Scalability: Rethinking The blockchain

Aviv Zohar The Hebrew University & QED-it Joint work with Yonatan Sompolinsky & Yoad Lewenberg

Two related problems A block every 10 minutes  A Long wait for transaction confirmations

1MB per block (pre SegWit)  A limit on number of transactions per second (3.3 TPS) *assuming 0.5KB per transaction

Larger blocks

Higher block creation rates

More forks in chain

*Data generously shared by Decker & Wattenhofer

Larger blocks

Higher block creation rates

More forks in chain

Lost Capacity

Skewed Rewards

50% attack with less than 50% of hash power

Lower Security

Lots of new protocols to address scalability 

BitcoinNG, Solidus, Algorand, Hybrid Consensus, Byzcoin

Each with slightly different properties I will talk about SPECTRE Designed for payments (not so good for smart contracts).

Insight 1: DAGs are more powerful Direct Revelation. Let each block reveal its full “worldview”

We can still tell what the longest chain is

Insight 2: Bitcoin is related to voting 

Consider each block as voting for any chain that contains it (against chains that don’t)

A



B

C

D

E

F

G

H

I

The longest chain wins 9

Cloning in elections Trump Republican Cruz Democrat Clinton

A voting rule is “clone proof” if it then maintains the result of the elections even when one of the alternatives is “cloned” (maintaining order)

10

Plurality is not clone-proof x3

x4

Dem.

Rep.

Rep.

Dem.

x2

x2

Clinton

Trump

Cruz

Trump

Cruz

Trump

Cruz

Clinton

Clinton

x3

A Condorcet loser is elected 11

Cloning in Bitcoin

Trump

Cruz

Clinton

We should “prefer” visible (published) blocks over ones that were hidden. That helps us be clone proof 12

Insight 3: amplification 

Miners strengthen the majority decision and thus make it more robust B

A

D

C

E

F

G

H

Add new block here!

I

13

SPECTRE: A Fast and Scalable Cryptocurrency Protocol [Lewenberg, Sompolinsky, Z] https://eprint.iacr.org/2016/1159.pdf

What do miners do? Create blocks with transactions (with PoW)  Blocks point to all known “tips” of the DAG  That’s it. 



Blocks created in parallel may contain conflicting transactions.

Nodes observe (local copy) of DAG  decide if Tx is Accepted or Rejected 

Accepted TXs

Just like Bitcoin: Accepted

Rejected

But REALLY what we should think of transactions in 3 states: RobustReject, Pending, RobustAccept Just like in Bitcoin: RobustAccept

RobustReject

Pending

Properties that we are aiming for Consistency: Tx is Accepted iff all inputs are accepted and all conflicts are rejected. Safety: If Tx is RobustAccepted by any node, then (with high prob) all nodes will RobustAccept, forever. Weak Liveness: if a Tx is published in DAG and no conflicting Txs are published for a while, it is RobustAccepted quickly. As long as the attacker is