Proof of Stake vs.

Proof of Work
White Paper
( )
BitFury Group
21 2015 ( 1.0-ru)

(. proof of stake)

(. proof of work),
. , , , ,
. , ,
, .

1.0

13 . 2015

(.)

1.0-ru

21 . 2015

( )

2015 Bitfury Group, LLC.

Without permission, anyone may use, reproduce or distribute any material in this paper for noncommercial
and educational use (i.e., other than for a fee or for commercial purposes) provided that the original source and
the applicable copyright notice are cited.

, . -

(. blockchain, ) , ; ( , )
. , , 1 .
(P2P) . . , ,
, .
, , .
(PoW) . , , , ;
.
, , p,
p. ,
, , .
, :
;
, .
.
, , . ,
. , , .
, , (PoS). : ,
.
, p , p.
1

, , , -

(SPV) [1]. ,
.


:
, , . ,
, ,
.
, , , .

1.
, , , ,
( ), .

(. unspent trans-

action outputs, UTXO). , . ,

, , ,
.
. ; , .
, , .

; -

.
, .
, .

.
1. B , , B .
, B , B , B .
, , ,
-. CAP- (.

.
-
B1

2 B2

i1

Bi1

Bi

Bi

i+1

Bi+1

Bi+1

i+2

Bi+2

Bi+2

Bi+1

. 1. .
Bi+2 Bi+2

consistency, availability, partition-tolerance) [2], ( )

( , ), . , . ,
, . (. eventual consistency [3]), :
1. , , ,
, .
,
(. 1). ():
;
.
, -
:

 2. . , B , B ,
B .
, . 1, 12, B . : Bi+2 , Bi+1
i+2

; ,

( Bi+1
-

, ). ; ,
. , , , . , (
, ).
, :
3. , ,
.
:
2. , , (. mining, ) .
3. , , (. minting, ) .

1.1.
, . :
, ,
[4] ;
.
, SHA-256 [5]; [0, 2256 1].
, - hash()
5

 [0, M ]. , , , ,
SHA-256 -.
, ;
, :
hash(B) M/D,
D [1, M ]

(1)

. B , -

(1),
. D, , ; D.
T (r), , r , ,
r/D (. A):

P {T (r) t} = 1 exp(rt/D).
n r1 , r2 , , rn . T ,
, T (ri ) , 2 . , T :

n
t )
P {T = min(T1 , . . . , Tn ) t} = 1 exp
ri ;
D
def

i=1

ri

P {T = Ti } = n

j=1 rj

: -

p p . , , ,
13.

1.2.
(1) ,
, ,
. A bal(A). ,
hash(hash(Bprev ), A, t) bal(A)M/D,

(2)

[6], .

, .

 Bprev , ;
t

(UTC).

,
(2), .
(1), , , t (2). ; , , , . , PoS- , ; , .
t. ,
t UTC- , ,
7200 t. , .
A t, (2), . ,
; ,
, A.
, , A, bal(A)/D (. A). , (2)
: . , , ,

a bal(a)

a bal(a)/D . , -

, D

D=

1
bal(a),
Tex a

Tex . , , D , .

1.3.
(. delegated proof of stake, DPoS)

- . DPoS
BitShares ( 2.5), , Slasher
Tendermint ( 4). , (), ( ). DPoS-, :
7

 ;
.
, ,
.
, ,
; , Slasher
. ; Tendermint,
. DPoS, ,
( );
DPoS , (. depositbased proof of stake).
(2). DPoS
:
.
, .
, .
, ,
PoS; .

1.4.
, ,
(). , ,
[7].
4 ([8]). ,
, ,
(, -) , (, ).
;
"" ,
8

 , . , , . , . ,
, , , , , ;
, , .

(, , ), .
5. , , , .
, , N , N ,
N , . (, , ).
, Proof of
stake: How I learned to love weak subjectivity [8] ,

, .

2.
,
(. 1):
Peercoin, PPCoin (peercoin.net);
Nxt (nxt.org);
BlackCoin (blackcoin.co);
Novacoin (novacoin.org).
BitShares,
(bitshares.org). Ethereum (ethereum.org) ; Ethereum .

 1. PoS . , ( 24 23 2015 )
CoinMarketCap [9].

. $

, . $

Peercoin (PPCoin)

22,6

10,8

83

1 000

10,7

27

BlackCoin

75,0

2,2

15

PoW / PoS

Novacoin

1,14

1,4

20

PoW / PoS

BitShares

2 511

11,7

55

PoS

NXT

PoW / PoS

2.1. Peercoin
Peercoin, PPCoin

, 2012

Sunny King. Peercoin

[10]:
.
,
.
Peercoin : , , Peercoin
(UTXO). 10 ; , UTXO .
Peercoin , -
SHA-256, ; , . , ;
.
, PoW PoS. ,
Peercoin .
Peercoin (. coin age).
[11].
6.

, . , , , , .
Peercoin : .
(. , , ).

10

 , U Peercoin

hash(hash(Bprev ), U, t) bal(U ) age(U )M/D,

(3)

age(U ) , U . PoS (3) , ,

UTXO, .

coinstake , -

, UTXO , .
coinstake U , (3);
, U , .
, PoS (3)

. ,
, UTXO
.
, .
, Peercoin . .
[12], ;
, , . , .

2.2. Nxt
Nxt

, 2013 -

. Peercoin, Nxt ,
; , 1 NXT, , . ,
.
Nxt , , ,
[13]:
Nxt . Nxt
. .
, , , , . .
: 255. , .
11

 ( 24 ). , ,
.
Nxt . (2), A, ,

hash(hash(Bprev ), A) t bal(A)M/D.
(4) Bprev

, , t

(4)

, -

Bprev . , , ,
PoS ;
. - (4) :
1. ( , . generation signature) Bprev ;
2. ;
3. 8 .
, , ,
, (4) A. ,
Nxt D .
, (2), (4) ,

A . , PoS Nxt :
, .
,

hash(hash(Bprev ), A)
A = arg min
bal(A)
A

. Nxt . : , , [14] (. B).

2.3. Novacoin
Novacoin

PoW/PoS , Peercoin.

:
Novacoin : , 64 [15] (. 16 Peercoin).

12

 ,
- (. coin day weight) (3). , coinstake- PoS- PoS
[16].
- Novacoin , 30
90 -. , - UTXO 1 Novacoin
:
,

10

30

60

90

120

200

30

60

90

90

2.4. BlackCoin
Blackcoin

, -

. . BlackCoin
,
(2),
[17]. 64 ;
1% (, BlackCoin ).

2.5. BitShares
BitShares

, -

, (,
). , BitShares ( XCP Counterparty). BitShares
. BitShares BitShares 2.0, ,
BiShares, DPoS.
BitShares . BitShares , . , BitShares, ; . , ,
. ,
, .
, N , . N , .
13

 . , N ,
, .
, , , , , . , ( -). , , ,
. , .

3.
, PoS-, , .
Cryptocurrencies without proof of work [19].
PoS- - , , [20]. , , ,
(1). , ; ,
PoS .

3.1.
, (2),
: (, ),

. -

, .
, ;
PoW

. , -

PoW, ,
. , PoS-c

, . ,
2: , (. 3.4).
, . , , , . -

14

 , ,
, ,
.
; 4. PoS ,
; ,
.

3.2.
, PoS, ,
, , . PoW- , :
,
. PoS- , 10 % ,
(, 1 000 $) , , 1 000 $
0,01 % .
, PoS ; , Peercoin Ethereum (. 4).

3.3.
PoS-, , , ,
. PoW-, ,
, ; ,
PoS-. , , ; ,

. , .
, . , Nxt , 720 ( 12 ). ,
. , ,
. 15

 , .
,

, .
,
PoS-.

3.4.
,
:
1. - ;
2. , , , ;
3. , . , ,
. , , ).
4. ,
,
.
, , , ; ,
. , PoW-
. , , , , , , , .
PoS , 3.1.

3.5.
Peercoin ,
.
Peercoin, . , , , ,
. , , , , UTXO
10 . ,
16

 ( UTXO ),
. , , .
Peercoin, UTXO 90 . , Novacoin BlackCoin. , (3).

3.6.
A

Bh h; A (2) -

, Bh . A ,
Bh , Bh+1 ,
, Bh . Bh+1 , A , (2)
t. Bh , ,
, .
, (
,
, ).
,
UTXO . PoW-, , , . , PoS , , ; , DPoS .

3.7.
PoW ; ,
, [21].
, (,
6). , [22].
, PoW PoS

(. denial of service, DoS)

(. Sybil attack). DoS- , . ,

, 17

 2015 [23]. , .
DoS- , , .
, PoS , PoW.
, ,
(. selfish mining) [6]. ,
. PoS , PoS . , , - [24]; , [25].
2 . PoW , .
PoS-, :
, , ;
, (,
).

2.

PoW

PoS

DPoS

+3

, DoS

(,
)

-
PoS-
5
,
4

18

3.8.
3.8.1.
:
1. , .
2. , , , , .
.
3. , (, 6)
, , . , , .
, 50% , (
PoW, PoS) . ,

,
, , 3.4. , ( , ). , :
;

100 000 (

);

0,10 $ ( ).

10 000 $; ,
500 $.
. 25 , 5 000 $. ,
; , 4 000 $. 6
, 7 , ( 28 000 $). 50
. ,
. , ,

.
19

 , . PoS , , , .
PoS-
. 3 $ ( , ) 1 %.

3 109 $ 0.01/365 82 103 $.

, 1 3 400 $

, .
,
. , . PoW, PoS,
; ,
. , PoW-, ,
. ( ), , , ,
; ,
.
, PoS- ,
; .
PoW-, (, . .) .
3.8.2.
, 3.5.
PoW-; PoS-,
. Peercoin , .
, . , , ,
(- ).
, . x
;
p. rd

x,

, ,
20

 . (, 5 - [26], rd 5 106 .
(3); T , . T t0 /x, t0

( Peercoin, t0 = 10

). p, ,
(T rd ) , , :

P {T rd < xS} = p.
,

( x xS )
1 exp
= p;
t0 rd

t0 rd
x = log(1 p)
.
S

(5)

, x,
rd S . , , rd < B , B

. Peercoin, rd 107 B 2.3 107 [27]. , rd B . Peercoin 90 . ,

(3) 90 ; , S B 90 .

S B 60 . -

, ,

Peercoin [28].
rd and S

x=

10 B
log(1 p)
=
B 60

log(1 p)

1
.
144 60

(6)

p = 0.5, x 0.9% ; p = 0.9 (6) x 1.6%.

, x ; ,
.
(.. 60 ),

x 60 /2.
10 000 $ x = 1.6%
4 800 $. xS/rd 1 .

21

3.8.3.
, ,
,
. , ,
. , 1 000
4 . $ (, , ,

).
, ;
, 5 000 $
,
. PoS 2/3 ;
, DPoS , .

4.
4.1.
PoS- (., BitShares, Chains of Activity,
Cryptocurrencies without proof of work [19], Transactions as Proof of Stake [29]),
( ) , . ,
, . , ,
, ,
,
.
, , ;
, .

4.2. PoW / PoS

, , ( 3.2), ; Peercoin Novacoin. :
PoW-, (1);
PoS-, (2) .
22

( Nxt). PoW- PoS-, ,

Ethereum. Ethereum ;
PoS- , .
PoW / PoS- , .
PoW- , 3. , , PoW
.

4.3. Tendermint
Tendermint [30]

, -

. Tendermint .
,
, (. bonding transaction); .
, (. unbonding transaction); (. unbonding period).
, ,
2/3 . , ,
1/3 ,
. ,
, (. evidence transaction), , , . - , .
( ,
3.4). , : 2/3
, . , ( Nxt).

4.4. Slasher
Slasher

PoS / PoW- ,

(Vitalik Buterin), Ethereum [31]. 23

, Slasher ;
PoW, PoS.
(1). , coinbase- ,
hash(n) n. ; , , n. 100
: h ,
h + 100, h + 101, , h + 900.
30 .
, . ,
(2):
Signers(h) = {A : hash(n(h 2000), n(h 1999), ..., n(h 1901), A) 64M bal(A)/B},
B =

a bal(a)

, n(i)

(7)

i. (7) ,
64 , , .
. , ,
1 000 . , ,
.
Slasher , Tendermint.
,
, .
, 33 % , , .
, Slasher, . , PoS . PoS (2),
, . , . ,
Slasher , . , , ,
.
, , 2 000 .
24

 Slasher , . Slasher
PoS, (, BitShares).

4.5. Casper
Casper

Ethereum Vlad Zamfir [32]. Tendermint, Casper

. , ; .
, , , , 2/3
(, 99 %).
, Casper .

5.
,
;

Peercoin, Nxt, Novacoin, Black-

Coin BitShares. , , , , ( ). PoS,

(. ).
, , . , ; ,
. , . PoW, ;
PoS- ,
. , PoS , , . , ,
. [20],
PoS- ;

25

 -. , ; - , ( ).

,
PoS, , . ,
.

A.
, -

U 1,
U [0, 1]

(8)

. -, (1) (8):
PoW, = 1/D ;
PoS, = bal(A)/D , bal(A) .
, , U ,
(8). N , , .
, r , r .
(2) , r = 1.
T , , N T = N/r .

P {T t} = P {N rt} = 1 P {N > rt} = 1 (1 )rt = 1 exp(log(1 )rt).

1 ( ),
log(1 ) ;

P {T t} 1 exp(rt).

, T r . PoW, r/D , PoS bal(A)/D .

26

 B. Nxt
2.2, Nxt ,
. PoS- (4),
Nxt: , PoW (1)
PoS (2). (4), Nxt [14] ,
.
, n Nxt

b1 b2 . . . bn > 0,

bi = 1.

i=1

(4)
Ui [0, 1/bi ]. ,
. , i,

pi = P {Ui = min Uj }.
j

1/b1
1/b2
1/bn
n

1 1/bi
dxi
pi =
dx1
dx2 . . .
dxn .
b
xi
xi
xi
j=1 j 0
{z
}
|
n1 xj ,j=i

1/b1

pi = bi

(1 bj x) dx,

j=i

pi = bi

n1

j=0

(i)
Bj

(i)

(1)j Bj

(j + 1)bj+1
1

(9)

j b,

bi . (, n = 4,
(0)

B1 = 1;
(1)

B1 = b2 + b3 + b4 ;
(2)

B1 = b2 b3 + b2 b4 + b3 b4 ;
(3)

B1 = b2 b3 b4 ,
.) (9) ;
.
. bi = 1/n. ,

pi =

1
n

n(
0

x )n1
1(
x )n 0 1
dx =
1
 = ,
n
n
n
n
n

.
27

b1 = a;

i = 2, . . . , n bi = b =

1a
.
n1

a, b.

1/a

p1 = a

(1 bx)n1 dx = a

1 (1 b/a)n
.
nb

p1 a =

a
(1 nb (1 b/a)n ).
nb

, b a n:

[
]
n1 a
n(1 a) (
1 a )n
p1 a =
1
.
1
n 1a
n1
a(n 1)

,
lim p1 = a +

]
a [
a e(a1)/a .
1a

, :
(. . 2). , Nxt .

0.7
0.6

0.5
0.4
0.3
0.2
0.1
0
0

0.1

0.2

0.3

0.4

0.5

a
. 2. Nxt

Nxt , [14] , : U [0, 1], log U/b

b. ,
(4)
log M log hash(hash(Bprev ), A) t bal(A)/D,
28

 . , .

[1] Thin client security // Bitcoin Wiki.
URL: https://en.bitcoin.it/wiki/Thin_Client_Security
[2] Seth Gilbert, Nancy Lynch. Brewer's conjecture and the feasibility of consistent, available, partition-tolerant
web services // ACM SIGACT News.

2002.

33 (2).

[3] Werner Vogels. Eventually consistent - revisited.

pp. 5159.

2008.

URL: http://www.allthingsdistributed.com/2008/12/eventually_consistent.html
[4] Merkle tree // English Wikipedia.
URL: https://en.wikipedia.org/wiki/Merkle_tree
[5] SHA-2 // English Wikipedia.
URL: https://en.wikipedia.org/wiki/SHA-2
[6] Ittay Eyal, Emil Gn Sirer. Majority is not enough: Bitcoin mining is vulnerable.

2013.

URL: http://arxiv.org/pdf/1311.0243v5
[7] Sybil attack // English Wikipedia.
URL: https://en.wikipedia.org/wiki/Sybil_attack
[8] Vitalik Buterin. Proof of stake: How I learned to love weak subjectivity // Ethereum Blog.

2014.

URL: https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/
[9] Crypto-currency market capitalizations
URL: http://coinmarketcap.com/
[10] Sunny King, Scott Nadal. PPCoin: peer-to-peer crypto-currency with proof-of-stake.

2012.

URL: http://www.peercoin.net/assets/paper/peercoin-paper.pdf
[11] Transaction fees // Bitcoin Wiki.
URL: https://en.bitcoin.it/wiki/Transaction_fees
[12] Checkpoint lock-in // Bitcoin Wiki.
URL: https://en.bitcoin.it/wiki/Checkpoint_Lockin
[13] Nxt whitepaper // Nxt Wiki.
URL: https://wiki.nxtcrypto.org/wiki/Whitepaper:Nxt
[14] mthcl. The math of Nxt forging.

2014.

URL: http://www.docdroid.net/e29h/forging0-5-1.pdf.html
[15] Proof of work // Novacoin Project Wiki.
URL: https://github.com/novacoin-project/novacoin/wiki/Proof-of-work
[16] Proof of stake // Novacoin Project Wiki.
URL: https://github.com/novacoin-project/novacoin/wiki/Proof-of-stake
[17] Pavel Vasin. BlackCoins proof-of-stake protocol v2.

2014.

URL: http://blackcoin.co/blackcoin-pos-protocol-v2-whitepaper.pdf
[18] Daniel Larimer, Charles Hoskinson, Stan Larimer. BitShares: a peer-to-peer polymorphic digital asset exchange. 2014.
URL: http://scribd.com/doc/173481633/BitShares-White-Paper
[19] Iddo Bentov, Ariel Gabizon, Alex Mizrahi. Cryptocurrencies without proof of work.
URL: http://www.cs.technion.ac.il/~idddo/CoA.pdf

29

2013.

[20] Vitalik Buterin. On stake // Ethereum Blog.

2014.

URL: https://blog.ethereum.org/2014/07/05/stake/
[21] Meni Rosenfeld. Analysis of hashrate-based double-spending.
URL: https://bitcoil.co.il/Doublespend.pdf

2012.

[22] Ghassan O. Karame, Elli Androulaki, Srdjan Capkun. Two bitcoins at the price of one? Double-spending
attacks on fast payments in Bitcoin.

2012.

URL: http://eprint.iacr.org/2012/248.pdf
[23] July 2015 flood attack // Bitcoin Wiki.
URL: https://en.bitcoin.it/wiki/July_2015_flood_attack
[24] Matt Springer. Is Bitcoin currently experiencing a selfish miner attack? // ScienceBlogs.

2014.

URL: http://scienceblogs.com/builtonfacts/2014/01/11/is-bitcoin-currently-experiencing-aselfish-miner-attack/

[25] Ed Felten. Game theory and Bitcoin // Freedom to Tinker.

2013.

URL: https://freedom-to-tinker.com/blog/felten/game-theory-and-bitcoin/
[26] Bitcoin days destroyed // Blockchain.info.
URL: https://blockchain.info/charts/bitcoin-days-destroyed
[27] Peercoin charts live // blockr.io ( 07 . 2015).
URL: http://ppc.blockr.io/charts
[28] Peercoin block explorer // blockr.io ( 07 . 2015).
URL: http://ppc.blockr.io/
[29] Daniel Larimer. Transactions as proof-of-stake.

2013.

URL: http://bravenewcoin.com/assets/Uploads/TransactionsAsProofOfStake10.pdf
[30] Jae Kwon. Tendermint: consensus without mining.

2015.

URL: http://tendermint.com/docs/tendermint.pdf
[31] Vitalik Buterin. Slasher: a punitive proof-of-stake algorithm // Ethereum Blog. 2014.
URL: https://blog.ethereum.org/2014/01/15/slasher-a-punitive-proof-of-stake-algorithm/
[32] Vlad Zamfir. Introducing Casper the friendly ghost // Ethereum Blog.

2015.

URL: https://blog.ethereum.org/2015/08/01/introducing-casper-friendly-ghost/

2015 Bitfury Group, LLC.

Without permission, anyone may use, reproduce or distribute any material in this paper for noncommercial
and educational use (i.e., other than for a fee or for commercial purposes) provided that the original source and
the applicable copyright notice are cited.

30