Part V — Blockchain & Trustless Consensus · Chapter 3

Proof-of-stake

Hook

Proof-of-work makes block proposal expensive by burning electricity. Could the same expensive-to-win, cheap-to-verify race be run without a single watt of wasted computation — just money already staked in the system?

Intuition

Round 1's leader: D — a validator with 10% selection probability.

Slide the round number and watch a different validator win each time. There's no computation to race — just a deterministic lottery where each validator's ticket size is exactly its stake. A's 40-stake ticket wins 4 times as often as D's 10-stake ticket, on average.

Formalize
  1. Lay every validator's stake out on a line

    Validators A, B, C, D hold stakes 40, 30, 20, 10 (total 100). Laid end to end on [0,100)[0, 100):

    • A occupies [0,40)[0,40)
    • B occupies [40,70)[40,70)
    • C occupies [70,90)[70,90)
    • D occupies [90,100)[90,100)
  2. Hash the round number into a ticket on that line

    ticket(round)=toyHash("epoch-round-x")mod100\text{ticket}(\text{round}) = \text{toyHash}(\texttt{"epoch-}\text{round}\texttt{-x"}) \bmod 100 — a pseudo-random position, uniform over [0,100)[0,100), standing in for a real chain's verifiable random function (VRF).

  3. Whoever's range the ticket lands in proposes the block

    Because each validator's slice of the line is exactly proportional to its stake, the probability validator vv is selected is P(v)=stake(v)/istake(i)P(v) = \text{stake}(v) / \sum_i \text{stake}(i) — no computation race, just weighted chance.

  4. Nothing-at-stake: voting costs nothing without a penalty

    In proof-of-work, hash power spent mining one fork can't also be spent mining a competing fork — it's a physical resource. Stake isn't consumed by voting, so without a rule against it, a validator can support every competing fork at once for free. Slashing closes this gap: forfeit your entire stake if you're caught supporting more than one fork.

  • stake(v) — validator vv's stake; determines both its slice of the line and its slashing exposure.
  • ticket — the round's hashed lottery draw, uniform over [0,totalStake)[0, \text{totalStake}).
Play

No rounds run yet.

Run rounds one at a time and watch the tally bars grow. Over many rounds, D (10% of stake) wins roughly a tenth as often as A (40% of stake) — the same proportional guarantee as the formula, just visible as frequency instead of probability.

Worked example

Six rounds, validators A(40) B(30) C(20) D(10), stake ranges A:[0,40) B:[40,70) C:[70,90) D:[90,100).

  1. Round 1

    toyHash("epoch-1-x")=896\text{toyHash}(\texttt{"epoch-1-x"}) = 896, so ticket=896mod100=96\text{ticket} = 896 \bmod 100 = 96. That falls in D's range [90,100)[90,100)D wins, despite holding only 10% of the stake.

  2. Round 2

    toyHash("epoch-2-x")=857ticket=57\text{toyHash}(\texttt{"epoch-2-x"}) = 857 \Rightarrow \text{ticket}=57, inside B's [40,70)[40,70)B wins.

  3. Rounds 3–6
    • Round 3: toyHash("epoch-3-x")=818ticket=18\text{toyHash}(\texttt{"epoch-3-x"})=818 \Rightarrow \text{ticket}=18, falls in A's [0,40)[0,40)A
    • Round 4: toyHash("epoch-4-x")=779ticket=79\text{toyHash}(\texttt{"epoch-4-x"})=779 \Rightarrow \text{ticket}=79, falls in C's [70,90)[70,90)C
    • Round 5: toyHash("epoch-5-x")=740ticket=40\text{toyHash}(\texttt{"epoch-5-x"})=740 \Rightarrow \text{ticket}=40, falls exactly at B's lower bound → B
    • Round 6: toyHash("epoch-6-x")=701ticket=1\text{toyHash}(\texttt{"epoch-6-x"})=701 \Rightarrow \text{ticket}=1, falls in A's [0,40)[0,40)A
  4. Six rounds: D, B, A, C, B, A
    • A: 2 wins (stake 40%)
    • B: 2 wins (stake 30%)
    • C: 1 win (stake 20%)
    • D: 1 win (stake 10%)

    A small sample, but already leaning the way the stakes predict.

Checkpoint

Validator D holds only 10% of the stake, so it should win roughly 1 in 10 rounds. Slide to a round number (1–30) whose leader is D.

Slide to search for a round D wins
Summary
P(v selected)=stake(v)istake(i)P(v \text{ selected}) = \frac{\text{stake}(v)}{\sum_i \text{stake}(i)}

Proof-of-stake replaces "spend energy to win the right to propose" with "risk capital to win the right to propose" — cheaper for the planet, but it opens a new failure mode that proof-of-work structurally can't have: voting for every fork at once costs nothing unless slashing makes it costly. The next chapter looks at what happens when forks appear at all, under either consensus rule.