The paper Formal Barriers to Longest-Chain Proof-of-Stake Protocols (Brown-Cohen, Narayanan, Psomas, Weinberg, 2018) describes an attack on Proof-of-Stake cryptocurrencies called Undetectable Nothing-at-Stake (p. 11, 4.2 - Recency, Definition 11). I don't understand why this attack matters. The paper says

Depending on reward scheme, there may be an expected monetary gain for [undetectably] announcing [blocks on different forks].

As far as I understand it, the attacker simulates multiple independent miners like in a Sybil attack. But for the attack to be undetectable, it also needs to divide its stake among the miners it simulates. This way, each of the miners has only a fraction of the stake, so it can only mine as much as an independent, honest miner with this fraction of the stake. Otherwise it could be detected. This is because it can only behave the same way an honest miner with a high latency connection might behave. How can this lead to a higher gain?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.