
Ethereum Proof of Stake FAQ - justinzollars
https://github.com/ethereum/wiki/wiki/Proof-of-Stake-FAQ
======
xorcist
Ethereum was supposed to have every feature under the sun from the start,
proof-of-stake perhaps being the second most hyped. (Turing completeness being
the clear first, which is problematic given the halting theorem and all that,
so it's now rich statefullness instead.) And PoS is one of those ideas that
most people looking at cryptocurrencies end up trying some variant of. PoW is
obviously wasteful and it would be nice to improve on that. The problem is
that it doesn't have the same properties as PoW have, and that are hard to do
without.

The problems are the basic ones, how to avoid colluding stakers, how to neuter
the market for consumed stakes, how to deter chain splits. There is a constant
flow of new coins that try various approaches, but the ones that have survived
have all had to resort to some variant of checkpoints where a trusted third
party decides on regular intervals which chain is valid. This has obvious
implications for a supposedly trustless digital currency, where you don't
really need that complicated blockchain anymore.

This Ethereum PoS FAQ is much like other documentation from the Ethereum
Foundation quite dense where most paragraphs introduce terms not seen
elsewhere (economic finality? slashing? weak subjectivity?). If you want the
interesting bit, the TL;DR, then skip to the part about weak subjectivity.
Read it, and then read it again and bear in mind how other coins solved this
problem.

Tell me I'm wrong, but I think this bit with the key part being that the node
"authenticate out of band", involve a certain third party with a Very
Important Key. In which case the rest of the theory in the document doesn't
matter much, does it?

~~~
rothbardrand
The assumption that PoW is wasteful is one with an ideological basis that
comes from a lack of understanding of the purpose PoW serves, and I suggest
you read the Satoshi white paper.

Ethereum uses a lot of handwaving to justify what is ultimately a pump program
to make insiders and large ETH holders richer.

~~~
cocktailpeanuts
> The assumption that PoW is wasteful is one with an ideological basis that
> comes from a lack of understanding of the purpose PoW serves

I agree with this, but I think the real problem with PoW is the mining pools
centralizing. People seem to think the recent swift soft fork is something to
be celebrated, but I think it's kind of scary how swift it was. It just means
that the mining pools are so centralized that the transition was so easy.

Then again, this is something even PoS will probably suffer from.

------
earlz
Just for an other-side perspective, people that enjoy this might enjoy my
technical deep dive into PoSv3: [http://earlz.net/view/2017/07/27/1904/the-
missing-explanatio...](http://earlz.net/view/2017/07/27/1904/the-missing-
explanation-of-proof-of-stake-version)

It is a much older implementation that works on Bitcoin's UTXO model (rather
than the account model in Ethereum) and without smart contracts. It doesn't
have a solution to the nothing at stake long-term attack, but it thwarts all
known short-term attacks. Personally, CASPER's solution to the nothing at
stake problem is concerning. In an ideal world, it is ideal, but in a more
practical world, I can definitely foresee someone doing something wrong or
making a mistake (either developer bugs, or consumer running two wallets,
etc), unintentionally making a block on another chain, and losing their $1M
worth of ETH as a result. It only takes that happening once, maybe twice, to
get people to think twice about staking, and when less people are staking with
less coins, the network is much easier to attack

(disclaimer: I work on a blockchain project that is somewhat a competitor to
Ethereum)

~~~
narush
In every interaction with a blockchain, users have the chance to lose all of
their funds. User error in with regular transactions is a far more likely
issue than anything else (though there is no denying the importance of the
validator code being written).

Also, running two wallets would not cause one to lose money. Running two
instances of the validator code might - but why anyone would do that is
unclear.

------
cocktailpeanuts
I am curious why people don't talk much about the "rich get richer" aspect of
proof of stake. Most say "proof of work also is rich get richer scheme" to
justify this, but in my opinion they are completely different because proof of
work involves efforts that exist in the atom world (need to buy all the mining
pools) whereas proof of stake involves purely digital efforts therefore the
scale can be completely different.

Am I missing something? Or is this people just being optimistic?

~~~
aoeusnth1
I don't see this as a problem, because proof of stake must compete with other
mechanisms to convert time*capital into more capital, and it has diminishing
returns. If PoS has higher risk-adjusted returns than other investments, it
will become more crowded until this is no longer the case.

PoS provides real value - the maintenance of a blockchain - so it makes sense
to reward the capital required for such maintenance accordingly.

~~~
nosuchthing
If the coin supply is inflated at some % of current account balance, or old
coins decay then large PoS holders are incentivized to reinvest into the
economy.

Only online nodes provide value to blockchains. In a PoS blockchain an online
node with 100,000 credits is generating equal value to a node with .03
credits.

~~~
aoeusnth1
I don't buy the idea that all votes in PoS should be considered with equal
weight. Otherwise it seems pretty easy to DOS the network with a ton of low-
weight votes, get 51% of the network, and do whatever you want.

The capital-weighted PoS system prevents this because if you want 51% to the
network to be able to do abusive things, you have to risk devaluing your
enormous PoS investment by destroying trust in the Ethereum network.

I don't understand your first point, could you clarify?

~~~
cocktailpeanuts
> if you want 51% to the network to be able to do abusive things, you have to
> risk devaluing your enormous PoS investment by destroying trust in the
> Ethereum network.

I have a hypothetical scenario I'm curious about. Let's say the Bitcoin
network becomes so valuable that a huge chunk of the world economy depends on
it, believing that it can't be manipulated. Most people would rather play nice
with this than sabotage the network, but since the whole point of this
consensus mechanism is assuming the worst case, let's say there's an entity
(it could be a terrorist group or a nation) whose interest is to mess this up
regardless of how much money they lose as a consequence.

This is an unlikely event but I think it's possible in some special cases that
we can't foresee at the moment (just like nobody could predict that people
will come up with ASICS for mining, or like people would form a pool to mine
things) The only condition required is:

1\. Get a hold of enough money to terrorize the network

2\. Be at a position where you indirectly can gain more by losing all your
money that's worth 51% of the network.

In this case, this entity can decide to attack the network without any
consequences due to the pseudonymous nature of the blockchain. People will see
this happen in daylight but won't be able to easily figure out who this was if
this was based on proof of stake, because all you need to do this is to secure
your fund in the bitcoin network.

However if Bitcoin was using proof of work, you will have to buy whole bunch
of mining rigs (or build them yourself in some secret bunker) which is much
more traceable than if you simply used money for this terrorism.

I'm not making up some convoluted scenario just to troll, I'm genuinely
curious how this will work out and hope to be proven wrong because I also want
to live in a world where proof of stake works.

~~~
yorwba
I think what would happen in your scenario is this:

1\. The terrorists use their 51% stake to interfere with the network.

2\. People begin to notice that their transactions aren't going through as
expected.

3\. Some panic and try to pull out.

4\. The price drops due to the rising supply.

5\. The resulting feedback loop causes a crash.

6\. The uncooperative nodes are identified.

7\. The blockchain is forked to revoke the stake of those nodes.

8\. Business continues as usual.

The only way I see the terrorists cause any long term damage is if they buy
when the price is lowest and then repeat their attack. (Assuming balances
aren't reset to pre-crash levels.) If it happens often enough, that would
certainly erode the trust people place in the currency. On the other hand, if
balances _aren 't_ reset, the second crash would be much less severe, since
nobody will want to lose money selling when the price is down.

Essentially, no proof-of-X scheme can ensure that malicious interference
doesn't happen, but it can make it costly enough that it happens only rarely.
Then the occasional event can be handled manually (see also the DAO hack).

~~~
cocktailpeanuts
Interesting, as no technology is perfect, and people come up with clever
hacking schemes for desktop computers till this day, I think the more valuable
the network becomes, the more frequent this type of attack will be.

Do you think they will keep forking whenever major events like this happen? I
worry that a couple of these attacks will be enough to drain all the trust
from the network. Ethereum may have saved itself once by forking but a lot of
people think this is not sustainable and think a couple more of these and
people will leave.

------
rothbardrand
Proof of Stake is a mechanism by which people who own a lot of ethereum
(notably the foundation and insiders) can get the mining rewards instead of
the miners.

It also means locking up the supply of ethereum draining liquidity and thus
pumping the price.

Technologically it is not good for security:
[http://www.truthcoin.info/blog/pow-
cheapest/](http://www.truthcoin.info/blog/pow-cheapest/)

But as a pump and dump, it's an excellent thing to do.

~~~
cocktailpeanuts
I am also wary of proof of stake, but this is not something you can say with
such a certainty, like you're doing.

If someone asked "how safe is proof of work?" ten years ago, everyone would
have laughed and thought you're joking.

I'm only saying this because you're making a snarky comment while pretending
to know exactly how it will play out. Nobody knows how it will work. Who
knows? Maybe some unexpected human behavior like mining pools will happen in
proof of stake approaches and it may end up going in a completely unexpected
direction.

~~~
nebabyte
> If someone asked "how safe is proof of work?" ten years ago, everyone would
> have laughed and thought you're joking

I see PoW and PoS as nearly analogous in this regard - the rich can dominate
both and so on - except that PoS is far less wasteful.

I'm excited to see where this goes.

~~~
aoeuasdf1
I agree. The article the GP posted posits that they are equally wasteful, but
ignores the fact that:

\- The thing that they are wasting, capital, was created out of thin air by
the act of switching to PoS

\- There are large negative externalities to burning power by mining with
hashes, which increase the cost to society of using PoW vs. PoS.

------
beaner
Proof of stake incentivizes low velocity of money - you have to stake to not
have your funds diluted. This seems like the opposite of what the digital
aspect of cryptocurrency should be bringing to the table.

~~~
wmf
Under proof of work you essentially end up "staking" money by buying
ASICs/GPUs that take 9-12 months to break even. In general, miners are going
to spend almost as much as the block reward, whether that's in hardware and
electricity or in opportunity cost. [http://www.truthcoin.info/blog/pow-
cheapest/](http://www.truthcoin.info/blog/pow-cheapest/)

And many people are "hodling" cryptocurrency as a long-term store of value
anyway so presumably they aren't concerned with the velocity of money.

~~~
surrey-fringe
Ethereum's block hash algorithm is more memory intensive than bitcoin's and
benefits less from ASIC work -- please correct me if I'm wrong but I don't
think that it faces the same problems.

~~~
rothbardrand
You're right and it's proven pretty robust at that. This is a good proof of
work, because it means that anyone with commodity hardware can set up a miner,
and the playing field is pretty level.

~~~
nosuchthing
Assuming everyone has existing funds to acquire mining hardware.

Large existing expendable cash has a greater advantage to mine and mint.
Mining pool operators are also in a position to manipulate minting and
transactions in the network.

------
kanzure
another treatment
[https://download.wpsoftware.net/bitcoin/pos.pdf](https://download.wpsoftware.net/bitcoin/pos.pdf)

~~~
brighton36
Thank-you

------
CJefferson
So now the 1% (who own about 35% of wealth as far as I know) would get to
write the rules however they like? Sounds fun.

~~~
darawk
No, because the economic majority can simply make a new chain. Just like the
DAO hard fork. Ethereum Classic still exists, it just doesn't have
(relatively) as much economic weight.

~~~
nebabyte
Likely because it's pretty obviously run and held by shysters looking to
profit rather than write a line of code, but that's a whole other can of
worms.

I agree with you in theory, but the BTC/BCH split would be a better example of
the majority splitting off of profiteers rather than the other way around.

------
Method-X
If you're interested in proof of stake, it's definitely worth reading about
delegated proof of stake [1]. The gist of it is that token holders vote for
the nodes (miners). So far as I've seen, it's the best way to address the
issue of governance on a blackchain.

1\. [https://bitshares.org/technology/delegated-proof-of-stake-
co...](https://bitshares.org/technology/delegated-proof-of-stake-consensus/)

~~~
runeks
Delegated proof-of-stake suffers from the same problem that all consensus
algorithms suffer from: people will always be willing to spend, at most, _n_
coins on producing _n_ coins. The only way to avoid it is by giving particular
nodes the special privilege of producing coins, otherwise the free market will
push up the price until there is no profit left[1].

[1] [http://www.truthcoin.info/blog/pow-
cheapest/](http://www.truthcoin.info/blog/pow-cheapest/)

------
davidgerard
PoS will turn into a stealth PoW if it is possible _in any way_ to influence
the outcome with money. The history of all economic activity shows people
being willing to spend $49.99 to make $50. Though spending $49.99 of bank
balance probably beats $49.99 of carbon.

Have they got a proof of concept as yet, or is this all still vaporware that
nobody on this thread should be talking about in the present tense?

~~~
ChrisClark
Yeah, they have a proof of concept code up on their github, only started on it
in the past few weeks though. Up till now it's all been math and research.

~~~
cdetrio
The first casper PoC was in 2015, and PoC2 was in early 2016.[1] However,
there was a pivot from the early "consensus-by-bet" to the current version,
which is based on "prepare and commit" messages. I think the current one is
PoC4. [2,3]

1\. [https://blog.ethereum.org/2016/03/05/serenity-
poc2/](https://blog.ethereum.org/2016/03/05/serenity-poc2/) 2\.
[https://github.com/ethereum/casper](https://github.com/ethereum/casper) 3\.
[https://github.com/ethereum/pyethereum/pull/791](https://github.com/ethereum/pyethereum/pull/791)

~~~
ChrisClark
Thanks, that's a lot more than I thought.

------
cchero
The cryptocurrency mining industry is worth about 3 billion dollars per year.
About sixty percent of that is from Ethereum mining.

Ethereum switching to proof of stake is a threat to billions of dollars in
annual revenue. Miners should be rallying against this, and the budget they
have for lobbying and pr could reasonably be nine figures.

Ethereum miners are not the only ones affected. If two million gpus suddenly
flood the market, either the resale value of hardware will nosedive, or the
difficulty of all other coins will skyrocket. Miners who do not even mine
ethereum should still be actively opposed to ethereum switching to proof of
stake.

~~~
MichaelBurge
I've felt like writing a "Money is not a real thing" article for a while, and
this would be a prime example of why you don't optimize for revenue but rather
e.g. physical goods.

The generalization of your argument is that rapidly increasing productivity of
any good is bad, because it decreases the relative power of existing capital
holders.

If all the miners on all proof-of-work currencies lost all their revenue and
the currency was equally secure, I would consider this a good thing since the
electricity could be allocated elsewhere.

~~~
CaptainSwing
I guess schumpeters point with creative destruction was the rupture required
to replace one paradigm with another (Incidentally, he got this straight from
marx). Technology, and markets, move in fits and starts as conservative
tendencies meet with more efficient, or qualitatively different, competion.
For both schumpeter and marx this view was seen as opposed to equilibrium
models of economics on which much of mainstream economics and game theory
still relies

------
gus_massa
What happens in case of a hard fork? How will they ensure that no one will
validate blocks in the wrong fork? With PoW the miners much choose one fork or
at lest split the hash power. With PoS the miners can validate blocks in both
hard forks without too much effort.

Moreover, if the 51% dislike the one fork, or the version before the fork,
it's too easy to validate correctly in the part of the fork they like and
launch a 51% attack to the other fork. This would have killed ETC and BCC
instantly. (I'm not sure if this is a bug or a feature.)

~~~
drcode
No: If they validate blocks in both chains, their entire staking deposit is
immediately destroyed (in both chains)

This is one of the main innovations in modern POS algorithms.

~~~
Taek
That is only true for coins that are recognized on both chains. In the event
of a hard fork, all you need to do is send your hardforked coins to a new
address, and then start staking from that address. You can then vote on both
chains with your coins, and no penalty algorithms will punish you.

~~~
flashmob
If there is a hardfork and you're staking then I'd imagine you'll also be
automatically staking on both chains, nothing to do. Hardfork only matter if
you're transacting at the time of the fork, your transaction could be replayed
on the other chain or if a reorganisation happens, in that case you may want
to wait until the fork gets resolved.

------
gaetanrickter
PoS has done a great job at attracting a loyal following e.g.
[http://reddit.com/r/ethtrader](http://reddit.com/r/ethtrader) and it only
looks like it's gaining in momentum.

------
anticrisis
This is a lovely faq and quite informative, however I'd feel a lot better if
there were peer-reviewed papers by researchers with some prior work on
Byzantine Fault Tolerance.

~~~
Taek
It's worth pointing out that Byzantine fault tolerance has been around for
almost 40 years, and yet it wasn't until bitcoin that you could build a
decentralized currency that people felt confident in.

Academic Byzantine fault tolerance is insufficient, because you cannot naively
assume that most participants will behave honestly. They have to have an
incentive to behave honestly, and there can be no room for dishonest behavior
that would be more rewarding.

There's a reason that it took so long to get a working digital cash - a new
breakthrough was needed and that breakthrough ended up being Proof of Work.

To trust a new system for decentralized money, I would want to see peer review
not just from academics, but also from the leading bitcoin experts, who in my
opinion are the only ones that really understand cryptocurrency.

~~~
anticrisis
It's true, it's an old field that remains (I think) in progress. I just fear
that the confidence in decentralized currency you cite may be overly
influenced by the profit early proponents have earned.

Perhaps a few academic collaborations could generate peer-reviewed papers that
leverage those decades of research alongside the practical experience of
bitcoin experts.

