Transparency: I'm the founder of Lynx Core and I designed the 3 Hybrid PoW Rules.

The system has been running stable (but a little slow) for over a year and a considerable amount of research and time has been spent focusing on each of the 'arbitrary rules'. I would agree with your initial sentiment of the comment though, popol. Each of the rules can be circumvented. But look deeper.

Each of the individual Hybrid PoW Rules are designed to be part of a bigger picture. With a combination of time and money, a bad actor could overcome each one of the individual Rules, yes. The challenge lies in being able to coordinate and consistently overcome all of the Rules for a sustained contiguous series of blocks.

The first rule forces the miner to rotate reward addresses after a block win. Not a huge deal, to be honest. 60 blocks is the wait time. So an attacker would probably need to work with 61 addresses for starters. Research with GPU mining software and some research with ASICs show that this isn't an easy thing to do (right now). We all know that that isn't an excuse as once incentives exist to do it, some smart person will fork cgminer(?) to rotate reward addresses. It's only a matter of time. But it works for now, and since Lynx mining isn't profitable, the financial incentive to do it doesn't exit (yet).

The second rule requires the respective reward address to have a fluctuating minimum balance at the time the block is won. Kind of like PoS, but not really. You don't increase your chances of winning a block by having a greater balance, nor do you win a greater coinbase reward (plus fees). Also, the requirement amount is correlated to the network difficulty. Once the network diff starts to increase (due to an array of reasons including an attack with an ASIC) the minimum balance requirement in each address changes. The ceiling on the per address balance is 100 Million Lynx or ~$46k USD (at todays prices). The minimum is 100 Lynx or $0.46 USD at todays price. So today the cost to fund 61 addresses would be ~$28 USD. Again, not a big deal. But once the ASIC is enabled and the network diff changes, that cost increases quickly so funding those addresses might be prohibitive. (As a result, the system is the most secure as long as we have 2 or more concurrent attackers.)

The third rule is the most tedious. A random selection match must occur with a 1 in 256 chance of match. Without a match, the candidate block is flagged as invalid. As well, the network consensus rules will not pass a block that doesn't meet the requirement. The values for the match are embedded in the block header, so it's easily verifiable. Again, easy to overcome with time and money.

The 3 Rules operate on top of the normal business rules of Proof of Work that we are used to with Bitcoin/Litecoin. The design is inspired by the idea of not relying on a single threshold or security layer that is all encompassing to secure PoW, but instead rely on a combination of weak layers that when combined create a stronger solution. With effort, anyone can break a bamboo shoot, but breaking a bundle of bamboo is a near impossible feat.

It's been stable for over a year. The question remains. Does it really work? Did we implement it poorly? Does it scale? Interested in your thoughts. -ben