Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol
Aggelos Kiayias Alexander Russell† Bernardo David‡ Roman Oliynykov§
August 21, 2017
Abstract
We present “Ouroboros”, the first blockchain protocol based on proof of stake with rig-
orous security guarantees. We establish security properties for the protocol comparable to
those achieved by the bitcoin blockchain protocol. As the protocol provides a “proof of stake”
blockchain discipline, it o ers qualitative e ciency advantages over blockchains based on proof
of physical resources (e.g., proof of work). We also present a novel reward mechanism for in-
centivizing Proof of Stake protocols and we prove that, given this mechanism, honest behavior
is an approximate Nash equilibrium, thus neutralizing attacks such as selfish mining. We also
present initial evidence of the practicality of our protocol in real world settings by providing
experimental results on transaction confirmation and processing.
1 Introduction
A primary consideration regarding the operation of blockchain protocols based on proof of work
(PoW)—such as bitcoin [30]—is the energy required for their execution. At the time of this writ-
ing, generating a single block on the bitcoin blockchain requires a number of hashing operations
exceeding 260, which results in striking energy demands. Indeed, early calculations indicated that
the energy requirements of the protocol were comparable to that of a small country [32].
This state of a airs has motivated the investigation of alternative blockchain protocols that
would obviate the need for proof of work by substituting it with another, more energy e cient,
mechanism that can provide similar guarantees. It is important to point out that the proof of work
mechanism of bitcoin facilitates a type of randomized “leader election” process that elects one of
the miners to issue the next block. Furthermore, provided that all miners follow the protocol, this
selection is performed in a randomized fashion proportionally to the computational power of each
miner. (Deviations from the protocol may distort this proportionality as exemplified by “selfish
mining” strategies [21, 38].)
A natural alternative mechanism relies on the notion of “proof of stake” (PoS). Rather than
miners investing computational resources in order to participate in the leader election process, they
instead run a process that randomly selects one of them proportionally to the stake that each
possesses according to the current blockchain ledger.
University of Edinburgh and IOHK.
[email protected]. Work partly performed while at the National and
Kapodistrian University of Athens, supported by ERC project CODAMODA #259152. Work partly supported by
H2020 Project #653497, PANORAMIX.
†
University of Connecticut.
[email protected].
‡
Aarhus University and IOHK,
[email protected]. Work partly supported by European Research Council
Starting Grant 279447.
§
IOHK,
[email protected].
1
Proof-of-Stake Sidechains
Peter Gaˇ
zi1, Aggelos Kiayias1,2, and Dionysis Zindros1,3
1 IOHK
2 University of Edinburgh
3 National and Kapodistrian University of Athens
December 18, 2018
Abstract. Sidechains have long been heralded as the key enabler of blockchain scalability and inter-
operability. However, no modeling of the concept or a provably secure construction has so far been
attempted.
We provide the first formal definition of what a sidechain system is and how assets can be moved
between sidechains securely. We put forth a security definition that augments the known transaction
ledger properties of persistence and liveness to hold across multiple ledgers and enhance them with
a new “firewall” security property which safeguards each blockchain from its sidechains, limiting the
impact of an otherwise catastrophic sidechain failure.
We then provide a sidechain construction that is suitable for proof-of-stake (PoS) sidechain systems.
As an exemplary concrete instantiation we present our construction for an epoch-based PoS system
consistent with Ouroboros (Crypto 2017), the PoS blockchain protocol used in Cardano which is one
of the largest pure PoS systems by market capitalisation, and we also comment how the construction
can be adapted for other protocols such as Ouroboros Praos (Eurocrypt 2018), Ouroboros Genesis
(CCS 2018), Snow White and Algorand. An important feature of our construction is merged-staking
that prevents “goldfinger” attacks against a sidechain that is only carrying a small amount of stake. An
important technique for pegging chains that we use in our construction is cross-chain certification which
is facilitated by a novel cryptographic primitive we introduce called ad-hoc threshold multisignatures
(ATMS) which may be of independent interest. We show how ATMS can be securely instantiated by
regular and aggregate digital signatures as well as succinct arguments of knowledge such as STARKs
and bulletproofs with varying degrees of storage e ciency.
1 Introduction
Blockchain protocols and their most prominent application so far, cryptocurrencies like Bitcoin [27], have
been gaining increasing popularity and acceptance by a wider community. While enjoying wide adoption,
there are several fundamental open questions remaining to be resolved that include (i) Interoperability: How
can di↵erent blockchains interoperate and exchange assets or other data? (ii) Scalability: How can blockchain
protocols scale, especially proportionally to the number of participating nodes? (iii) Upgradability: How can
a deployed blockchain protocol codebase evolve to support a new functionality, or correct an implementation
problem?
The main function of a blockchain protocol is to organise application data into blocks so that a set of
nodes that evolves over time can arrive eventually to consensus about the sequence of events that took place.
The consensus component can be achieved in a number of ways, the most popular is using proof-of-work [16]
(cf. [27,17]), while a promising alternative is to use proof-of-stake (cf. [26,20,5,13]). Application data typically
consists of transactions indicating some transfer of value as in the case of Bitcoin [27]. The transfer of value
can be conditioned on arbitrary predicates called smart contracts such as, for example, in Ethereum [11,31].
The conditions used to validate transactions depend on local blockchain events according to the view
of each node and they typically cannot be dependent on other blockchain sessions. Being able to perform
operations across blockchains, for instance from a main blockchain such as Bitcoin to a “sidechain” that
has some enhanced functionality, has been frequently considered a fundamental technology enabler in the
blockchain space.4
4 See e.g., https://blockstream.com/technology/ and [1].
Marlowe: financial contracts on blockchain?
Pablo Lamela Seijas[0000 0002 1730 1219]
and Simon Thompson[0000 0002 2350 301X]
School of Computing, University of Kent, Canterbury, UK
1 Introduction
This paper explores the design of a domain specific language, Marlowe,12 targeted
at the execution of financial contracts in the style of Peyton Jones, Eber and
Seward [16] on blockchains. In doing this, we are required to refine the model of
contracts in a number of ways in order to fit with a radically di↵erent context.
Consider the following example of an “escrow” contract so that we can explain
the motivation more concretely. The aim of this contract, written in functional
pseudocode in the style of [16] involves three participants: alice, bob and carol.
alice is to pay an amount of money to bob on receipt of goods from her. alice
pays the money into escrow controlled by carol.
There are two options for the money: if two out of the three participants agree
to pay it to bob, that goes ahead; if, on the other hand, two of the participants
opt to refund the money to alice, that is done instead.
The outer primitive When waits until the condition – its first argument –
becomes true; in this case, the condition is that either two participants choose
refund or two participants choose pay. The second argument of the When is
itself another Contract, which is performed after the condition of the When has
been met, and it makes the payment if two participants chose pay, otherwise it
redeems previous money commitments.
(When (Or (two_chose alice bob carol refund)
(two_chose alice bob carol pay))
(Choice (two_chose alice bob carol pay)
(Pay alice bob AvailableMoney)
redeem_original))
We discuss this particular example in more detail in Marlowe in Section 3
below; but it already gives us an example of how traditional contracts are
fundamentally di↵erent from contracts that are meant to be run on top of
the blockchain. In the traditional model, enforcement of the contract is the
responsibility of the legal system. If alice does not pay the money into escrow,
or carol chooses to keep it for herself, then they can be sued for the money
? This work is part of the Cardano project and is supported by IOHK, https://iohk.io
1 Named after Christopher Marlowe, the Elizabethan poet, dramatist and spy, who was
born and educated in Canterbury, en.wikipedia.org/wiki/Christopher_Marlowe
2 Marlowe is available from https://github.com/input-output-hk/scdsl
l
IOHK Research Papers https://iohk.io/research/library/