Why does Monero use proof of work?

Question

Why does Monero use proof of work instead of something that saves electricity like proof of stake?

Have there been any serious to abandon PoW for PoS at some point similar to the plan of Ethereum developers such as Vitalik Buterin?

Answer 1

The role of PoW is only to order transactions chronologically, nothing else. Thing is, PoW is the only known way to have the authority on transaction ordering be decentralized. PoS can't work for that purpose. There's some good research on this: https://download.wpsoftware.net/bitcoin/pos.pdf

The problem boils down to the fact that, with PoS, what you're staking and what you're winning is one and the same thing, a digital token. So, you're staking something that doesn't physically exist, to win more of something that doesn't physically exist. And the more you have, the more you're able to win. Sure, because there's a market you can say you're staking something of 'value', but if you got it cheap in the first place and it appreciated 100x in the meantime, the cost for you to start foul play is not at the new price, but at the old price at which you got it. Also, if you're happy with 100x, you just dump it on the market, exit clean and let some other poor soul be exposed to the risk. There's no 'investment' you can lose, because it's all digital - both the prize and the stake.

With PoW, your stake is something physical. You used 'real' money which still stands for actual human work performed, invested into specialized hardware, and consumed hard, physical energy to win the prize. Why this is important? Because energy can't be created out of thin air - you can't cheat laws of physics. This means that the punishment for attempts at cheating will always cost you real-world resources and not some digital token which came into existence from thin air in the first place. Even if you sell all your winnings, it doesn't erase your investment/stake. You still have the hardware you invested in, and there is still incentive to keep it running as long as the market gives value to the token it creates. You can't get rid of it at 100x like in PoS, because only the token appreciates, while the mining gear depreciates. See the difference?

But why do we need PoW at all?

Problem is, in digital world, anything can be simulated. If we're trying to simulate gold, what's to stop us to change the color of this 'virtual gold'. If we can do it, then why it should have value? The most important property of a cryptocurrency is ensuring certainty of its properties, like emission, fungibility, immutability, security etc. We often hear the term 'voting' but I think it is misleading. When you vote, it's someone else performing some action. This is not the case with cryptocurrency. When you 'vote', you're really only saying "the crypto with xyz properties is the one I consider valid" and if someone sends you something with xyq properties, you ignore it as invalid. If there are many peers stating exactly the same xyz properties, then it becomes a currency among them, and anyone accepting xyz as properties is free to join and transact. The more peers accepting it, the more certain you are you will have peers to transact with who're accepting the xyz properties. So where's the vote making someone else do something? There's no such vote. You either accept xyz or you don't. That's the role of nodes. There's one property which the nodes simply aren't able to verify - chronological ordering of transactions and for that, we need miners. That's it.

With PoW, any attempt at rewriting history is expensive. With PoS, it's free. 'Solutions' to make PoS 'work' like checkpoints defeat the purpose because how can you tell which checkpoints are the 'right' ones? Someone said so? Some 'trusted' server? I thought we're building trustless decentralized systems here :)

Answer 2

PoW is more secure than PoS in that it costs nothing to try to fork a PoS chain. An attacker can try to make as many different chains as they can with a PoS chain, but with PoW if you try to fork the chain and you fail, that orphaned block took time and energy, because your computer is hashing away, working. There is no work needed in PoS mining, therefore PoS chains will never be as secure as PoW. Proof of Work stops bad actors from just running a script. The attacker must launch bad workers, which is expensive to do.

See section three of http://bitfury.com/content/5-white-papers-research/pos-vs-pow-1.0.2.pdf

Answer 3

The simplest reason why Monero uses Proof of Work (PoW) is because it is guaranteed to work and was the only option at the time (2014).

It is entirely possible that Proof of Stake consensus algorithms will dominate PoW algorithms in the future, but at the time of this answer (2017), this is not the case.

Monero is using quite a number of new functionalities that have not been thoroughly tested yet, like Ring CT. Adding PoS to the mix would probably make the attack surface of Monero too large. Remember the elliptic curve bug in all cryptonote protocols in the first half of 2017 (which also affected Monero):

The so-called "key image" as used in CryptoNote coins utilising elliptic curve ed25519 can be modified in a special way, allowing double-spends. This effectively allows someone to create an infinite amount of coins in a way that is impossible to detect without knowing about the exploit and explicitly writing code to check for it.

Monero's purpose is to be digital cash, so it must be anonymous and secure. This is why Monero is probably not ready yet for something like PoS, because the anonymity features make it even more difficult to deal with severe security holes. Compare with Ethereum, which is more focused on development and smart contracts than on just being a store of value (at least as I wrote this answer, I expect this to change in the next 3-5 years).

In principle, though, Monero could be PoS just as well as it is PoW. It would change nothing as the consensus layer is separate from the cryptographic layer that enables anonymity.

Answer 4

PoS saves electricity the same way you save electricity when you unplug your refrigerator.

Do not count on it to provide long term security (freeze past transactions). The problem is twofold:

1. Unlike an attack against a PoW coins (that cost energy), the attack on PoS coins cost only PoS coins.
2. The supply of PoS coins is unlimited because they cost nothing to produce (unlike PoW coins). Therefore the value of PoS coins cannot be sustained over time.