What is the Long-Range-Attack in Proof-of-Stake? And how will this vector be mitigated with the Casper Proof-of-Stake implementation?

2 Answers 2


In a naively implemented proof of stake, suppose that there is an attacker with 1% of all coins at or shortly after the genesis block. That attacker then starts their own chain, and starts mining it. Although the attacker will find themselves selected for producing a block only 1% of the time, they can easily produce 100 times as many blocks, and simply create a longer blockchain in that way.


  • 3
    Can you expand slightly? I don't understand how the attack could 'out-pace' the real chain since the main chain would be moving at the same rate (or would it?). Wouldn't the difficulty modifier still require that blocks appear at the same interval? Commented Dec 26, 2017 at 17:32

From Casper 101:

It's roughly the same mechanism as 51% attack (make a longer chain that rewrites the ledger in the attacker’s favor), but instead of starting the attack 6 blocks back, go much further back in the chain’s history (i.e. 60,000 blocks). This is a problem for PoS since there’s no proof of work (or a time-intensive operation) required to rewrite a very long chain.

This and the nothing at stake problem are solved via ideas from slasher (and its improved variations). The main points are that (1) validators are known, which allow for fault attribution at a validator level and (2) by having “slashing conditions” that strongly disincentivize certain actions, it is possible to mitigate these issues. Again, this example is crucial in understanding the Casper team’s view on consensus algorithm design: we can leverage economic mechanism design to a secure distributed system.

  • If you have something at stake, how do you send the staked coins to the network? Sounds like you need to use the private key or some other key with lesser access. Also, what if nodes get hacked into and a hacker gets the node to send a wrong result to the network? The stake would be slashed and they would lose tons of money?
    – RagHaven
    Commented Jan 19, 2018 at 2:23
  • 1
    @AndroidDev93 Yes. The same goes with a normal wallet: if an attacker hacks your wallet, they can steal all of your money. Keeping your secret key safe is the golden rule no matter if you use PoW or PoS. Commented Feb 12, 2018 at 10:45
  • @stackoverflower If my PoW miner gets compromised my funds don't get stolen though. My miner only has the public key. In proof of stake, that's not the case though. This sounds like a new vulnerability when comparing PoS to PoW?
    – RagHaven
    Commented Feb 21, 2018 at 17:57
  • @AndroidDev93 The PoW miner also has a key-pair that is used to receive transaction fees and new bitcoins, though you can regularly move funds out of the miner's wallet to keep the loss low. With PoS what you can do is to split your funds into multiple miners, and run them in parallel. This won't use more electricity though, because you can program them so they always make the same decision. Commented Feb 22, 2018 at 10:32
  • 1
    @stackoverflower the PoW miner only has the public key. Not the private key of the wallet. In PoW you never take money out of the wallet. You only put money into the wallet. So, PoW only has the public key. In PoS that doesn't seem to be the case though. You need to be able to slash funds if they respond incorrectly. So, you need to have some sort of private key in the miner.
    – RagHaven
    Commented Feb 26, 2018 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.