P2share: how to turn any network (or testnet!) into a bitcoin miner

[ZmnSCPxj]

@AdamISZ

As to the quoted analysis specifically (basically the argument that @VzxPLnHqr 's selector can be grinded, but extended to PoS generally), I don’t really agree that this is universal @ZmnSCPxj. Consider that Ethereum’s block-proposer-choosing algorithm (“RANDAO”) uses deterministic signatures (BLS) for the specific reason that the outcomes, while both pseudorandom and unpredictable to the non-key holder, are not grindable at all. So they end up with this model: each validator in the set throws in their signature, and they incrementally xor the result till the end of the epoch (32 blocks iirc). This gives outputs that can only be predicted at the very last step, and still grinding isn’t possible (because the attacker-validator only has one valid signature, too!). The only attacks that remain are block withholding (you have a 1 bit choice, release a block or don’t), or the more dramatic attack of forking (see Forking the RANDAO, research from last year; this is a specific weakness, but it’s less fundamental than my next sentence). I do think the forking attack is fundamental - from the earliest days the main attacks proposed were more of the “history grinding” type (see: “nothing at stake”) than the “future grinding”. If you can realistically fork deeply, proof of stake is pretty obviously unsound - slashing is great and all, but it cannot work in the absence of a single canonical chain — the exact thing that it purports to create! (hence Vitalik fell back, imo correctly, on “weak subjectivity” as the actual defence, not slashing). So the question of the soundness of such schemes always ends up being practical: is it just too impractical to effect real world attacks. Shrug, not sure.

Well, anything you commit to can be changed, and you can always just rearrange or otherwise malleate external data in your block: in Bitcoin terms, the miner can always change their coinbase address. I do not know in detail what Ethereum does (the less I know about Ethereum, the better, IMO, I would rather fill my head with Lightning) but I am sure that any data that can in principle come from an out-of-blockchain oracle (and my understood model of Ethereum is that it requires out-of-blockchain oracles anyway) can be malleated, and scripts (which are supposed to be user-given and “Turing complete”) can be arranged to allow interpretation of multiple oracle output encodings as “the same” (in much the same way that a NUL character and an overlarge UTF-8 encoding of the NUL character can be “the same”, to let us sneak in NUL characters past C ASCII string library functions for good or ill), thus allowing for similar malleation of whatever you are committing to in a block header chain, whatever you are using to sign it with.

Any “history grinding” can then be converted to “future grinding”; you just have to have control of the current version of history i.e. “history being written by the victors” principle.