How to perform decryption in this single-bit PKE scheme? Consider a cyclic group $G$ of order $q$, and let $g$ be a generator for $G$. Assume $(G, q, g)$ is public. Consider the following 1-bit public-key encryption scheme.

To $generate (pk,sk)$:


$x \xleftarrow{\$} {1, , 2, . . . , q}$
$h ← g^x$
$pk ← h, sk ← x$
Return $(pk, sk)$


To encrypt the message $M = 0$, we define $E_{pk}(0)$ as:


$y\xleftarrow{\$} {1, 2, . . . , q}$
Return $(g^y, h^y)$


To encrypt message $M = 1$, we define $E_{pk}(1)$ as: 


$y\xleftarrow{\$} {1, 2, . . . , q}$
$z\xleftarrow{\$} {1, 2, . . . , q}$
Return $(g^y, g^z)$


Define $D_{sk}(C)$ and prove that this 1-bit public key encryption scheme is $IND-CPA$ secure if the DDH assumption holds for $(G, g)$. (To be clear,
this means doing a reduction.)
(Why would no one ever actually use this scheme in practice?)

I haven't been able to come up with proper decryption yet. And I was thinking proving it to be $IND-CPA$ secure would be along the lines of ElGamal security proof. Am I right about it?

And practically, I don't think this is used much because the work involved in 1-bit encryption multiplied across the number of bits in the message would be much larger than the alternative option of using a multiple bit encryption. Am I right about this?
To decrypt, you basically take the $g^y$ component and raise it to the secret key, obtaining $g^{yx}$. Now, if this value is equal to the second component of the ciphertext, you can see that $M$ must be 0, since $g^{yx} = h^y$; otherwise, $M$ is 1. 

Regarding the proof: yes, it would be very similar to ElGamal, since you have to construct the challenge ciphertext using a DDH tuple.