Monero Stack Exchange is a question and answer site for developers and users of the secure, private and untraceable cryptocurrency Monero. It only takes a minute to sign up.
Sign up to join this community
Is there, even in principle, a smart way to implement proof-of-stake in any privacy currency where you are always hiding your balance from others?
(I'm not interested in discussing the advantages of proof-of-work over proof-of-stake, etc. That's not the point.)
For Proof of Stake in e.g. Ethereum, someone that owns funds can become a "validator" by sending a special type of transaction that locks up their ether into a deposit. The process of creating and agreeing to new blocks is then done through a consensus algorithm that all current validators can participate in.
Monero already has a type of transaction, called a coinbase transaction, which produces an output with an unencrypted amount. This is necessary in order to verify that miners are creating new XMR at the consensus enforced inflation rate.
A new type type of transaction could be devised that did reveal the output amount in a similar way, in order to be eligible as a validator. Let's call such outputs VEOs (validator eligibility outputs). These VEO outputs would be clearly identifiable on the blockchain because they would be the only outputs created in non-coinbase transactions that also have non-encrypted output amounts.
It'd be important that such VEOs cannot be referenced as decoys in other transactions, because it'd be important that funds can be demonstrated to be parked as VEOs and not spent. Therefore a consensus rule would need to be written that required that when VEOs are referenced in a transaction, they can only be referenced by the owner of that VEO (i.e. no ring signature would be allowed for untraceability).
When the VEO is spent in a transaction (which would unpark the funds and remove that output's validator eligibility), a regular Monero output with an encrypted amount would be created, and so this new output could then be spent in the future with Monero's regular transaction value secrecy and untraceability features.
TL;DR: Yes.
Yes, I believe this is theoretically possible. I see some restrictions, though.
Monero's transactions ensure the sum of inputs equals the sum of outputs (inclduding the fee). This is done by some kind of homomorphic addition over the values, and comparing the results.
A proof of stake system could probably be built by allowing a type of transaction where there is a single input, the values being compared are the sum of outputs on one side, and a factor multiplied by the sum of inputs. That factor would be derived from the age of the youngest input in the ring (PoS typically uses the age of the staking input to determine the rate granted to the input's owner). The catch is that, since people will want to get the maximum PoS payment possible, they'll only include older inputs as fake outs. The system could be made to quantize output age, so you could select fake outs from a few days off the real output for no change in PoS rate and still hide the real input in a ring.
