edited.md

Abstract

Saito fixes the collective action problems which impede scaling in proof-of-work and proof-of-stake blockchains by coupling a circular (finite) ledger to a consensus mechanism that incentivizes the collection and sharing of transactions and their fees. Saito's measure of 'work' is more granular than traditional blockchain, rewarding the work of distributing transaction data across the network rather than solely paying for mining or staking for the privilege of authoring a block. Blocks in Saito are published as soon as they contain enough 'routing work' and rewards are unlocked via a hash lottery in subsequent blocks - the result is the full elimination of sustainable or profitable majoritarian (such as 51%) attacks in a blockchain which scales according to market demand.

Saito pays user-facing infrastructure nodes based on demand while maintaining an open consensus mechanism. This approach scales naturally and directly, as it explicitly pays for the processing of larger amounts of data as demand increases. Combined with Saito's security properties, the scalable network can at the simplest level be harnessed as a trustless universal broadcast layer capable of providing owner-less public key infrastructures (PKI) safe from MITM attacks, authenticated-by-default data exchange, payment channels, network infrastructure for other blockchains, and much more.

In economic terms, Saito is a solution for inducing the free market to deliver a public good applied holistically to blockchain design. This approach specifically corrects the fundamental collective action problems inherent in proof-of-work and proof-of-stake based consensus mechanisms such that profit-seeking actors compete to propagate and host user data as quickly and efficiently possible. The approach enables arbitrary scalability without sacrificing openness - the practical limits for growth are constrained by physical network and node hardware rather than protocol limits. It is the authors belief that the practical limit for a Saito blockchain today is in the order of 100 TB data throughput per day, and that advances in routing technology will push this to the petabyte level within a decade.

1. THE PROBLEM

The problem of blockchain scaling is not at the network hardware level: at the time of writing data centers around the world are implementing 400 Gbps network switches while 100 Gbps connections are becoming standard even in lower-tier colocation facilities. Given the resources necessary to compensate it, there are no technical or physical constraints preventing a blockchain from distributing data between its nodes this efficiently.

What limits network growth is the economic challenge of designing a protocol which provisions existing technology while maintaining the desirable properties of blockchain. In the past, non-economists have waived these considerations under the assumption that as long as money is being paid to the network at all, the entire system will enjoy efficient, market driven funding. This is not the case; proof-of-work and proof-of-stake are both afflicted by two market failures described by collective action theory: a Tragedy of the Commons problem which leads to blockchain bloat and deferral of cost into the future, and a Free Rider problem which leads to an under-provision of user-facing network infrastructure in exchange for an over-provision of paid activities like mining and staking. Neither problem is crippling at small scale, but each issue demonstrably forces compromises as bandwidth and storage costs rise with increased use.

Faced with the need to pay for uncompensated network infrastructure, blockchain engineers have effectively conceded the problem to the market. Economists have known since the 1960s how these collective action problems arise when you ask the private sector to fund non-excludable infrastructure (the desirable openness property of blockchain): the economic model will always develop concentrated points of closure where money can be made most efficiently, as Infura does for Ethereum. Businesses which pay for transaction collection must necessarily close access to the fees which subsidize them; the resultant controlled flow of funds into the blockchain undermines the openness of the consensus layer.

Because the network only subsidizes block production, it is only able to punish actions around publishing blocks - when what the network requires is to tax and reward good and bad behavior at the most granular level possible to account for all possible behavior which affects the openness, scalability and security of the ledger. For a consensus mechanism to judge only blocks is to ignore value in the data which makes up those blocks, so Saito's fundamental change is to base it's tax and reward structure off of transaction data. Equally as important, but simpler to state, Saito's other innovation is to enact a market rate cost for data storage and allow data to be pruned from the chain without breaking consensus. To understand the solutions it is useful to define the economic problems in context.

The tragedy-of-the-commons is an issue created by the existence of a permanent ledger, which encourages nodes to accept payment today for work (in the form of data stores and transmission) which can be offloaded to others tomorrow. This incentive leads to blockchain bloat as well as transaction mis-pricing, since users pay fees which do not reflect the true cost of their data to the network past the instance those fees are initially processed. The fact that this is a fundamental issue in blockchain is self-evident from the way Satoshi's solution in the Bitcoin White Paper was "not to care;" an approach which stops being viable in networks that operate at serious economic scale.

The solution requires all nodes that add transactions to the blockchain bear the cost of processing and storing those transactions for as long as that data remains on chain. In practice, this requires a market mechanism for accurately determining the price of on-chain data storage. The components described in Section 2 help remedy the tragedy-of-the-commons though the elimination of blockchain storage creep and the inclusion of a meted-out, rather than the upfront, market driven payment scheme for nodes which add data onto the chain.

The free-rider problem is more insidious. It arises in blockchains where payments are made for one type of work (such as mining or staking) at the expense of other important network activities. This lopsided incentive structure motivates participants to maximize spending on paid work and minimize it on everything else. In the blockchain space, this results in miners and stakers "free-riding" on participants who do the work of serving users through transaction collection, application development and in general run the user facing network. The problem gets worse as the network scales: a Bitcoin miner that spends a smaller percentage of revenue hashing than less altruistic miners will lose constantly lose market share and eventually be forced to capitulate. The status-quo solutions to this are either to keep the costs of auxiliary network provisions low, as Bitcoin does, or to embrace the privatization of the user facing network in order to increase throughput, an approach commonly seen in high data throughput chains like Ethereum or BSV, to name a couple.

Likewise, standard economics typically solves the free-rider problem by eliminating the property of "non-excludability" associated with any good or service, restricting its benefits to those who pay the costs of provision. In the blockchain space, this solution fundamentally destroys the openness of the network. Computer scientists often address the problem by adding protective middleware which is itself susceptible to the same economic problems and subsequent attack vectors, such as wrapping consensus payments in closed voting rings. The 'jiggery-pokery' approach can never solve the underlying economic issues - markets are powerful enough and incentivized to undermine these structures and suck value wherever possible.

Without a solution to this problem the choice is between a network which cannot scale because it cannot pay for its own network operations, or a network which does scale at the cost of the core values of blockchain: openness, trustlessness, and economic self-sufficiency. Neither approach is acceptable for building a genuinely open blockchain at massive scale.

The theoretical solution to the free-rider problem requires fixing the underlying incentive structure so that participants are compensated for providing what the network actually needs, rather than primarily rewarding hashing or staking. Because the blockchain requires a quantifiable cost-of-attack, the measure of work in this approach is shifted from 'mining' or 'staking' towards a different form of work which rewards nodes in proportion to the value they provide to users in the network i.e. processing user transactions and data into an open chain as quickly as possible.

This new measure of work derives itself from the transaction fees that users pay to include their transactions. This has fundamental benefits regarding cost of attack, network scaling, and value provided to users. Securing the rewards from this mechanism from fee-recycling attacks gives the network quantifiable and negative returns on attacking the network even when the attacker has a monopoly on work. This mechanism is fully described in Section 3 & 4.

2. FIXING THE TRAGEDY OF THE COMMONS

Saito solves blockchain storage creep by allowing nodes in the network to delete the oldest block in the ledger as the newest one is added. The interval length of the blocks which must be stored is defined by an "epoch." Epoch length is specified in consensus code. An extreme case: a blockchain designed to handle global traffic for distributed key-exchange applications, may have an epoch length corresponding to as short a time as 24 hours.

Saito specifies that once a block falls out of the current epoch, its unspent transaction outputs (UTXO) are no longer spendable. Any UTXO from that set which contains enough tokens to pay a rebroadcasting fee must be included in the very next block i.e. network nodes will automatically include it. Block producers do this by creating "automatic transaction rebroadcasting" (ATR) transactions that preserve the original transaction data, but have an entirely fresh and newly-spendable UTXO. Since these transactions must be re-included, block producers may only produce valid blocks when they possess the a full epoch's worth of history. After two epochs have elapsed block producers may delete all unpaid block data, though the 32-byte header hash may be retained to prove connection with the original genesis block.

The ATR mechanism fixes the tragedy of the commons problem completely, making it impossible for the blockchain to grow so big that it collapses. They key is ensuring that the 'rebroadcasting fee' paid by ATR transactions is proportional to the average fee paid per byte by all transactions added in the most recent epoch - this gives a market driven price to store data on chain based on what users were most recently willing to pay. As the blockchain expands and there is less space for new transactions available, the price of transaction fees increases and forces up the fees paid by older transactions increasing the amount of data pruned. The market reaches equilibrium when old data is removed from the chain at the same pace that new data is added.

Market discovery of the true cost of blockchain processing is an important effect of this incentive structure. As storage cost decreases or demand increases, nodes in Saito can accept more transactions and increase the size of blocks without any forks, governance, hard coded economic variables or manual adjustment at all. Subtler forms of free riding like nodes deleting on-chain data or refusing to store historical blocks are eliminated as well, as nodes which do not store the full epoch cannot determine which transactions to rebroadcast and thus fall out of consensus.

While ATR solves the problem of tragedy of the commons by ousting blockchain creep and giving direct market prices for space on chain, it does not distribute compensation to the nodes in the peer-to-peer network to pay for the fundamental activities that keep the network operating. Solving this problem requires a new consensus mechanism.

3. ELIMINATING FREE-RIDING

In Saito, a node is allowed to publish a block once it has collected enough routing work. Routing work is a measure derived from the fees embedded in the transactions that a node has either directly received from users or been forwarded from other nodes. Routing work begins equal to the fee included in a transaction, and the work earned is halved every time a transaction is forwarded along its path to a subsequent routing node. One transaction may have multiple paths which each measure distinct sets of routing work, but a transaction's routing work is only counted in the path that led to the finalized block. Routing nodes cryptographically sign transactions as they propagate through the network to mark their claim on the routing work within. Valid blocks must contain a collection of transactions such that their sum of routing work they provide to nodes in the routing paths exceed a certain threshold, which begins high and decays linearly towards zero over time.

Since routing work is derived from the fees embedded in transactions, attacking the network by attempting to buy more routing work has a measurable cost: the cost of out-competing all other user transactions. It can be seen from figure 2 that it is impossible for an attacker to produce blocks at a faster pace than the main chain unless they have access to sources of transactions which provides greater routing work than the rest of the network combined. This attack becomes more difficult as an attacker produces consecutive blocks, since the outstanding routing work from the rest of the network builds up the longer the attacker has a monopoly on block production; this cannot be said for Proof of Work or Proof of Stake and is a key security upgrade Saito has over traditional blockchains. The routing work waiting to be included grows at a constant rate which increases the cost of continuing an attack at the same rate. The plight of attackers is further exacerbated by the fact that if the attacker does not have exclusive access their source of routing work, other nodes will use it before any transaction hoarding can take place.

As long as there is no payment for block production (like a mining or staking reward), this system offers comparable security to Bitcoin; cost-of-attack can always be quantified and attackers must spend their own money to attack the chain. Users may wait however many block confirmations are needed to meet their security requirements. Also like Bitcoin, the network can increase the amount of routing work needed for block production to keep block-time constant, so that as transaction fee volume grows, security scales with it.

To fund network infrastructure and avoid a deflationary crash, Saito must distribute the transaction fees from a completed block. But fees cannot simply be given directly to block producers as that would allow attackers to use income from one block to generate the routing work needed to produce the next one. Dividing up the rewards between different nodes is preferable, but so long as block producers have any influence over who gets paid, a savvy attacker can Sybil the network or conduct grinding attacks that target the token-issuing mechanism.

Distributing rewards securely is solved in Saito by inverting the classic proof-of-work solution. In Bitcoin, consensus rules make it expensive to produce blocks and fees are then handed to the block producer, along with a block subsidy. This is meant to ensure producing consecutive blocks is expensive, but it also guarantees conditions in which attacks are profitable. In Saito the solution is the opposite: first by ensuring that rewards are proportional to work regardless of who produces the block, and second by using retroactive proof of work to unlock those rewards.

We call the mechanism that achieves this the "golden ticket." This mechanism pays honest nodes for collecting fees regardless of who produces blocks by unlocking payments through a lottery conducted in the subsequent block, but only if a proof of work puzzle is solved in time. The system is designed to ensures there is a quantifiable and cost for attacking the system in all scenarios.

4. THE GOLDEN TICKET

Whenever a node produces a block, it may collect the marginal surplus of fees tied to that block's routing work past the amount of routing work required by consensus for valid block production. The great majority of fees from this block are not distributed upon publishing.

Unlocking the remainder of the routing work and associated fees requires the network to solve a computational puzzle called 'The Golden Ticket.' This puzzle requires knowledge of the block hash to solve and cannot be calculated in advance. Miners on the network listen for blocks as they are produced and begin hashing in search of a solution. Should they find a valid solution, they propagate it into the network as a normal fee-paying transaction; multiple successful miners will compete for their solution to be included via the transaction fee they include.

Only one solution may included may be included in any block, and that solution must correspond to the puzzle from the block directly before it to be considered valid. If a Golden Ticket goes unsolved, the funds that were not paid out in the previous block are simply not allocated - they remain with their block and eventually fall off the chain, at which point the lost funds are recollected by the consensus layer and eventually redistributed as part of a future block reward.

Should a Golden Ticket solution be found in time, the unallocated fees are released to the network, split between the miner that found the solution and a random node in the peer-to-peer routing network. The routing node is selected using a random variable sourced from the miner's solution, with each routing node's chance of winning proportional to the overall routing work it contributed to the block being solved.

We call the division of payment between the miners and routers the paysplit of the network. It is set to 0.5 by default (half to miners, half to routers) but can be made adjustable as described in the section below. The golden ticket system can be visualized as follows.

This system has several major advantages over the proof-of-work and proof-of-stake mechanisms, including the elimination majoritarian attacks. Saito explicitly distributes fees to the nodes that service users, collect transactions and produce blocks, doing so in proportion to the amount of value that these actors provide to the overall network - not just hashing or staking. Network nodes compete for access to lucrative inbound transaction flow, and will happily fund whatever development activities are needed to get users on the network, supplying them with primary access to routing work. Of note, the services provided by the edge nodes to attract Saito usage can include public-facing infrastructure needed by other blockchains.

This is a fundamental shift: where other blockchains explicitly define what activities have value, Saito lets the users signal what services provide value through fee-pricing, while the network infers who deserves payments. Saito also incentivizes the efficient delivery of value to users by paying for value rather than a subset of network activities. This guarantees the network can remain self-sufficient and open at scale.

The Saito consensus mechanism is also "twice as secure" as its proof-of-work and proof-of-stake counterparts. Honest nodes route transactions to block producers and earn fees in exchange, but attackers are thrown into a catch-22: they must not only spend the same amount of fees as the honest network the produce a competitive chain, but also match 100 percent of the mining output to find enough golden ticket solutions to recapture their attack costs. Even if attackers successfully launch fee-recycling attacks, the must still spend 100 percent of their income on hashing since they do not have the benefit of miners from the honest chain helping unlocking fees used in the attack, and could only earn half their fees back even if they did.

The basic version of the Saito system achieves 100 percent fee-security, eliminating the fifty-one percent attack completely. Section 5 describes a modification to this mechanism that pushes security above 100 percent and guarantees that attackers will always lose Saito by attacking the network. Regardless of which implementation is used, the economic problems created by traditional consensus mechanisms which rely on external supply-curves vanish: mining serves as a pure cost function instead of a difficulty function allowing the blockchain to remain secure even as the supply curve for hash becomes perfectly flat.

5. ADVANCED SECURITY - POWSPLIT

It is possible to increase the attack costs beyond 100 percent of the available returns through a "powsplit" mechanism. Note that in the normal Saito implement with a fixed paysplit of 0.5, the network auto adjusts mining difficulty so that one golden ticket solution is found per block, on average. Since miners cannot control the variance at which solutions are found, network difficulty may end up being lower at times than is needed for optimal security.

"Powsplit" eliminates this problem by adjusting the mining difficulty such that one solution is found every N blocks on average. When a solution is finally found, the rewards for the string of unsolved blocks are distributed to the winning routing nodes from each block, and the solver earns their split from the same blocks.