I'll preface this by saying that I appreciate the time taken to post and that I know there are a lot of projects so it's impossible to be extremely informed about all of them.
Nevertheless, I would like to push back on several points which are inaccurate since I think it's important for correct information to be out there, and also to note that, in my opinion, this seems to be based on a very superficial look as opposed to an in-depth analysis.
For example, you claim that "the governance system creates potential weaknesses that do not necessarily outweigh its strengths", but then fail to mention what any of those are or might be. You later go on to say that "the hybrid consensus POW / POS just makes everything super complicated and potentially vulnerable to hacks and bugs", but once again provide no insight into statements that could realistically apply to nearly anything which I'll elaborate on later. I would expect an analysis to delve into perceived strengths and weaknesses and to provide a, hopefully balanced, discussion about them.
So, with that in mind, I'll address some select points:
> a fair launch, community-driven development and innovation, treasury for development (10% of miners rewards)
Agreed. This is all well documented and easy to verify with on-chain data.
> Low PoW miner rewards risk reducing network security...
Since you didn't go into depth here, I'll assume that by network security you are predominantly referring to the ability and costs associated with pulling off 51% double spends and related attacks.
This is mathematically provably incorrect in Decred due to its hybrid PoW/PoS system. The assertion would be true in a pure PoW environment, but Decred is not pure PoW. On the contrary, Decred's hybrid PoW/PoS system provides far greater security against 51% attacks than pure PoW and it's really not even close. Depending on which assumptions are made, it's anywhere from 10x stronger in the worst case scenario to closer to 100x stronger under more realistic scenarios. It also gets even more comparatively strong as the relative value of individual coins increases.
Moreover, due to fact that roughly 80% of the total coin supply that will ever exist have already been emitted and distributed, it is no longer feasible at all to perform an external attack. By external, I mean one or more malicious entities having enough funds to buy up enough tickets and hash power to be able to perform an attack because there simply are not enough remaining coins.
In order to theoretically acquire enough coins, an attacker would have to convince existing coin holders to sell, which would:
(a) take an extended period of time since coins that were used to acquire tickets in the staking system can't be sold until the associated ticket is randomly called to vote which happens with an average of 28 days per ticket; and
(b) significantly raise the attack cost because buying up that many coins would necessarily significantly raise the acquisition price
The same cannot be said of pure PoW systems since you could always theoretically buy and/or manufacture enough hash power to dominate the network in short order. Note that I'm not making any claims on the probability or difficulty of doing so, rather commenting on the technical possibility.
> PoS ticket voting and Politeia governance favors wealthier and more active stakeholders
Correct, and that is by very much by design. People with more skin in the game have more influence. Wealthy people having more influence is realistically true, especially over time, with all of the current models I've analyzed.
For example, consider the case of centralized authorities such as a group of developers, a council, or benevolent dictators. All of those models eventually end up highly influenced by wealthy individuals. You might currently have one or more individuals temporarily serving in those centralized roles who are more less susceptible to such influence on ideological grounds for the time being, but over time, centralized authorities tending towards corruption is a well-known phenomenon. Centralized authorities aren't magically immune to it just because it has to do with cryptocurrencies. I would posit there is even more pressure for such behavior with
As another example, consider the case where governance is purely decided by PoW. Wealthier individuals can acquire much more hashpower and therefore have more influence in that scheme too.
Even worse, with all of the other models I've analyzed, the money for influence peddling is almost always done behind closed doors unbeknownst to the wider community.
Decred simply formalizes this reality and makes it fair and transparent by applying a sortition to it in the same way PoW applies a sortition to the block mining process. With Decred, you can see every vote on every consensus rule change, every Politeia vote, and every Treasury spend with cryptographic proof that the vote was actually backed by real coins.
> Limited mobile functionality
I think this is probably the most fair criticism overall out of all of your points.
Decred is on multi-coin mobile wallets such as Cake and Exodus which offer a very nice experience for storing and spending coins. However, the options are indeed fairly limited for some of the more advanced governance features.
It is an area where a nice first-class mobile experience would be welcome.
I would also note that mobile devices are objectively far less secure than properly configured non-mobile devices such as desktops, mini PCs, and Raspberry Pis (all of which Decred has software that works well with, even when running a fully validating node), so there is a security tradeoff to be made there.
As a result, within the Decred community, stakeholders who store more than a few coins and participate in governance tend to be highly security conscious individuals that often prefer non-mobile options.
> Privacy features are limited compared to dedicated privacy coins
I have to push back against this point. As with most things, there are pros and cons to all privacy systems. I would argue that neither Monero's RingCT nor Decred's StakeShuffle system is objectively better than the other. Both are very nice privacy systems that suit their respective projects well. They both have a different set of pros, cons, and limitations that make them both better than the other in some ways and worse in others.
For example, Monero having confidential transactions by default is better from a standpoint of the ease of use for keeping reasonable privacy as compared to Decred's opt-in system. However, that comes at the expense of some other properties such as inflation prevention, ease in changing the cryptographic primitives, and long-term pruning.
On the other hand, Decred's opt-in system provides inflation prevention, is already using post-quantum cryptography, does not require consensus changes to implement new cryptographic techniques and primitives, and allows for fully pruning the utxo set. However, that comes at the expense of users having to take the additional step to use the system as compared to Monero's "always on" system.
To elaborate slightly, there are some fundamental tradeoffs between perfectly hiding and perfectly binding commitments and you can't have both at the same time. Perfectly hiding commitments help keep amounts hidden in the event of a break in the underlying cryptography (e.g. by QCs), but come at the expense of the potential to create unlimited coins out of thin air. On the other hand, perfectly binding commitments prevent the creation of coins out of thin air in the event of a break in the underlying cryptography, but come at the expense of potential deanonymization of old historical amounts.
Monero's RingCT relies on perfectly hiding commitments elliptic curve cryptography while Decred's StakeShuffle uses perfectly binding commitments quantum resistant cryptography.
This is an important distinction, because for Monero, while such inflation wouldn't be great for its overall economy in the same way the counterfeiting any fiat currency is damaging, it wouldn't necessarily spell disaster for the project depending on how severe it was. However, for Decred, any type of inflation, undetected or not, would potentially be disastrous, because its governance system is tied to coin ownership.
Since the RingCT cryptographic primitives are so baked into the DNA and consensus rules of Monero, changing them is a highly specialized and non-trivial task, but all transactions are protected by default. Meanwhile, in Decred, because StakeShuffle is baked into full nodes via a mixing pool, it is much easier to change as cryptanalysis improves over time, but the obvious tradeoff is transactions that don't use the system do not get the privacy benefit.
Finally, due to the nature of RingCT, the full transaction history is required meaning validating nodes can never have real full pruning. Instead, Monero's pruning method is to spread all of historical data out over multiple pruned nodes. Specifically, it removes a random 7/8 of the unnecessary ring signature data on each node and makes the other random 1/8 of the data available to other nodes which themselves do the same. This results in saving 2/3 of the storage space, and also means nodes only need to download 1/3 of the data, but it still grows indefinitely.
As a slight aside, I'd like to note that Monero's pruning approach is much better than Bitcoin's method of having all pruned nodes download the entire chain and then delete everything before a certain point. I commend Monero for having a good pruning implementation which works within the system's limitations.
By contrast, Decred's StakeShuffle provides the potential for true full pruning of all non-active utxos from the historical data meaning it can be pruned to a couple of hundred MB no matter how large the full chain gets. For full disclosure, pruning is not yet implement in dcrd, mainly because it's really efficient and the chain really isn't all that large yet as a result, but a lot of thought and consideration has been put into ensuring it is possible to do as I've described.
I could much in depth on this topic, but this is already probably longer than many people will read.
> Contributors and community face barriers due to the complexity of the protocol
> the hybrid consensus POW / POS just makes everything super complicated and potentially vulnerable to hacks and bugs
These are basically the same point and one which I entirely disagree with.
The hybrid consensus is really not that complicated at all. It essentially consists of some rather straightforward code that implements tickets, voting, and a lottery and uses that to impose additional consensus rules that are applied to every block. The code involved is something that any junior software engineer can read and understand.
Compare that with many other much more complicated things, such as Monero's own RingCT scheme. Truly understanding and reviewing that requires someone who is quite well versed in several aspects of cryptography and higher level mathematics. Most of it is outside of the average existing skill set of typical software engineers.
As it applies to the claim that it could potentially be vulnerable to hacks and bugs, I honestly don't find to be a very compelling line of reasoning. That same line of reasoning could just as easily be used (and not very helpfully for the same reason I might add) to say that Monero's RandomX and/or RingCT are super complicated and potentially vulnerable to hacks and bugs. In fact, there is even existing evidence that could be used to support those views, if one were so inclined, since there have actually been real historical vulnerabilities in both of those up to and including successful deanonymization in addition to theoretical possibilities.
Meanwhile, Decred launched in Feb 2016, which means it's coming up on 9 and half years, and no exploitable vulnerabilities or bugs have been found in its Hybrid PoW/PoS system, despite having undergone multiple security reviews, passed various controversial consensus changes via decentralized stakeholder voting (as opposed to something dictated by a benevolent dictator) that had a lot of incentive for powerful entities to block, attempted social engineering attacks, and a variety of other attempts to thwart the system.
Now, of course, I'm not claiming it's impossible for any to exist, since that would be naive, but, again, that same thing is true for any systems, so making _generalized_ claims in a vacuum about how something maybe could potentially have bugs is not particularly meaningful. For example, ASICs were created for Monero before despite its then anti-ASIC cryptonight algorithm and it's similarly not beyond the realm of possibility that it could happen again for RandomX. That is not meant as an attack on Monero, nor to imply that it necessarily means it's likely, rather I'm merely pointing out that it's not entirely impossible as a way to illustrate the broader point. Something being unfamiliar does not necessarily mean it's complicated and any claims that try to posit potential vulnerabilities and bugs due to complexity require a thorough review of the code in question as well as its track record.
I'll finish by noting that something that I personally find rather annoying in the cryptocurrency space as a whole that I see way to often is the notion that there is only one true way to do something while completely ignoring the tradeoffs which always exists. I would really like to see more analysis honestly considering the real tradeoffs when discussing various technologies.