Quote from: cunicula on December 21, 2011, 02:36:55 PM

This is a nice way of putting it.

My preferred 'most secure' system is different from the above: (requires X, but X is augmented by Y):

votes = (1+coins)^p*(hashes)^(1-p) where 0 < p < 1 [I would suggest p = 0.8 as a good value]

You don't need coins to vote in this system. Coins just give your votes more weight. By contrast, you do need hashes to vote.

The major issue I see with such a system is that it makes mining pools even more important. Also larger pools (or at least pools holding more coins in their reward address) are actually MORE efficient. We already see a massive migration to the largest pools (bigger get bigger) and the only advantage they have is lower variance. If Deepbit for example actually could generate more revenue per share than smaller pools in pretty short time we would have 1 pool.

A variant of that which could work is a shared reward system. Essentially there would be no reason for pools to even exist. A currency w/ a built in p2pool type mechanism would simply distribute global rewards (subsidies and fees) based on work performed in the prior 144 blocks (24 hours) based on shares submitted to the network. So who solved the block would be irrelevant from a payout perspective. If the currency produced 50 coins per block and you contributed 0.1% of global hashrate you would earn 0.05 coins per block regardless of who solves the block (~7.2 coins per day assuming same block time as Bitcoin). It would significantly reduce "solo miner" variance as the only variance that would occur would be in GLOBAL (not individual) block generate times. On a week long basis that number is very stable. Optionally a finders fee could be given to the block solver as a personal reward to avoid block withholding.

On edit: I just realized pools would still exist. People would be pooling money to increase stake (and thus effective hashing power) just like right now they pool hashing power to reduce variance. If raw hashing power is weighted by coins held (proof of stake) then people would form pools to increase their effective proof of stake. A coin w/ a built in p2pool mechanism and rewards auto distributed based on hashing power would still be an interesting concept.

On edit 2: A variant on the proof of stake increasing effective hashing power would be to simply require a mining "fee" to be held in escrow in order to sign a block. Thus having more coins doesn't improve hashing performance but to mine you must be holding a stake. Obviously the relationship would need to be linear in an anonymous network. As an example the proof of stake could be 30 days of generation. Today 1 GH produces roughly 1 BTC per day so to mine @ 1 GH would require holding 30 BTC in the reward address. To mine @ 3 TH (DeepBit) would require holding 30,000 BTC. To achieve 51% of network hashing power would require 51% of hashing power plus 108,000 BTC. One could make the proof of stake larger but that would make starting mining more difficult even for smaller miners. One option would be to adjust the proof of stake requirement dynamically just as difficulty is done. For example each block would record the value of the reward address at block signing. The network could compare the reward address actual amount to required amount. If it is significantly larger (miner indicated a higher proof of stake is desired) then the proof of stake increases x%. Say from 30 days to 31.5 days. Miners who are overcapacity (more hashing power than stake) could also be accounted for and if the network is understaked reduce the proof of stake requirement.

I also agree that some sort of escrow mechanism would be necessary to increase the damage done in any attack. This could simply be part of the network much like newly minted coins can't be spent the coinbase transaction would make the reward + proof of stake be newly minted (and thus unspendable for 120 blocks).

For example today the coinbase transaction looks like this
* input address: null (0 BTC)
* output address: reward address (reward BTC) <- locked for 120 blocks

Proof of stake chain would have a coinbase like this:
* input address: address holding stake (xxx BTC)
* output address: reward address (reward + proof of stake requirement) <- locked for 120 blocks
* change address: change address (balance of input - proof of stake)