2

Is there a possibility of zero-knowledge proof of stake without disclosing your balance?

  • Please could you be more specific about what the properties of your balance are that the scheme would require disclosure of, in order for the proof to be useful? – knaccc Oct 3 '18 at 1:28
  • @knaccc I'm wondering if some kind of zero-knowledge proof of stake is possible at all. It might not be really "zero" knowledge, since you have to have some proof of a certain stake, but it might be zero knowledge who actually holds this stake. – janowitz Oct 3 '18 at 9:37
4

It is possible to generate a proof of balance (reserve proof), which states you own at least the claimed amount.
See rpc doc about it.
So theoretically, it is possible.

  • 2
    If I understand correctly, that method generates a proof that you have at least a certain specified balance by searching for your unspent outputs that together equal or exceed that specified balance, and then disclosing what the values of those outputs are. So it's basically like saying: "I'll prove that I have at least $30 by not telling you how much is in my wallet, but by telling you that I definitely have two $20 bills in it". – knaccc Oct 3 '18 at 1:25
1

I have a few of thoughts on this:

  1. The most straightforward way I can think of, in any use case, would be to use a combination of time-locked outputs and a type of reserve proof. This way, the user simultaneously publicly demonstrates the ownership of funds and not being able to spend said funds for a certain duration. One would probably wield their "power" by signing with the private key of the staked transaction.
  2. Perhaps there could be a form of decentralized governance, where voting is allowed if one stakes their coins for the duration of a particular period of time. Again, their vote would be verified by checking they signed with the appropriate private key. [I haven't explored the math, but...] Perhaps there could also be a key image generated at this level to ensure one vote per private key without disclosing the signer.
  3. Using staking as a means of entitling a wallet/address to passive income seems tricky, but may be possible, though maybe not with the same characteristics of a typical interest-bearing account, and not with Monero as it currently is. There would need to be some fundamental change to current consensus rules (such as breaking out a staking reward from the mining reward) before it'd be worth devising such a scheme.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.