Consensus: Proof of Work vs Proof of Stake

How strangers agree

Hi, I'm Block. Picture thousands of strangers spread across the planet. They don't trust each other, some of them might be lying, and they all have to agree on one list of who paid whom. In this lesson: the problem, how proof of work solves it, how proof of stake solves it, and what both mean for your security.

Who adds the next page?

Last time, we ended on a hard question. Every node keeps its own copy, but new blocks can show up from different places at the same moment. So who gets to add the next page? Which version counts? And how do you stop a liar from adding a fake one? The answer is called a consensus mechanism.

The answer is a consensus mechanism.

Computer scientists described a version of this back in nineteen eighty-two, and called it the Byzantine Generals Problem. Several generals surround a city. They must all attack or all retreat, but they can only talk by messenger, and some of them may be traitors. How do the loyal ones still agree?

Agree, even when some players are traitors.

On an open network, it's even harder. There's no member list. Anyone can join, anyone can leave, and one person can pretend to be a thousand computers. Bitcoin's design paper pointed out that one vote per internet address could be taken over by anyone able to grab lots of addresses. Free votes are easy to fake.

If votes are free, they're easy to fake.

Make votes cost something

The fix is clever. Make the right to add a block cost something real, something you can't fake by making more accounts. Proof of work makes you spend computing power and electricity. Proof of stake makes you lock up money. Either way, your vote has to be paid for.

Your vote has to be paid for.

Let's start with proof of work, the system Bitcoin uses. Miners gather waiting transactions into a candidate block. Then they race to find a number that makes the block's fingerprint, its hash, come out below a target set by the network. There's no shortcut. The only way is to guess, over and over.

No shortcut. Just guess and check.

Think of it as a lottery where every ticket costs electricity. A hash can't be predicted, so miners make an enormous number of guesses, changing one small number each time, until someone gets lucky. Whoever finds a winning fingerprint first gets to add the block.

Every guess costs real electricity.

And here's the beauty of it. Finding the answer is incredibly hard, but checking it is almost instant. Any node can hash the block once and see that the fingerprint really is below the target. Hard to produce, easy to verify. That's the whole trick.

Hard to produce, easy to verify.

So what stops blocks from coming faster as more miners join? Every two thousand and sixteen blocks, roughly every two weeks, Bitcoin adjusts the difficulty, so blocks keep arriving about every ten minutes on average. More miners don't mean more blocks. They mean harder puzzles.

More miners means harder puzzles, not more blocks.

Now, what if two miners find a block at almost the same moment? For a short while, some nodes see one and some see the other. Then the next block lands on top of one of them, and that branch pulls ahead. Nodes follow the chain with the most work behind it, and the other block is dropped.

The chain with the most work wins.

That's why a brand-new block with your payment in it can occasionally be replaced, and why confirmations matter, like we saw in the blocks lesson. If your transaction was in the dropped block, it usually just goes back in line for the next one. The deeper it's buried, the safer it is.

The deeper it's buried, the safer it is.

Cheating is expensive

So what does it take to cheat? To rewrite history, an attacker needs more computing power than all the honest miners combined. That's the fifty-one percent attack from the blocks lesson. On a large network, the hardware and electricity make it enormously expensive. The design paper's bet: playing fair should pay better than cheating.

Playing fair should pay better than cheating.

The trade-off is energy, and Bitcoin still runs on proof of work. All those guesses burn real electricity around the clock, and that's on purpose. The cost is exactly what makes the history so expensive to fake. We'll go inside mining, and where all that power goes, very soon.

The energy cost is what makes history hard to fake.

How proof of stake works

Now, proof of stake. Instead of burning electricity, validators lock up the network's own coins as a security deposit. Ethereum switched to this in September twenty twenty-two, in an upgrade called the Merge. In proof of stake, your deposit is your ticket to take part.

Your deposit is your ticket to take part.

On Ethereum, running one validator takes a deposit of thirty-two ether, locked in a special contract on the network. That deposit isn't just a ticket. It's collateral, and it can be taken away if the validator cheats.

The deposit is collateral.

Time is split into twelve-second slots. In each slot, one validator is picked at random to propose the next block. Then a committee of other validators checks it and votes on whether it's valid. Those votes are called attestations, and every active validator casts one in each round of slots. One proposes, many check.

One proposes, many check.

Every few minutes, the network takes stock. When validators holding two-thirds of all the staked ether agree on a checkpoint, that part of the chain becomes final. Final means that undoing it would cost an attacker a huge share of all the stake on the network.

Final means undoing it costs a fortune.

Day to day, validators earn small rewards for proposing and voting on time. If a validator misses its duties, say its computer goes offline, it loses roughly what it would have earned. Honest and online pays. Offline costs a little. Cheating costs a lot.

Online pays. Offline costs a little. Cheating costs a lot.

So what stops a validator from lying? If one proposes two different blocks for the same slot, or casts contradictory votes, the network slashes them. Part of their deposit is destroyed and they're forced out. If many cheat together, the penalty can take their entire stake. Lying costs real money.

In proof of stake, lying costs real money.

Think of it like a bond. You put up money for the right to help run things, and you lose it if you're caught cheating. In proof of work, cheating wastes your electricity. In proof of stake, cheating burns your own deposit.

Cheat, and you burn your own deposit.

Attacks still exist in proof of stake. They just look different. With a third of all staked coins, an attacker could stop the chain from finalizing. With a majority, they could try to steer which blocks win. And reversing finalized history would mean losing at least a third of all the stake on the network.

Undoing final blocks burns a third of all stake.

The difference most people notice is energy. According to the project's own site, the switch to proof of stake cut Ethereum's electricity use by more than ninety-nine point nine percent. The security now comes from money at stake, not electricity spent.

Security from money at stake, not electricity spent.

Work vs stake

So which one is better? People argue about this endlessly, and both have trade-offs. Proof of work ties security to physical cost and has the longest track record. Proof of stake uses a tiny fraction of the energy and can punish cheaters directly. Different tools, same goal: one honest record.

Different tools, same goal: one honest record.

Consensus protects the record

Now, what does all this mean for your security? Two things. First, consensus protects the record, not you. Both systems stop strangers from rewriting the ledger. Neither one can stop you from signing a bad transaction. The chain will faithfully record your mistake, forever.

The chain faithfully records your mistakes too.

Second, staking attracts fake offers. Real staking rewards come from the protocol itself, and they change as more or less coin is staked across the network. So a site promising a fixed, guaranteed high return is a red flag, not a feature.

US regulators list the same warning signs again and again: guaranteed profits, promises of no risk, and pressure to act fast before you've had time to check. If it says risk-free, it isn't. Real staking always comes with risks, and an honest platform spells them out.

If it says risk-free, it isn't.

And watch for the personal version. Someone friendly offers to stake for you, as a favor, with a better rate than anywhere else. All you have to do is share your recovery phrase so they can set it up. Staking never requires handing anyone your phrase.

Whatever you decide about staking, the rules from the keys lesson still apply. Read exactly what you're signing. Know who holds the keys afterward. And never share your recovery phrase with anyone, for any reason. Consensus keeps the ledger honest. Keeping your keys safe is your job.

The network keeps the record. You keep the keys.

Proof of work vs proof of stake

Here's the whole lesson in four lines. Strangers on an open network need a way to agree that can't be faked. Proof of work makes adding a block cost electricity. Proof of stake makes cheating cost your deposit. And neither one can protect you from signing a bad transaction. The network keeps the record honest. You keep your keys safe.

The network keeps the record. You keep the keys.

Sources

• The Byzantine Generals Problem was published in 1982 (Lamport, Shostak, Pease): generals, some of whom may be traitors, must reach a common decision
• Bitcoin whitepaper: one-IP-address-one-vote could be subverted by anyone able to allocate many IPs; proof-of-work is one-CPU-one-vote; ties between simultaneous blocks are broken when the next proof-of-work is found; nodes follow the longest chain; an attacker ought to find it more profitable to play by the rules
• Bitcoin: block header hash must be at or below the target; difficulty retargets every 2016 blocks (about two weeks) to keep about one block every 10 minutes
• Ethereum proof of stake: 32 ETH deposit per validator; 12-second slots, 32-slot epochs; one validator pseudo-randomly selected to propose per slot; committees attest; finality when 66% of staked ETH agrees on checkpoints; slashing for proposing two blocks in a slot or contradictory attestations destroys some or all of the stake; one-third of stake could prevent finality, 51% could try to control the canonical fork; reverting a finalized block requires losing at least one-third of staked ETH
• Ethereum base reward per validator falls as total active stake rises (proportional to 1/sqrt of total stake); slashing can reach the full effective balance when many validators are slashed together; slashed validators are removed from the network
• The Merge reduced Ethereum's annualized electricity consumption by more than 99.988%
• The Merge took place on September 15, 2022, switching Ethereum from proof of work to proof of stake
• CFTC: 'risk-free', 'zero risk', 'absolutely safe' and 'guaranteed profit' claims are hallmarks of fraud; fraudsters promise high guaranteed returns and create a false sense of urgency

Education only. Not financial advice.