*DeFi is the next major frontier for blockchain technology – but what does the current surge of interest mean for Ergo?*

The narrative around blockchain technology is evolving in front of us. The use cases for smart contract platforms are becoming clearer by the day, encapsulated in the catch-all term of ‘DeFi’, or Decentralised Finance.

DeFi services are often much like their traditional counterparts, including lending and derivatives platforms, as well as more exotic services. Unlike their conventional analogues, though, these are open platforms, accessible by anyone and built with the transparency and security that come from the blockchains on which they are hosted.

## The DeFi surge

The last two weeks have seen the nascent DeFi space change rapidly, catalysed by the launch of lending platform Compound’s governance token, COMP. One of the inherent benefits of DeFi is transparency, and the impact of this move can clearly be tracked on websites like [DeFi Pulse](https://defipulse.com/).

Compound almost immediately took the top spot in terms of Total Value Locked (TVL), pushing the Maker Protocol into second place. From a baseline of $100 million, Compound rose to over $600 million TVL in only ten days, as tens of thousands of users flocked to take advantage of the platform’s distribution of COMP tokens in the new craze of ‘Yield farming’.

But it certainly wasn’t all back for the rest. In the same period of time, the Maker Protocol hit an all-time high for the amount of Dai generated using its Vaults. Meanwhile Sythetix, a synthetic assets platform, has doubled its TVL.

This is not like a bear market rally in the regular crypto world, where value is simply shuffled between BTC and alts, while the general trajectory is down. Something else is at work here.

## Unconventional thinking

The reason may rest on another inherent property of DeFi platforms: composability. Because DeFi dApps are transparent and open, they can be built upon and adapted, creating new dApps easily. And then those dApps themselves can be plugged into other applications, adapted and redeployed in a virtuous circle of usage.

Compound’s rise goes hand-in-hand with the rise of other DeFi initiatives because it is so easy to connect different platforms in the DeFi world. It’s almost hard to view these as distinct platforms at all, when the boundaries are so porous. Assets can be leveraged, lent and deployed on one dApp in order to take advantage of the benefits currently offered by another. And there’s evidence – thanks to the transparency of the blockchain – that’s exactly what’s happening.

DeFi demands some unconventional thinking. Instead of viewing the sector in the fairly natural human terms of competition, who is #1 and what their lead is over #2, it requires a paradigm shift and a recognition that composability means collaboration by default. It’s not only desirable, but unstoppable – inseparable from what DeFi is, at its core. Open, collaborative financial services.

For Ergo, the surge of interest in the sector is an exciting development and confirms the decision to prioritise [diverse smart contract and DeFi functionality](https://ergoplatform.org/blog/2020_03_16_ergo_sigma/). It also points to the need for interoperability between blockchains, enabling any smart contract protocol to interact with any other.

Ergo is well on the way to that end with atomic swaps, which will facilitate cross-platform activity – and ultimately, the use of ERG and Ergo assets in Ethereum and other blockchains’ DeFi services, and vice versa.

DeFi will clearly be a big part of financial services provision in the coming years, and Ergo will bring unique contributions to the space.

Ergo and the explosion of DeFi


_There’s often a tension in the crypto world between security and convenience. That trade-off is unacceptable if we want these technologies to be widely used. Here’s how Ergo addresses one common and very important issue._

We all know that the most secure way to use Bitcoin, or any crypto, is to download a copy of the blockchain and run a full node yourself. That way, every time you or anyone else makes a transaction, your client checks the blockchain to ensure it’s valid. You don’t have to trust anyone else.

A full Bitcoin node checks all the blocks in the blockchain (using headers) and makes sure there are no fraudulent transactions. It’s a very secure way of using crypto – but there’s a problem. It requires significant bandwidth, storage and processing power. That kind of commodity hardware is expensive, and using a full node to validate and make transactions is in any case unsuitable for mobile devices. This is particularly true for Bitcoin, where the blockchain is over [270 GB and counting](https://www.blockchain.com/charts/blocks-size).

## SPV

Simplified Payment Verification (SPV) is designed to address this problem, as described in the [Bitcoin white paper](https://bitcoin.org/bitcoin.pdf):

- _It is possible to verify payments without running a full network node. A user only needs to keep a copy of the block headers of the longest proof-of-work chain, which he can get by querying network nodes until he's convinced he has the longest chain, and obtain the Merkle branch linking the transaction to the block it's timestamped in. He can't check the transaction for himself, but by linking it to a place in the chain, he can see that a network node has accepted it, and blocks added after it further confirm the network has accepted it._
 
Satoshi notes that this is not a perfect solution, and is vulnerable to an attacker overpowering the network and fooling SPV users.

Moreover, while SPV mode is intended for resource-limited devices, even this ‘lite’ approach is not always feasible. Ethereum’s headers alone total around 5 GB to download. Thus Ethereum mobile clients do not validate chain validity and so blindly have to trust third parties.

There are proposals to reduce the requirements for SPV mode by checking just a few random headers, instead of all of them. But it’s hard to do that securely. 

## Efficient SPV

Several years have been spent researching and developing secure protocols that allow for efficient SPV clients. The two best-known and most reliable protocols are NiPoPoWs and FlyClient.

Ergo implements NiPoPoWs, or Non-interactive Proof-of-Proof-of-Work. This technology can be explored in full on this dedicated website: [https://nipopows.com](https://nipopows.com):

- _Non-Interactive Proofs of Proof-of-Work (NIPoPoWs) are short stand-alone strings that a computer program can inspect to verify that an event happened on a proof-of-work-based blockchain without connecting to the blockchain network and without downloading all block headers. For example, these proofs can illustrate that a cryptocurrency payment was made._

- _NIPoPoWs allow very efficient mobile wallets to be created. [SPV wallets](https://bitcoin.org/en/developer-guide#simplified-payment-verification-spv) are already very lightweight compared to full nodes because they only require the download of block headers, not the whole blockchain. NIPoPoW wallets need to download only a small ***sample*** of block headers, around 250, when SPV clients need to download half a million block headers. The sample needed changes but doesn't grow much in size as the blockchain grows larger by the years, even after decades of data has been accumulated._

This enables us to build a mobile SPV client that requires around __just 100KB__ of block headers to be downloaded.

A super-efficient Ergo wallet with SPV security is in development, so stay tuned for more updates!


Building Ergo: SPV security


__Blockchains are siloed systems that can only reference their own data, established by consensus. Oracles are the solution to the problem of working with external information, which is vital for many everyday use cases.__

Blockchains are intentionally self-contained. They reference information only recorded within their immediate ecosystem, that has been agreed upon by a majority of miners. Since the whole point of a blockchain, based on consensus, is that there are no sources of centralisation or single points of failure, that poses a problem.

What happens when you want to engage with external information? Many blockchain-based applications need to process data from the real world. That might be financial information, such as market data and prices from exchanges, for DeFi applications; it could be sporting results, for eSports predictions markets; it could even be [atmospheric noise information, for random number generators](https://www.random.org/).

## Introducing Oracles

Oracles are the software that serves as a link between these real-world sources of data and the siloed world of the blockchain. They are simple in principle, since they only need to create a series of transactions with the necessary data (ideally formatted in an easily-accessible way) at regular intervals. 

However, while anyone can record information to an open blockchain, that is a source of centralisation. So how do you trust an oracle?

The answer is: you don’t. Just like the blockchain’s consensus method itself, you need multiple oracles pulling data from multiple sources, then coming to agreement about the value to record to the blockchain. So you don’t need to trust an individual miner, and you don’t need to trust an individual oracle.

## Example: bitcoin price data

As an example, let’s say we want to record bitcoin’s closing price every day to the Ergo blockchain, to give us a long-term and reliable source of price data.

We could take a dozen – or even a hundred – different data feeds, each pulling data from a major exchange. Coinbase, Bitstamp, Kraken, and so on. We make sure that many exchanges are represented, and while it’s good to have several examples of data from the same exchange, we don’t want any exchange over-represented.

Then the parties need to reach consensus about the price. Let’s say there are 100 parties and prices involved. There are different ways they could do that:

* Take the mean of all the prices they provide
* Discard the highest and lowest 20 prices, and take the mean of the remaining 60 prices
* Select the median price
* Weight the prices, with the central cluster of prices having greater weight, and take the mean

The aim is to discard or downweight any outliers, which could be due to extreme price fluctuations on a single exchange, API outages, or dishonest oracle data providers, while retaining many good data points to ensure a single reliable record of price.

Oracles are a hugely important part of the blockchain ecosystem. Once you have robust oracles in place, you can create all kinds of DeFi applications – including stablecoins, which are a vital part of the blockchain economy, and one we’ll be exploring on Ergo in the coming months.


Building Ergo: Oracles


__We’ve designed Ergo with long-term economic sustainability in mind, and storage rent is one of the ways we’re ensuring miners stay profitable well into the future. One community member, Robert, describes this function as ‘on-chain garbage collection’ that reduces the problem of blockchain bloat – and even makes it profitable.__

The 2020 block reward reduction will probably be the most important halving Bitcoin ever experiences. This is the point where the narrative of programmatic scarcity and digital gold will truly be proven, in the context of the sharpest economic downturn in living memory. In previous halvings, Bitcoin has still been in its infancy, a niche experiment. Future halvings will confirm the principle. But this one is the watershed.

Looking ahead, though, what happens in 20 or 30 years, when block rewards have fallen so far that miners have to rely on tx fees and potentially other sources of revenue? Will Bitcoin be sustainable? What will be the impact on the ecosystem?

The simple answer is that we don’t know.

Mining rewards are a key feature in maintaining the security of proof-of-work blockchains like Bitcoin and Ergo. And so, while we have deliberately kept many of Bitcoin’s tried and tested features, we have updated this one to give miners a boost when block rewards have fallen to zero.

## Lost coins

Digital scarcity is an important feature of Ergo. Like Bitcoin, ERG are designed to be a finite resource and long-term store of value. We do not agree with the principle of infinite inflation.

And yet, this has to be balanced against the needs to pay miners to secure the blockchain and process transactions. Without adequate compensation for miners, there is no viable blockchain at all. Ergo approaches this by slowly recycling lost coins, in a feature we call ‘Storage rent’. 

Studies suggest that as many as [4 million BTC may have been lost forever](https://bitcoinist.com/estimated-4-million-bitcoin-lost-forever-by-users-forgetfulness/). These are coins that were mined in the early days of Bitcoin and stored on hard drives that were subsequently thrown away or destroyed because the owners forgot about them or thought they were worthless, as well as coins in addresses for which the private keys have been lost. (And, of course, there’s Satoshi’s estimated holdings of 1 million BTC, which may never move.)

Where coins have genuinely been permanently taken out of circulation in this way, it makes sense to have a mechanism to recover them and put them back into the blockchain economy. That way, we can preserve digital scarcity without unnecessarily accelerating it. In other words, by attempting to stick to the intended algorithmic supply for any given point in time.

Ergo’s halving schedule is faster than Bitcoin’s. Block rewards start at 75 ERG, and decrease steadily after the first two years. There is no ‘long tail’ of emission, and after eight years block rewards will fall to zero. After that, total supply will be fixed. The number of ERG in existence will never be more than 97,739,925.

## Storage fees

From that point, however, miners will need further incentives to secure the network. Miners have ongoing costs in terms of bandwidth and storage, and in cases where coins are simply left for years, there is typically no charge for reflecting the value of securing them. The tx fee that is paid up-front in Bitcoin is the only charge ever made for storing those coins.

In Ergo, in addition to transaction fees, miners will also be able to collect storage rent fees on UTXOs that have not been moved for four years or more. 

Fees will be deducted slowly, over time – the unmoved UTXOs will not simply be appropriated by miners. Anyone who wants to avoid this simply needs to move their balances once every four years, which is not an onerous requirement for helping incentivise miners and avoiding the deflationary consequences of lost coins. You can read more about how fees will be levied in [this paper](https://fc18.ifca.ai/bitcoin/papers/bitcoin18-final18.pdf).

In this way, Ergo seeks to ensure a balance between maintaining digital scarcity, on the one hand, and giving miners long-term incentives to secure the blockchain, on the other – long past the point where new coins have ceased to be released.


Building Ergo: Storage rent


_As the next financial crisis takes hold, it’s clear that conventional monetary policy is at its limit. Smart contract platforms like Ergo enable more innovative, targeted implementations of economic stimulation that the conventional banking sector cannot achieve._

Conventional monetary policy is a hammer. It works as far as it goes, but if all you have is a hammer then every problem starts to look like a nail.

When the Global Financial Crisis hit over a decade ago, central banks did what they were used to doing. Cutting interest rates means it’s cheaper to borrow money, so there’s more cash in the system that can be spent and will circulate in the economy – paying for goods and services, funding employment and allowing life to continue something like as normal.

That, at any rate, is the theory. It’s what central banks do in recessions to stimulate economic activity. When times are better, they raise interest rates to make it more expensive to borrow money and prevent the economy from overheating (including asset bubbles).

## The outer limits

This is a blunt tool, but it works, up to a point. In the 2008 crisis, the problem was more severe – so severe, in fact, that interest rates were slashed to zero. Banks were still afraid to lend because they didn’t know the quality of the collateral they were offered in return, those notorious mortgage-backed securities.

So the central banks undertook a programme of Quantitative Easing (QE). This entailed creating huge amounts of cash that didn’t exist before, then purchasing various assets from the banks. The idea was that the central bank would take on the risk and the assets, and commercial banks would then use this gift of liquidity to lend to small businesses and individuals, allowing them to continue operating as before.

It didn’t work. Little of that newly-created money went to small businesses. Instead, banks used it to shore up their own balance sheets and make their own finances safer, investing only in low-risk assets rather than risky SMEs. Ultimately that cash filtered through to assets like the stock market and property, making the wealthy even more wealthy while the poorer were priced out of the market.

## Helicopter money

Today, as we experience the greatest financial challenge of our lifetimes – greater than even the Global Financial Crisis – central banks are considering even more unorthodox approaches. One of these is ‘helicopter money’. This involves cash being simply airdropped directly to citizens, either in the form of tax breaks or as money straight into their bank accounts. America has discussed giving \$1,200 to every adult. Other nations are exploring the same idea.

But there’s a problem with this, too.

Just like the banks, ordinary citizens are worried about their finances. So instead of going out and spending (where ‘going out’ is even possible), they pay down their debt. That newly-printed money goes nowhere.

That’s really as far as central banks can go. But a platform like Ergo can offer different types of money, with different conditions attached via smart contracts, incentivising different behaviour in different circumstances. And that enables a whole different range of monetary policy tools.

## ‘Hot potato’ money

In normal times, banks seek to maintain an inflation rate of around 2%. This means money is worth less over time. So instead of saving it all, and seeing the value of their savings fall, citizens have the incentive to spend it and circulate it within the economy.

Too much inflation, of course, is a bad thing. Get money printing wrong and you have hyperinflation like Venezuela or Zimbabwe, and your economy collapses.

But what if we kept inflation low, but created a limited amount of a special class of money that had to be used quickly if it was to retain its value at all? We’ll call this ‘hot potato’ money, because it has to be passed on fast.

Using a blockchain and smart contracts, this would be a simple matter of creating a new token that could be freely transferred and traded, just like any other token. And it could be backed by reserves (held with the central bank, commercial banks or any other entity). But the difference would be that it has to be spent within a month of receiving it, or those tokens are locked, their value is lost to the holder and the funds that back them are freed up to return to the reserve holder.

So this would be regular money that people had to spend: use it or lose it. If they hoard it, it becomes useless. And we can ensure that it is not used to pay down debt by including conditions that ensure it cannot be used by the banking sector. Of course, Ergo’s Sigma protocols can be used to figure out what has been spent, where, without knowing individual spending habits – enabling even more targeted stimulus.

This idea likely has far-reaching implications – and possibly unintended consequences. What would the result be, for example, of creating different ‘classes’ of money that were only semi-interchangeable? Would this introduce unwelcome, even dangerous friction?

This and other questions would need to be explored further. What’s clear is that central banks are already experimenting with unconventional monetary policy and are fast reaching the end of the road. We can continue that experiment with better, more powerful and targeted tools.


Ergo use case: ‘hot potato’ monetary policy


_The need to reform the global financial system has been clear since the last crisis in 2008. Now, COVID-19 has forced our hands. We cannot delay, and the best way to start is from the grassroots._

As lockdowns across the world effectively shut down whole sectors and a large part of the economy, we are entering a new era at breakneck pace. Central banks are taking unprecedented action in the form of money printing but, just like last time around, they will almost certainly fail at the ‘last mile’ (intentionally or otherwise): while their efforts will benefit the financial sector and the wealthy, the funds will not reach those small businesses and individuals who need them the most.

## Crossing the last mile

Technology like the Ergo platform can address this problem efficiently, building bridges into and within our local economies without the need for commercial or central banks. A key principle of Ergo, and one stated in the white paper, is that it is for regular people. The developers have spent considerable time building technology that can be applied to real-world use cases. (This is the idea behind ‘[Smart contracts for the people](http://chepurnoy.org/blog/2018/10/smart-contracts-for-the-people/)’, for example.)

## LETS

In the present circumstances, a [Local Exchange Trading System (LETS) would be a strong use case for Ergo](https://ergoplatform.org/blog/2019_04_22-lets). A LETS is a mutual credit association in which individual members are allowed to borrow from a common pot of money. All the loans are written into a ledger. Naturally, a blockchain system allows for strict and more granular rules around the size of loans and their use, as well as user privacy.

For example, let’s assume Alice has a zero balance. She wants to buy a litre of milk from Bob, and borrows the agreed price of 2 euros from the common pot. Alice’s account now registers -2 euros and Bob’s +2 euros. Bob can spend his balance with other participants of the LETS, and the creation of credit allows for economic activity and velocity of money even where people have, temporarily, no cash. Of course, limits on borrowing can be imposed – and even on positive ones, to prevent hoarding within the LETS. Such a system can be [built trustlessly on Ergo](https://ergoplatform.org/blog/2019_05_29-exchange/).

## Crisis measures

Systems like this have historically become popular during times of crisis. The first system of this kind was established by Michael Linton in a Canadian town stuck in depression back in 1981. LETS were also popular during the 1998-2002 Argentine Great Depression.

Most LETS groups consist of 50 to 250 members, with paper-based credit notes and ledgers maintained by a committee. However, it is unsurprising that paper-based LETS have suffered from problems such as counterfeit notes, dishonest activity by administrators, and so on (much like centralised crypto exchanges). A blockchain-based LETS could be vastly superior to any previous system.

Moreover, building lots of small credit systems on the same blockchain enables interoperability and novel financial products designed to strengthen the system as a whole. Hundreds of different LETS could exist, for individuals and small businesses, with different participation criteria, different credit limits, collateralisation requirements and other parameters. And yet they could still be connected by gateways allowing liquidity to move between different LETS, if required – while avoiding exposure to toxic debt.

_What use cases do you have for Ergo to address the broken financial system? Let us know._


Ergo use case: Local Exchange Trading System (LETS)


_Ergo enables new models of financial interaction, underpinned by smart contracts built on flexible and powerful Sigma protocols but easily accessible to developers._

One of the most exciting things about blockchain is the possibility of making digital agreements without any trusted intermediaries. In the simplest use case, pioneered by Bitcoin, Alice can send a payment directly to Bob, wherever the two of them are located around the world, with no bank or any trusted third party needed. However, with the functionality of a modern blockchain like Ergo, it is possible to make far more complex and sophisticated financial agreements than simple payments. Take the following example.

## Gold-backed tokens

Alice uses ERGs to purchase gold-backed tokens from Bob. Bob stores the gold in a secure vault, and uses the blockchain to issue one token for every Troy ounce of gold he has. Alice can then use these tokens freely in different contracts, transferring and trading them under whatever conditions she specifies in the smart contract code. When Alice wants to sell the tokens for physical gold, she can conduct another transaction with Bob, receiving ERG in return, at market price.

The point of blockchain contracts is to eliminate the need for trust. While the purchase transaction is now trustless, in this instance Alice still needs to trust Bob about two things. Firstly, Bob may refuse to swap the gold tokens back to ERG at the correct price when Alice wants to sell. Secondly, Bob may default on his obligations – running away with the gold, or misusing the funds he receives and running a fractional reserve.

## Extending the contracts

To address these issues, we can create an Oracle, or decentralised price feed. This uses multiple sources of external data to record the price of gold to the blockchain at regular intervals. This price feed will be the reference point for the redemption contract that manages the sale of Alice’s gold with Bob (or any other participant). Thus the system automatically enforces the right price when a swap takes place.

The second situation requires a third-party insurer, Charlie, whose service is also hosted on the blockchain with a smart contract. When Alice purchases gold from Bob, she additionally buys an insurance contract from Charlie. The payment can be dependent on factors including the amount of insurance required, and Bob’s reputation – again, managed by a decentralized feedback mechanism. Now, if Bob defaults, Alice will automatically receive the value of her gold tokens, with Charlie effectively acting as a buyer of last resort.

## Programmable contracts

There are, of course, many other example use cases like this one. We can also extend this use case, adding further economic actors. For example, Charlie may sell shares in his insurance business to Dave and other participants, providing them with a proportion of revenues in return for ensuring he has the capital he needs to cover any liabilities from the outset.

However, even the most complex use case is simpler than general-purpose software that can be used to program any contract. After all, generalised logic must be both far-reaching and secure. Moreover, even a specialised contract is made up of many steps, each of which is fairly simple. Thus another requirement for a general-purpose platform is that it should simplify the process of writing contracts, making them as accessible (and safe) as possible. This can be achieved with the use of template agreements, with customisable parameters. The insurance contract above could be based on a module with flexible parameters, for example. This could be used and reused in many different circumstances.

## Ergo’s approach

This is essentially the approach that Ergo takes, providing superior support for real-world financial agreements. It does this through:

1. Support for multi-stage contracts ([watch details for developers](https://www.youtube.com/watch?v=g3FlM_WOwBU))
2. A simple high-level language, ErgoScript, enabling clear descriptions of contractual logic
3. Support for formal verification of contracts for improved security guarantees (Ergo Platform deployed its [first formally verified p2p crowdfunding contract](https://twitter.com/chepurnoy/status/1239936086106935296) just three months after the network launched)
4. Easy Oracle creation
5. Native support for complex signature schemes

In short, creating financial contracts on the blockchain isn’t just about the functionality you provide. It’s about making that functionality safe and accessible, as well as powerful. Ergo achieves this and more.


Ergo use cases: safe, simple financial contracts


_Ergo’s smart contracts and DeFi functionality are built on Sigma protocols – a powerful, flexible class of zero-knowledge proofs. Find out more about why they’re so important, and how they put Ergo head and shoulders above the competition._

Cryptography is a fascinating area, and one of the most exciting and intriguing concepts it offers are zero-knowledge proofs. In simple terms, a zero-knowledge proof allows someone to prove they know the solution to a problem without actually revealing the solution itself.

Let’s say someone picks up a phone in a bar. You can prove it’s yours by hiding the screen, entering the unlock code and showing the unlocked screen to the person who found it. This is a simple example of a zero-knowledge proof: you have proven you own the phone without giving away any sensitive information.

In cryptography, most practical problems are associated with secrets. The most popular application lies in digital signatures, used by millions of people around the world every day. Essentially, these involve saying: ‘This message proves I know the private key associated with this public key – but I’m not revealing the private key itself’. (Not every digital

signature scheme uses zero-knowledge proofs, but the most popular do.)

## Sigma protocols

Among the hundreds or even thousands of zero-knowledge protocols, there is a sub-class of efficient and composable proof-of-knowledge protocols called Sigma Protocols. These are also known as Generalized Schnorr Proofs. Sigma protocols can be represented as digital signatures in a straightforward way, so we can effectively think of them as signatures in the context of blockchain.

A Schnorr signature is a simple Sigma protocol signature, then. Schnorr signatures have been [proposed as an alternative to Bitcoin’s current signatures](https://en.bitcoin.it/wiki/Schnorr). (It is one of the most efficient signature schemes, which is why it would be beneficial for Bitcoin.)

However, there are dozens of other Sigma protocols. One of the great things about them is that they are composable, using simple AND and OR logic. So you can ask for a signature with the following statement: ‘Prove to me knowledge of either this secret OR that secret’ (this is a one-of-two ring signature). Or you can ask, ‘Prove to me knowledge of any two of these three secrets’ (a two-of-three ring signature). Those are just two simple examples; there are many more, and they can be far more complex and sophisticated.

## Ergo: Sigma + blockchain

When combined with a blockchain, these composable proofs enable some very powerful use cases. The logic for proofs can include conditions based on blockchain state. For example, ‘If the deadline block height has been reached, Alice can provide knowledge of a secret key for a refund. OR a ring signature from Alice and Bob is required to spend coins.’ Or ‘If this account holds a minimum of 100 ERG, Alice OR Bob can remove funds above that amount.’

Thus some very interesting and flexible DeFi applications can be built on Ergo, using secure, straightforward and efficient Sigma protocols.


Building Ergo: Sigma protocols


Ergo takes the most secure and best-established features of Bitcoin and implements advanced new cryptographic features on its rock-solid foundations. This series explores the choices we have made in creating Ergo, with the first article unpacking the advantages of the UTXO model.

When you’re dealing with financial value, you cannot afford to take chances. Every architecture decision in a cryptocurrency platform has implications. While there are different ways to solve the same problem, some solutions are better tested and more reliable than others.

Like Bitcoin, Ergo uses the ‘UTXO’ (unspent transaction outputs) model, rather than the Account model used by platforms like Ethereum. There are a number of reasons why we have made this choice, but first it’s worth explaining a little about how the UTXO or ‘Box’ model works.

Most people think that the balance of an account is a simple number that is updated when you send or receive funds. This is the obvious way to approach the problem; after all, it is effectively how money works in the real world. Your bank account has a balance that is increased or decreased when different transfers are made in and out. This is how the ‘Account’ model operates: your balance on the blockchain is altered by transactions to and from the account.

## How much dough?

The UTXO model, pioneered by Bitcoin, is quite different. You can think of this a bit like a person holding a series of lumps of bread dough. Their balance is the sum of these lumps, or UTXOs. Lumps can be divided or combined, before they are sent to a new address, but you always know where they came from. For example:

Alice has 100g of bread dough (100 ERG). She breaks off a lump of 75g and gives it to Bob, keeping 25g of ‘change’ for herself.
Charlie has 250g of dough. He breaks off 150g and gives it to Bob, keeping 100g of change for himself.
Bob breaks 20g of dough off the 150g lump he received from Charlie, and combines the resulting 130g with the 75g he received from Alice. He gives the total of 205g to Dave, keeping the 20g change for himself.
Dave now has 205g of bread dough, which used to belong to Charlie. Before Charlie owned it, 75g used to belong to Alice, while 130g used to belong to Bob.

In the UTXO model, ‘lumps’ of coins can be combined and divided, but unlike bread dough, they aren’t mixed together. You can follow the history of funds right back to the coinbase transaction in which those coins were first mined. That’s very different to the Account model, where the balance of each account is simply changed. (You can, of course, check the blockchain to make sure the Account says what it should, but that’s not intrinsically necessary like it is with the UTXO approach.)

## Why UTXO?

The UXTO model has several implications. For a start, each object is immutable – lumps of coins cannot be ‘edited’ like an Account balance is edited when a transaction is made. The balance is calculated from the transaction history, right back to the point those coins first came into existence. 

That makes security much simpler, because either a UTXO exists in the form you are expecting, or it does not exist at all. With the account model, you need to carefully check that the account you’re dealing with is in the state it should be (and developers typically don’t do that properly). This also makes UTXOs more friendly for offchain protocols, like sidechains and the Lightning Network.

Accounts make it easier to store the ‘state’, but easy doesn’t always mean better. With Ergo’s extended UTXO model, state transitions are more explicit and so they are cleaner – there are no unwanted surprises. It might be a little bit more burdensome to deal with, but it’s a lot better and more straightforward in terms of security.


Building Ergo: UTXO vs Account


It’s the smartest crypto you’ve never heard of. Ergo takes the best of Bitcoin and integrates Sigma protocols so powerful they make Ethereum look like it would lose a game of chess against your cat. If you’re tired of spin and hype over solid tech, Ergo will remind you that in crypto, it’s always been fashionable to be intelligent. Bright is the new black, people, and Ergo is set to dazzle you.

DeFi is set to be the major blockchain trend for 2020. Many new smart contract platforms are positioning to become one of the handful of big players in the space. With a strong head start, competent development team and impressive network, Ethereum’s place in this billion-dollar (and growing) movement is assured. The others must offer something different – dramatically different – to differentiate themselves against this background. Ergo is a smart contracts and DeFi platform that may have what it takes to carve out a niche in this fast-moving and competitive new sector.

## Powerful But Safe Contracts

Ethereum is an exceptional platform, but there are things it does not do well. Its Turing-complete smart contracts are powerful, but dangerous – as incidents from The DAO to the Parity wallet exploits have proven, with tens of millions of dollars in collateral damage. With complexity comes uncertainty, and potentially catastrophic vulnerabilities. Contracts can be expensive to run, and depending on network conditions may execute unpredictably – or not at all. 

Ergo takes a fundamentally different approach to smart contract development. The team, which has extensive experience with blockchain platforms, frameworks and organisations from Nxt and Waves to Scorex and IOHK, has adopted a declarative model for programming whereby it’s always known in advance how much code will cost to run – and, indeed, whether it will run precisely as intended. While that might on the surface limit code complexity, it’s nevertheless possible to create Turing-complete scripts by iterating processes across multiple blocks. That means Ergo can support versatile dApps that run predictably, with known costs, and don’t have any of the dangers of unrestricted functionality.

## Sigma protocols

The platform is unashamedly conservative, basing as many features as possible on Bitcoin – after all, Bitcoin is the most battle-tested crypto network in existence. Ergo’s UTXO model, PoW mining and finite supply draw on Bitcoin’s approaches to consensus and economic incentives.

But Ergo also incorporates cutting-edge research into new cryptographic processes, using Sigma protocols to enable DeFi applications that would be either complex and messy or simply impossible on other platforms. Sigma protocols are a well-known class of zero-knowledge proofs that allow developers to implement very powerful processes very elegantly. For example, what if you want to build a privacy service that allows any one of a dozen different accounts to spend funds from an address – but no one can tell who has made each transfer? Such a ‘ring contract’ is possible with Ethereum, but it would require a clunky and expensive workaround. With Ergo’s Sigma protocols, it’s possible to implement this kind of use case and many others quickly, efficiently and – above all – securely. Sigma protocols have not been deployed in such generic form within crypto before. Yet this kind of out-of-the-box functionality is hugely valuable, especially when no other DeFi platform offers it.

## Get involved

Ergo’s team has been working on the project for over two years, attracting interest from some major players in the crypto space (including Cardano’s Charles Hoskinson) but avoiding mainstream attention until now. With the platform’s core functionality now substantially complete, the developers are seeking to expand the network, form new partnerships and make a mark in the nascent DeFi movement.


Welcome to Smart Money


## What is Crowdfunding?

Crowdfunding is a way of raising capital through the collective efforts of individuals. The campaigns are mostly started via the world wide web and allow projects and businesses to be funded by raising small amounts of money from a large number of people.
One of the best known examples for successful crowdfunding startups is Oculus Rift, a virtual reality headset. The company Oculus VR initiated its campaign in 2012 and was only two years later acquired by Facebook for $2 billion total. Besides the usual startups, there are also a lot of blockchain projects which went the way of crowdfunding, for example, Ethereum, Tron and EOS. Today, numerous platforms exist that allow you to publish your campaign. Some of the bigger ones are Indiegogo, Kickstarter, and Gofundme, only to name a few. 
Crowdfunding has a lot of benefits: a wide reach, efficiency, and marketing aspects being the most convincing... But for now, let's get onto what's really important! 

## Introducing Crowdfunding on Ergo

A few days ago, on August 28th, core developer [Kushti](https://www.ergoforum.org/u/kushti) stated on the (Ergo forum)[www.ergoforum.org] that he managed to successfully write and implement code that allows users to start a crowdfunding campaign on top of the Ergo blockchain (as mentioned in the [whitepaper page 6](https://ergoplatform.org/docs/ErgoScript.pdf). This code even works with the current wallet API. [Here](https://ergoplatform.org/blog/2019_06_04_wallet-documentation/) is a quick guide on how to set up the wallet.
In this article, you will learn how to do exactly that: crowdfunding on top of Ergo! It also takes you through the proposal of the first campaign ever, which is to fund the [post-EIP1](https://github.com/ergoplatform/eips/blob/master/eip-0001.md) crowdfunding script development.
If you want to go into all the details, please read the following section, “The Script”. Otherwise, you can simply skip to reading the “How To Donate”, "How To Collect Donations", and “Crowdfunding Project Proposal” sections below that.

## The Script

The simplest crowdfunding script, according to the [ErgoScript White Paper (page 6)](https://ergoplatform.org/docs/ErgoScript.pdf), is “a script for the following crowdfunding situation: a project backer (with key backerPubKey) wishes to give money to a project (with key projectPubKey), but only if the project raises enough money (at least minToRaise) from other sources by a deadline (expressed in terms of HEIGHT). 
To give money to the project, the backer will create an output box protected by the following script. The script contains two conditions: one for the case the deadline has passed (enabling the backer to get the money back) and one for the case it succeeded (enabling the project to spend the money if the amount is at least minToRaise before the deadline). 

In order to ensure enough money has been raised, the script will search the output collection for a box with a sufficient value going to the projectPubKey. To check where the value of the output box is going, the script will read the script protecting the output box and compare it to the script corresponding to proveDlog(projectPubKey); this script can be obtained byprojectPubKey.propBytes.

As currently the API does not support embedding of custom environment variables (only predefined ones like HEIGHT), the only way to compile the script is to replace such variables in the script from the white-paper with concrete values. For example, consider that a crowdfunding campaign is successful if it is raising 500 Ergs before block number 50,000. For backerPubKey and projectPubKey we can use PK() function which accepts only P2PK serialized keys at the moment. Then the modified script from the WhitePaper becomes the following:

```scala
{
   val backerPubKey = PK("9h7DHKSDgE4uvP8313GVGdsEg3AvdAWSSTG7XZsLwBfeth4aePG")
   val projectPubKey = PK("9gBSqNT9LH9WjvWbyqEvFirMbYp4nfGHnoWdceKGu45AKiya3Fq") 
    
   val deadline = 50000
   val minToRaise = 500L * 1000000000 
   
   val fundraisingFailure = HEIGHT >= deadline && backerPubKey
   val enoughRaised = {(outBox: Box) =>outBox.value >= minToRaise 
                              && outBox.propositionBytes == projectPubKey.propBytes
                      }
        
   val fundraisingSuccess = HEIGHT < deadline && projectPubKey && OUTPUTS.exists(enoughRaised)
   fundraisingFailure || fundraisingSuccess                     
 }                              
```

## How to Donate

First of all, JSON is not supporting multi-line strings, so you need to replace line breaks with `\n`.
Also, quotes are to be escaped, so use " instead of ". The resulting JSON will be sent to `/script/p2sAddress`.
To donate to a project, first get your address from /wallet/addresses, take e.g. the first of them. Put the address into the backerPubKey, so a request to /script/p2sAddress will look like the following after this step:

```scala
{
  "source": "{ 
    val backerPubKey = PK(\"9...\")
    val projectPubKey = PK(\"9gBSqNT9LH9WjvWbyqEvFirMbYp4nfGHnoWdceKGu45AKiya3Fq\")
    val deadline = 50000
    val minToRaise = 500L * 1000000000
    val fundraisingFailure = HEIGHT >= deadline && backerPubKey
    val enoughRaised = {
      (outBox: Box) => 
        outBox.value >= minToRaise && outBox.propositionBytes == projectPubKey.propBytes
    } 
    val fundraisingSuccess = HEIGHT < deadline && projectPubKey && OUTPUTS.exists(enoughRaised) 
    fundraisingFailure || fundraisingSuccess 
  }"
}    
```

with your address instead of “9…”.

Send the string to `/script/p2sAddress` to get a response like:

```scala
{
  "address": "GB3kh2izpWKvyZfMboQwsEscjPaZcz9WrzGqZB4ZrkzRreiFMV6HZYWXGMK3rqCjDCoPgWGNzfnYSUhivW4a1VRYPE7uZXwKnBcqWcRkiuTx6QW55EcPcWeELUsumwdtKoFtWY583nWnKZff"
}     
```

Copy address string (GB3… in our example) and send the money to it via `/wallet/payment/send` . A request to the API method to send 10 Ergs (10 Billion nanoErgs) will be like following:

```scala
[
 {
   "address": "GB3kh2izpWKvyZfMboQwsEscjPaZcz9WrzGqZB4ZrkzRreiFMV6HZYWXGMK3rqCjDCoPgWGNzfnYSUhivW4a1VRYPE7uZXwKnBcqWcRkiuTx6QW55EcPcWeELUsumwdtKoFtWY583nWnKZff",
   "value": 10000000000
 }
]
```

That’s all!

Now the wallet will automatically find the box on the blockchain, as it contains the public key which belongs to the wallet in the refund condition. The wallet then periodically checks whether the box is spendable by constructing a simplest transaction with the box as an input and just one output (to the same address). After refund height (50,000 in our example) the wallet will be able to spend the box and so the box value will be added to /wallet/balances.
Please note that this will not be the case after EIP-1 3 implementation as the wallet will use narrow recognition patterns by then.

## How to Collect Donations

The wallet which is associated with the project public key will find incoming boxes on the blockchain. However, it will fail to make sure that boxes are spendable, as the wallet currently is using a simplest transaction for that, and the script is failing for such a spending transaction.
Before `/wallet/boxes/uncertain` method being implemented, the only way for a project to find incoming boxes. Then `/wallet/transaction/send` with manually provided (in “inputsRaw”) serialized boxes (use `/utxo/byIdBinary` to get the serialized box by its identifier).

Kushti did that by himself and got the following [transaction](https://explorer.ergoplatform.com/en/transactions/3d5a1102296b6159754097f33e780cae2692d9a2ec2b6daf26219651bcc2ae48).

Please note that [EIP-1](https://github.com/ergoplatform/eips/blob/master/eip-0001.md) will break this workflow as well.

Kushti proposes to raise 500 Ergs before block 50,000 to develop command-line scripts (in Python) for organizing and participating in crowdfunding campaigns after EIP-1 implementation. Command-line scripts are more suitable than doing requests manually and also could be used for building graphic interfaces on top of them.

The treasury did provide [half of the funds](https://explorer.ergoplatform.com/en/transactions/2fc882792b94f8210e4378f2f5bab90896523e212d927ed16600170d76f46ac9), so others need to contribute the missing 250 Erg collectively. In case of a campaign failure refunds will be given automatically. As collecting pledges is not trivial at the moment, Kushti will lead the project role, so please use the following key, which is controlled by him: 

`9gBSqNT9LH9WjvWbyqEvFirMbYp4nfGHnoWdceKGu45AKiya3Fq`

In order to donate any amount of money, please follow the `“How To Donate”` section above with replacing backerPubKey with your public key, and pledge amount with a proper value (please note that it is in nanoErgs, `1 Erg = 1.000.000.000 nanoErgs`).

As always, if you have further questions, suggestions or want to participate in the movement, please join our social media channels or forum.

[t.me/ergoplatform](https://t.me/ergoplatform) | [t.me/ergo_mining](https://t.me/ergo_mining) | [www.ergoforum.org](www.ergoforum.org)


Ergo and crowdfunding


Firstly, we would like to thank many enthusiasts, developers, miners, other folks, and our families for measureless help with Ergo development and launching. The launch finishes a few years period of initial research and development by the Team, and also starts a new epoch, where the core technology is mostly set in stone and gradual improvements in protocol implementations and infrastructure projects become the main focus.
  
The current core Ergo Core Team remains fully committed to the project (at least, while the Foundation Treasury enables that). With that in mind, let me give the light on current status of the project and future plans.

## Current status

In the first place, let me remind some keypoints of Ergo:

1. It is still a conservative Proof-of-Work blockchain with a strictly limited coin supply, a Bitcoin-like transactional model, a cautiously chosen target delay between blocks, and so on. In that sense Ergo is similar to Bitcoin, and time has proven that this is the best choice for those who value decentralization and sound money.

2. Despite Bitcoin-like transactional model (with one-time unspent transaction outputs), Ergo supports enhanced contractual money possibilities without sacrificing security. We already have examples for crowdfunding, ICO, cold wallet contract, and so on. Also, Ergo provides best access to generic discrete log based zero-knowledge proofs, and thus it is better (in some cases, the only choice) for protocols to be built on top of it. For example, there is 2-out-of-3 multi-signature already done in the network, and this signature preserves zero-knowledge (so no third-party observer can ascertain which two parties actually signed the transaction input). In the same way, ring signatures (1-out-of-N signatures preserving zero-knowledge) are coming for free. Also please take a look at Ergomix, a [non-interactive mixing scheme](https://ergoplatform.org/docs/sigmastate_protocols.pdf), and maybe the first practical non-interactive mixing proposal.

3. Ergo has native support for custom tokens. Also it has support for authenticated data structures which can be trusted (modification of a dataset happening outside the blockchain by a trusted party) or trustless (modifications are happening on-chain as defined by a contract, but only very compact dataset digest is stored in UTXO set anyway).

4. It has pool-resistant and (somewhat) ASIC-resistant Autolykos Proof-of-Work scheme, which is targeting top-level GPUs, with best performance being on GPUs with 8gb+ RAM.  

5. For better decentralization in regards with possible full-nodes count decline with time, Ergo for first time supports stateless fully secure clients. Efficient SPV clients support is also done, but via [NIPoPoW technology](https://nipopows.com/), not the FlyClient used in Grin.

6. No need for hot debates on changing block size and many other parameters. Just using block size as an example, a miner can simply start voting at the beginning of an epoch (consisting of 1,024 blocks), and if 50+% of miners within the epoch support a change (1% block size increase or decrease in block size), it will happen. For many aspects of the protocol, soft-fork updates are possible, if 90+% of mining power votes are for a soft fork. Here Ergo is finishing what Bitcoin, with its soft-forkability, and Ethereum, with its dynamic gas limit per block readjustment, have started.

All of these features are probably not very visible now, just one week after launch, but they will define unique Ergo characteristics in the long-term. Please note, for success in the long-term, you need to go from first principles. 
Ergo is doing that, and not in the tech only: please note that Ergo has well-defined social contract described in Section 2 of the whitepaper. 

## Further Ergo Core Team Duties

While the reference node implementation is working more or less well, its interface could be confusing even for skilled users, and there is no infrastructure, such as wallets, frameworks to develop applications etc. Thus the core team will spend coming months on delivering needed frameworks and API improvements and supporting wallets and exchanges, some of which are already in-process. Also note that many components of the node are not efficient now, so performance of the node will be significantly increased in the observable future. At the same time, external teams continue to do security audits. The most critical parts of protocol design and reference implementation have already been audited, sometimes by more than one party.

## Hardforking policy

Ergo is trying to avoid hard-forks. Emission, proof-of-work, basics of transactional model and other core things should not be changed at all as any change about core parts of design means another chain. However, developers may propose hard-forks within first 12 months if (and only if):

* a hard-fork is about security fixes only. The only exception is about making cost of particular instructions adjustable
via miners voting, which was planned but not delivered in the current mainnet.
* a hard-fork is supported by 90+% of miners.
* a hard-fork is not breaking old contracts, freezing or moving any funds.

## Community Matters!

Development should become more transparent and open to external contributors, with gradual switching to EPIPs (EPIP stands for Ergo Platform Improvement Proposal), formal documents appearing and discussed before implementation like Bitcoin and Ethereum are already using BIPs and EIPs, respectively. 

Ergo is also in need of an ecosystem of frameworks and applications around it. A part of the treasury will be spent on grants for ecosystem developers. Details of the grant program will be announced later, however, you may contact the Ergo Core Team right now with any proposals. Also, the team would be happy to help with advice, needed API improvements, and so on. From an investor perspective, investing in projects on top of Ergo may be more valuable in comparison with other blockchains, considering the commitments to protocol stability made by the team.  

Also, please spread the word about Ergo! We are a nascent blockchain getting it's feet off the ground and are looking for contributors who are interested in writing documentation, articles, and other material.

## Ergo and Ergo Data

Initially, it was announced (couple of years ago) that two chains will be launched, Ergo and Ergo Data. Technology would be the same (or very similar), but parameters are different. The main idea behind Ergo Data is to serve needs of data-intensive applications, such as land registries, certificate directories etc. 

Currently, Ergo Data plans are unclear. The network will be launched only in case users will show demand for it. Also, 
Ergo Data would most likely be a sidechain of Ergo. Also, it will not be launched soon in any case, and only after Ergo  having established a solid infrastructure base. In case of Ergo Data chain being launched, EFYT holders at the moment of Ergo launch will get ErgoData tokens. A snapshot of EFYT holders at the moment of launch has already been done.
