Hi Billy,
I was going to write a post which started by dismissing many of the weak arguments that are made against PoS made in this thread and elsewhere.
Although I don't agree with all your points you have done a decent job here so I'll focus on the second part: why I think Proof-of-Stake is inappropriate for a Bitcoin-like system.
Proof of stake is not fit for purpose for a global settlement layer in a pure digital asset (i.e. "digital gold") which is what Bitcoin is trying to be.
PoS necessarily gives responsibilities to the holders of coins that they do not want and cannot handle.
In Bitcoin, large unsophisticated coin holders can put their coins in cold storage without a second thought given to the health of the underlying ledger.
As much as hardcore Bitcoiners try to convince them to run their own node, most don't, and that's perfectly acceptable.
At no point do their personal decisions affect the underlying consensus -- it only affects their personal security assurance (not that of the system itself).
In PoS systems this clean separation of responsibilities does not exist.
I think that the more rigorously studied PoS protocols will work fine within the security claims made in their papers.
People who believe that these protocols are destined for catastrophic consensus failure are certainly in for a surprise.
But the devil is in the detail.
Let's look at what the implications of using the leading proof of stake protocols would have on Bitcoin:
### Proof of SquareSpace (Cardano, Polkdadot)
Cardano is a UTXO based PoS coin based on Ouroboros Praos[3] with an inbuilt on-chain delegation system[5].
In these protocols, coin holders who do not want to run their node with their hot keys in it delegate it to a "Stake Pool".
I call the resulting system Proof-of-SquareSpace since most will choose a pool by looking around for one with a nice website and offering the largest share of the block reward.
On the surface this might sound no different than someone with an mining rig shopping around for a good mining pool but there are crucial differences:
1. The person making the decision is forced into it just because they own the currency -- someone with a mining rig has purchased it with the intent to make profit by participating in consensus.
2. When you join a mining pool your systems are very much still online. You are just partaking in a pool to reduce your profit variance. You still see every block that you help create and *you never help create a block without seeing it first*.
3. If by SquareSpace sybil attack you gain a dishonest majority and start censoring transactions how are the users meant to redelegate their stake to honest pools?
I guess they can just send a transaction delegating to another pool...oh wait I guess that might be censored too! This seems really really bad.
In Bitcoin, miners can just join a different pool at a whim. There is nothing the attacker can do to stop them. A temporary dishonest majority heals relatively well.
There is another severe disadvantage to this on-chain delegation system: every UTXO must indicate which staking account this UTXO belongs to so the appropriate share of block rewards can be transferred there.
Being able to associate every UTXO to an account ruins one of the main privacy advantages of the UTXO model.
It also grows the size of the blockchain significantly.
### "Pure" proof of stake (Algorand)
Algorand's[4] approach is to only allow online stake to participate in the protocol.
Theoretically, This means that keys holding funds have to be online in order for them to author blocks when they are chosen.
Of course in reality no one wants to keep their coin holding keys online so in Alogorand you can authorize a set of "participation keys"[1] that will be used to create blocks on your coin holding key's behalf.
Hopefully you've spotted the problem.
You can send your participation keys to any malicious party with a nice website (see random example [2]) offering you a good return.
Damn it's still Proof-of-SquareSpace!
The minor advantage is that at least the participation keys expire after a certain amount of time so eventually the SquareSpace attacker will lose their hold on consensus.
Importantly there is also less junk on the blockchain because the participation keys are delegated off-chain and so are not making as much of a mess.
### Conclusion
I don't see a way to get around the conflicting requirement that the keys for large amounts of coins should be kept offline but those are exactly the coins we need online to make the scheme secure.
If we allow delegation then we open up a new social attack surface and it degenerates to Proof-of-SquareSpace.
For a "digital gold" like system like Bitcoin we optimize for simplicity and desperately want to avoid extraneous responsibilities for the holder of the coin.
After all, gold is an inert element on the periodic table that doesn't confer responsibilities on the holder to maintain the quality of all the other bars of gold out there.
Bitcoin feels like this too and in many ways is more inert and beautifully boring than gold.
For Bitcoin to succeed I think we need to keep it that way and Proof-of-Stake makes everything a bit too exciting.
I suppose in the end the market will decide what is real digital gold and whether these bad technical trade offs are worth being able to say it uses less electricity. It goes without saying that making bad technical decisions to appease the current political climate is an anathema to Bitcoin.
Would be interested to know if you or others think differently on these points.
[1]:
https://developer.algorand.org/docs/run-a-node/participate/generate_keys/[2]:
https://staking.staked.us/algorand-staking[3]:
https://eprint.iacr.org/2017/573.pdf[4]:
https://algorandcom.cdn.prismic.io/algorandcom%2Fece77f38-75b3-44de-bc7f-805f0e53a8d9_theoretical.pdf
Cheers,
LL