Ergo platform overview
0 likes388 views
The document provides an overview of the Ergo platform, detailing its vision of achieving a decentralized and survivable cryptocurrency by improving upon traditional blockchain technologies. It discusses the Autolykos consensus protocol, demurrage component for state size control, and a flexible development model through miner voting. The roadmap includes plans for future testnet releases and a mainnet launch in early 2019.
Ergo platform overview
- 1. December 2018 Ergo platform overview Dmitry Meshkov
- 2. Outline 2 Ergo vision Decentralization Survivability Applicability Roadmap
- 4. History 4 2015 2017 Dec 2017 Jun 2018 Jul 2018 Jul 2018 Oct 2018 Nov 2018 Research and Scorex framework development Ergo implementation started Testnet 0 (Digest/Utxo state) Testnet 1 (Smart contracts) Testnet 1.5 (Native tokens) Testnet 1.6 (Threshold signatures, Extension) Testnet 1.7 (Demurrage component) Testnet 1.8 (Autolykos PoW)
- 5. Vision Huge hype of cryptocurrencies, but technology stuck Blockchain 2.0, 3.0, ..., while actually we are still at 1.0 New protocols are trying to achieve high throughput, complicated smart contracts, ... .. while sacrificing decentralization, promising that it will be achieved somewhere in the future Why to start a new cryptocurrency? 5
- 6. Vision Blockchain 1.1 – a major update to blockchain technology without breaking changes Truly decentralized system Long-term survivability Friendly for clients and applications Ergo idea 6
- 8. Decentralization 8 The main value of cryptocurrencies Have multiple layers: miners, users, developers, ... Ergo should be as decentralized, as possible
- 10. Consensus: Why Proof-of-Work? 10 Widely studied and tested Have high security guarantees Allows new members to join the network Light validation allows to use the blockchain without third parties 1 2 3 4
- 11. Consensus: Known Proof-of-Work Drawbacks 11 ASICs – centralize the network around ASICs manufacturers1 2 Mining pools - centralize the network around pool operators
- 12. Consensus: ASIC-Resistance 12 Widely studied area Memory-hard computations to reduce ASICs supremacy over commodity hardware Autolykos is based on the one list k-sum problem, that is similar to the known Equihash PoW Miner should keep the whole list of elements (2Gb) in RAM or recalculate the same elements 104 -... times
- 13. Consensus: Mining pools 13 Regardless of the PoW algorithm, 2-4 pools control the network Others BTC.top F2Pool AntPool ViaBTC BTC.com Hashrate distributions for 06.11.2018 (for 24 hours), taken from blockchain.com, etherchain.org, explorer.zcha.in BTC ETH ZEC Others Nanopool f2poo2 Sparkpool Ethermine Others Slushpool FlyPool F2Pool Poolin AndPool
- 14. Consensus: Mining pools 14 Non-Outsourceable puzzles: efficient puzzle solving requires access to private key Just few proposals before Autolykos Ergo is going to have the first PoW puzzle, that is both memory-hard and non-outsourceable
- 15. Consensus: Autolykos 15 q is the group order H is a hash function, returning values [0,q) genIndexes is a hash function, returning integer sequence Target interval parameter b, that is recalculated via difficulty adjustment rules Miner have 2 secrets: sk, x He is finding such a nonce, that sum of elements d does not exсeeds b Solution contains 2 public keys, nonce, d
- 16. Consensus: Autolykos 16 Solution verification is done over public keys If miner can find a solution over public keys - he may compute dlog for pk Moreover, solution reveals one linear relation between secrets If miner is able to obtain two solutions, he may calculate secret
- 17. Autolykos: Efficiency 17 Solution size is 75-107 (depends on d) Header verification requires verifier to calculate 1 genIndexes hash, 32 hashes H and perform two exponentiations in the group Scala implementation allows to verify block header in 2 ms (Intel Core i5-7200U, 2.5GHz)
- 18. Autolykos: Small miners 18 Non-outsourceablity means that small miners will rarely collect rewards While the same amount on average Example: if network hashrate is 2*1014 H/s and one GPU hashrate `2*107 H/s` (stats from Ethereum), miner should have 4 GPUs to generate 1 block per year Mining on 1 GPU is a kind of a lottery In USD equivalent you should spend approximately 1 block reward to create 1 block per year
- 19. Node regimes
- 20. Node regimes: Now 20 You must set up a node or trust someone Node synchronization is slow, unreliable and resource intensive Regular users resort to trusted solutions If service provider is hacked (or become malicious), users may lose their funds And may not even notice this, because they use trusted block explorer Better alternatives (e.g. SPV nodes in Bitcoin) exist, but only allows to validate some subset of rules
- 21. Node regimes: Ergo 21 Ergo block header supports Non-Interactive Proofs of Proof-of-Work, that allows to synchronize the network, by downloading < 1Mb of data Ergo state is authenticated, which enables verification of transactions without any trust and without keeping the entire state Flexible configuration for facilitated node regimes Client may only keep a subset of block headers and validate transactions using authenticated dictionaries Miner can keep the entire state and a fixed number of full blocks
- 22. Node regimes: Ergo Launch time Security Weeks Hours Seconds Trusted PoW majority Decentralized Web wallet SPV node Full node
- 23. Node regimes: Ergo 23 It is possible to use Ergo from a smartphone without any trust It is possible to join the network and start mining within a few hours No material performance degradation over time
- 25. Survivability: Introduction 25 A key aspect of decentralization is the lack of dependence on developers Imagine you're going to buy a cryptocurrency for your child – what will you choose? No hardforks, chain splits, internal wars
- 26. Survivability: Fundamental approach 26 Long-term survivability requires secure protocol Research, review, analysis and then the implementation Well-known studies or own research: Chepurnoy, A., Kharin, V. and Meshkov, D., 2018. Self-reproducing Coins as Universal Turing Machine Chepurnoy, A., Kharin, V. and Meshkov, D., 2018. A Systematic Approach To Cryptocurrency Fees Meshkov, D., Chepurnoy, A. and Jansen, M., 2017. Revisiting Difficulty Control for Blockchain Systems Reyzin, L., Meshkov, D., Chepurnoy, A. and Ivanov, S., 2017. Improving authenticated dynamic dictionaries, with applications to cryptocurrencies ...
- 28. Demurrage 28 Facilitated node regimes allow to survive along the blockchain growth Digest mode enables the verification of blocks without keeping the whole state But miners should create correctness proofs for light nodes, therefore they must still refrain the entire state How to limit the growth of the size of the state?
- 29. Demurrage: State size 29 Demurrage component: miners are paid for keeping state If box was kept untouched in the state for 4 years, miner could collect K*boxSize coins from it If there are not enough coins in the box at this point - it is removed from the state. To incentivise miners to clean this dust, every box should contain at least MinValuePerByte*boxSize coins Upper-bound of the state size become predictable Parameters may be changed by miner votes
- 30. Demurrage: Circulating supply 30 In existing cryptocurrencies, after the initial emission number of coins decreases due to lost keys, incorrect contracts, etc. This loss rate may exceed emission rate much earlier Eventually number of coins in circulation will reach 0 By collecting storage fee from outdated boxes, miners return coins to circulation
- 31. Demurrage: Miner reward 31 Mining without fixed reward is unstable Transaction fees are unpredictable and usually quite low Demurrage provides an additional miners reward Allows to stop emission quite soon (8 years)
- 32. Demurrage 32 Makes Ergo similar to demurrage currency Similar to inflation, demurrage incentivizes people to use their money (at least once per 4 years) Real-life experiments demonstrated significant increase in the velocity of money in circulation However, number of real-life experiments is low May be turned off (K=0) via miners voting
- 33. Development
- 34. Development 34 Environment is not static, therefore the network should also be changeable But how to make these changes? A decentralized cryptocurrency should avoid a dedicated "core" team But development still requires funds The network should achieve long-term survivability without promised further changes
- 35. Development: Voting protocol 35 Ergo allows to change a lot of parameters via miners voting: K, MinValuePerByte, block size, contract costs and more... When a new epoch (1024 blocks) starts, miner proposes changes for up to 2 parameters If the majority of miners vote "yes" for proposed change at the end of the epoch, it is confirmed Some parameters are changed with a fixed step, the rest are limited to 1% per epoch
- 36. Development: Voting protocol 36 voting on fundamental changes that require a soft-fork lasts for 32 epochs and requires 90 percent of the miners to vote Only one fundamental change can be voted on simultaneously After a successful vote a 128-epoch activation period starts If user sees a block with the next version, he skips validation of new features But this part is still under construction
- 37. Development: Foundation 37 Part of the emission goes to a treasury to fund the development For the first 2 years, block reward is 75 Erg, 7.5 Erg (10%) of them goes to foundation First year foundation reward will be used to cover EFYT token EFYT to Erg swap will be performed on Waves DEX by buyback in Erg/EFYT pair with limit 1 After the first year the community will decide, where to spend these funds via voting But this part is still under construction Coinsperblock Coinstotal Time (years)
- 39. Applicability 39 To survive, a blockchain must have a user base Ergo: user-friendly and protocol-friendly Voting - flexible on-chain configuration Light nodes - decentralized wallets, DApps, layer 2 solutions Smart contracts - secure and flexible
- 40. Smart contracts
- 41. Smart contracts: Bitcoin vs Ethereum 41 UTXO model (output == box) Bitcoin-like script, that protects box from spending Bitcoin already allows to implement a lot of contracts: https://en.bitcoin.it/wiki/Contract Assumed to be not Turing complete But known Turing-complete blockchains are subject to DoS attacks While still have "gas" limit and don`t allow infinite loops
- 42. Ergo script: Idea 42 Strict upper-bound for computation time Only operations, that allow to estimate script complexity before execution Constant-time access to environment (few last headers) No jump operator and infinite loops Operations on predefined collections Supposed to be not Turing-complete...
- 43. Ergo script: Chaining 43 … but actually is Turing completeness proof – implementation of known Turing complete system Rule 110 was implemented in Ergo script (see http://arxiv.org/pdf/1806.10116v1)
- 44. Ergo script: Chaining 44 Even if you don’t have infinite loop inside a block, you have it between blocks
- 45. Ergo script: Chaining 45 Rule 110 Ergo script implementation Becomes possible because of access to outputs (no such direct access in Bitcoin)
- 46. Ergo script: Chaining 46 If you need some computation: Estimate work done before execution Put it to one or multiple transactions Number of blocks is infinite Possibly infinite loop
- 47. Ergo script: Operations 47 Arithmetics: (+, -, *, /, %) Boolean operations (||, &&, xor) If-then-else Arrays: `append`, `slice`, `map`, `fold`, `exists`, `forall`, etc. Lambdas: `OUTPUTS.exists(fun (out: Box) = out.value >= minToRaise)` Deserialize → P2SH, MAST Crypto: blake2b, sha256, AVL+ tree, composable Σ-protocols
- 48. Ergo script: Emission 48 Consensus rules may be moved to scripting layer Emission rules (testnet 1.7):
- 49. Ergo script: Emission 49 In testnet 1.8 there is also rule for miner output. It should be spent in such a transaction, that has exactly one output, which creation height is current height, and proposition is: Height >= SELF.creationHeight + 720 && minerPk Emission box Reward box User box Emission box Reward box User box Emission box Reward box User box
- 50. Ergo script: Examples 50 More at https://git.io/fpDhE Atomic swaps, DEX, crowdfunding, etc..
- 52. Roadmap 52 Testnet (1.9-2.0) releases soon… GPU miner Wallet Exchange listing Foundation Security audit & testing Website, blog, ... Libraries & tooling Mainnet release in Q1-Q2 2019