2

I have a question about Proof of Stake.

Are there any protections against a user just creating an entirely new chain, since there is no computational penalty for creating a really long chain, couldn't a malicious actor create a chain larger than the one most nodes agree on with a completely different history? Or remove past transactions easily? Does Casper or other PoS implementations just have nodes check against their existing chains to check that they haven't been fully altered?

Because the proof of work protects against this by making it extremely time confusing to change one block because you have to redo all the proofs for each block in front of it, but if you don't need to do a large amount of CPU work to change history, couldn't nodes give new nodes a blockchain missing a block or transaction?

3
  • Casper has a finality "gadget". That's the original name, "Casper the Friendly Finality Gadget". Aug 5 '20 at 2:50
  • @Chan-HoSuh wait so does Casper work on top of a proof of work chain? Doesn't that defeat the purpose? Aug 5 '20 at 4:14
  • The point I was making is that Casper started out as a PoS-based finality mechanism on top of the Eth 1.0 PoW chain. In other words, yes, finality is the key way to make this stuff work and it was recognized early on. The current Eth 2.0 design uses Casper finality but combines it with a fork-choice rule to fully be PoS. See arxiv.org/abs/2003.03052 Aug 8 '20 at 2:12
1

This is called the Nothing at Stake attack. You're correct that it's much easier to build a fork. It's a problem when someone owns more than 50% of all coins (not very likely).

But another issue is that in Proof of Stake nodes have nothing to loose to compute on other forks. That means in theory a node that wants to maximise its profits would always compute on ALL forks. This results in an attacker requiring only 1% of the stake for a successful attack given that all nodes behave like this.

Ethereum will have penalties included for nodes computing on all forks. That's why you need to stake 32 ETH to become a validator. See also https://medium.com/coinmonks/understanding-proof-of-stake-the-nothing-at-stake-theory-1f0d71bc027.

4
  • Thank you for the helpful response! I'm still wondering about how Proof of Stake systems prevent transactions being removed from blocks or blocks being removed from the chain entirely? Aug 5 '20 at 5:40
  • Adding on to my first comment: This would only be possible when a new node joins the network and queries other nodes for their chain, but I'm still wondering how new nodes know which block is valid and which is not. Aug 5 '20 at 5:50
  • @TransmissionsDev You are asking about the exact specifics of the PoS implementation? I'm not sure about ETH2.0 specifics, but as a high-level description: Generate verifiable random number, use that number to determine the next block miner chosen proportionally to their stake. Aug 5 '20 at 20:19
  • @TransmissionsDev Nodes can then verify the randomness in each epoch and see if the correct node mined the given block. Aug 5 '20 at 20:20
1

It works differently for different PoS implementations, but it's usually a variation on this:

  • When a node with more stake adds a block to the blockchain, you say this adds more "difficulty" of the chain (analogous to the amount of mining power that would have been needed to find a block)

  • One node with very little stake, no matter how many blocks it builds on its own chain, will always have lower "cumulative difficulty" than the chain being build by the nodes with the majority of the stake

  • Like PoW, nodes always accept the chain with higher "cumulative difficulty" as the "real" chain, and switch to it if they find a longer one

  • So unless you have 51%+ of the stake, you can never build a more valid chain than the rest of the stake in the network, no matter how many blocks you make in private (if you build a chain with blocks that go into the future to add cumulative difficulty, other nodes will have a rule not accept it).

But there are 2 things that can be done. one of them is a "nothing at stake" attack, where a node creates blocks on 2 (or more) chains simultaneously, each of which gives him a possibility of making a better chain. But if everybody does this its kind of a scramble, random who would come out on top, probably proportional to stake anyway.

The other thing that can be done is a "long range" attack, where you go to some people who used to possess 50% of the stake between them, and buy their old private keys for cheap money (because their accounts are empty now, why do they care?). In PoS, if you have keys that control 51% of the stake at any point of the chain's history, then you can go back and build a longer chain than the "real" chain from that historical point, and cause all of the other nodes to accept it as real

For example, if I bought up the year-old private keys of accounts that, together, used to control 51% of the stake (even if they don't possess those funds anymore), then I can secretly (and efficiently) build a new chain for the past year with higher "cumulative difficulty" than the rest of the network. when I show this chain to other nodes, they will accept it as the "real" chain and switch to it.

Most PoS chains use a kind of bandaid solution for that: they just don't ever consider forks from more than X time ago compared to their current fork. so most of the running nodes would reject the long range attack. however, any new node that joins the network and connects with the attacker, will pick the long range attack chain over the "honest" chain. So it's a kind of superficial fix for the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.