2

It is my understanding that in proof of stake, the validator puts up a stake that gets slashed if they don't respond to requests truthfully. In the scenario that someone hacks into your node, wouldn't it be very easy to slash someones funds and have them lose a ton of money?

The scenario I am trying to capture here is one where you try to run a proof of stake validator on the cloud or an environment that could be more prone to breaches. In PoW, it would be inefficient, but, I could run a miner on my cloud and just give it the public key. It'll continue making me money without the private keys. If I want to run my own wallet to interact with my account I could setup a node in a more locked down environment to accomplish that and on an on-demand basis. For PoS I would assume it would be risker to try this since the validator would need to have access to the private key or some hypothetical staking key that provides lesser access.

Does Ethereum have any protections from this?

Improve this question

1 Answer 1

Reset to default
1

In the scenario that someone hacks into your node, wouldn't it be very easy to slash someones funds and have them lose a ton of money?

If someone can hack into your node, then you've likely got bigger problems.

They may well have access to your accounts/keys, so would be more incentivised to not only cause you to lose your money (via the mechanism you describe), but to steal your money outright. (i.e. You lose a ton of money because they've stolen it, not because the slasher conditions have penalised you.)

Does Ethereum have any protections from this?

Almost certainly not :-) If someone has full access to your node (and accounts, and passwords [by way of a keylogger they installed last time they hacked into your machine]), they are essentially you.

Improve this answer
7
  • 1
    Today, if someone hacked into my node they would only get the public key though. In Proof of Work I don't need to worry about this. So, is this one of the cons of proof of stake?
    – RagHaven
    Jan 19, 2018 at 15:19
  • So do you keep your private keys/UTC files elsewhere? As in, you don't actively use your accounts on your node? I was thinking that most people currently run a full node so they can run their own wallet. I'm perhaps misunderstanding what you're asking :-)
    – Richard Horrocks
    Jan 19, 2018 at 15:24
  • 1
    It depends on what I am running the node for. I can be running a full node just as a miner with the incentive of making money, and not for interacting with my account itself.
    – RagHaven
    Jan 19, 2018 at 15:34
  • 1
    The scenario I am trying to capture here is one where you try to run a proof of stake validator on the cloud or an environment that could be more prone to breaches. In PoW, it would be inefficient, but, I could run a miner on my cloud and just give it the public key. It'll continue making me money without the private keys. If I want to run my own wallet to interact with my account I could setup a node in a more locked down environment to accomplish that and on an on-demand basis.
    – RagHaven
    Jan 19, 2018 at 15:34
  • 1
    Would that prevent an attack as follows - 1. I spin up a validator with whatever parameters that are needed. 2. My instance gets hacked. They see that I am running a validator. They replace the validator with a malicious validator. 3. They should still be able to know what the staking keys are since they are in the environment. 4. The validator loses its stake since it is untruthful.
    – RagHaven
    Jan 19, 2018 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.