I go line-by-line against Vitalik’s Proof of Stake FAQ. PoS is still just as expensive as PoW (but it may have different security features).

Proof of Stake is Back

Yesterday I noticed that someone from Ethereum has responded to my August 2015 article “Nothing is Cheaper than Proof of Work” on their Proof of Stake FAQ.

…and now I see that it was written by Vitalik Buterin himself, almost a year ago (!).

Oh, brother..

I’m not sure it makes any difference at this point, but I started this so I suppose I may as well finish it.

Here we go!!

The Claim



Vitalik’s phrase “equally efficient” is vague, but fortunately he clarifies it to mean “equally wasteful”. So, we’re back in business.

Vitalik Seeks a Work-Independent Protocol


Vitalik correctly notes that there must be a “plausible mechanism” to turn work into blocks. In other words, there must exist a f1 of type { work –> result }. We might call this the “workability” of the protocol – the extent to which it can be “worked”.

However, Vitalik ignores that I address this here by saying that, in a peer to peer network, all f’s that map to result (ie, every f which { ?? –> result } will have an input which is work related. In other words, the f1 in question will always exist. All protocols are “workable”.

Amazingly, Vitalik gives an example which is so bad, it almost proves my point by contradiction. He uses “my [Vitalik’s] laptop’s /dev/urandom” as an example of something which cannot be “worked”. His example cannot be worked, because and only because it is not P2P – it is a trusted 3rd party source of randomness.

(In practice it is not even true that his scenario is “unworkable”, as a prospective “worker” could try to bribe Vitalik, or could try to hire people to track down his laptop’s physical location and then take it from him at gunpoint).


Here, Vitalik gives an example where a blockreward can be “worked” in two ways. The second (“forcing a reset”) is irrelevant, but this is the one which he carefully elaborates. But the first “capital lockup costs” is relevant, and it is de-emphasized.

My simple equation does not require that the “workers” attack the system. If the total reward is $1000, then the total waste will be $1000, and it will all take the form of capital lockup costs. This would still be true (ie, I would still be right), if it were impossible to reset the randomness.

For Vitalik has neglected the “very large set”. It will indeed be very large, and it will be very very wasteful. Capital which is attempting to be staked must, necessarily be “locked up” to at least a minor extent. And if this is not the case in the protocol, it is the case in practice – money that is waiting to be staked cannot be turned toward other purposes. The fact that these “bonds” might be very short-term, will only make them more convenient which will only make the “very large set” even larger – and more wasteful. Instead of two medium numbers multiplied together, we will have a small number multiplied by a large number (but the product will be the same).

If these funds are not officially regarded as “staked” (ie, locked for a full year), we might call them “prestaked” for a day, or an hour. Instead of buying PoW lottery tickets, they will buy prestake PoS lottery tickets in order to win the privilege of becoming a validator.

There are other problems, but they distract from the overall message of MC=MR. Instead, just imagine the total reward is $1000, and that the randomness can not be messed with. In such a case, individuals will tend to invest (“stake”, or “prestake”) a marginal dollar, until the MC=MR, as I suggest. Imagine it were any other way, for example that MC<MR? This would imply that the first person to invest $1 in staking (in joining the “very large set”) would get an expected return of more than $1. So, this will obviously draw more capital in.

Vitalik’s example assumed that Waste = Attack. But this is not necessarily the case; if Attacks = 0 then Waste will just equal regular Work.


We’ll get back to this “security” claim later.

The Waste-Equivalence Argument, Restated


Let me restate my argument by comparing and contrasting PoW and PoS.

In PoW, you do the following: borrow $W1 money at rate r, buy a bunch of equipment and electrical power, earn BTC, and then liquidate everything and repay what you can, which is $W2 (which is very little, possibly zero). You have come up short, spending a total of $A = (W1*R)-W2 , but meanwhile you have earned $A worth of BTC.

(note: R = (1+r), the loan factor)

In PoS, you do the following: you borrow $S1 money at rate r, “stake it” (ie lock it away for a year, or a day or whatever), earn ETH, get the staked funds back, and repay the loan, which is $S1. But because interest rates were not zero, you still come up short. You invested a total of $B = (S1*R)-S1 , but earned $B worth of ETH.

In PoW, you paid cost_w = (W1*R)-W2 .
In PoS, you paid cost_s = S1*r .
In PoW you received benefit_w = $A worth of BTC.
In PoS you received benefit_s = $B worth of ETH.

This is all quite basic, and possibly undisputed.

The point I have made since Nov 2014, is that the second half of each sentence drives the first (ie “earned $B worth of ETH” determines how much total money is deployed in “borrow $S1 money”). And therefore the social waste per block will equal the block’s value.

If the benefit of mining, or of stake-ing, is higher then the cost, more people will do it. In practice there is no way to prevent people from staking (where this is defined as: joining the “some very large set” above). At least, there is no P2P way, because all are equal peers, and so no one has the privilege of denying someone entry.

So, if a blockchain currently emits X = $A worth of value in each block, then this blockchain gains nothing by switching to proof of stake. For a given X = $A, all four quantities would be the same: cost_w = cost_s = benefit_w = benefit_s . They are all equal to $X (call it: the “critical $X”).

I really have no idea if Vitalik disputes any of the above facts (which are all that I require to prove my “equally wasteful” thesis).

Waste is Different From Security

Now, we return to the point that we passed over earlier.

Below, Vitalik argues that the security, ie what an attacker would have to pay, is different under PoW and PoS. Specifically, he summarizes it (correctly) as “[the above] serves to show…that PoS gets more bang for its buck in terms of security”.


In may be the case that PoS gets more bang for its buck, which is to say that PoS gets more “security” per blockreward value (ie, per “critical X”, or per “wasted” dollar), than would PoW.

(This is exactly the argument that Jae Kwon of Tendermint retreated to, after admitting that PoS was indeed just as wasteful as PoW.)

In my 2015 article, I emphasize that PoS is allowed to have different (probably worse) security assumptions than PoW:


I highly doubt that PoS is more secure. Perhaps it is, but I still wonder what would happen in my original scenario:

  1. Attacker …purchases “used” private keys
  2. …executes a large long-range NaS attack (making a trillion fake histories, that all look very very similar to each other) [cost: ~free],
  3. …threatens to imprison/kill anyone who tries to point out which history is real [cost: mafia connections, law enforcement, or a couple million $$]).

I think it is hard for Vitalik to both [a] constantly tell us which PoS chain we should be on, and [b] constantly evade capture by the mob / world governments / private investigators.

And, last I heard, there were all kinds of scalability / uptime problems with PoS, which again I am going to just ignore. (And these are just the known/theoretical problems – remember how much we have learned about PoW’s little quirks [block withholding, selfish mining, relay/broadcast strategy, ASICBoost, etc] in just a few years of using it in practice).

For now lets just say that PoS does indeed get more bang for its buck – this is irrelevant to my argument about waste. Even if PoS is more secure than PoW, it is still just as wasteful as PoW. The “buck” of PoS is the same as the “buck” of PoW, whatever their respective “bangs”.

What Vitalik is trying to say (I assume) is that, since the security is lower, we can then, safely, decrease the critical X.

However, this notion, that one can control the critical X is a fallacy that I (in 2015) purposefully delayed handling


…until the end of the piece.

Since Vitalik already ignored it once, I’m not sure what good it will do to repeat it, but here goes!

The Coinbase-Rot Paradox (Reprise)

Trying to reduce waste only re-increases the waste, and vice-versa.

How PoS Might Cash In on the Additional PoS Security

Ethereum might want to take advantage of the supposed PoS security advantage, by decreasing its Critical X, and thereby being less “wasteful” than Bitcoin. But how might it do this? It must decrease the value of its blockreward!

Blockreward = C "coins released" * M "market price per coin".

Ethereum can’t magically alter the market price (and if they could, they would hardly want to send it downward (!), as would be required in this case), so their only option is to try to decrease factor C, the quantity of Ethers released per block.

The Problem with That Strategy

First of all, I wonder if the PoS supporters know that Vitalik is essentially saying “we need to work on PoS so that we can achieve our goal of making sure that, relative today, a higher percentage of Ethers are mined in the future!”. Somehow I doubt it.

But there’s actually an even bigger problem. As I stated in my piece nearly two years ago, moving C down will tend to move M up, because:

  1. Logically, the blockchain must start with 0 coins issued, and end with 100% of coins issued. Thus the blockchain-designer (ie Vitalik) can only control the speed of issuance – he may choose a big candle with a slow fuse, or else he may choose a short candle with a quick fuse.
  2. Slowing the issuance speed, will cause today’s quantity of CryptoCoin issued per block to decrease. Hastening the issuance will necessarily require that more CryptoCoin be issued per block today.
  3. The units of money are fractional (as Vitalik ought to know), which is why inflation is a tax, and why switching from dollars to cents (or to millicents) would not directly affect anyone’s net worth.
  4. Thus, someone who buys into a slow candle will “own more money longer”. Someone who buys into a fast candle will own more money shorter. As a result, the market value of fast candle coins will be less than that of slow candle coins.

Item #2 is the “coinbase” part, and #4 the “rot” part of what I called the “Coinbase-Rot Paradox”.

And the paradox is likely to be quite strong.

Allow Me to Elaborate

Consider that society, in a given year, demands X amount of briefcases, and Y amount of refrigerators, and Z amount of money. If Ether were the only money in existence (ie, if no one used USD, gold, etc as money anymore), then public demand for it would total some amount (let’s call it “Sigma”, and let us measure it in purchasing power [as in $PPP]). So, the public wants Sigma$ worth of Ether to exist in the year 2017. In a world with fast Eth, the Eth price is Sigma$ / q_fast , but in a world with slow Eth, the Eth price is Sigma$ / q_slow .

q_slow is, paradoxically, growing at a faster rate, than q_fast!

q_fast :    4, 4, 2, 2, 1, 1, .5, .5 ;  [8 years, 15 total]
q_medium : 1.875, 1.875, ... , 1.875 ;  [8 years, 15 total]
q_slow :   .5, .5, 1, 1, 2, 2, 4, 4  ;  [8 years, 15 total]

Money supply growth rate in period 3:

g(q_fast, 3):    25%  (ie, 2/8)
g(q_medium, 3):  50%  (ie, 1.875/(1.875*2))
g(q_slow, 3):   100%

The math probably comes out to be a complete wash (in other words, that the Critical X cannot be altered at all), but perhaps not – I haven’t checked. I’m really not interested in this question, so perhaps you, the reader can put some thought into it. Perhaps there is an optimally slow issuance schedule.

Whatever the case may be, Vitalik/Kwon’s argument that “PoS is more secure” ends up translating only to a claim that “Bitcoin is too vulnerable to 51% attacks”. Even if every single one of their claims is correct (not likely), then the entire PoS project only amounts to a blockchain which is harder to 51% attack, but otherwise equally wasteful of resources. (Given that Bitcoin has been 51% attacked zero times, this would seem to be a dubious investment of resources.)

Let me repeat: the security level has nothing to do with my claim that PoW and PoS are equally wasteful. If Vitalik derives some rule for an optimally slow issuance schedule, then someone could just plug that schedule into a PoW chain, and that PoW chain would have the same (lower) economic waste (at an allegedly lower security level). Which is my point. Switching from PoW to PoS doesn’t matter. Both PoW and PoS will waste exactly the same amount: their Critical X.

So lowering the Critical X means that the protocol exhibits lower waste under PoS and a lower waste under PoW.

Because they’re THE SAME THING!!


Vitalik continues, so I suppose I will as well:


In the above paragraph, Vitalik draws a marginal/total distinction…but it is (seemingly) on the wrong variable.

I am saying that, to generate a block, users will pour forth effort ($PPP) totaling that of the block’s sale value (in $PPP). If MC is below MR, more people will take advantage of this opportunity to earn free money. If MC is above MR, some people will cease this activity (as it is deleting their money). In equilibrium the MC=MR, as taught to all ECON 101 students.

Vitalik is saying that, in pouring forth the effort, users will care relatively less and less about each dollar locked up. Locking up the first 1% of their net worth (ie just 1%) will not “hurt” as much as locking up the last 1% (ie, all 100% of it).

In other words, I am saying that “the auctioneer is selling $100 worth of gold, and people will keep bidding on it until the price reaches $100”. And Vitalik is saying “well, you are so rich that you can easily spare some of these $20 bills you have lying around”.

There is no contradiction whatsoever between the points. Vitalik is simply looking at a different variable.

In fact, when he says:


If this were true, what it would actually mean is that a higher quantity of Ether would be locked up. So it would be more wasteful!

For example, imagine that annual Ethereum tx fees + block subsidy, for the whole year, total only $10,000,000. But also imagine that many Eth-users do not care to use their parked Ether at all in the next year. All of the indifferent Ether would be staked – call it 2 billion USD, at today’s prices. A 2 billion dollar investment can guarantee one at least 24 million dollars or so, but the PoS project is only bringing in 10 million. An additional 14 million has been wasted.

( Users could buy a forward contract to repurchase their ETH next year (at today’s prices), sell it all today, buy Treasury Bonds, earn 24 million, and execute the forward contract to repurchase their ETH. They would be exactly where they were today, but they would have 14 additional million USD. )


As stated above, I object to the possibility of “keeping issuance low” (which is the Coinbase-Rot paradox). And I disagree that there will be economic surplus. I think Vitalik is overestimating the size of these “gains” – they would be tiny breadcrumbs spread over a vast population of stakers. And staking would be annoying, and so per capital (or per staked $) there would likely be very low surplus.

As I pointed out in the original article, claiming that “it is very easy to stake” is analogous to claiming that “it is very easy to hash”. But greater efficiency of mining equipment merely results in correspondingly greater hashing. To see this, imagine two worlds in which the block reward is worth $100: inefficient and efficient. In the inefficient world, hashes cost $1/hash, but in the efficient world they cost $0.00001/hash. In both worlds, miners will spend $100 total – in the first, on 100 hashes; in the second, on 1,000,000 hashes.


We have three major differences, as I see them:

  1. Vitalik believes that “prestaked” funds do not count as “locked up”, even though funds cannot be used for two purposes at once.
  2. Vitalik does not endorse the Coinbase-Rot paradox, for unknown reasons.
  3. Vitalik continues to believe that staking is not a big deal because it is easy and convenient to do. I agree, but Vitalik does not reply to my argument that –if staking is indeed very easy and convenient– it will result in tremendously high rates of staking, resulting in great waste (and tiny rewards per staker).

We agree that PoS and PoW can have different security levels and different security models. Vitalik thinks he can trade off some of this security, in return for reducing waste, but he has not explained how he plans to do this to my satisfaction (ie, the C-R paradox). It is also unclear to me if this is even desirable (perhaps security is generally more important than ‘waste’).

I suppose that Vitalik’s strongest pro-PoS argument, would be to take the first objection and try to argue that ‘there is no investment which is comparable to pre-staking’, therefore, society does not have to forgo anything as it watches users compete with each other over where/how to temporarily lock their checking accounts. Vitalik could try to argue that he had created something new and valuable (the ultra-short duration investment) at exactly the same time that he had “wasted” it. This is similar to Bram Cohen’s PoSPaT which would make unused hard drive space valuable and then immediately consume (“waste”) this value.

However, this is difficult, as short-duration investments (eg, 4 week treasury bond, savings account for 1 month, commercial paper) already exist. And even if they did not exist today, ultra-short duration investments could be invented. Similarly, Bram’s examples would “re-become” wasteful if something like Sia or (old-style) Wuala ever got off the ground.


I go through the PoS FAQ (where my arguments are mentioned) and reply, line by line.

I still do not believe that PoS represents a significant improvement over PoW. A world of PoS is still one of greater scarcity of capital, and a world of PoW is still one of greater scarcity of silicon/electricity. The dollar value (or gold value) of each of the two types of waste will tend to be exactly equal.

PoS is theoretically very similar to PoW. But in practice, we have more experience with PoW. A practical person would re-use what already works. However, PoS very suspiciously requires a team of highly skilled researchers to constantly be looking in on it. I continue to believe that this PoS research is itself a ‘waste’ of money and time, as it can’t really accomplish anything (and, in practice, doesn’t).

comments powered by Disqus