What Would It Mean for a Network to Require Verified Identity to Participate?

Every blockchain has to answer the same question before it can trust a single vote: how do you stop one person from pretending to be many? A network with no answer to that question can be taken over cheaply: one operator, a thousand fake identities, a majority that was never really a majority. This page is about the fourth answer anyone has seriously tried to that question, identity, and the price it charges that the other three don't.

Everything below describes a design space and where Solidus sits inside it, not a finished product.

The general problem

The formal name for "one person pretending to be many" is a Sybil attack, after the psychiatric case study of a woman with multiple personalities: the term was coined to describe exactly this failure mode in peer-to-peer systems. Any permissionless-adjacent network, one where participation isn't hand-picked by a central operator, needs some mechanism that makes faking many identities to gain disproportionate influence expensive or hard. Without one, "one node, one vote" degenerates instantly: an attacker who can spin up identities for free can out-vote everyone else simply by spinning up enough of them.

The three mechanisms that have actually been deployed at scale each answer this by pricing identity differently.

Three known answers

Proof-of-work prices identity in compute. To have influence proportional to N identities, you need to control roughly N times the hashing power of a single honest participant. This is the mechanism Bitcoin popularized: mining is expensive, and the expense is the point. It converts "how many identities can you claim" into "how much specialized hardware and electricity can you afford to run continuously." The cost is real, physical, and ongoing; it doesn't go away once you've paid it once, because someone else's identity requires the same continuous expenditure to match. The weakness is exactly that it externalizes cost into energy consumption, and that the resulting power concentrates wherever electricity and hardware are cheapest, not necessarily where trust should live.

Proof-of-stake prices identity in capital. Instead of burning electricity, a participant locks up a bond, the network's native asset, proportional to the influence they want. Faking many identities means bonding many times over, and every bonded unit is capital placed at real economic risk: behave dishonestly and it can be slashed. This converts the Sybil question into an economic one, is your dishonesty worth more than your bond?, and it's the model most newer general-purpose chains (Ethereum since the Merge, Cosmos chains, Solana) have converged on, because it doesn't require burning energy to secure the network. The cost here is capital, and the corresponding weakness is that capital concentrates too: whoever already holds the most stake finds it cheapest to acquire more influence, and a genuinely new, capital-poor participant has no cheap way in.

Proof-of-authority prices identity in reputation. A small, known set of operators, often named, often legally identifiable, run consensus, and what they're staking isn't anonymous capital or burned electricity but their real-world standing. If a proof-of-authority validator behaves dishonestly, the cost isn't a slashed bond, it's a ruined, identifiable reputation outside the system entirely. This is cheap to run and fast to finalize, which is why permissioned consortium chains lean on it, but it trades away permissionless entry by design, you don't get to become a proof-of-authority validator by buying hardware or bonding capital, you get invited, and the set of who can be invited is deliberately small.

Three different prices, three different failure modes: compute concentrates by geography and hardware access, capital concentrates by existing wealth, reputation concentrates by existing gatekeeping power. None of them is free of the concentration problem, they just relocate it.

The fourth answer: identity-gating

Identity-gating is a distinct family member, not a replacement for the other three, in practice it composes with stake rather than substituting for it. The cost it prices is credentialing: a validator has to hold a verified-human identity credential that is distinct from every other validator's, which means faking many identities requires acquiring many distinct verified-human credentials rather than just more compute or more capital. Someone who already has a hundred times the capital of everyone else can't buy their way past this the way they can under pure proof-of-stake, because the constraint isn't "how much can you bond": it's "how many separate humans can you plausibly prove yourself to be."

Solidus's specific instance of this idea is called Proof-of-Identity: a validator eligibility rule layered on top of ordinary stake-weighted validation, requiring a verified-human credential in addition to a bond, so that one operator can't cheaply multiply influence just by splitting capital across addresses. The identity-credential requirement itself is roadmap. The full mechanism, how the credential is issued, how it's checked, how it composes with the VRF committee election, belongs to the page that owns it in detail; this page names the shape of the idea and moves on rather than re-explaining it.

The real cost, stated plainly

Every one of the first three mechanisms has a cost that lives entirely inside the system being secured: burn more electricity, bond more capital, risk more reputation. Identity-gating is different: it imports a cost from outside the system, and that import is exactly where the honesty has to be sharpest.

A verified-human credential is only as trustworthy as whoever verified the human. Proof-of-work doesn't ask you to trust anyone; the chain itself can verify that hashes were computed. Proof-of-stake doesn't ask you to trust anyone; the chain itself can verify that a bond exists and was slashed correctly. Identity-gating asks you to trust an issuer, some party attesting "this credential really does correspond to one distinct human, verified some way", because the chain has no native way to look at a person and confirm they're a person, let alone that they're not the same person as validator number forty-one.

So the mechanism doesn't eliminate the trust question the other three mechanisms manage to keep internal, it relocates it to a single point: the issuer. And that point deserves to be named directly rather than gestured at. Why would anyone accept a validator's identity credential from an issuer with no audit and no operating track record? Today, Solidus is that issuer. There is no third-party audit of the verification process behind Proof-of-Identity, and there is no multi-year operating history that would let an outside party independently confirm the issuer's error rate, its resistance to being fooled by a well-resourced attacker, or its resistance to being compromised or coerced. Answering "who verifies the verifier" with "trust us" is not a resolution to the problem: it is a restatement of it.

This is not a problem this page is going to solve, and it should not be read as one with an implied answer lurking underneath it. It is the genuinely open cost of choosing identity as a Sybil-resistance mechanism: you trade a capital-or-compute problem, which the chain itself can verify, for a trust-the-issuer problem, which it cannot. An audit, an independent third party formally reviewing the verification process against a defined standard, is on the roadmap and would be one real step toward addressing it; it is not something that exists today, and no claim on this site should imply otherwise.

Where the other numbers live

This page is the wide-angle view of the tradeoff space, not the ledger of what's currently running or how the mechanism works in detail. For the mechanism itself, how a credential is structured, how eligibility checking composes with the VRF committee election, what "verified-human" actually means in the current design, see the Proof-of-Identity page. Both exist so this essay doesn't have to re-argue either.