|
@@ -1,3 +1,5 @@
|
|
|
|
|
+# Dynamic Proof of Stake
|
|
|
|
|
+
|
|
|
## blockchain
|
|
## blockchain
|
|
|
|
|
|
|
|
blockchain $\mathbb{C}$ is a series of epochs, it's a tree of chains, $C_1$, $C_2$, $\dots$, $C_n$, the chain of the max length in $\mathbb{C}$ is the driving chain C
|
|
blockchain $\mathbb{C}$ is a series of epochs, it's a tree of chains, $C_1$, $C_2$, $\dots$, $C_n$, the chain of the max length in $\mathbb{C}$ is the driving chain C
|
|
@@ -7,8 +9,9 @@ is multiple of blocks, some of those block might be empty due to the nature of t
|
|
|
|
|
|
|
|
|
|
|
|
|
## Genesis block
|
|
## Genesis block
|
|
|
-the first block in the epoch updates the stake for stakeholders, which influences weighted random leader selection algorithm, for epoch j, $S_j$ is the genesis block's data for n stakeholders of the blockchain:
|
|
|
|
|
|
|
+the first block in the epoch updates the stake for stakeholders, which influences weighted random leader selection algorithm, for epoch j, the pair ($S_j,\eta_j$) is the genesis block's data for n stakeholders of the blockchain:
|
|
|
$$S_j=((U_1,v_1^{vrf},v_1^{kes},v_1^{dsig},s_1),\dots,(U_n,v_n^{vrf},v_n^{kes},v_n^{dsig},s_n)$$
|
|
$$S_j=((U_1,v_1^{vrf},v_1^{kes},v_1^{dsig},s_1),\dots,(U_n,v_n^{vrf},v_n^{kes},v_n^{dsig},s_n)$$
|
|
|
|
|
+$$\eta_j \leftarrow \{0,1\}^\lambda$$
|
|
|
$$\small\text{\emph{note that new stakeholders need to wait for the next epoch to be added to the genesis block}}$$
|
|
$$\small\text{\emph{note that new stakeholders need to wait for the next epoch to be added to the genesis block}}$$
|
|
|
|
|
|
|
|
## Block
|
|
## Block
|
|
@@ -16,7 +19,7 @@ block $\textbf{B}$ is the building block of the blockchain
|
|
|
|
|
|
|
|
block $B_{i}=(st,d,sl,B_{\pi},\rho, \sigma_s)$ created for slot i by stakeholder, and slot i leader $U_s$:
|
|
block $B_{i}=(st,d,sl,B_{\pi},\rho, \sigma_s)$ created for slot i by stakeholder, and slot i leader $U_s$:
|
|
|
|
|
|
|
|
-$$\textbf{\textcolor{red}{st}}: \text{state of the prebvious block, hash($B_{i-1})$}$$
|
|
|
|
|
|
|
+$$\textbf{\textcolor{red}{st}}: \text{state of the prebvious block, Hash(head($\mathbb{C}$}$$
|
|
|
$$\textbf{\textcolor{red}{d}}: \text{data held by the block}$$
|
|
$$\textbf{\textcolor{red}{d}}: \text{data held by the block}$$
|
|
|
$$\textbf{\textcolor{red}{sl}}: \text{slot id generated by the beacon}$$
|
|
$$\textbf{\textcolor{red}{sl}}: \text{slot id generated by the beacon}$$
|
|
|
$$\textbf{\textcolor{red}{$B_\pi$}}: \text{proof the stakeholder ${U_s}$ is the owner, $B_{\pi}=(U_s,y,\pi)$, y,$\pi$ are the output of the VRF}$$
|
|
$$\textbf{\textcolor{red}{$B_\pi$}}: \text{proof the stakeholder ${U_s}$ is the owner, $B_{\pi}=(U_s,y,\pi)$, y,$\pi$ are the output of the VRF}$$
|
|
@@ -25,14 +28,26 @@ $$\textbf{\textcolor{red}{$\sigma_{s}$}}: \text{owner signature on the block}$$
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-
|
|
|
|
|
-
|
|
|
|
|
## leader selection
|
|
## leader selection
|
|
|
at the onset of each slot each stakeholder needs to verify if it's the weighted random leader for this slot.
|
|
at the onset of each slot each stakeholder needs to verify if it's the weighted random leader for this slot.
|
|
|
$$y < T_{i}$$
|
|
$$y < T_{i}$$
|
|
|
$$\small\text{\emph{check if VRF output is less than some threshold}}$$
|
|
$$\small\text{\emph{check if VRF output is less than some threshold}}$$
|
|
|
this statement might hold true for zero or more stakeholders, thus we might end up with multiple leaders for a slot, and other times no leader.
|
|
this statement might hold true for zero or more stakeholders, thus we might end up with multiple leaders for a slot, and other times no leader.
|
|
|
also note that no one would know who is the leader, how many leaders are there for the slot, until you receive signed block with a proof claiming to be a leader.
|
|
also note that no one would know who is the leader, how many leaders are there for the slot, until you receive signed block with a proof claiming to be a leader.
|
|
|
-$$y = VRF(slot_id||nonce)$$
|
|
|
|
|
|
|
+$$y = VRF(\eta||sid)$$
|
|
|
|
|
+$$\small\text{\emph{$\eta$ is random nonce generated from the blockchain, $\textbf{sid}$ is block id}}$$
|
|
|
$$\phi_{f} = 1 - (1-f)^{\alpha_i}$$
|
|
$$\phi_{f} = 1 - (1-f)^{\alpha_i}$$
|
|
|
$$T_{i} = 2^{l_{VRF}}\phi_{f}(\alpha_i^j)$$
|
|
$$T_{i} = 2^{l_{VRF}}\phi_{f}(\alpha_i^j)$$
|
|
|
|
|
+note that $\phi_f(1)=f$, \textbf{f}: the active slot coefficient is the probability that a party holding all the stake will be selected to be a leader.
|
|
|
|
|
+stakeholder is selected as leader for slot j with probability $\phi_f(\alpha_i)$, $\alpha_i$ is $U_i$ stake.
|
|
|
|
|
+
|
|
|
|
|
+## beacon
|
|
|
|
|
+built on top of globally synchronized clock, that leaks the nonce $\eta$ of the next epoch a head of time (thus called leaky).
|
|
|
|
|
+$\eta_j$ for epoch $e_j$, is the hash of the last epoch $e_i$ block's VRF y that lasted 24k slots, up to the middle 8k block, note that k is a persistence security parameter,used to set the clock.
|
|
|
|
|
+$$ \eta_j = hash(B_{iR}.B_{\pi}.y|| \dots ||B_{iR+\frac{R}{2}+4}.B_{\pi}.y) $$
|
|
|
|
|
+$$\small\text{\emph{R is the epoch length}}$$
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+# Protocol
|