1

I'm studying how Proof-of-Stake systems work. This answer on "How does proof-of-stake “mining” work?" explains specifically the Nextcoin implementation of PoS. The idea is that the next "miner" is chosen randomly from a pool of online users. However, my main concern with this system is: how do you stop someone from simply building a longer chain (from scratch) of made up transactions towards thousand of addresses that were randomly created by the malicious user? If it were higher than the current "valid" chain, wouldn't the fake one replace the valid one?

Improve this question
1
  • I meant that you wrote proof of work, and I think you meant proof of stake.
    – Nick ODell
    Commented Jul 6, 2015 at 8:50

1 Answer 1

Reset to default
6

This problem is generally known as "nothing at stake" or "costless simulation", where there is indeed nothing preventing anybody from making arbitrarily long chains where they are the only participants in the network. If you were an early majority holder of the altcoin, emulating a massive network with thousands of users and then presenting that to peers valid would be trivial and effectively costless. Compromised private keys or "empty" private keys purchased from early participants in the network would also be a viable choice for bootstrapping an attack like this.

The proposed solution in NXT is that nodes will refuse to reorganize very deeply (more than a day or two), making a weak assumption that the first chain you have seen is probably going to be the one the rest of the network is on. Ethereum has proposed for their move to Proof of Stake that they will use a "phone a friend" cryptosystem, essentially requiring users to confirm that they are on the same root proof of stake block chain using real world out of band communication (like a phone call or Royal Mail).

Neither has particularly strong assurances of validity, and is simply one of the realities of a Proof of Stake system that has the cost and reward internalized. In Proof of Work there is a significant real world cost to attempting competing chains, and given the choice of two there are clear rules for nodes to distinguish them.

Improve this answer
2
  • What about reorganizing not very deeply, say 10-15 blocks away? That would require the dishonest user to have many coins on different addresses right?
    – Luca Matteis
    Commented Jul 6, 2015 at 9:26
  • 1
    That sort of rule only works if you assume no new nodes ever join the network, that network connectivity is perfect and can't be split into pieces by failed interconnects or malicious influence, and that all nodes are online continuously. Absent these someone can split the network, make each half follow a small fork, and then the network will be permanently divided.
    – Claris
    Commented Jul 6, 2015 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.