Overview

Proof-of-stake (PoS) protocols are a class of consensus mechanisms for blockchains that work by selecting validators in proportion to their quantity of holdings in the associated cryptocurrency. This is done to avoid the computational cost of proof-of-work (PoW) schemes. The first functioning use of PoS for cryptocurrency was Peercoin in 2012, although its scheme, on the surface, still resembled a PoW.

Description

For a blockchain transaction to be recognized, it must be appended to the blockchain. In a proof-of-stake blockchain, the appending entities are named minters or validators (in proof-of-work blockchains, this task is carried out by the miners); in most protocols, the validators receive a reward for doing so. For the blockchain to remain secure, it must have a mechanism to prevent a malicious user or group from taking over a majority of validation.

PoS accomplishes this by requiring that validators have some quantity of blockchain tokens, requiring potential attackers to acquire a large fraction of the tokens on the blockchain to mount an attack.

Proof-of-work (PoW), another commonly used consensus mechanism, uses a validation of computational prowess to verify transactions, requiring a potential attacker to acquire a large fraction of the computational power of the validator network. This incentivizes consuming huge quantities of energy. PoS is more energy-efficient.

Riposo and Gupta showed that a formal PoS mathematical model can derive a metric for the expected gain of a staker. They introduced a forward-method model that computes staking rewards as the staking return per block-validation period and proved that the resulting interest equals the ratio of the average staking gain to the total staked coins. The model incorporates PoS-specific factors such as slashing (penalties for misbehavior) and Maximal Extractable Value (MEV), showing that slashing reduces expected rewards and that MEV links transaction-fee extraction to the average staking gain.

In addition, the authors illustrated the model using Ethereum 2.0, and presented an analogous derivation for PoW consensus.

Attacks

The additional vulnerabilities of PoS schemes are directly related to their advantage: a relatively low amount of calculations required when constructing a blockchain.

Long-range attacks

The low amount of computing power involved allows a class of attacks that replace a non-negligible portion of the main blockchain with a hijacked version. These attacks are called in literature by different names, including Long-Range, Alternative History, Alternate History, and History Revision, and are unfeasible in the PoW schemes due to the sheer volume of calculations required. The early stages of a blockchain are much more malleable for rewriting, as they likely have much smaller group of stakeholders involved, simplifying the collusion.

If the per-block and per-transaction rewards are offered, then the malicious group can, for example, redo the entire history and collect these rewards.

The classic "Short-Range" attack (bribery attack) that rewrites just a small tail portion of the chain is also possible.

Nothing at stake

Since validators do not need to spend a considerable amount of computing power (and thus money) on the process, they are prone to the Nothing-at-Stake attack: the participation in a successful validation increases the validator's earnings, so there is a built-in incentive for the validators to accept all chain forks submitted to them, thus increasing the chances of earning the validation fee.

The PoS schemes enable low-cost creation of blockchain alternatives starting at any point in history (costless simulation); submitting these forks to eager validators endangers the stability of the system. If this situation persists, it can allow double-spending, where a digital token can be spent more than once. This can be mitigated through penalizing validators who validate conflicting chains ("economic finality") or by structuring the rewards so that there is no economic incentive to create conflicts.

Byzantine-fault-tolerance-based PoS are generally considered robust against this threat (see below).