Bitcoin Forum

Hi Bitcoiners

This is my first post on the forum, please be kind  :)

I recently read up about impossibility of proof of stake and nothing at stake problem. I still do not follow what is so fundamental about it. Why can't we have a 'rule' that a node can generate only one block at given height and a running 'black-list' of public keys to enforce that rule. We can have black-listing someone as a mining operation with rewards several times block reward so that black-listing would be an equilibrium strategy.

One node can have as many public keys as it wants. Public keys are not assigned to nodes.

Post a link to the one you read, and I will Rip it apart for you.  :)
Everyone I have read so far has been B.S. propaganda spread by PoW miners.

Proof of Stake is not only as secure as PoW , but with coin age has greater protection from 51% attack.
Which even at the time of this post , Chinese mining pools have over 51% control of Bitcoin.


 8)

See the criticism section for a quick overview:
https://en.m.wikipedia.org/wiki/Proof-of-stake

Nothing At Stake Explained In 4 Minutes
https://www.youtube.com/watch?v=pzIl3vmEytY

try LEOcoin pos! you need to have at least 1000leocoin in wallet to receive 10% a year pos! coin need to be minimum 24h old and maxx 5 years!
if you hold 5000 cloins in wallet you got 15%..but if you hold 50k in wallet,then you receive 20%..its come approx 27 coins a day!

In fact all nodes follow everything in stake model which here in my corner works nicely ;D . From what u wrote its clear u misunderstood how proof of stake works.

Ok , above is the quote from the wiki.

Here is what is wrong with it.

BadGuy has 50 coins ,   GoodGuy1 has 10 Coin  , GoodGuy2 also staking 10 coins

GoodGuy1 is staking
[10] on the block 500 on Fork1

At the same moment another block is created by GoodGuy2
[10] on the block 500 on Fork2


Now the BadGuy
Since he has nothing to Lose , Stakes his 50 Coins on both Forks

So Now
Fork1 [60]  & Fork2 [60]

Which means by trying to stake on both blocks at the Same Time, all he did was Negate his Staking Power by adding to Both.  :D

Which Fork is chosen will be decided by someone else , not trying to play both sides.
He makes his staking power irrelevant.

The other flaw with the Nothing at Stake Lie, which must be beyond the concept of PoW miners.
When Proof of Stake stakes a Block , Coin Age is used up, meaning those coins will now be offline and unable to stake until their minimum stake age is reached again.
It would be the same as when a PoW miner mined a coin and then immediately turned off his ASICS for a prescribed amount of time.
Which would mean he could mine no other block until , he was allowed to turn his ASICS back on.
Which is why PoS is superior to PoW , as random Chaos is entered into it.
PoW miners can maintain the ~ same HashRate thruout mining while a PoS Staker Amounts & Coin Age are in constant Flux every time they stake.
So what is burned when you stake, Coin Age & Staking Weight is burned, and it takes a minimum stake age before it can be recovered.

 8)

FYI:
As far as the DoubleSpend , PoW or PoS is susceptible to doublespend with Zero Confirmations .
Solutions for both PoW & PoS is to wait the prescribed amount of Confirmations, and never accept Zero Confirmations.

Yes I had thought about it. We can, for example, require some offline PoW to white-list a public key.
It seems to me that it is central assumption behind bitcoin design that buying 'pseudo-identity' is free and I fail to see why it needs to be the case.

Those who support PoS, I would like to believe that PoS actually works but lot of smart people seem to think otherwise, others seem to propose overly involved scheme to 'work-around' it's limitations. So I joined this forum to find out what I am missing.

In nothing at stake attack, as I understand, attackers doesn't stake on both forks. They argue that stable strategy for all honest miners is to mine on all the fork. Then attacker assumes that everyone is doing this and stakes on the double spend fork (or whatever he wants to use instead of main-chain). That is why it doesn't matter how much attacker has. I do find this valid objection, just something not fundamental and trivial to prevent, hence I started this thread.

OK , so you think

Attacker has 1 coin ,   GoodGuy1 has 10 coins GoodGuy2 also staking 10 coins

Fork1
GoodGuy1 is staking
GoodGuy2 is staking
[20]  

At the same moment on Fork2
GoodGuy1 is staking
GoodGuy2 is staking
[20]

Now the Attacker
Places a transaction on Fork1
Stakes his 1 coin on Fork 2

So Now
Fork1 [20] only 2 blocks & Fork2 [21] 3 blocks

Fork2 now has more coins in 3 Blocks, and becomes the longest chain with the most difficulty.

All of this in an attempt at a double spend.
1st off
Standard PoS wallets don't Multi-stake, you would have to code one your self.

Let's say you do and it works exactly as you described and you spend coins on Fork1 and overwrote it when Fork2 became the longest Chain.
Basically a History rewrite.

This is why it will Fail.  Once the fork2 becomes the longest chain, all of the wallets will reorg to fork2 and it will be the correct chain.
This means the coins you sent in the transaction on fork1 will not confirm, and the wallet you sent it too will not reach even 1 confirmation.

Longest chain with the most difficulty wins , just wait the recommend # of confirmations and all zero confirmation attacks fail.


 8)

FYI:
Double spending if someone accepts zero confirmations is easy on Proof of Work.
I don't even need to be a miner, just paid a higher transaction fee to pull it off.
I had 2 devices with the same BTC wallet , send the coins from the 1st device to the vendor with no fee,
then send all of my BTC from the same wallet on 2nd device to another BTC address I control, including a high fee for faster transactions.
If the Vendor accepts Zero confirmations, he will see the BTC sent from the 1st device, and I exit the store with his product for free.
5 to 10 minutes later after the 1 confirmation, all of my BTC will have arrived at my other BTC address and the Vendor just saw his payment never Confirmed.
Moral is PoW or PoS wait the recommend confirmations.  ;)

From what I understand, attacker will delay using his stake until accepted number of confirmations are passed and later use it to rewrite the history. Anyway I will leave defending it to those who 'know' this stuff while I wait resolution of the original question   :)

Hmm,

Nope , every Block that passed increases the Difficulty.
Meaning your Attacker has to have enough weight to rewrite the chain from a previous point.
That is called a History Rewrite attack not a Nothing at Stake.

 8)

https://github.com/kushti/common-pos

https://github.com/ConsensusResearch
https://github.com/ConsensusResearch/articles-papers/blob/master/multistrategy/multistrategy.pdf

I think , I answered why the nothing at stake is nothing to worry about.
However you want the part in blue answered.

Nothing is stopping anyone from making a wallet that stakes 1 block and then does not allow that same wallet to stake for a few more block.
Just as someone could design a Checkpoint server to enforce a checkpoint after every single block, meaning their can never be a reorg.

These things are not done, because it is not really a problem. Just a made up propaganda story by G.Maxwell that fools many people.

If any of it were truth, checkpoint servers would be implemented on all PoS coins overnight, but they are not , because using the difficulty # which increases with every block, it is unnecessary.    :)

Longest Chain with the Most Difficulty Wins.  ;)

 8)


FYI:
Personally ,
I would be more concerned with the fact the Chinese Mining Pools could overwrite the last 8 to 12 hours of BTC transaction history for the last year and no one can stop them.

FYI2:
Checkpoint Servers can choose which fork a wallet will take no matter the difficulty, which is why they are considered a single point of failure.
Control the Checkpoint server and you can control the coin.  :P

https://steemit.com/crypto/@heiditravels/crypto-tips-proof-of-work-vs-proof-of-stake#@anonymint/re-heiditravels-crypto-tips-proof-of-work-vs-proof-of-stake-20161211t193723096z

https://github.com/cosmos/cosmos/issues/43#issuecomment-264969234

sometimes i see from pow miner this argument:
"At pos, whales mine everything... small fishes doesnt take nothing", "it's a Rich get richer scheme".

well, i do agree with that... but the question is: is pow different? can i mine bitcoin using my old desktop(an small investment)? of course not.
to mine coins using PoW i have to make a huge investment in hardware. and to mine coins at PoS i have to make this same investment but in coins..

I Agree with you about the POS, it all depends on the weight, but as far as i remember POSV3 should solve this problem. Now for POW, it is a simple capitalist sheme, invest more to earn more. Consider POS reward as a bonus, not as a way to earn money and everything will go well.
Doesn't banks give fixed 2%/year rate ? it is a bonus right ? it is the same here.

The issue with PoS is the Sibyl Attack.
An attacker generates an army of fake nodes, has them all create a fake blockchain from a fake genesis block, use fake timestamps to "mine" it, and tries to push this fake blockchain to all nodes.
When someone the attacker is trying to scam starts up a wallet, the wallet asks the nodes for blockchain data, and has no way of knowing which chain is genuine.
Anyone using PoS coins risks getting a sackful of worthless coins that only exist on a fake chain generated by the attacker.
PoS is green and [sarcasm] anti-china (The evil Chinese miners are destroying Bitcoin! It was all good when ghash.io was taking over, because they are Americans, therefore they have good intentions, but the Chinese want to boycott foreign transactions and double spend! We have to stop them!)[\sarcasm], but there is no way to protect against Sybil attacks without introducing even more centralization (checkpoint server = Federal Reserve system).

Thats why it is always good to check out the community block explorer or an exchange to see what chain they are on. Hell, this is standard procedure for any coin whether is PoS or PoW.

LOL,  :D

You do realize that PoW or PoS coins are both Protected from the little story you just described by the Checkpoints written directly in the program code.  :)
Does not matter how long or how high the difficulty of the Fake Chain , that itty bitty checkpoint stops that shameless hussy know as Sybil Cold.

I sorry but the Scary Sybil story, can't overpower a simple checkpoint. Which is why PoW coins & PoS coins both use them in their program code.

I do agree that a check point server is centralized and should be avoided as a single point of failure.

However the checkpoints in the source code or even what is know as a rolling checkpoint (simply not allowing reorgs after a certain # of blocks) ,
both allow the coin to stay Decentralized and Protected.  ;)


 8)

FYI:
PressTab brought up an excellent point.

Since no one here can seem to articulate the issues properly and seem to have completely ignored my prior post in this thread (https://bitcointalk.org/index.php?topic=1709776.msg17153187#msg17153187) with links off to expert points, I am forced to post because there is so much disinformation being posted in this thread.

The nothing-at-stake issue manifests itself in numerous different ways. For example in PoS but not in DPoS, it can manifest in a stake grinding attack, which converts PoS into PoW. So you've achieved nothing with PoS. Checkpoints don't help to stop stake-enabled malfeasance in real-time, i.e. there is nothing-at-stake to attempt attacks in between checkpoints. There are various schemes that purport to deal with certain attacks and we even have NEM's Proof-of-Importance which obfuscates that it is really attackable by nothing-at-stake. To respond to each of these with details on the different varieties of nothing-at-stake vulnerabilities for every hyped NAOD (nonsense algorithm of the day), is more time than I can waste right now. But if you read my rebuttal of Dan Larimer linked below, you will get some flavor for the fact that it is indeed possible to find egregious, insoluble flaws in all these PoS variants. In short, none of the consensus systems (including PoW) invented thus far are robust enough. I wrote about this yesterday:

https://steemit.com/blockchain/@anonymint/future-of-decentralized-currency-is-not-bitcoin
https://medium.com/@shelby_78386/future-of-decentralized-currency-is-not-bitcoin-eec2e9c39a0a

Both PoS and DPoS have the nothing-at-stake flaw that it can be in some scenarios more liquid (on a time opportunity cost basis) to attack and short the coin, than it can be to protect one's stake for the long-term investment. Thus the stake is really nothing-at-stake. Whereas, for "the one chain to rule them" on non-repurposable ASICs, the PoW mining farms have at stake their huge sunk costs and long-term leases which they can't recover with shorting and overt attacking. However, for lesser PoW chains and those without an ASIC, they can in theory be attacked by renting hashrate and/or botnets. This is all covered in great detail in my whitepaper which will hopefully be released within Q1 2017.

Note even Dan Larimer could not refute my summary of attacks on his DPoS (https://steemit.com/crypto/@heiditravels/crypto-tips-proof-of-work-vs-proof-of-stake#@anonymint/re-dantheman-re-anonymint-re-heiditravels-crypto-tips-proof-of-work-vs-proof-of-stake-20161211t201538564z). Make sure you click that link and get a little bit of the flavor of the deep level of inspection of issues you will get with my coming whitepaper.

IOHK and Charles Hoskinson did not solve the problem that the stake concentrates in a power vacuum and that 51% of the stake can still do malfeasance.



Sorry I don't have time to waste arguing on the forum. It is time to get something accomplished, which I can't do it I am going back and forth here.

If any of you have something important to debate, write a white paper. Do some deep research. Write a comprehensive document. All this n00bs pontification from their armchairs is actually spreading disinformation.

I am not claiming kiklo is a n00b, but he is not telling you everything he knows when he replies. He is just telling you the part that makes PoS look favorable.

kiklo is correct that in theory the lesser PoW chains and especially those without ASICs in theory need checkpoints, but that doesn't even protect them from rented hashrate attacks. However his point does not apply to Bitcoin. Bitcoin has checkpoints to be extremely paranoid such as if for example there was breakage of SHA256 such as a quantum computer attack such as the one described at the end of Iota's Tangle white paper.

We ignore you old friend , because you're too long winded.   :)

Checkpoints stop longer range history attacks and the between Difficulty # and waiting for confirmations PoS is safe to use.
And I don't want to waste time arguing with you either, so instead of writing a Book , pick a PoS coin and Prove your Exploits.
Don't talk theory , Prove it Real World , until then , I will trust the checkpoints and Difficulty #, and wait for the required confirmations.

Don't forget a year ago , you were against all forms of PoS and now you are promising your new coin will be a form of DPOS (with your fixes of course.)  ;)

By the way your talk of Shorting a coin (like shorting a stock) , like I told you in the past, if you think Shorting is that easy,
Pick a coin and show me how you kill it by shorting it, (It is not as easy as you make out.) .


 8)

FYI:  Now you claim to Know , what you think I Know.  :D  :P

Here is theory for you to tangle with.

Quantum Computer creates a Virtual System , that has time emulated where 1 nanosecond emulates 1 normal second in the real world.
Inside this virtual system the time is set back to a month before btc was created.
Using the Quantum computer abilities, it creates a PoW blockchain that is longer with more difficulty in a fraction of the time.

* And the only thing that stops it from overwriting the Bitcoin PoW blockchain are those little checkpoints. *  ;)

PoW or PoS face many of the same dangers.


 8)

There is a reason there is not a $12 billion mcap PoShit coin[1]. If ever there is, then you will find out that your "security" is not. Read my rebuttal of Dan linked in my prior post. I will not respond again. You use unfalsified claims, which is not science.

I am eagerly awaiting Ethereum to blow itself up with Casper "the Friendly Ghost" (https://blog.ethereum.org/2015/08/01/introducing-casper-friendly-ghost/). ;)


I am not embracing PoShit. My design is not PoShit.


[1] And it isn't just because of security fears, but also because PoS is a political clusterfuck from the start. Network effects are destroyed by politics. Take Nxt, Steem, Bitshares as pertainent examples. Then again, Bitcoin has now reached the point of centralization and has also entered a political clusterfuck too. But PoW did at least scale before it became centralized by China + Blockstream and reached the upper limit of the volume it could do decentralized.

Something like what Theymos proposed here should be the most robust and secure solution: https://bitcointalk.org/index.php?topic=1654457

Currently your design is just shit, but I still give you the benefit of the doubt that it will evolve into something better.  ;)

Just because the top coin is not currenly PoS , does not mean it won't happen in the future.  :)

I trust my PoS coins more than any PoW coin especially BTC, considering the mining Pools can delay or refuse transactions and basically hold my PoW coins hostage at will.
Plus right at this very moment the Chinese Mining Pools have the Power to Overwrite the last 8 to 12 hours of transactions at will.
Funny how no one worries about that.  :D

 8)

Yes, the fake chain would not be able to convert honest nodes, but anyone new joining the network would have no basis for deciding which nodes are honest and which are Sybil nodes.
This includes new nodes and any lightweight client that may house a wallet.
PoS turns into a p***ing contest between the true chain and fake chains generated by attackers, and eventually degrades into a messy PoW system that defeats the purpose of PoS.
PoS is a good dream, but the best we can do in a "decentralized and protected" fashion is to shift the PoW from power-bound work to hardware-bound work systems where the mining gear must lie unused for most of the time (BurstCoin, Bitcoin Tic-Tac Coopetition mining (https://bitcointalk.org/index.php?topic=1709496.0), My cyclic PoW scheme (https://bitcointalk.org/index.php?topic=1638955.msg17151703#msg17151703)) or to recycle the computing power using protein folding PoW (questionable security) or prime chains.

Decentralization can be increased by providing miners with an extra, non-transferable incentive that the user does not need much of (marginal utility declines with amount) such as reserved space in blocks. This may require signature based PoW.

Coins usually have a seed node hard coded into the wallet. That seed node points new syncers to nodes. If the seed node is an honest node, which it should be because it is typically commissioned by the developers, then as you admit.... an honest node is hard to fool. If that seed node is not easily fooled, it will also only be connected to other honest nodes. This means that new syncers will be pointed towards honest nodes.

But, I will reiterate. Whether you are syncing bitcoin for the first time, or whether you are syncing the smallest PoS coin for the first time. It would be awfully stupid not to check that you are on the correct chain when you are done syncing.

If you have an honest node, why not just have the node control everyone's balance and sign all transactions?
The key premise of a decentralized system is that there is no hub node that can be trusted.

is this kind of attack possible only with standard pos coin like diamond, or with new type of pos coin like decred and especially etheruem? i think etehruem work in different way right we should be safe with it?

I accidentally used the wrong term. I meant DNS seed, not seed node. DNS seed points to peers, seed node is just a node that is usually connected to the network.

bitcoin uses DNS seeds nodes too... right now they have 6 of them.
https://github.com/bitcoin/bitcoin/blob/master/src/chainparams.cpp#L120

There has to be a network discovery mechanism. This is universal for any type of proof system. Or for that matter, any peer to peer software.

Edit - The old way of network discovery was for the wallet client to join an irc channel and announce that you are seeking peers. This I suppose could have been more decentralized than the current version (although the centralization becomes the irc channel), but now is looked at as more of a security risk than anything else.

PressTab already answered that one, Check the Block Explorer after you sync for the 1st time. PoS or PoW  :P
GetPeerinfo tells you what height the other peers are on.


New Nodes, (PressTab's Answer) ,
Lightweight clients are linked thru electrum, which has a synced block chain monitored by professionals that compare it with the Block Explorer.



WTF, dude mail me some of what you are smoking , I want some.  ;)

Proof of Stake has been out long enough, and no one has even pulled off an actual sybil attack
I am sorry it is like freaking out that a black hole it going to open and destroy the Planet Earth in the next 24 hours.
Is it Possible, sure many things are Possible,
Is it Probable , odds are against it.

Sybil while in theory Possible, is Very Improbable , Thanks to Checkpoints , Honest Nodes, & Just Checking the block explorer to compare chains.  :)
You going to need a better Boogeyman to scare the Proof of Stake Community.

Personally for boogeymen , I prefer the Legend of Wooley Swamp.  :D
https://www.youtube.com/watch?v=gSM7voOCkU0

 8)

I am in favor of PoS, though I've been always saying that I'm not a coder.

BurstCoin's PoC is PoS or PoW (https://bytecoin.org/blog/proof-of-activity-proof-of-burn-proof-of-capacity/). You were refuted at your other two linked above.

Your knowledge is insufficient. You are not even making the strong arguments against PoS, which I already pointed out. Arguing against checkpoints is the weakest argument you can make against PoS.

There exist multiple variations of N@S weaknesses of non-PoW coins:
#1 Selfish nodes have an incentive to double-mine on multiple forks
#2 Stakeholders have an incentive to sell old, unused keys as they have nothing to lose anymore
#3 An attacker can rent or short +50% of the existing coins without taking any risk (no unrecoverable sunk costs as opposed to PoW)

All three scenarios make it easier and less costly to double-spend or to disrupt the currency, so that an attacker doesn't need to have +50% of the stake in order to carry out his plot.

Double-mining itself (#1) can occur in two different forms:
- Actual double-mining where the node is creating and broadcasting separate blocks on two or more chain forks.
- Probabilistic double-mining where the node tries to mine on top of every chain fork he is aware of, but only broadcasts one single block. PoS coins often foresee a block selection rule that decides which fork to mint on if both have the same length. According to the protocol, you would only mint on top of the fork that you received first. But you have the incentive to modify your client so that you will try to mint on both to maximize your chances of finding a valid block.

Punitive schemes such as Slasher (https://blog.ethereum.org/2014/07/05/stake) are proposed to defend against actual double-mining by requiring minters to make a depositive that is destroyed if a minter is caught double-minting later on (other minters can prove the fact by making an evidence transaction). The probabilistic mining strategy can be avoided if the next minter is decided before a fork starts. To that end, on can have a protocol in which it's not the current block n that determines the next miner, but an older block down the chain (n - k). This way you either have the opportunity to mint on both or neither fork (provided that the fork is not longer than k blocks).

NeuCoin (http://www.neucoin.org/en/whitepaper/download) uses a different punitive scheme in which both blocks of the double-minter are simply discarded by the other nodes.

Concerning #2, the linked paper also shows (p. 30) how difficult it is for an attacker to rewrite the history as he needs (virtual) time to catch up with the network.


It appears that N&S attacks of the types #1 and #2 can be successfully prevented by incorporating appropriate incentive/disincentive mechanisms in the protocol.
On the other hand, I'm not aware of any cryptocurrency (or white paper) that solves or at least tackles issue #3. That's why I'm currently working on my own proposal to solve (or at least mitigate) this fundamental problem.

I'm just 'catching up' with POS so apologies in advance.

For #1, if I mine on one fork, doesn't that fork immediately become the one that will get most likely get accepted by the network? If so why even bother with mining on both?  Unless of course my blocks are getting delayed in the network so much that there is risk another POS miner would be selected due to some timeout, then it might make sense to mine on multiple forks in the hope that one of those blocks makes it to the rest of the network in time. But with proper timeouts, this seems unlikely. Plus don't some proposals punish this multiple fork mining behavior?

For #2, when is this attack used, during initial block download? Is the idea to use this stake to try to perform a stake grinding attack in advance and send those blocks to a syncing node instead of real chain?

For #3, I can't obtain access to 50% of coins without exchanging for other tokens, fiat or goods/services can I (with the exception of #2)? Those are sunk costs that I can't recover if I cause problems with POS chain.

#1 Fails is Bullshit  (This was covered on the 1st page of this topic already.)
https://bitcointalk.org/index.php?topic=1709776.msg17135430#msg17135430
https://bitcointalk.org/index.php?topic=1709776.msg17136990#msg17136990

#2 Fails is Bullshit
Between the increased Difficulty, and hard coded checkpoints in the Software, # 2 fails.

#3 An attacker can rent or short +50% of the existing coins without taking any risk (no unrecoverable sunk costs as opposed to PoW)

LMAO ,  :D :D :D  the mythical Short attack, which again I call Bullshit!
Anything , stocks or coins PoW or PoS can be Shorted. But you guys always act like it is so easy.
Fact is YOU HAVE TO PUT UP COLLATERAL TO BORROW AGAINST THE SHORT, and if your short attempts fails, (which there are ZERO Guarantees it will Work.) ,
You lost all of your Collateral and failed in your attempt to hurt the coin. (That is when you realize you were STUPID for thinking shorting was easy.)  :D
Please pick a coin and show us how easy this is to pull off, until then I am calling it BULLSHIT!


 8)

FYI:
You can tell you don't know much about Proof of Stake,
in your Shorting Myth you say 50% of the existing coins.
Proof of Stake using Coin Age, means you have to have 51% of coin age, not 51% of the coin supply.
You may have 60% of the coin supply, but if the other 40% has a higher coin age, the PoS coin will be able to resist your 51% attack.  :D
Also the second you start staking , your coin age % starts dropping, so even if you have 51% of the coinage , once you mine 2% only, you are down to 49% and that is the end of your attack. Which is why Proof of Stake is more resistant to 51% attacks than PoW.  ;)

PoW is an Adversarial Consensus System, which is fighting each other using hash rate.

PoS is a Cooperative Consensus System, where we take turns leading the blockchain,
like a group of runners when one gets tire another leads, together we create the Strongest Chain. :)

https://sochi-informburo.ru/wp-content/uploads/2016/10/05-10-16-03.jpg

If a) the protocol foresees a "first seen"-rule that prefers blocks that you received first, b) everybody is abiding to this rule (not using modified clients) and c) network latency is evenly distributed among the nodes, then probably yes.

As I explained in the probabilistic approach, you don't even have to actually mine on both and send two blocks. It's even extremely unlikely that you will succeed on both. To maxime your chances it suffices to just check and see if you can mine on any of the two blocks, no matter which one you received first. Such a behaviour can distrupt consensus.

Yes, please check out the links in my previous post for further details.

Ideally, you would try to buy coins from early adopters when the coin wasn't popular already. That should make it "easier" to buy keys representing a large precentage of stake that existed at that early stage. However, as pointed out in the NeuCoin paper I cited, even if you possess a majority of historic stake it seems that you still have no realistic chances to win the battle since you'd still have to compete with 100% of the stake.

If there is a a big-enough market for short selling the coins, you could sell at a predefined price without the need of buying the stake beforehand. So, the subsequent devaluation of the coin caused by your attack wouldn't affect this price.

Another attack vector (that is even working wihtout the possibility of short selling) is to regularly buy 51% of the coin and launch lower scale attacks that remain largely uncovered and thus don't have a negative impact on the market price.

It is usually based on difficulty. Not a first seen basis. It does I suppose have an element of first seen, in that you can only orphan so many blocks.. usually 6 or 12 at a time.

If you are within the same modifier interval, then it is actually extremely likely that you will get the same stake kernel on both chains. Why wouldn't you?


This only works if the coin has never had any checkpoints added to it. And even if it hasn't had checkpoints added, then it would have to be a coin that uses coin age, which a lot of the modern PoS clones don't do.

Really all you have to do is add a checkpoint after the coins have had a decent distribution, and then this argument #2 is pretty much void.

Of course, the primary rule is usually based difficulty or chain length. Afaik, some coins do use "first seen" as a secondary rule to select between chains that have the same difficulty/length.  

The modifier interval is a method applied by some PoS coins in order to protect against N@S attacks. Naive PoS schemes in which the next block's hash target is derived from the previous block, are susceptible for this kind of attack. At least this is how I understand Vitalik's blog post:


I agree, checkpoints (whether centralized or decentralized) can offer a solution against this kind of attack. My post was based on the naive implementation of a PoS coin with no special protective measures against N@S.

I guess what I am saying, is that if there are two chains, why would you not publish the same stake to both chains? If the split happened before the modifier interval has changed (which is the only thing that would alter your utxo hashed kernel value from one chain to the other) then you should have almost identical ability to publish to both chains, assuming that difficulty is relatively similar between the two. You can publish to both chains without modifying a client either, simply all you would need to do is run two nodes, one on each chain.