Proof-of-Stake (PoS) distributed ledgers are the most common alternative to Bitcoin's Proof-of-Work (PoW) paradigm, replacing the hardware dependency with stake, i.e., assets that a party controls. Similar to PoW's mining pools, PoS's stake pools, i.e., collaborative entities comprising of multiple stakeholders, allow a party to earn rewards more regularly, compared to participating on an individual basis. However, stake pools tend to increase centralization, since they are typically managed by a single party that acts on behalf of the pool's members. In this work we propose Conclave, a formal design of a Collective Stake Pool, i.e., a decentralized pool with no single point of authority. We formalize Conclave as an ideal functionality and implement it as a distributed protocol, based on standard cryptographic primitives. Among Conclave's building blocks is a weighted threshold signature scheme (WTSS); to that end, we define a WTSS ideal functionality and propose two constructions based on threshold ECDSA, which enable (1) fast trustless setup and (2) identifiable aborts. This work is supported by JSPS KAKENHI No. JP21K11882. 4 The carbon footprint of: i) a single Bitcoin transaction is equivalent to 1, 202, 422 VISA transactions; ii) the total Bitcoin network is comparable to Sweden. (https: //digiconomist.net/bitcoin-energy-consumption; May 2021) energy-free, but often rely on complex cryptographic primitives, e.g., secure Multiparty Computation [26], Byzantine Agreement [8,17,27], or Verifiable Random Functions (VRFs) [9,17].Regarding rewards, blockchain-based financial systems, like Bitcoin, aim to incentivize participation in the consensus mechanism. The rewards comprise of newly-issued assets and of transaction fees, i.e., assets paid by parties for using the system. Interestingly, both PoW and PoS ledgers are economies of scale, who favor parties with large amounts of participating power. One reason is poorlydesigned incentives, resulting in disproportionate power accumulation [23,13]. Another is temporal discounting, i.e., the tendency to disfavor rare or delayed rewards [35]. Specifically, in Bitcoin, a party is rewarded for every block it produces, so parties with insignificant amounts of power are rarely rewarded. In contrast, accumulating the power of multiple small parties in "pools" yields a steadier reward. As a result, PoW systems see the formation of mining pools, 5 while PoS systems usually favor delegation to stake pools [7,21] over "pure" PoS, where parties act independently. Finally, the ledger's performance and security are often better under fewer participants. For instance, PoS systems require participants to be constantly online, since abstaining is a security hazard; this requirement is more easily guaranteed within a small set of dedicated delegates.A major drawback of existing stake pools is that they are typically managed by a single party, the operator. This party participates in consensus, claims the rewards offered by the system, and then distributes them among the pool's members (...
