Towards a Multi-Chain Future of Proof-of-Space

TL;DR

This paper introduces a new multi-chain Proof-of-Space scheme that resists newborn attacks by combining shared and chain-specific proofs, ensuring security and incentive compatibility in a multi-chain blockchain environment.

Contribution

It proposes a novel multi-chain Proof-of-Space framework that effectively counters newborn attacks and proves its security and incentive compatibility.

Findings

The multi-chain scheme resists newborn attacks effectively.

Participants can maximize utility through resource partitioning.

The scheme is proven to be incentive-compatible.

Abstract

Proof-of-Space provides an intriguing alternative for consensus protocol of permissionless blockchains due to its recyclable nature and the potential to support multiple chains simultaneously. However, a direct shared proof of the same storage, which was adopted in the existing multi-chain schemes based on Proof-of-Space, could give rise to newborn attack on new chain launching. To fix this gap, we propose an innovative framework of single-chain Proof-of-Space and further present a novel multi-chain scheme which can resist newborn attack effectively by elaborately combining shared proof and chain-specific proof of storage. Moreover, we analyze the security of the multi-chain scheme and prove that it is incentive-compatible. This means that participants in such multi-chain system can achieve their greatest utility with our proposed strategy of storage resource partition.

Equations

$$\text{weight}(A_i)=(\frac{H({\tau }^i)}{2^{\lambda }}{)}^{1/S^i}$$

$$w(\mathbf{s},\mathbf{B},k):=\{\begin{array}{cc}\frac{{\mathbf{s}}_k}{{\mathbf{B}}_k+{\mathbf{s}}_k},& {\mathbf{s}}_k\le (1+\delta ){\mathbf{\beta }}_k^{\prime }{\mathbf{s}}_0\\ \frac{\widetilde{{\mathbf{s}}_k}}{{\mathbf{B}}_k+\widetilde{{\mathbf{s}}_k}},& \text{otherwise}\end{array}$$

$$\text{val}(\mathbf{s},\mathbf{B},k):=r\times w(\mathbf{s},\mathbf{B},k)\times \omega {\mathbf{B}}_k.$$

$$U(\mathbf{s},\mathbf{B}):=\sum _{k=1}^M\text{val}(\mathbf{s},\mathbf{B},k).$$

$$\widetilde{\text{opt}}(c,\mathbf{B}):={\text{argmax}}_{\mathbf{s}\in {\mathcal{D}}_c^{M+1}}U(\mathbf{s},\mathbf{B})$$

$$\widetilde{\text{opt}}(c,\mathbf{B})=\frac{c}{2}\circ \frac{c}{2}\mathbf{\beta }$$

$$\frac{{\partial }^{2}F}{\partial x_i^2}=\frac{2{\mathbf{\beta }}_i}{(k{\mathbf{\beta }}_i+x_i{)}^2}\left(1-\frac{x_i}{k{\mathbf{\beta }}_i+x_i}\right)$$

$$L(\mathbf{x})$$

$$=-\sum _{i=1}^n{\mathbf{\beta }}_i\cdot \frac{x_i}{k{\mathbf{\beta }}_i+x_i}+\sum _{i=1}^n{\mu }_i\left(x_i-{\mathbf{\beta }}_i{x}_0\right)+\nu \left(\sum _{i=0}^n{x}_i-c\right),$$

$$\frac{\partial L(\mathbf{x})}{\partial x_0}=\sum _{i=1}^n-{\mu }_i{\mathbf{\beta }}_i+\nu =\frac{k}{c(k+\frac{c}{2})}(1-\sum _{i=1}^n{\mathbf{\beta }}_i)=0$$

$$\frac{\partial L(\mathbf{x})}{\partial x_i}=-{\mathbf{\beta }}_i\cdot \frac{k{\mathbf{\beta }}_i}{x_i(k{\mathbf{\beta }}_i+x_i)}+{\mu }_i+\nu .$$

$$\frac{\partial L(\hat{\mathbf{x}})}{\partial x_i}$$

$$=-\frac{2k}{c(k+\frac{c}{2})}+\frac{2k}{c(k+\frac{c}{2})}=0.$$

$$U(\mathbf{s},\mathbf{B})=-F(\mathbf{s})\times r\omega ||\mathbf{B}||$$

$$\frac{{\mathbf{s}}_{a_1}^A}{{\mathbf{\beta }}_{a_1}}\ge \frac{{\mathbf{s}}_{a_2}^A}{{\mathbf{\beta }}_{a_2}}\ge \dots \ge \frac{{\mathbf{s}}_{a_{exc}}^A}{{\mathbf{\beta }}_{a_{exc}}}>{\mathbf{s}}_0^A.$$

$$\bm{s}_{i}^{A+}=\left\{\begin{array}[]{rcl}&\frac{\bm{\beta}_{a_{1}}}{\bm{\beta}_{a_{1}}+1}(\bm{s}_{0}^{A}+\bm{s}_{a_{1}}^{A})&\qquad i=a_{1}\\ &\frac{1}{\bm{\beta}_{a_{1}}+1}(\bm{s}_{0}^{A}+\bm{s}_{a_{1}}^{A})&\qquad i=0\\ &\bm{s}_{i}^{A}&\qquad o.w.\\ \end{array}\right.$$

$${\text{seff}}_i=\min \{{\mathbf{\beta }}_i{\mathbf{s}}_0,{\mathbf{s}}_i\}.$$

$${\mathbf{s}}_0^{A+}=\frac{1}{{\mathbf{\beta }}_{a_1}+1}({\mathbf{s}}_0^A+{\mathbf{s}}_{a_1}^A)>\frac{1}{{\mathbf{\beta }}_{a_1}+1}({\mathbf{s}}_0^A+{\mathbf{\beta }}_{a_1}{\mathbf{s}}_0^A)={\mathbf{s}}_0^A,$$

$${\text{seff}}_i^{A+}=\min \{{\mathbf{\beta }}_i{\mathbf{s}}_0^{A+},{\mathbf{s}}_i^{A+}\}>{\mathbf{\beta }}_i{\mathbf{s}}_0^A={\text{seff}}_i^A.$$

$$D=\left\{\mathbf{s}\in {\mathcal{D}}_c^{M+1}|\forall i\in [M].{\mathbf{s}}_i\le {\mathbf{\beta }}_i{\mathbf{s}}_0\right\}.$$

$$\text{opt}(\mathbf{\beta }):=\frac{1}{c}\widetilde{\text{opt}}(c,\mathbf{B})=\frac{1}{2}\circ \frac{1}{2}\mathbf{\beta }.$$

$${\mathbf{s}}_i=\frac{\alpha }{1-\alpha }b,$$

$${\mathbf{s}}_0$$

$$\ge \frac{\frac{\alpha }{1-\alpha }b||\mathbf{B}||}{(1+\delta )(b+\frac{1-\alpha }{\alpha }b)}=\frac{{\alpha }^2}{(1+\delta )(1-\alpha )}||\mathbf{B}||.$$

Full text

1 Introduction

Since the proposal of Bitcoin in 2008 [1], blockchain has been successfully providing a decentralized consensus on a distributive ledger in a permissionless environment through a peer-to-peer network. In a high level, blockchain is a chain of blocks, each containing certain linearly ordered transactions. The consensus of blockchain performs a “leader election” process and a “ledger extension” process for each round. The “leader election” process elects one or few leaders from all consensus participants (known as miners) according to their computing power, and then these leaders perform a “ledger extension” process via appending their proposed blocks to the rear of the blockchain. Since the specific computing power is evaluated by having miners work on finding certain hash functions preimages, such a way of leader election is called Proof-of-Work (PoW) [2]. The computing power of conducting PoW is referred to as hash power.

PoW consensus scheme suffers from notorious consumption of hash power which turns out to be a waste of natural resource. This circumstances has activated the investigation of alternative consensus schemes which are more energy-efficient. An alternative consensus scheme is Proof-of-Stake (PoS) [3, 4, 5, 6, 7, 8, 9]. In the “leader election” process of PoS consensus scheme, the leader is randomly selected proportionally to the stake that each miner holds, rather than the hash power. Another alternative to PoW is Proof-of-Space (aka. Proof-of-Capacity, PoC). In PoC consensus, the one-time consumption of hash power is replaced by the holding of the storage resource, namely, recyclable hardware disks. Also, PoC is inherited with a nature of concurrency by providing resource proof for multiple chains simultaneously. With a shared nonce for the pebbling graph [10, 11, 12] (PG, the building block of most existing PoC-based consensus schemes), the claim on the same storage can be applied to the consensus of more than one PG-based blockchain. With such a shared proof of storage, the same storage contributes to the security of multiple chains – less total resource is required for the same security guarantee globally.

However, a direct shared proof of the same storage brings about newborn attack, which makes new chains hard to launch since holders of large storage pools may attack a newly started chain with almost zero-cost (it needs only to duplicate the proof one more time). In this paper, we aim to address this issue by proposing an innovative multi-chain scheme of proof-of-space based on the SpaceMint [13] protocol. This scheme is built on a combination of a shared proof and a chain-specific proof of storage, which makes the same storage source contributes simultaneously to multiple blockchains, and the cost for an adversary to launch a newborn attack is enormous. Moreover, we prove that our scheme is incentive-compatible, which means participants can achieve their greatest utility with our desired strategy of storage resource partition.

1.1 Related Works

Two recent works [14, 15]both proposed their “Proof-of-Space” protocol. Their main difference is whether the proofs are for transient storage or persistent storage. Proof of transient space(PoTS) by Ateniese et al. [14] enables efficient verification of memory-hard function [16], which is a function that needs a lot of space to compute. In this work, a verifier only needs $O(\textsf{poly}\log S)$ time and space to verify the claimed space usage of the prover, where $S$ is the amount of storage the prover $P$ wants to dedicate. Proof of persistent space(PoPS) by Dziembowski et. al. [15] allows the verifier to repeatedly audit the prover. Only prover who stores the data persistently can pass the repeatedly audit.

Proof of retrievability(PoR) [17] allows a user who outsources some useful data to an untrusted server to repeatedly verify if the data is still existing in the server. The difference between PoPS and PoR is whether a large amount of initial data is transferred from verifier V to prover P.

Previous PoC constructions only differ in the pebbling graphs $G$ . Dziembowski et. al. [15] proposed two constructions of PoC schemes in the random oracle model, using Merkle tree and graphs with high “pebbling complexity”. One is based on a graph with high pebbling complexity by Paul et. al. [18], which is $(\Theta(S/\log S),S/\log S,\infty)$-secure (see definition in Sec. 2.2). Another one combines superconcentrators [19, 20, 21], random bipartite expander graphs [22, 23] and depth robust graphs [24, 25] and is

$(\Theta(S),\infty,\Theta(S))$-secure

The construction of Ren and Devadas [26] uses stacked bipartite expander graphs, which is

$(\alpha\cdot S,(1-\alpha)\cdot S,\infty)$-secure

for any $\alpha\in[0,0.5]$. The labels of the graph are computed just as in  [15], however the prover only stores the labels on top of this stack.

The construction of Krzysztof Pietrzak [27] uses depth-robust graphs from  [16] to realize PoC, which is

$(S\cdot(1-\epsilon),\infty,S)$-secure

This construction has a tight bound, which means it can get security against adversary storing $(1-\epsilon)$ fraction of the space. Moreover, this construction gets security against parallelism, which implies massive parallelism of oracle queries doesn’t benefit the adversary. Besides, this work also introduces and constructs a new type of PoC, which allows the prover to store useful data at the same time.

1.2 Paper Organization

The remainder of this paper is organized as follows. Sec. 2 introduces notations, building blocks and the background of PoC. Sec. 3 presents a single-chain PoC scheme built on SpaceMint – one of the most well-known PoC scheme today. Based on this, in Sec. 4, we describe our framework for the multi-chain PoC scheme both by a general functionality and a specific protocol realizing one case of the functionality. Finally, we analyze the incentive compatibility and security of our framework in Sec. 5.

2 Backgrounds

2.1 Notations

For a set $S$, $|S|$ denotes the number of elements in $S$. With “$||$” we denote concatenation of strings. More generally, for any two tuples $\bm{m}_{1},\bm{m}_{2}$, $\bm{m}_{1}\circ\bm{m}_{2}$ is the concatenation of them and for unary tuple $\bm{m}_{1}=(m)$, $\bm{m}_{1}\circ\bm{m}_{2}$ is written as $m\circ\bm{m}_{2}$ (same to the case of $\bm{m}_{2}=(m)$). We ideally assume $N$ participants and refer to them by either identities $(P_{1},P_{2},\ldots,P_{N})$ or their public keys ($\textsf{pk}_{1},\textsf{pk}_{2},\ldots,\textsf{pk}_{N}$) interchangeably. The secret key corresponding to a public key pk is denoted as $\textsf{pk}^{-1}$ for simplicity. To further facilitate our description of a high-level framework. We assume a public-key infrastructure (PKI) among all participants, which is described by a functionality $\mathcal{F}_{cert}$. Moreover, to any tuple of messages $(m_{0},m_{1},\ldots,m_{\ell})$, we use $(m_{0},m_{1},\ldots,m_{\ell})_{\textsf{pk}^{-1}}$ to signify the tuple along with the valid signature on the tuple hash from the participant of public key pk. In later descriptions, we may take the necessity of signing and verifying as granted and avoid redundant descriptions. We assume a hash function $H:\{0,1\}^{*}\to\{0,1\}^{\lambda}$ simulating the random oracle [28]. Note that based on $H$, we can build $H_{z}$ for any message $z$ as $H_{z}(\cdot):=H(z||\cdot)$ [29].

2.2 Proof-of-Space

Proof-of-space is an interactive protocol between a prover P and a verifier V that demonstrates the prover P is storing some data of a certain size. The PoC protocol in [15] involves two phases: initialization phase and execution phase.

Initialization is an interactive process between the prover P and the verifier V. It runs on shared inputs $(id,S)$. $id$ is an identifier to assure that the prover P cannot reuse the same disk space to run PoC for different statement. $S$ is the amount of storage the prover P wants to dedicate. After the initialization phase, P stores some data F , whereas V only stores a commitment $\gamma$ to F.

Execution is an interactive process between the prover P and the verifier V. The prover P runs on data F and the verifier V runs on input $\gamma$. Then the verifier V sends challenges to the prover P, obtains back the corresponding openings. At the end V verifies these openings and outputs $accept$ or $reject$.

The security of a PoC protocol was formally defined in [15]. Specifically, a $(S_{0},S_{1},T)$-adversarial prover $\hat{\textsf{P}}$ was defined, which means $\hat{\textsf{P}}$’s storage after the initialization phase is bounded by $S_{0}$, while during the execution phase it runs in storage at most $S_{1}$ and time at most $T$. Secure PoC protocols are required to have three properties, which are completeness, soundness and efficiency.

Completeness: We say a PoC protocol has completeness if the verifier always outputs $accept$ for any honest prover P with probability $1$. 2. 2.

Soundness: We say a PoC protocol has soundness if the verifier V outputs $accept$ with a negligible probability for any $(S_{0},S_{1},T)$-adversarial prover $\hat{\textsf{P}}$ . 3. 3.

Efficiency: We say a PoC protocol has efficiency if the verifier V can run in time $O(\textsf{poly}\log S)$.

We say that a PoC protocol is $(S_{0},S_{1},T)$-secure if the above three properties are satisfied.

3 Single-Chain Proof-of-Space

In this section, we use SpaceMint protocol as the building block of our multi-chain protocol to be described in the latter section.

3.1 Graph Labeling Game

At first, we introduce the graph labeling game [30, 31].

Definition 1 (Graph Labelling)

We consider a directed acyclic graph (DAG) $G=(V,E)$ ,which has a vertex set $V=\{0,1,\ldots,S-1\}$ and a hash function $H:\{0,1\}^{*}\rightarrow\{0,1\}^{\lambda}$, the label $l_{i}\in\{0,1\}^{\lambda}$ for each vertex $i\in V$is recursively computed as $l_{i}=H(\textsf{nc},i,l_{p_{1}},...,l_{p_{t}})$ where $l_{p_{1}},...,l_{p_{t}}$ are the parents of vertex $i$ and nc is a unique nonce.

Graph labeling game is the building block of most PoC protocols. Let $G=(V,E)$ be a directed acyclic graph (DAG) which has $S$ nodes . $H:\{0,1\}^{*}\rightarrow\{0,1\}^{\lambda}$ is a collision-resistant hash function. For every $id$, a fresh hash function can be sampled: $H_{id}=H(id||\cdot)$. The PoC protocol based on the graph labeling game is as follows:

Initialization: First, P computes the labels on all nodes of $G$ using graph labelling, and commits to them in $\gamma$ using Merkle-tree Commitment. Then P gets $q$ challenges from V. For each of the challenges $C=(C_{1},...,C_{q})$, P opens the label on the $C_{i}^{\text{th}}$ node of $G$, as same as the labels of all its parent nodes. Finally, V checks the openings of all challenge nodes and their parents. V also checks if the challenge nodes are computed correctly from their parents. 2. 2.

Execution: V chooses $t$ challenge nodes randomly. Then P sends the opening of these challenge nodes to V. This execution phase can be done repeatedly.

3.2 PoC Definition

Before introducing how to apply any PoC schemes to blockchains, we introduce the formal description of a PoC at first designed to apply between two parties. A PoC scheme built on a hash oracle $H$ is described as $\mathrm{\Pi}_{\text{PoC}}=(\textsf{init},\textsf{open},\textsf{vrf})$. Specifically,

Space Commitment.

$\mathrm{\Pi}_{\textnormal{PoC}}.\textsf{init}^{H}(S)\to(\gamma,\widetilde{\gamma})$ inputs the size of the pebbling graph and returns a pair $(\gamma,\widetilde{\gamma})$ after building up the graph where $\gamma$ is the commitment released to the publicity and $\widetilde{\gamma}$ is a secret to be locally stored.

Commitment Opening.

$\mathrm{\Pi}_{\textnormal{PoC}}.\textsf{open}^{H}(S,\widetilde{\gamma},C)\to\tau$ takes as input the graph size, the threshold $\widetilde{\gamma}$, the challenge $C$ and returns a proof $\tau$.

Verification.

$\mathrm{\Pi}_{\textnormal{PoC}}.\textsf{vrf}^{H}(S,\gamma,C,\tau)\to\{accept,reject\}$ verifies a proof $\tau$ for the challenge $C$ to the graph of size $S$ and public commitment $\gamma$.

3.3 SpaceMint

In SpaceMint [13], the structure of blocks is identical to Bitcoin blockchain except for containing a space proof instead of a hash solution. Furthermore, the detailed protocol of SpaceMint is similar to any blockchain, in spite that the mining and chain-competition differ from that of PoW-based blockchains. Thereby, it is too redundant to cover every details to introduce the full scheme. To describe SpaceMint, we only need to enumerate all the difference between SpaceMint and the ordinary blockchain.

Initial Step.

For a miner to dedicate $\lambda N$ bits of storage to the blockchain network, it computes and stores the labels of their pebbling graph to get $(\gamma,\widetilde{\gamma})\leftarrow\mathrm{\Pi}_{\textnormal{PoC}}.\textsf{init}^{H}(S)$ at the initial stage. Afterwards $sctx=(\textsf{pk},\gamma)_{\textsf{pk}^{-1}}$ is broadcast to the network.

The Mining.

Each miner maintains a main chain (the chain branch with the greatest total weight) in its view. We denote the chain as $(A_{1},A_{2},\ldots,A_{i-1})$ and their corresponding proofs as $\tau^{1},\tau^{2},...,\tau^{i-1}$ ($i\geq\Delta$). To mine the next block $A_{i}$, the miner at first derives the challenge for block $i$ from the proof of block $i-\Delta$, i.e., $C_{i}=H(\tau_{{i-\Delta}})\mod S$. Thereby, the miner obtains $\tau\leftarrow\mathrm{\Pi}_{\textnormal{PoC}}.\textsf{open}^{H}(S,\widetilde{\gamma},C_{i})$ and assembles $A_{i}$ with $\tau$. This differs from PoW.

Block Verification.

Different from the nonce verification in the existing blockchain, we in SpaceMint should check the open-up $\tau$ of each block by $\mathrm{\Pi}_{\textnormal{PoC}}.\textsf{vrf}^{H}(S,\gamma,C,\tau)$.

Chain Weight.

Assuming a block is followed by $m$ sequential blocks $(A_{1},A_{2},\ldots,A_{m})$, which have valid proofs $\tau^{1},\tau^{2},...,\tau^{m}$ respectively, and that the corresponding space contributed by these miners are $S^{1},S^{2},...,S^{m}$. The weight of $A_{i}$ is defined as follows:

[TABLE]

It can be proved that the probability that $A_{i}$ has the largest weight among these $m$ blocks equals to his fraction of the total space, which is $\frac{S^{i}}{\sum^{m}_{k=1}S^{k}}$. In this way, in a chain competition, the chain branch with the greatest total weight outruns the others. This differs from the existing blockchain where the block weight is atomic (either one or zero).

4 A Multi-Chain scheme

In this section, we introduce our framework for the multi-chain scheme of proof-of-space. To this end, we first describe our high-level functionality and then propose one possible realization of the functionality based on the aforementioned SpaceMint-based single-chain protocol.

4.1 Functionalities

In a high level, as Fig. 1, we expect to have all participants pay half of the total storage for purchasing the upper bound of their admissible storage (the shared proof part, denoted as $\bm{s}_{0}$), and allocate the rest half of storage on each supportive chains respectively according to their market weight ($\bm{s}_{i}$ for chain $i$). Specifically, to a chain $i$ with $\bm{\beta}_{i}=\frac{\bm{B}_{i}}{||\bm{B}||}$ ($\bm{B}_{i}$ is the sum of $\bm{s}_{i}$ for all participants) fraction of total storage proof, we stimulate the participant to allocate $\bm{s}_{i}=\bm{\beta}_{i}\bm{s}_{0}$ storage on it. To allow for the start-up of new chains, we in actual ask that $\bm{s}_{i}\leq(1+\delta)\bm{\beta}_{i}\bm{s}_{0}$. Clearly, as an equilibrium of economics, the total storage proof behind a blockchain is proportional to the total market weight of the chain. Therefore, the market weight of each chain is described by the total storage proof behind the chain. Also, we assume that the amount of released coins and transaction fees is the same to all chains for each round and hence the per-coin value is proportional to our defined market weight.

In all, our system supports $M$ different PoC-based blockchains. Each ($j^{\textnormal{th}}$) of them elects leaders according to $s^{i}_{j}$. Specifically, each miner ($i^{\textnormal{th}}$) has the chance of being the leader of each round by

[TABLE]

where $\bm{B}^{\prime}_{k}:=\bm{B}_{k}+\bm{s}_{k}$, $\bm{\beta}^{\prime}:=\frac{\bm{B}^{\prime}}{||\bm{B}^{\prime}||}$, and $\widetilde{\bm{s}_{k}}:=\max_{\bm{s}_{k}}\{\bm{s}_{k}\leq(1+\delta)\bm{\beta}_{k}^{\prime}\bm{s}_{0}\}$. The exact formula of $\bm{s}_{k}$ is easy to uncover by solving a quadratic equation (hence can be described in codes when implemented). However, we remain the current formulation for readability. To facilitate proofs in later sections, we observe that $\psi_{\bm{B},k}(\bm{s}):=w(\bm{s},\bm{B},k)$ is continuous on $(\mathbb{R}^{+})^{M+1}$ and is smooth almost everywhere (a.e.) on $(\mathbb{R}^{+})^{M+1}$ except for $\{\bm{s}\in(\mathbb{R}^{+})^{M+1}|\bm{s}_{k}=(1+\delta)\bm{\beta}_{k}^{\prime}\bm{s}_{0}\}$ with zero Lebesgue-measure for each $k\in[M]$.

The detailed description of the functionality is shown in Fig. 2, where we aim to provide a framework more general than our specific way of realization so the size of leaders to be elected for each round is parameterized by lsize. In fact, lsize of most existing blockchains and our realization based on SpaceMint is simply $1$.

4.2 A Protocol for $\textsf{lsize}=1$

To build our realization of the above functionality with $\textsf{lsize}=1$ based on our SpaceMint-based single-chain PoC protocol in the previous section, most steps are natural implementations of our building block. However, few issues should be carefully considered alongside. To establish a commonly verifiable computation on the market weight $\bm{B}$ in a decentralized environment, we assume that the market weight of each chain is proportional to the summed weight of latest $\Delta$ consequent blocks by a constant factor $\mu$. To make sure that each space proof is used for only one identity, there should be a pool $\Gamma$ of space commits locally store in each node. We have put the specific protocol in Fig. 3 since details are not crucial to the roadmap of our paper.

5 Framework Analysis

The realization of our functionality in Fig. 2 should satisfy both safety and liveness. The analysis of basic safety and liveness is specific to the way of realization. In our protocol to realize the functionality with $\textsf{lsize}=1$, the basic safety and liveness properties of the realization are inherited from SpaceMint. In this section, we focus on two higher-leveled properties of our general framework for a PoC multi-chain future, namely, incentive compatibility and the system security that a considerable fraction of global storage resource has to be held by an adversary to devastate any chain under the framework, even for newly launched chains or chains with the least market weight.

5.1 Incentive Compatibility

In this part, we prove that our framework is incentive-compatible. Namely, participants achieve their greatest utility (the most expected revenue) with our desired strategy of storage resource partition. Without loss of generality, we consider $\delta=0$ to simplify our proofs. Also, we assume $\bm{\beta}^{\prime}=\bm{\beta}$ from time to time to simplify proofs. To begin with, we formally describe the partition strategy.

Definition 2 (Capacity Resource Partition)

For each participant with total capacity $c$, all its admissible resource partitions form the space $\mathscr{D}_{c}^{M+1}\subset(\mathbb{R}^{+})^{M+1}$ that $\sum_{i=0}^{M}{s_{i}}=c$ for each $\bm{s}=(s_{0},s_{1},\ldots,s_{M})\in\mathscr{D}_{c}^{M+1}$. Furthermore, we introduce $\mathscr{D}^{M+1}:=\cup_{c\in{\mathbb{R}^{+}}}\mathscr{D}_{c}^{M+1}$.

Likewise, we denote $\mathscr{D}_{1}^{M}$ as the set of vectors $(\beta_{1},\beta_{2},\ldots,\beta_{M})\subset(\mathbb{R}^{+})^{M}$ of length $M$ that $\sum_{i=0}^{M}{\beta_{i}}=1$.

The utility function is a mapping from a partition strategy to the expected revenue for each round. To define the global utility function, we firstly introduce the chain-specific utility function.

Definition 3 (Chain-Specific Utility Function)

The chain-specific utility function for chain $k$ is

[TABLE]

Intuitively, $r$ is a positive constant, $w(\bm{s},\bm{B},k)$ (proportionally) describes the probability of becoming the leader of each round, and the per-coin value of chain $k$ is proportional to the market weight of the chain (hence is $\omega\bm{B}_{k}$ for a positive constant $\omega$). Note that we have assume that the minted coins and transaction fees are the same for each chain and for each round, hence it is not a necessity to add in another factor for it in the multiplication.

At a first glance, the formula above seems fit only into the scenario of $\textsf{lsize}=1$. Actually, in the multi-leader case, each participant has lsize times the chance to become an leader while each leader has only $\frac{1}{\textsf{lsize}}$ fraction of total revenue. By $\frac{\textsf{lsize}\cdot\bm{s}_{k}}{\bm{B}^{\prime}[k]}\cdot\frac{r}{\textsf{lsize}}\cdot\omega\bm{B}^{\prime}_{k}=\frac{\bm{s}_{k}}{\bm{B}^{\prime}_{k}}\cdot r\cdot\omega\bm{B}^{\prime}_{k}$, the expected revenue remains identical to the one-leader case.

Definition 4 (The Utility Function)

Thereby the final utility function is the sum of all chain-specific utility functions

[TABLE]

The optimal resource partition strategy is clearly depicted as below.

Definition 5 (Optimal Resource Partition)

To a participant with total storage resource $c$, its optimal resource partition strategy in the environment where each chain $i$ has market weight $\bm{B}_{i}$ is

[TABLE]

We aim to show that our desired resource partition strategy optimizes the utility function. That is to have the optimal resource partition equals our desired one.

Theorem 5.1

For any $c\in\mathbb{R}^{+}$ and any $\bm{B}\in\mathscr{D}^{M}_{c}$,

[TABLE]

where $\bm{\beta}=\frac{\bm{B}}{||\bm{B}||}$.

To prove this theorem, we at first introduce two lemmas.

Lemma 1

For any positive integer $n$, positive values $k,\ (\bm{\beta}_{1},\bm{\beta}_{2},\ldots,\bm{\beta}_{n})$ with $\sum_{i=1}^{n}\bm{\beta}_{i}=1$, function $F(\bm{x}):=-\sum_{i=1}^{n}\bm{\beta}_{i}\cdot\frac{x_{i}}{k\bm{\beta}_{i}+x_{i}}$ ($\bm{x}=(x_{0},x_{1},\ldots,x_{n})$) achieves its minimum in $\hat{\bm{x}}=(\frac{c}{2},\frac{\bm{\beta}_{1}c}{2},\ldots,\frac{\bm{\beta}_{n}c}{2})$ subject to

• •

$g_{i}(\bm{x}):=x_{i}-\bm{\beta}_{i}x_{0}\leq 0$* for each $i\in[n]$,*

• •

$g_{n+i+1}(\bm{x}):=-x_{i}\leq 0$* for each $i\in[n]\cup\{0\}$,*

• •

$h(\bm{x}):=\sum_{i=0}^{n}x_{i}-c=0$.

Proof

To begin with, we show that $F$ is convex on $(\mathbb{R}^{+})^{n+1}$. It is easy to observe that the Hessian matrix of $F$ is diagonal since $\frac{\partial^{2}F}{\partial x_{i}\partial x_{j}}=0$ for each $i\neq j$. Each element in the diagonal

[TABLE]

is positive so the Hessian matrix is semi-definite and $F$ is convex on $(\mathbb{R}^{+})^{n+1}$. Since $F$ and each $g_{i}$ are convex and $h$ is an affine function, this turns out to be a convex optimization and any minimal value of $F$ is its minimum. According to Karush-Kuhn-Tucker (KKT) conditions, we only need to show that

• •

$\triangledown L(\hat{\bm{x}})=\bm{0}$,

• •

$\mu_{i}g_{i}(\hat{\bm{x}})=0$ for all $i\in[2n+1]$,

where

[TABLE]

$\mu_{i}=\nu=\frac{k}{c(k+c/2)}$ for each $i\in[n]$. For each natural number $i\leq n$, $\mu_{n+i+1}$ are set to be zero so $\sum_{i=n+1}^{2n+1}\mu_{i}g_{i}(\bm{x})=0$. In fact,

From simple derivations,

[TABLE]

and for each $i\in[n]$,

[TABLE]

Thereby,

[TABLE]

As a result, we conclude that $\triangledown L(\hat{\bm{x}})=\bm{0}$. 2. 2.

The second condition is easy to hold since $g_{i}(\hat{\bm{x}})$ = 0 for each $i\leq n$ and $\mu_{i}=0$ for each $i>n$.

Therefore, $f$ achieves its minimum in $\hat{\bm{x}}$.

Intuitively, Lemma. 1 alone has proved Theorem. 5.1 since by having $k=||\bm{B}||$,

[TABLE]

within the boundary in the lemma. Since the Hessian matrix is semi-definite either inside the boundary (shown in the lemma proof) or outside the boundary (easy to verify) and $U$ is obviously continuous everywhere and smooth a.e. except for a subset with zero Lebesgue measure, $U$ is almost convex and the local maximization is actually the global optimization. However, to more strictly prove the theorem, we still require the following lemma.

Lemma 2

For any space division strategy on $n$ chains, suppose $\bm{s}^{A}=(\bm{s}_{0}^{A},\bm{s}_{1}^{A},\ldots,\bm{s}_{n}^{A})$, if $\exists i\in[n]:\bm{s}_{i}^{A}>\bm{\beta}_{i}\bm{s}_{0}^{A}$ , then there always exists another strategy whose utility is better than $\bm{s}^{A}$.

Proof

If there exists $i\in[n]:\bm{s}_{i}^{A}>\bm{\beta}_{i}\bm{s}_{0}^{A}$, then there must exist a set of index $I^{A}=\{a_{1},a_{2},\ldots,a_{exc}\}\subset[n]$ where $\forall i\in I^{A}$, $\bm{s}_{i}^{A}>\bm{\beta}_{i}\bm{s}_{0}^{A}$ and $\forall i\notin I^{A}$, $\bm{s}_{i}^{A}\leq\bm{\beta}_{i}\bm{s}_{0}^{A}$ both satisfy. Without loss of generality, we assume

[TABLE]

Consider another strategy $\bm{s}^{A+}=(\bm{s}_{0}^{A+},\bm{s}_{1}^{A+},\dots,\bm{s}_{n}^{A+})$. When comparing $\bm{s}^{A+}$ with $\bm{s}^{A}$, the new strategy just subtracts some space division from $\bm{s}_{a_{1}}$ and adds it to $\bm{s}_{0}$. In detail, $\bm{s}^{A+}$ can be formally expressed as

[TABLE]

Notice that if $\bm{s}^{A}$ is a valid space division strategy, then $\bm{s}^{A+}$ is also a valid strategy, as $\sum_{i=0}^{n}\bm{s}_{i}^{A+}=\sum_{i=0}^{n}\bm{s}_{i}^{A}=c$.

Now we compare the utility of $\bm{s}_{i}^{A}$ with that of $\bm{s}_{i}^{A+}$. Consider the utility function $U$ for a space division strategy. If we denote the truly effective space division for chain $i$ as $\textsf{seff}_{i}$, where

[TABLE]

Then, it is obvious that the utility function is monotonic for every $\textsf{seff}_{i}$ where $i\in[n]$. As a result, if $\forall i\in[n],\textsf{seff}_{i}^{A+}\geq\textsf{seff}_{i}^{A}$ and $\exists i\in[n],\textsf{seff}_{i}^{A+}>\textsf{seff}_{i}^{A}$, then the utility of strategy $\bm{s}^{A+}$ is better than that of $\bm{s}^{A}$.

In fact, when $i=a_{1}$, we have $\textsf{seff}_{i}^{A}=\bm{\beta}_{a_{1}}\bm{s}_{0}^{A}$, while $\textsf{seff}_{i}^{A+}=\bm{s}_{i}^{A+}=\frac{\bm{\beta}_{a_{1}}}{\beta_{a_{1}}+1}(\bm{s}_{0}^{A}+\bm{s}_{a_{1}}^{A})$. Since $\frac{\bm{s}_{a_{1}}^{A}}{\bm{\beta}_{a_{1}}}>\bm{s}_{0}^{A}$, it comes out that $\textsf{seff}_{a_{1}}^{A+}>\textsf{seff}_{a_{1}}^{A}$. When $i\in I^{A}$ and $i\neq a_{1}$, given that we have assumed $\bm{s}_{i}^{A}>\bm{\beta}_{i}\bm{s}_{0}^{A}$, then $\textsf{seff}_{i}^{A}=\bm{\beta}_{i}\bm{s}_{0}^{A}$. Since

[TABLE]

we have

[TABLE]

When $i\in[n]$ and $i\notin I^{A}$, it is obvious that $\textsf{seff}_{i}^{A+}=\bm{s}_{i}^{A+}=\bm{s}_{i}^{A}=\textsf{seff}_{i}^{A}$. And it concludes that the utility of $\bm{s}^{A+}$ is better than that of $\bm{s}^{A}$.

Now we are allowed to prove Theorem. 5.1.

Proof

We partite $\mathscr{D}_{c}^{M+1}=D\uplus D^{\prime}$ into two domains where

[TABLE]

Lemma. 2 tells that each strategy in $D^{\prime}$ can be emulated by a strategy in $D$. Therefore, $D$ includes the optimal partition strategy within $\mathscr{D}_{c}^{M+1}$. By having $k=||\bm{B}||$, $U(\bm{s},\bm{B})=-F(\bm{s})\times r\omega||\bm{B}||$ in Lemma. 1 within $D$ and so forth the optimal strategy among $D$ is our desired partition.

Based on Theorem. 5.1, we find that the optimization of strategy is indeed independent from the total resource $c$. Hence we conclude that for any participant, the optimal strategy is to divide half resource for the shared proof and divide the rest part according to the market weight of each chain

[TABLE]

5.2 System Security

In this part, we show the difficulty of devastating a chain (say, $i^{\textnormal{th}}$ chain of market weight $\bm{B}_{i}=b$) with $\frac{b}{||\bm{B}||}=\beta$ fraction of total market weight. To devastate chain $i$, the adversary should occupy the total market weight with total storage resource over $\alpha b$111Most existing systems ask for $\alpha>1/3$, but we treat $\alpha$ as a tunable parameter to allow flexibility.. That is to have $\bm{s}_{i}=\alpha(b+\bm{s}_{i})$ and at the same time $(1+\delta)\bm{\beta}^{\prime}_{i}\bm{s}_{0}\geq\bm{s}_{i}$ where $\bm{\beta}^{\prime}_{i}=\frac{b+\bm{s}_{i}}{||\bm{B}||+\bm{s}_{i}}$. Thereby,

[TABLE]

and hence

[TABLE]

For $\alpha>\frac{1}{3}$ and $\delta=\frac{1}{10}$, $\bm{s}_{0}\geq\frac{5}{33}||\bm{B}||>15\%||\bm{B}||$. This tells that regardless of the market weight of the chain, the adversary has to devote more than $15\%$ global storage resource ($45\%$ to $\alpha>1/2$) to devastate a chain with even the slightest market weight.

6 Conclusion

In this paper, we have proposed a novel multi-chain scheme from the inherited merit of proof-of-space. With our framework, the same storage source contributes simultaneously to multiple blockchains and newly set up blockchains are hard to be devastated. In the future, we look forward to the flourishing development of PoC-based blockchains and having our framework implemented on them. Also, although we have shown to realize this framework via pebbling graph-styled proof-of-space schemes, we also expect its application on PoC schemes of other styles.