What exactly is the Nothing-At-Stake problem?

Question

What exactly is the Nothing-At-Stake problem in Proof-of-Stake consensus networks?

While I understand what the nothing at stake problem means, I do not really understand the security implications. What are they?

Answer 1

You don't lose anything from behaving badly, you lose nothing by signing each and every fork, your incentive is to sign everywhere because it doesn't cost you anything.

So as it doesn't cost you anything, it's a good strategy to work on each and every chain should a fork occur and double spend a digital good.

Maybe the wiki explains it better :

However, this algorithm has one important flaw: there is "nothing at stake". In the event of a fork, whether the fork is accidental or a malicious attempt to rewrite history and reverse a transaction, the optimal strategy for any miner is to mine on every chain, so that the miner gets their reward no matter which fork wins. Thus, assuming a large number of economically interested miners, an attacker may be able to send a transaction in exchange for some digital good (usually another cryptocurrency), receive the good, then start a fork of the blockchain from one block behind the transaction and send the money to themselves instead, and even with 1% of the total stake the attacker's fork would win because everyone else is mining on both.

Edit: I found this video, this is 4min and explains the issue quite well and with drawing : it makes things quite clear !

Answer 2

tl;dr from Casper 101

[In proof of stake] if there’s a fork in the chain, the optimal strategy for any validator is to validate on every chain, so that the validator gets their reward regardless of the outcome of the fork.

More details

Proof of work requires CapEx (buy ASICs and other equipments) and OpEx (power and real estate cost etc) to participate in securing the network. Those are realized costs, whether or not the miner is successful.

In proof of stake, it is the potential loss of economic value that secures the network. So during an ideal execution, the validator actually does not incur realized costs. (One of the benefits here is that you can theoretically have a lower over cost of securing the network).

However, in the case of a fork:

• In proof of work, a miner's rewards depend on allocating economic resources (i.e. realized costs) to the correct chain. Therefore, they have incentives to allocate their costs to what they believe is the correct branch of the fork.
• In proof of stake, because the process of securing the network does not have an intrinsic cost (such as power and opportunity cost of using power on another branch of the fork), there's an inherent problem of the validator having no downside to staking both forks.

That problem is referred to as the nothing-at-stake problem. (More details in Proof of Stake FAQ)