1

It is my understanding that in proof of stake, the validator puts up a stake that gets slashed if they don't respond to requests truthfully. In the scenario that someone hacks into your node, wouldn't it be very easy to slash someones funds and have them lose a ton of money?

The scenario I am trying to capture here is one where you try to run a proof of stake validator on the cloud or an environment that could be more prone to breaches. In PoW, it would be inefficient, but, I could run a miner on my cloud and just give it the public key. It'll continue making me money without the private keys. If I want to run my own wallet to interact with my account I could setup a node in a more locked down environment to accomplish that and on an on-demand basis. For PoS I would assume it would be risker to try this since the validator would need to have access to the private key or some hypothetical staking key that provides lesser access.

Does Ethereum have any protections from this?

0

In the scenario that someone hacks into your node, wouldn't it be very easy to slash someones funds and have them lose a ton of money?

If someone can hack into your node, then you've likely got bigger problems.

They may well have access to your accounts/keys, so would be more incentivised to not only cause you to lose your money (via the mechanism you describe), but to steal your money outright. (i.e. You lose a ton of money because they've stolen it, not because the slasher conditions have penalised you.)

Does Ethereum have any protections from this?

Almost certainly not :-) If someone has full access to your node (and accounts, and passwords [by way of a keylogger they installed last time they hacked into your machine]), they are essentially you.

  • Today, if someone hacked into my node they would only get the public key though. In Proof of Work I don't need to worry about this. So, is this one of the cons of proof of stake? – AndroidDev93 Jan 19 '18 at 15:19
  • So do you keep your private keys/UTC files elsewhere? As in, you don't actively use your accounts on your node? I was thinking that most people currently run a full node so they can run their own wallet. I'm perhaps misunderstanding what you're asking :-) – Richard Horrocks Jan 19 '18 at 15:24
  • It depends on what I am running the node for. I can be running a full node just as a miner with the incentive of making money, and not for interacting with my account itself. – AndroidDev93 Jan 19 '18 at 15:34
  • The scenario I am trying to capture here is one where you try to run a proof of stake validator on the cloud or an environment that could be more prone to breaches. In PoW, it would be inefficient, but, I could run a miner on my cloud and just give it the public key. It'll continue making me money without the private keys. If I want to run my own wallet to interact with my account I could setup a node in a more locked down environment to accomplish that and on an on-demand basis. – AndroidDev93 Jan 19 '18 at 15:34
  • @AndroidDev93, I don't have an answer as to whether this is a con for the current design of PoS, but I can envision a way around at least the attack Richard Horrocks has proposed re: direct theft: PoS could (in my quick evaluation) be designed to allow delegates to do the approval (thereby enabling a different key to secure the staking process than the one used to provide the stake itself). – lungj Jan 19 '18 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.