memoscan

0x18d2…ed36

All memos sent from and to 0x18d2…ed36.
0x18d2eb5c…ed36sent to0x18d2eb5c…ed36·#17,523,125·0x5f1971c8…8dae42
Satoshi NakamotoZpayments to be sent directly from one party to another without going through abenefits are lost if a trusted third party is still required to prevent double-spending.The network timestamps transactions by hashing them into an ongoing chain ofzthe proof-of-work. The longest chain not only serves as proof of the sequence of:long as a majority of CPU power is controlled by nodes that are not cooperating toZnetwork itself requires minimal structure. Messages are broadcast on a best effortvW7Jproof-of-work chain as proof of what happened while they were gone.Commerce on the Internet has come to rely almost exclusively on financial institutions serving as*most transactions, it still suffers from the inherent weaknesses of the trust based model.Javoid mediating disputes. The cost of mediation increases transaction costs, limiting theand there is a broader cost in the loss of ability to make non-reversible payments for nonreversible services. With the possibility of reversal, the need for trust spreads. Merchants mustA certain percentage of fraud is accepted as unavoidable. These costs and payment uncertaintiesG:over a communications channel without a trusted party.allowing any two willing parties to transact directly with each other without the need for a trustedW':from fraud, and routine escrow mechanisms could easily be implemented to protect buyers. In'WFVJtimestamp server to generate computational proof of the chronological order of transactions. Thecooperating group of attacker nodes.Znext by digitally signing a hash of the previous transaction and the public key of the next ownerJthe coin. A common solution is to introduce a trusted central authority, or mint, that checks everyissue a new coin, and only coins issued directly from the mint are trusted not to be double-spent.Zcompany running the mint, with every transaction having to go through them, just like a bank.&ƖW*transactions. For our purposes, the earliest transaction is the one that counts, so we don't carebe aware of all transactions. In the mint based model, the mint was aware of all transactions and&Zpublicly announced [1], and we need a system for participants to agree on a single history of theZmajority of nodes agreed it was the first received.6W'fW*The solution we propose begins with a timestamp server. A timestamp server works by taking anewspaper or Usenet post [2-5]. The timestamp proves that the data must have existed at theits hash, forming a chain, with each additional timestamp reinforcing the ones before it.4. Proof-of-WorkThe proof-of-work involves scanning for a value that when hashed, such as with SHA-256, the&W*of zero bits required and can be verified by executing a single hash.Zblock until a value is found that gives the block's hash the required zero bits. Once the CPUvVJwithout redoing the work. As later blocks are chained after it, the work to change the blockThe proof-of-work also solves the problem of determining representation in majority decisionZable to allocate many IPs. Proof-of-work is essentially one-CPU-one-vote. The majorityfW7FVJin it. If a majority of CPU power is controlled by honest nodes, the honest chain will grow theredo the proof-of-work of the block and all blocks after it and then catch up with and surpass theW diminishes exponentially as subsequent blocks are added.the proof-of-work difficulty is determined by a moving average targeting an average number of1) New transactions are broadcast to all nodes.3) Each node works on finding a difficult proof-of-work for its block.5) Nodes accept the block only if all transactions in it are valid and not already spent.Zchain, using the hash of the accepted block as the previous hash.extending it. If two nodes broadcast different versions of the next block simultaneously, somebut save the other branch in case it becomes longer. The tie will be broken when the next proofof-work is found and one branch becomes longer; the nodes that were working on the othermany nodes, they will get into a block before long. Block broadcasts are also tolerant of droppedJrealizes it missed one.fZBy convention, the first transaction in a block is a special transaction that starts a new coin ownedFW:a way to initially distribute coins into circulation, since there is no central authority to issue them.zresources to add gold to circulation. In our case, it is CPU time and electricity that is expended.:less than its input value, the difference is a transaction fee that is added to the incentive value ofFW&VJcirculation, the incentive can transition entirely to transaction fees and be completely inflationThe incentive may help encourage nodes to stay honest. If a greedy attacker is able toJto defraud people by stealing back his payments, or using it to generate new coins. He ought toeveryone else combined, than to undermine the system and the validity of his own wealth.6ZOnce the latest transaction in a coin is buried under enough blocks, the spent transactions beforetransactions are hashed in a Merkle Tree [7][2][5], with only the root included in the block's hash.not need to be stored.&Zgenerated every 10 minutes, 80 bytes * 6 * 24 * 365 = 4.2MB per year. With computer systemsj1.2GB per year, storage should not be a problem even if the block headers must be kept inBlock Header (Block Hash)#:Block Header (Block Hash)Transactions Hashed in a Merkle Tree After Pruning Tx0-2 from the Block:8. Simplified Payment VerificationVW a copy of the block headers of the longest proof-of-work chain, which he can get by queryinglinking the transaction to the block it's timestamped in. He can't check the transaction forand blocks added after it further confirm the network has accepted it.&Zvulnerable if the network is overpowered by an attacker. While network nodes can verifyFVJtransactions for as long as the attacker can continue to overpower the network. One strategy toƖJblock, prompting the user's software to download the full block and alerted transactions torun their own nodes for more independent security and quicker verification.VZAlthough it would be possible to handle coins individually, it would be unwieldy to make atransactions contain multiple inputs and outputs. Normally there will be either a single inputoutputs: one for the payment, and one returning the change, if any, back to the sender.6Ztransactions depend on many more, is not a problem here. There is never the need to extract aJPrev Hash Nonce6ZMerkle Branch for Tx3The traditional banking model achieves a level of privacy by limiting access to information to theV&Ɩ6ǚprecludes this method, but privacy can still be maintained by breaking the flow of information inzan amount to someone else, but without information linking the transaction to anyone. This isjindividual trades, the "tape", is made public, but without telling who the parties were.from being linked to a common owner. Some linking is still unavoidable with multi-inputis that if the owner of a key is revealed, linking could reveal other transactions that belonged to11. CalculationsW7Jchain. Even if this is accomplished, it does not throw the system open to arbitrary changes, such&Znot going to accept an invalid transaction as payment, and honest nodes will never accept a blockmoney he recently spent.Random Walk. The success event is the honest chain being extended by one block, increasing itsW"w:Ruin problem. Suppose a gambler with unlimited credit starts at a deficit and plays potentially anWfW*reaches breakeven, or that an attacker ever catches up with the honest chain, as follows [8]:q = probability the attacker finds the next blockjIdentities Transactions TrustedV&Ɩ:Identities Transactions PublicTraditional Privacy ModelZattacker has to catch up with increases. With the odds against him, if he doesn't make a luckyWe now consider how long the recipient of a new transaction needs to wait before beingW*who wants to make the recipient believe he paid him for a while, then switch it to pay back toZsender hopes it will be too late.&Zsigning. This prevents the sender from preparing a chain of blocks ahead of time by working onJthat moment. Once the transaction is sent, the dishonest sender starts working in secret on aThe recipient waits until the transaction has been added to a block and z blocks have been'WJassuming the honest blocks took the average expected time per block, the attacker's potential*each amount of progress he could have made by the probability he could catch up from that point:Rearranging to avoid summing the infinite tail of the distribution...Converting to C code...double AttackerSuccessProbability(double q, int z) double p = 1.0 - q; double sum = 1.0; for (k = 0; k <= z; k++) double poisson = exp(-lambda); poisson *= lambda / i;zRunning some results, we can see the probability drop off exponentially with z.s:z=2 P=0.0509779s#*z=4 P=0.00345523zz=6 P=0.0002428cCzz=8 P=0.0000173Cjz=10 P=0.0000012:z=0 P=1.0000000ss3S#:z=10 P=0.0416605z=20 P=0.00248043*z=30 P=0.0001522z=40 P=0.0000095#Jz=50 P=0.0000006We have proposed a system for electronic transactions without relying on trust. We started withjownership, but is incomplete without a way to prevent double-spending. To solve this, we:that quickly becomes computationally impractical for an attacker to change if honest nodesFW:work all at once with little coordination. They do not need to be identified, since messages areleave and rejoin the network at will, accepting the proof-of-work chain as proof of whatjvalid blocks by working on extending them and rejecting invalid blocks by refusing to work on6W:[1] W. Dai, "b-money," http://www.weidai.com/bmoney.txt, 1998.trust requirements," In 20th Symposium on Information Theory in the Benelux, May 1999.2, pages 99-111, 1991.*In Sequences II: Methods in Communication, Security and Computer Science, pages 329-334, 1993.6Zon Computer and Communications Security, pages 28-35, April 1997.http://www.hashcash.org/papers/hashcash.pdf, 2002.JPrivacy, IEEE Computer Society, pages 122-133, April 1980.