20

What exactly is the Nothing-At-Stake problem in Proof-of-Stake consensus networks?

While I understand what the nothing at stake problem means, I do not really understand the security implications. What are they?

24

you don't lose anything from behaving badly, you lose nothing by signing each and every fork, your incentive is to sign everywhere because it doesn't cost you anything.

so as it doesn't cost you anything, it's a good strategy to work on each and every chain should a fork occur and double spend a digital good.

Maybe the wiki explains it better :

However, this algorithm has one important flaw: there is "nothing at stake". In the event of a fork, whether the fork is accidental or a malicious attempt to rewrite history and reverse a transaction, the optimal strategy for any miner is to mine on every chain, so that the miner gets their reward no matter which fork wins. Thus, assuming a large number of economically interested miners, an attacker may be able to send a transaction in exchange for some digital good (usually another cryptocurrency), receive the good, then start a fork of the blockchain from one block behind the transaction and send the money to themselves instead, and even with 1% of the total stake the attacker's fork would win because everyone else is mining on both.

edit: I found this video, this is 4min and explains the issue quite well and with drawing : it makes things quite clear !

  • 6
    Short attempt to help with why Proof-Of-Work (PoW) doesn't have this problem, in PoW miners get the most rewards by being on the main/correct chain. Miners are incentivized to put all their hashing power on the chain they believe is correct or will win: splitting up their hashing power across many/all chains only reduces the potential rewards they could have earned by putting all their hashing power on the "correct" chain. – eth Mar 31 '16 at 7:15
10

tl;dr from Casper 101

[In proof of stake] if there’s a fork in the chain, the optimal strategy for any validator is to validate on every chain, so that the validator gets their reward regardless of the outcome of the fork.

More details

Proof of work requires CapEx (buy ASICs and other equipments) and OpEx (power and real estate cost etc) to participate in securing the network. Those are realized costs, whether or not the miner is successful.

In proof of stake, it is the potential loss of economic value that secures the network. So during an ideal execution, the validator actually does not incur realized costs. (One of the benefits here is that you can theoretically have a lower over cost of securing the network).

However, in the case of a fork:

  • In proof of work, a miner's rewards depend on allocating economic resources (i.e. realized costs) to the correct chain. Therefore, they have incentives to allocate their costs to what they believe is the correct branch of the fork.
  • In proof of stake, because the process of securing the network does not have an intrinsic cost (such as power and opportunity cost of using power on another branch of the fork), there's an inherent problem of the validator having no downside to staking both forks.

That problem is referred to as the nothing-at-stake problem. (More details in Proof of Stake FAQ)

  • 2
    i find this answer better than the accepted one – icherevkov Apr 6 '18 at 21:16
  • 1
    This only applies if there truly is no intrinsic cost, which is false in Ethereum's case. Ethereum does have this cost because the ether minted so far has this cost - it was minted with PoW. It was not made out of thin air, and therefore this system is superior to all others because you have intrinsic cost and the efficiency of PoS all in one. With PoS-from-day-0 chains this indeed is a problem. But with Ethereum, not at all. – Swader Apr 8 '18 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.