it cheaper or perhaps worthwhile so how do you sort of balance of you know like what do you see like doing the mechanism design so that you balance these incentives like people can't that like you make it harder like expensive too short right before doing that you do an attack and and like keep more predictable bounds unlike like the amount of cloud the consensus behavior can change from one more to the next so let me let me tackle the first part of this question which had to do with useful proofs of work so that's an idea that comes up over and over again I've seen it in many different forms so first of all coin designers of different kinds typically shun this idea for a very simple reason the the main reason they cite is if it was the case that minting Bitcoin correspond to doing you know 50,000 protein folds and and we know the current cost of doing one protein fold on Amazon Turk or whatever that would anchor the price of a Bitcoin and people don't want that they wanted to go to the moon and if it is the case that that a protein fold is five cents then you are it's you're stuck with a Bitcoin price being five times fifty thousand five cents times fifty thousand at least in people's minds and that would create some kind of a price barrier so you see coin designers shunning this idea in response academics have looked at this and they've come up with different ideas for using useful proofs of useful proofs of useful work using things like secure hardware to show that this person actually dedicated their CPU to doing something of importance to themselves and it's up to you what that was and there is some interesting work coming out of academia on that front so that's that maybe goes towards addressing that issue the second part of your question I think had to do with what happens when somebody is shorting and attacking and and now analyzing those kinds of situations is always difficult but you know what what can one do essentially we can reason about coins in the system and we can model the amount of damage one can do to the external value of the coin as well and we haven't seen much analysis of that kind but I hope that moving forward we will see people take that into account because the coins their number doesn't matter what matters is the external market value in terms of shorting if the value is going away completely then then you will not be able to close your short anyways but in terms of like purchasing power this is something also something that that in general grows and you know we could argue that it might be growing at a similar pace to two advances in computing hardware take one more question from the audience okay just a quick question about economic finality I mean you mentioned that an attacker might buy coins mighty fur and lunch an attack and then the community might realize they don't attack and slash him and art fork and so on but do you think that commitment to attack yeah it's in attack the first step i redo my attack I do it again I do it again I'd do it again some commitments your attacks might be community destroying and also might for example incentivize people to sell that coin and leave the port O'Call no because like as I said basically I believe that if we can make a spur work well enough then attacks will make the ether price go up and so a commitment to attack will incentivize people to buy buy buy basically yeah in my view is kind of those sort of crypts we can on the Holy Grail I think I think actually the question you're asking is if someone commits hard enough to attack nee can they demoralize everyone and have them no longer believe the story that we will just sell the coins to the attacker at higher and higher prices right and the question like whether people will be demoralized or not it's kind of really about you know there are kind of states of knowledge and confidence in the kind of belief that you can't conduct this attack you know over and over again if it costs you like a significant amount every time and I think if people really believe that then it shouldn't make you lose confidence you should know that okay this is only in having a finite and small number of times and therefore you won't just dump your coins in response of the sphere of the persistent attack basically you know can someone commit to attacking the protocol and therefore demoralize the etherion community to the point where the price goes so low that like just get security goes to zero I mean in theory but I don't think it's very likely okay we have time for one last question hey my understanding with Casper is that if I have been offline for a while and then I come back online I need the Genesis block a forked choice rule and the current validator set so I was wondering if you could talk a bit about sort of the attack surface of that validator set being subjective and if there's ways to mitigate that with Casper when I switch over but you only have 55 seconds yeah you don't use the Genesis block you use something more recent the idea is right that there is this kind of like withdraw a revert limit and so like there might be some period like say for months as long as you log in within that period of time then you would authenticate the current state based on the information that you know given the previous state that you were aware of at the last time when you logged off so if you log on for it if you log off for a to long period of time then like it does become possible to make attacks where those attacks are not like we are the those attacks can happen without the attack or penalties but if you log on more frequently than that does not happen okay all right so let's thank the panelists for an excellent panel and thank you very much for your participation thank you very much our next speaker is Jason twitch introducing the true--but virtual machine Thank You panelists [Music]