<blockquote>
<p>the code could have a way to order transactions and if an attacker decides to do the opposite intentionally and decides to spam the network</p>
</blockquote>
<p>This is the crux of the issue: how do you achieve this? It isn't a trivial problem to solve in a decentralized network. The more generalized version of this non-trivial problem is called the <a href="https://www.microsoft.com/en-us/research/uploads/prod/2016/12/The-Byzantine-Generals-Problem.pdf" rel="nofollow noreferrer">Byzantine General's Problem</a>, it describes the ability of participants to come to an agreement in an untrusted network. The invention of bitcoin provides an economically-incentivized game-theoretic framework that could be considered a probabilist solution to this problem.  As @PieterWuille mentioned in the comments, there is no <em>absolute</em> guarantee of eventual consistency: there is only a (<a href="https://bitinfocharts.com/comparison/bitcoin-hashrate.html" rel="nofollow noreferrer">continually increasing, thus far</a>) economic incentive for participants to consider.</p>
<p>The solution that proof of work provides is to rate-limit spamming via the requirement for expenditure of a scarce resource: energy. It is hard to create a new block (it takes some amount of energy, on average), but it is easy to verify if a block is valid. And remember that the method for choosing the next valid block must be perfectly consistent across all nodes in the network, or else you risk a network split/fork, which is very undesirable.</p>
<blockquote>
<p>but how does the attacker benefit from that?</p>
</blockquote>
<p>There are many ways an attacker could benefit. As a simple example: the attacker takes a 'short' financial position, betting against the price of bitcoin. They then attack the network, assumedly causing the network's value to drop, and thus they would profit from their short position.</p>

CC BY-SA 4.0
2021-04-02T23:06:41.700Z
just to add to your answer, split chain can still happen in PoW by honest miners and we fix this by taking the longer chain. So it seems like the main benefit of PoW is to solve transaction order problem (called "double spending"), is there any other benefit?
SpaceMonkey
CC BY-SA 4.0
2021-04-02T23:09:40.557Z
@SpaceMonkey I added a bit more to my answer. Chain splits can indeed happen, proof of work helps to guarantee an *eventual* consensus. The few blocks at the chain tip would not be considered as secure as much older blocks in the same chain.
chytrik
CC BY-SA 4.0
2021-04-02T23:13:37.113Z
Proof of work is **not** eventually consistent, at least if you mean the technical term from distributed systems - that would imply that after a finite amount of time a certain state is irreversibly agreed upon by all participants. Under PoW, there is always a chance of reorganization, regardless of how deep it is buried. What PoW adds is an *incentive* for miners to cooperate on a single chain rather than work against each other, and under certain economic assumptions, that means the chance of reorgs goes down exponentially as time passes - but it still never becomes zero.
Pieter Wuille
CC BY-SA 4.0
2021-04-02T23:43:24.433Z
@PieterWuille what is the incentive for miners to cooperate on a single chain? if miners receive transactions in different orders and create a split chain, what is the incentive for one group of miners to discard their version of the chain and adopt the other one?
SpaceMonkey
CC BY-SA 4.0
2021-04-02T23:44:30.130Z
Only the subsidy/fee income miners receiving in the winning chain matters. If miners build competing chains, only one of those will win.
Pieter Wuille
CC BY-SA 4.0
2021-04-02T23:48:45.697Z
but they are receiving their mining fees as long as they continue on their version of the chain. What makes them ditch their version and switch to the other chain?
SpaceMonkey
CC BY-SA 4.0
2021-04-03T00:42:52.723Z
They get a payout each in their own fork, but ultimately forks get resolved - and only one one chain will eventually be accepted by the network. The subsidies/fees received in the extinguished chain don't result in money that's acceptable as BTC.
Pieter Wuille
CC BY-SA 4.0
2021-04-03T12:56:50.940Z
@PieterWuille exactly, so how do the forks get resolved eventually? isn't it where the "honest" nodes accept only the longest chain?
SpaceMonkey
CC BY-SA 4.0
2021-04-03T16:17:38.527Z
In PoW, the most-work valid chains wins. But how this happens isn't relevant for your question: somehow one of the chains needs to win - or we'd end up with two separate currencies if they both survive, each with their own ecosystems around it. And yes, of course it is only honest nodes that can be assumed to follow the most-work chain, but they're also the only relevant ones - they're the ones miners hope to sell their earned BTC to! Note that nodes are not just miners.
Pieter Wuille
CC BY-SA 4.0
2021-04-03T23:17:49.100Z
Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/122639/discussion-between-spacemonkey-and-pieter-wuille).
SpaceMonkey
CC BY-SA 4.0
2021-04-02T23:01:21.373Z
2021-04-02T23:24:34.860Z
2021-04-02T23:24:34.860Z
chytrik
<p>Taking the simple case of Bitcoin here:</p>
<p>If all nodes can validate published transactions by checking the signature (created using the private key of the sender) of the transaction against the public key of the sender, why isn't that sufficient to validate a block?</p>
<p>I understand that we also solve the puzzle of finding a nonce that when combined with a block's contents, gives us a hash that has N number of leading zeroes. Why do we need this at all? Isn't it enough to check the validity of each transaction in the block?</p>
<p>As for double spending, if a miner decides erroneously to include both transactions, nodes can see there isn't enough balance and reject such blocks. As for which transaction of the two to take, the code could have a way to order transactions and if an attacker decides to do the opposite intentionally and decides to spam the network (since there's no proof of work cost) but how does the attacker benefit from that?</p>

<blockchain><public-key><proof-of-work>
Why aren't public-private keys sufficient to build a block chain? Why do we need proof of work/stake?
SpaceMonkey
# Why aren't public-private keys sufficient to build a block chain? Why do we need proof of work/stake?

(Asked by: username_0 on 2021-04-02)

Taking the simple case of Bitcoin here:

If all nodes can validate published transactions by checking the signature (created using the private key of the sender) of the transaction against the public key of the sender, why isn't that sufficient to validate a block?

I understand that we also solve the puzzle of finding a nonce that when combined with a block's contents, gives us a hash that has N number of leading zeroes. Why do we need this at all? Isn't it enough to check the validity of each transaction in the block?

As for double spending, if a miner decides erroneously to include both transactions, nodes can see there isn't enough balance and reject such blocks. As for which transaction of the two to take, the code could have a way to order transactions and if an attacker decides to do the opposite intentionally and decides to spam the network (since there's no proof of work cost) but how does the attacker benefit from that?

**Tags:** blockchain, public-key, proof-of-work


---

## 1 answers

### Answer by username_1 on 2021-04-02. Score: 4 | Accepted answer

> the code could have a way to order transactions and if an attacker decides to do the opposite intentionally and decides to spam the network

This is the crux of the issue: how do you achieve this? It isn't a trivial problem to solve in a decentralized network. The more generalized version of this non-trivial problem is called the [Byzantine General's Problem](https://www.microsoft.com/en-us/research/uploads/prod/2016/12/The-Byzantine-Generals-Problem.pdf), it describes the ability of participants to come to an agreement in an untrusted network. The invention of bitcoin provides an economically-incentivized game-theoretic framework that could be considered a probabilist solution to this problem. As @username_2 mentioned in the comments, there is no *absolute* guarantee of eventual consistency: there is only a ([continually increasing, thus far](https://bitinfocharts.com/comparison/bitcoin-hashrate.html)) economic incentive for participants to consider.

The solution that proof of work provides is to rate-limit spamming via the requirement for expenditure of a scarce resource: energy. It is hard to create a new block (it takes some amount of energy, on average), but it is easy to verify if a block is valid. And remember that the method for choosing the next valid block must be perfectly consistent across all nodes in the network, or else you risk a network split/fork, which is very undesirable.

> but how does the attacker benefit from that?

There are many ways an attacker could benefit. As a simple example: the attacker takes a 'short' financial position, betting against the price of bitcoin. They then attack the network, assumedly causing the network's value to drop, and thus they would profit from their short position.

> **Comments:**
> **username_0**: just to add to your answer, split chain can still happen in PoW by honest miners and we fix this by taking the longer chain. So it seems like the main benefit of PoW is to solve transaction order problem (called "double spending"), is there any other benefit?  
> **username_1**: @username_0 I added a bit more to my answer. Chain splits can indeed happen, proof of work helps to guarantee an *eventual* consensus. The few blocks at the chain tip would not be considered as secure as much older blocks in the same chain.  
> **username_2**: Proof of work is **not** eventually consistent, at least if you mean the technical term from distributed systems - that would imply that after a finite amount of time a certain state is irreversibly agreed upon by all participants. Under PoW, there is always a chance of reorganization, regardless of how deep it is buried. What PoW adds is an *incentive* for miners to cooperate on a single chain rather than work against each other, and under certain economic assumptions, that means the chance of reorgs goes down exponentially as time passes - but it still never becomes zero.  
> **username_0**: @username_2 what is the incentive for miners to cooperate on a single chain? if miners receive transactions in different orders and create a split chain, what is the incentive for one group of miners to discard their version of the chain and adopt the other one?  
> **username_2**: Only the subsidy/fee income miners receiving in the winning chain matters. If miners build competing chains, only one of those will win.  
> **username_0**: but they are receiving their mining fees as long as they continue on their version of the chain. What makes them ditch their version and switch to the other chain?  
> **username_2**: They get a payout each in their own fork, but ultimately forks get resolved - and only one one chain will eventually be accepted by the network. The subsidies/fees received in the extinguished chain don't result in money that's acceptable as BTC.  
> **username_0**: @username_2 exactly, so how do the forks get resolved eventually? isn't it where the "honest" nodes accept only the longest chain?  
> **username_2**: In PoW, the most-work valid chains wins. But how this happens isn't relevant for your question: somehow one of the chains needs to win - or we'd end up with two separate currencies if they both survive, each with their own ecosystems around it. And yes, of course it is only honest nodes that can be assumed to follow the most-work chain, but they're also the only relevant ones - they're the ones miners hope to sell their earned BTC to! Note that nodes are not just miners.  
> **username_0**: Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/122639/discussion-between-username_0-and-username_2-username_2).  

---

