Tezos: A Self-Amending Crypto-Ledger Position Paper

1 Tezos: A Self-Amending Crypto-LedgerPosition GoodmanAugust 3, 2014\Laissez faire les propri etaires."| Pierre-Joseph ProudhonAbstractThe popularization of Bitcoin, a decentralized crypto-currency has in-spired the production of several alternative, or \alt", currencies. Ethereum,CryptoNote, and Zerocash all represent unique contributions to the crypto-currency space. Although most alt currencies harbor their own source ofinnovation, they have no means of adopting the innovations of other cur-rencies which may succeed them. We aim to remedy the potential foratrophied evolution in the crypto-currency space by presenting Tezos, ageneric and Self-Amending can instantiate any blockchain based protocol.

2 Its seed protocolspeci es a procedure for stakeholders to approve amendments to the proto-col,includingamendments to the amendment procedure itself. Upgradesto Tezos are staged through a testing environment to allow stakeholdersto recall potentially problematic philosophy of Tezos is inspired by Peter Suber's Nomic[1], a gamebuilt around a fully introspective set of this Paper , we hope to elucidate the potential bene ts of Tezos, ourchoice to implement as a proof-of-stake system, and our choice to write itin The Protocol Fork Problem.. Keeping Up With Innovation.. Economics of Forks.. Shortcomings of Proof-of-Work.. Mining Power Concentration.. Bad incentives.. Cost.. Control.

3 Smart Contracts.. Correctness..92 Abstract Three Protocols.. Network Protocol.. Transaction Protocol.. Consensus Protocol.. Network Shell..113 Is Proof-of-Stake Impossible?.. Mitigations.. Checkpoints.. Statistical Detection.. The Nothing-At-Stake Problem.. Threat Models..144 Potential Privacy Preserving Transactions.. Ring Signatures.. Non Interactive Zero-knowledge Proofs of Knowledge.. Amendment Rules.. Constitutionalism.. Futarchy.. Solving Collective Action Problems.. Raising Awareness.. Funding Innovation..161 MotivationIn our development of Tezos, we aspire to address four problems we perceivewith Bitcoin[2]:2-The \hard fork" problem, or the inability for Bitcoin to dynamically in-novate due to coordination and centralization issues raised by Bitcoin's proof-of-work limited expressiveness of Bitcoin's transaction language, which haspushed smart contracts onto other concerns regarding the implementation of a The Protocol Fork Keeping Up With InnovationIn the wake of Bitcoin's success, many developers and entrepreneurs have re-leased alternative crypto-currencies (\altcoins").

4 While some of these altcoinsdid not diverge dramatically from Bitcoin's original code1, some presented in-teresting improvements. For example, Litecoin introduced a memory hardproof of work function2and a shorter block con rmation time. Similarly,Ethereum has designed stateful contracts and a Turing-complete transactionlanguage[3]. More important contributions include privacy-preserving ring sig-natures (CryptoNote)[4] and untraceable transactions using SNARK (Zerocash)[5].The rise of altcoins has inspired a vast competition in software for this Hayekian growth, however, miss a fundamental point: fora cryptocurrency to be an effective form of money, it needs to be a stable storeof value. Innovation within a ledger preserves value through protecting thenetwork effect giving the currency its illustrate the problem of many competing altcoins, let us compare acrypto-currency and a smart phone.

5 When purchasing a smart phone, the con-sumer is paying for certain features, such as the ability to play music, checkemail, message his friends, and conduct phone few weeks, a newer smartphone model is released on the market whichoften contains enhanced features. Though consumers who have the older modelmay be jealous of those with the latest model, the introduction of newer smart-phones does not render older smartphones dynamic would change, however, if the newest phones could not com-municate with older models. If the many models and styles of smartphone couldnot be used together seamlessly, the value of each smartphone would be reducedto the number of people with the same suffer from the same fate as smartphones which are in-compatible with one another; they derive their value from a network effect, orthe number of users who have given it value.

6 To this end, any innovation thatoccurs outside of a crypto-currency will either fail to build enough network effectto be noticed, or it will succeed but undermine the value of the savings in theold currency. If smartphones were incompatible with older models, there would1wow, such unoriginal2scrypt mining ASICs are now available3be either very little innovation or extremely disruptive innovation forcing olderphones into are an attempt to allow innovations which will retain compatibil-ity with Bitcoin by pegging the value of a new currency to Bitcoin and creatinga two-way convertibility. Unfortunately, it's unclear whether they will be ex-ible enough to accommodate protocols substantially different fro Bitcoin.

7 Theonly alternative so far is to fork the Economics of ForksTo understand the economics of forks, one must rst understand that monetaryvalue is primarily a social consensus. It is tempting to equate a cryptocurrencywith its rules and its ledger, but currencies are actually focal points: they drawtheir value from the common knowledge that they are accepted as money. Whilethis may seem circular, there is nothing paradoxical about it. From a gametheoretic perspective, the perception of a token as a store of value is stable solong as it is widespread. Note that, as a ledger, Bitcoin is a series of 1s and choice to treat the amounts encoded within unspent outputs as balances isa purelysocialconsensus, not a property of the protocol in the protocol are referred to as \forks"3.

8 They are so calledbecause, in principle, users have the option to keep using the old protocol. Thus,during a fork, the currency splits in two: an old version and a new successful fork does not merely require software engineering, but the co-ordination of a critical mass of users. This coordination is hard to achieve inpractice. Indeed, after a fork, two ledgers exist and users are confronted with adilemma. How should they value each branch of the fork?This is a coordination game where the answer is to primarily value the branchother users are expected to primarily value. Of course, said users are likely tofollow the same strategy and value the branch for the same reason. These gameswere analyzed by economist Thomas Schelling and focal points are sometimesreferred to as \Schelling points"[6].

9 Unfortunately, there is no guarantee that this Schelling point will be the mostdesirable choice for the stakeholders, it will merely be the \default" choice. A\default" could be to follow the lead of a core development team or the decreesof a government regardless of their attacker capable of changing social consensus controls the currency forall intents and purposes. The option to stick with the original protocol is widelyirrelevant if the value of its tokens is annihilated by a consensus development teams are a potentially dangerous source of users can fork any open source project, that ability offers no protectionagainst an attacker with enough clout to alter the social consensus. Even as-suming the likely benevolence of a core development team, it represents a weak3not to be confused with blockchain forks which happenwithina protocol4 The argument that there can never be more than 21 million bitcoin because \if a forkraised the cap, then it wouldn't be Bitcoin anymore" isn't very substantive, for Bitcoin iswhat the consensus says it on which an attacker could exercise guards against the vulnerabilities wrought by the source of centraliza-tion through radically decentralized protocol forks.

10 It uses its own cryptoledgerto let stakeholders coordinate on forks. This allows coordination and enshrinesthe principle that forks are not valid unless they are endogenous, making itmuch harder to attack the protocol by moving the for instance that a popular developer announces his intention to forkTezos without making use of the protocol's internal procedure. \Why would heattempt to bypass this process?" might ask stakeholders. Most certainly, be-cause he knew that he wouldn't be able to build consensus around his signals to the stakeholders that their preferred consensus would be toreject this fork, and the Schelling point is thus to refuse it, no matter the cloutof that Shortcomings of Proof-of-WorkThe proof-of-work mechanism used by Bitcoin is a careful balance of incentivesmeant to prevent the double spending problem.