[Paper Review] A Memo on the Proof-of-Stake Mechanism

George Gui, Alı Hortaçsu+1 more|arXiv (Cornell University)|Jun 14, 2018

Blockchain Technology Applications and Security1 references4 citations

TL;DR

This paper analyzes the economic incentives of Ethereum's proof-of-stake (PoS) mechanism in the Casper proposal, showing that PoS enhances security against double-spending and sabotage attacks by imposing large stock costs on attackers through staked assets. Unlike proof-of-work, where attackers face only flow costs (e.g., electricity), PoS requires attackers to lock up and potentially lose a substantial portion of their stake, making attacks economically unviable due to the high opportunity cost and irreversible loss of funds.

ABSTRACT

We analyze the economic incentives generated by the proof-of-stake mechanism discussed in the Ethereum Casper upgrade proposal. Compared with proof-of-work, proof-of-stake has a different cost structure for attackers. In Budish (2018), three equations characterize the limits of Bitcoin, which has a proof-of-work mechanism. We investigate their counterparts and evaluate the risk of double-spending attack and sabotage attack. We argue that PoS is safer than PoW agaisnt double-spending attack because of the tractability of attackers, which implies a large "stock" cost for the attacker. Compared to a PoW system whose mining equipments are repurposable, PoS is also safer against a sabotage attack.

Motivation & Objective

• To evaluate the economic incentives and security properties of proof-of-stake (PoS) in Ethereum’s Casper upgrade.
• To compare PoS with proof-of-work (PoW) in terms of attacker cost structures, particularly regarding double-spending and sabotage attacks.
• To analyze how stock costs in PoS—such as lost staked assets—create stronger disincentives for malicious behavior than flow costs in PoW.
• To establish that PoS is more secure than PoW against both double-spending and sabotage due to the non-repurposable, high-value nature of staked assets.
• To derive equilibrium conditions under which attackers are deterred from launching attacks based on the relationship between block rewards, staking costs, and attack value.

Proposed method

• Models the PoS mechanism in Ethereum’s Casper proposal, where validators lock up Ether as stake and lose it if they misbehave.
• Applies the framework from Budish (2018) to analyze attacker incentives, focusing on stock versus flow costs.
• Uses a discounted cash flow model to relate the opportunity cost of staking to the price of Ethereum, deriving the equilibrium cost of staking via the formula $ C = \frac{c}{1 - \beta} $.
• Compares attacker costs in PoS and PoW, showing that PoS imposes a stock cost (loss of stake) while PoW imposes a flow cost (electricity).
• Derives a threshold condition $ P_{\text{block}} > \frac{V_{\text{attack}}}{\alpha_{\text{ether}}} $, where $ \alpha_{\text{ether}} \approx 10^6 $, to determine when attacks are deterred.
• Analyzes the role of offline coordination and validator reporting in detecting and penalizing malicious behavior, especially in cases of conflicting finalized checkpoints.

Experimental results

Research questions

• RQ1 How does the cost structure of proof-of-stake (PoS) differ from that of proof-of-work (PoW) in deterring double-spending attacks?
• RQ2 What is the minimum stake required for an attacker to successfully execute a double-spending attack in PoS, and how does this affect the economic viability of the attack?
• RQ3 Why is PoS more resilient than PoW against sabotage attacks, particularly when mining hardware is non-repurposable?
• RQ4 How does the opportunity cost of staking in PoS compare to the flow cost of electricity in PoW in terms of deterring malicious behavior?
• RQ5 What role does offline coordination play in resolving conflicts from malicious validators, and how does this affect the overall security of a PoS system?

Key findings

• PoS is more secure than PoW against double-spending attacks because attackers must lock up and risk losing a large stock of staked assets, which are non-repurposable and incur high opportunity costs.
• The attacker’s cost in PoS is a stock cost (loss of stake), which is significantly higher than the flow cost (electricity) in PoW, making attacks economically unviable.
• For a double-spending attack, an attacker needs at least 50% of the total stake, and the cost of acquiring and losing this stake is proportional to $ \frac{1}{2(1 - \beta)} N^* c $, with $ \alpha_{\text{ether}} \approx 10^6 $, indicating a massive deterrent.
• The model shows that the threshold for deterrence is $ P_{\text{block}} > \frac{V_{\text{attack}}}{\alpha_{\text{ether}}} $, where $ \alpha_{\text{ether}} $ is vastly larger than the corresponding coefficient in PoW, implying stronger security.
• In sabotage attacks, PoS is safer than PoW when mining hardware is non-repurposable, as the attacker loses the full value of their stake, whereas in PoW, the attacker only loses electricity costs.
• Even if an attack is unsuccessful, the irreversible loss of staked assets in PoS creates a strong disincentive, unlike in PoW, where malicious miners can often recover their hardware and re-invest it elsewhere.