From 7f87dd4745e3ae1087fc804c913cfe01ae0741a0 Mon Sep 17 00:00:00 2001 From: Andrew Stone Date: Thu, 8 Oct 2020 20:20:41 +0000 Subject: [PATCH] wiki commit --- protocol/blockchain/chainwork-proof.md | 104 +++++++++++++++++++++++++ protocol/blockchain/proof-of-work.md | 2 + 2 files changed, 106 insertions(+) create mode 100644 protocol/blockchain/chainwork-proof.md diff --git a/protocol/blockchain/chainwork-proof.md b/protocol/blockchain/chainwork-proof.md new file mode 100644 index 0000000..265b689 --- /dev/null +++ b/protocol/blockchain/chainwork-proof.md @@ -0,0 +1,104 @@ +# Chainwork Proof + +The idea of chainwork is intrinsic to blockchains. Nodes switch to the chain tip with the most cumulative "work" to help preserve the blockchain assumption that the majority of the miners on a chain are honest. Chainwork is calculated by summing the "work" done in each block in the chain. + +Is summing work a valid operation? + +More formally, *is the expected number of hashes to solve one block candidate with work W is equal to the expected number of hashes to solve N block candidates with work W/N?* + +## Warm-up + +For every block candidate, a target (specified in a nonstandard floating point form in the block header as 'nBits') is calculated. Any hash less than this target solves the block. Under the random oracle model (that is, assuming that cryptographic hash functions produce unpredictable output), this is equivalent to rolling a $2^{256}$ sided die with any number less than or equal to the target resulting in a "win". The probability of this is: + +$$ +P(target) = (target + 1)/2^{256} +$$ + +*We add one to target because the number range of target is from 0 to $2^{256}-1$, rather than 1 to $2^{256}$.* + +Equation 1 is about the target, but we sum work. We need the relationship between work and target which is defined in the code as follows: + +$$ +work = 2^{256}/ (target + 1) +$$ + +or, solving for target: + +$$ +T(work) = (2^{256}/work) -1 +$$ + +Finally we need an equation from general statistics. The expected number of trials before a success for such a random variable is given by (see [wikipedia](https://en.wikipedia.org/wiki/Geometric_distribution#Properties)): + +$$ +E(probability\_of\_success) = 1/probability\_of\_success +$$ + +'Trials' in our case are individual attempts to solve a block. So if the expected number of trials of two different processes are the same then we can say those two processes would take the same amount of work (on average). + +## Proof + +In mathematical notation we need to prove that: + +$$ +E(P(T(work))) = n * E(P(T(work/n))) +$$ + +With all of our preparation, this proof is easy. But I'll go through each step to make it easy to read along. + +First we'll replace the functions with their defintions on the left side **to prove that "work" is the expected number of hashes**. + +$$ +E(P(T(work))) = E(P((2^{256}/work) -1)) +$$ + +$$ + = E(((2^{256}/work) -1 + 1)/2^{256}) +$$ + +$$ + = E((2^{256}/work)/2^{256}) +$$ + +$$ + = E(1/work) +$$ + +$$ + = work +$$ + + +Second we'll do the same on the right side and simplify to prove that the result is the same: + +First, substitute the definition of T(): + +$$ +n * E(P(T(work/n))) = n * E(P((n*2^{256}/work) -1) +$$ + +Next, substitute the definition of P(): + +$$ + = n * E( ((n*2^{256}/work))/2^{256}) +$$ + +Third, substitute the defintion of E(): + +$$ += \dfrac{n}{\frac{(n*2^{256}/work )}{2^{256}}} +$$ + +Finally, simplify: + +$$ += \dfrac{n*2^{256}} {(n*2^{256}/work)} +$$ + +$$ += \dfrac{n*2^{256}*work} {n*2^{256}} +$$ + +$$ += work +$$ \ No newline at end of file diff --git a/protocol/blockchain/proof-of-work.md b/protocol/blockchain/proof-of-work.md index 1a52968..200eaed 100644 --- a/protocol/blockchain/proof-of-work.md +++ b/protocol/blockchain/proof-of-work.md @@ -31,6 +31,8 @@ Though the term difficulty is often used colloquially to refer generally to the Chainwork is a representation of the work performed through a block's entire history. It is calculated using the difficulties of each of the blocks in the chain. The work for a single block is calculated as 2256 / (target + 1), or equivalently in 256-bit two's-complement arithmetic, (~target / (target + 1)) + 1, where `~` is the bitwise NOT operation. The chainwork for a block is the sum of its work with the work of all the blocks preceeding it. As such, when a new block is mined, its chainwork is simply its work plus the chainwork of the block before it. +This algorithm implies that summing chainwork makes sense. More formally, the expected number of hashes to solve one block candidate with work W is equal to the expected number of hashes to solve N block candidates with work W/N. This is proved [here](/protocol/blockchain/chainwork-proof). + ## Extra Nonce Ideally in such a proof-of-work system, the dynamic parameters of the data being hashed (i.e. the block header) would provide enough variability to guarantee any possible output of the hash function used.