Most implementations of Proof-of-stake suck. They are not the way it's supposed to work, and the PoS stakers who forge blocks do not actually contribute security to the block chain in relation to their staking award.
Can you elaborate on that.
Okay.... With PoS as usually implemented, the "coin days destroyed" are the basis for selecting one chain over another. So that's the "security" measure that people ought to get paid for providing. But it is not what people get paid for providing. They get paid for locking up coins, providing something else. Something completely unrelated to the security of the block chain, because they can lock up the same coins on both sides of any fork.
Also? "Coin days destroyed" are not a finite resource in the way that something needs to be finite in order to help secure a block chain. Someone with 1 coin that's a month old should not be able to play for a 3-to-1 advantage in a game that nets him ten coins one day old. Nor should someone be able to spend the same coin in both of two different forks to generate
different priority in both just because the coin is spent at a different block chain height.
"Total transaction volume" is also not limited in the way you need it to be limited for security. If you have a system where an attacker can generate more priority for an attack chain by repeatedly shuffling his coins between different wallets after the fork, that's a broken system.
Also? If an attacker can prepare a block chain without letting anyone else see it, which has comparable transaction volume, just by replaying other people's transactions that he sees on the main block chain into his attack chain? That's also broken. If it's a coin-days-destroyed system so by playing them into later blocks make his attack chain have more priority than the real chain? That's even more broken.
The only real measure of stake that matters when picking between two forks of a block chain, which is limited in the way we need a security measure to be limited, is the amount of coins that existed before the fork, which are used as inputs after the fork. Even that is useless unless the transactions actually specify which side of the fork their stake supports by specifying the ID of a recent block and not being valid in any chain not derived from that block.
So, a Proof-of-stake system that works looks like this: Every transaction 'stakes' a recent block and is not valid in any block chain that is not derived from that block (so an attacker can't replay it into an attack chain that started before the stake block). The choice between forks is made on the basis of which chain has more coins that existed before the fork and are used in transactions staked after the fork. Because that's the basis of chain security, that's what users get paid for providing. And you do that by making them get interest on the coins they use as inputs in transactions, up to the stake block.
If they stake a block that's not very recent, the transaction is valid in all possible forks arising after the stake block, so it's not very useful for security. On the other hand, it's valid in all possible forks arising after the stake block, so they can be comfortably certain that whatever fork wins in such a split their transaction will be in it. So they get the security payment interest up to the stake block, and the miner gets the security payment interest after the stake block.
Miners are motivated to include absolutely all the transactions they can find on the network because including all the transactions means their block has priority if a fork happens. Miners will also make a transaction staking their own entire wallet every time they make a block, both to collect the interest on their coins and to generate priority for their block.
But someone not using their coins to support any block chain is contributing nothing to security for that whole time, so there has to be a top limit on the amount of time people can get paid interest for. Not too short, or you spam the block chain with transactions far too frequently made just for the purpose of not losing interest. But not too long, either, or you wind up with the whole burden of security sitting on the miners as people just sit there with their wallets not supporting either branch of any fork. Let the rest of the stake interest go to the miners along with tx fees, because the miners are providing security for all the people who leave their coins sitting there.
It doesn't matter how you decide who gets to form a block; I think proof-of-work mining is fine for that. But, once again, the amount of security counted for a chain fork, should equal the amount of security the payment is a reward for, so if you have a block subsidy (and you should, to distribute a coin supply) then you have to count the miner's work, or whatever resource the miner
irrevocably committed to his block that he cannot also commit to any forking block, toward block chain security too - in roughly the same proportion as the proportion of block subsidy to stake interest generated.
My own preference is for the miner to get a constant block subsidy, which will start out being the whole money supply. Hence the system works like a proof-of-work coin until coin interest/stake awards start to be generated. But if the system lasts, then the block award eventually pales into insignificance relative to the amount of stake income being generated, because compounding interest. So it asymptotically approaches a system that works like a proof-of-stake coin. The transition is very gradual, but at that point the miners are basically living on transaction fees and stake scraps.
