Proof of Buying
Admission Consensus
Here, we use the native token of the parent chain (mother chain) as the medium. To become a miner on this child chain (sub-chain), one must hold the native token of the parent chain to participate in consensus. Similar to PoW and PoS, a delegation mechanism is supported: retail holders can delegate their tokens to certain delegators.
Block Production Consensus
Miners must pay a certain amount of the parent chain’s native token to a designated address (which can be the sub-chain’s foundation address) on the parent chain, then broadcast this transaction to the sub-chain. Meanwhile, the miner locally computes a random value output using a VDF (Verifiable Delay Function) algorithm and broadcasts this random value on the sub-chain. All nodes on the sub-chain then calculate (payment amount × VDF random value), and the miner with the maximum result obtains the right to produce the block.
Why require payment in parent chain tokens?
Block production must have a real cost! This is a crucial prerequisite for making the final consensus objectively verifiable. If someone wants to attack the sub-chain consensus, they must pay the same cost — unlike PoS, where there’s “nothing at stake.” Additionally, because block production incurs a cost, even if an attacker has the deepest war chest, each attack reduces their available stake. They cannot maintain the same proportional block production power on every block indefinitely.
Why include VDF?
To prevent wealthy participants from monopolizing block production rights in the short term, we introduce VDF. The VDF output is random, and block rights are determined by computing VDF × payment amount. This weakens the ability of the rich to achieve absolute short-term dominance. Moreover, VDF outputs are unpredictable, making block production unpredictable. VDF is inherently parallel-resistant, so using it prevents the formation of large mining farms — at most, individuals can upgrade single-chip performance.
Why not use VDF alone?
Public chains need scalable centralization to some degree — whether mining pools/farms or staking proxies — these are necessary (though the former’s centralization is relatively transient). If the number of block-producing nodes reaches tens of millions, uncle blocks and orphan blocks would proliferate massively, lowering the cost of 51% attacks and causing severe network congestion and chaos. In Proof of Buying, the act of paying parent chain tokens constructs this scalable center of gravity.
Note: Often, the sub-chain’s block interval is shorter than the parent chain’s. Therefore, a payment transaction sent to the parent chain won’t be confirmed immediately on the parent chain. In such cases, the sub-chain verifies only basic conditions for the payment: whether the miner’s account balance on the parent chain is sufficient for this block production payment, and signature validity. Whether the payment is ultimately valid can only be confirmed after it is included on the parent chain — this step is resolved in the next phase: final consensus.
Final Consensus
Longest Sub-Chain Consensus: Using one slot or epoch on the parent chain as a finalization cycle, the protocol verifies and selects the fork that satisfies both of the following conditions as the main chain:
-
All payments made on the parent chain during the block production consensus phase have been successfully executed and confirmed.
-
The sub-chain with the largest total sum of (VDF random value × payment amount) across its blocks becomes the finalized main chain. The block data of this main chain is then compressed and uploaded to the parent chain for archiving.
Why upload to the parent chain?
As the protocol runs over a long period, the designated address on the sub-chain will accumulate an increasingly large amount of tokens. If the controller behind that address were to amass enough to mount a serious attack in the future, it could potentially overturn the chain. Uploading finalized main-chain blocks to the parent chain prevents future rollbacks — once archived on the parent chain, those blocks become unrollable.
Why NOT PoS + BFT?
-
Economic Perspective
Most public chains favor PoS because it has a very low startup cost — unlike PoW, which requires mining farms, pools, and custom ASIC development. With PoS, you can launch with little more than token minting and cloud servers.
The biggest advantage appears during bull markets: when token prices rise, PoS makes it easy and low-cost to pump the price repeatedly, especially in early stages when most tokens haven’t been distributed yet. However, the downside is severe: once prices fall, credit and price recovery become extremely difficult — especially evident in bear markets. Pump efforts also heavily rely on exchanges and market makers, making the project easily manipulated by them. -
Technical Perspective
PoS systems typically require BFT-like protocols (pBFT, HotStuff, etc.) for fork choice and final consensus. These have high engineering complexity and debugging difficulty; most open-source BFT implementations on the market are not straightforward to use directly.
BFT protocols also have inherent limitations: high network propagation complexity and strong subjectivity (since BFT voting is not objectively verifiable).
In PoS, security degrades exponentially when token prices fall. Additionally, mechanisms like restaking in DeFi protocols can further erode PoS security by over-leveraging it.