Proof of work vs proof of stake: how blockchains agree

Proof of work and proof of stake are two ways a blockchain decides who adds the next block when nobody is in charge. In proof of work, computers race to solve a puzzle, and the winner's cost is electricity. In proof of stake, the network picks someone from among those who have locked up coins as collateral, and the cost of cheating is losing those coins. Bitcoin uses the first; Ethereum has used the second since 2022.

In short

• Both answer the same question: on a network of strangers, whose version of the next block counts?
• Proof of work makes cheating expensive with hardware and electricity; proof of stake makes it expensive with money at risk that the network can destroy.
• Proof of stake uses a tiny fraction of the energy; proof of work has the longer track record and a simpler security argument.

What problem do both solve?

A blockchain is a ledger that thousands of computers keep copies of. Every few seconds or minutes, someone has to bundle new transactions into a block and add it. If anyone could add blocks freely, an attacker could add contradictory ones, paying someone and then writing a version of history where the payment never happened. If one company chose who adds blocks, the network would need to trust that company.

The answer is to make the right to add a block cost something that can't be faked by creating extra identities. An attacker can spin up a million fake accounts for free. They can't fake a million computers' worth of electricity, or a million coins' worth of collateral. Both systems tie influence over the ledger to a scarce resource, so that controlling the ledger means owning most of that resource.

How does proof of work work?

In Bitcoin, miners take a candidate block and repeatedly run it, with a changing number called a nonce, through a hash function, looking for an output below a target. There is no shortcut: each guess is a coin flip with very long odds, and the only way to win more often is to guess faster. The Bitcoin white paper of 2008 built this on Adam Back's Hashcash, an earlier scheme that used the same kind of puzzle to make spam email costly.

Checking a winning answer takes one hash, so every node can verify the work instantly. The network adjusts the difficulty every 2,016 blocks so that a block arrives about every ten minutes. If two versions of the chain compete, nodes follow the one with the most accumulated work. The note on how Bitcoin mining works follows one block through that process.

How does proof of stake work?

In Ethereum, the role of miners is played by validators. To become one, a person deposits 32 ether into a contract, where it is locked. Time is divided into slots of 12 seconds, and in each slot one validator is chosen pseudo-randomly to propose a block, while a committee of others attests that it is valid, according to ethereum.org's documentation. Every 32 slots, called an epoch, the chain sets checkpoints; once two-thirds of the staked ether has voted for them, those blocks are final.

The stick is slashing. A validator caught signing two conflicting blocks, or contradictory votes, has part of its deposit destroyed and is forced out. A lone mistake costs a small fraction, but the penalty grows with how many validators misbehave at once, so a coordinated attack can lose everything. Reverting a finalized block would require an attacker to sacrifice at least a third of all staked ether.

Who gets to add the next block: a worked example

The two systems hand out turns differently, and some arithmetic makes it concrete.

• Bitcoin: a block every ten minutes is 144 blocks a day. A miner with 1% of the network's computing power expects to win about 1.44 of them a day, though on any given day it might win none or four, because every block is a fresh lottery weighted by work.
• Ethereum: a slot every 12 seconds is 7,200 slots a day. Suppose there are 1,000,000 validators with equal stakes. Each one then expects to propose 7,200 ÷ 1,000,000 = 0.0072 blocks a day, or about one every 139 days. An operator running 1% of all validators, 10,000 of them, expects 72 proposals a day.

In both, influence is proportional to the resource put in: computing power in one, staked coins in the other. What differs is what that resource costs to hold and what happens to it if you cheat.

Proof of work vs proof of stake, side by side

	Proof of work	Proof of stake
Main example	Bitcoin	Ethereum since 15 September 2022
Who adds blocks	Miners who win a hashing race	Validators chosen at random, weighted by stake
What it costs to take part	Specialized machines and electricity	Coins locked as a deposit, plus an ordinary computer
What an attacker needs	More than half of all computing power	A large share of all staked coins
Penalty for cheating	Wasted electricity; the machines keep their value	Part or all of the deposit destroyed
When a payment is settled	Probabilistic; each new block makes reversal less likely	Final once two-thirds of stake vote for a checkpoint
Energy use	Very large, by design	Very small
Track record	Running since 2009	Ethereum's version since 2020, carrying the main chain since 2022

How big is the energy difference?

Very large. In figures the Ethereum Foundation compiled from public estimates, Ethereum used about 21 terawatt-hours (TWh) of electricity a year under proof of work and about 0.0026 TWh after it switched, a cut of more than 99.9% (ethereum.org). The same page put Bitcoin at about 149 TWh a year, using figures accessed in July 2023. The Cambridge Bitcoin Electricity Consumption Index keeps a running estimate, which moves with the price of bitcoin and the efficiency of mining machines.

Supporters of proof of work answer that the energy is the security: it is a real-world cost that an attacker must also pay, and miners often seek cheap power that would otherwise go unused. Critics answer that the same security can be had through collateral, without burning the electricity.

Still argued

Which system is more secure is a live argument, not a settled fact. Proof-of-work advocates say its security is simple and physical, that anyone can join by buying hardware, and that proof of stake lets the richest holders earn the most new coins and gives large staking services outsized influence. Proof-of-stake advocates say an attacker can be punished by having their stake destroyed, whereas a proof-of-work attacker keeps their machines and can try again, and that mining has concentrated in a few large pools anyway. Neither side's model has been tested by a full-scale attack on a major chain.

Check yourself

• Without looking back, explain what scarce resource each system ties influence to, and why fake identities don't help an attacker.
• Why can a proof-of-stake network punish an attacker in a way a proof-of-work network can't?
• What does it mean for a block to be "final", and how does that differ between Bitcoin and Ethereum?

Sources

• Bitcoin: A Peer-to-Peer Electronic Cash System — Satoshi Nakamoto, 2008
• Proof-of-stake (PoS) — Ethereum Foundation, ethereum.org
• The Merge — Ethereum Foundation, ethereum.org
• Ethereum energy consumption — Ethereum Foundation, ethereum.org
• Cambridge Bitcoin Electricity Consumption Index — Cambridge Centre for Alternative Finance