<p>All these possible attacks have been studied in Neucoin (Peercoin fork) white paper available here:</p>

<p><a href="http://www.neucoin.org/en/whitepaper/download" rel="nofollow noreferrer">http://www.neucoin.org/en/whitepaper/download</a></p>

<p>Here is their conclusion on the stake grinding attack (3.3.3):</p>

<blockquote>
  <p>To conclude this discussion on grinding in proof-of-stake, here is a
  statistic for the critics who say it is “costless” mini to grind
  through the blockspace: if an attacker owned 10% of NeuCoin’s staked
  currency and had access to all of the hash power of the Bitcoin
  network, his odds of success in a grinding attack would be one out of
  ∼10⁸⁷. By the way, there are only ∼10⁸⁰ atoms in the observable
  universe.</p>
</blockquote>

<p>These two attacks have also been described on Peercoin forum:</p>

<p>Time-drift: <a href="https://www.peercointalk.org/index.php?topic=2976.msg27924#msg27924" rel="nofollow noreferrer">https://www.peercointalk.org/index.php?topic=2976.msg27924#msg27924</a></p>

<p>Stake-grinding: <a href="https://www.peercointalk.org/index.php?topic=2976.msg27789#msg27789" rel="nofollow noreferrer">https://www.peercointalk.org/index.php?topic=2976.msg27789#msg27789</a></p>

CC BY-SA 3.0
2015-07-11T16:17:59.563Z
That's interesting, but how does it do that?
Nick ODell
CC BY-SA 3.0
2015-07-12T17:24:04.437Z
Hi Nick, the grinding attack against PoS is explained in detail in Neucoin white paper (link above) starting on page 32.  Feel free to ask if there is something you don't understand.  I won't be of much help on the mathematical part of it though ;)
mably
CC BY-SA 3.0
2015-07-26T16:39:47.947Z
This explains the attacks comprehensively and explains possible ways to prevent them, so I'm accepting this answer.
samthebest
CC BY-SA 3.0
2015-07-10T19:26:07.007Z
2017-06-10T23:48:55.793Z
2017-06-10T23:48:55.793Z
mably
<p>The general problems you are describing are inherent flaws in PoS, but you've caught onto some of the basic principles that are going to impact the security and integrity of the cryptosystem. </p>

<blockquote>
  <p>Anyway, even if we can't roll back in time, could we edit the program to try as many hashes as possible every second. For example, suppose we try 100 times to hash instead of once, for a given second, we then broadcast the block.</p>
</blockquote>

<p>This is known as stake grinding. </p>

<p>The selection of the next signer in the block chain is almost always (this varies by implementation) directly or indirectly deterministic based on the previous block information. As there is nothing inherently preventing a person from resigning previous blocks as much as they like, they can continue until the head of the chain also assigns them to be the next signer of a block as well. Under this attack either one person gains a vastly inflated amount of power over the chain, or if everybody is attempting to stake grind it breaks down to a particularly inefficient proof of work system with badly described properties. </p>

<p>Proof of Stake altcoins generally attempt to solve this by making the signer selection RNG seed come from earlier in the chain, say a thousand blocks prior to the head, with the idea that it is impossible for someone to influence the outcome from that far back in time. </p>

<blockquote>
  <p>I guess there exists a "start time" on the block chain we can't roll the clock before because transactions with timestamps already exist on the chain. But could we roll back say just a few minutes? Could this gain us anything?</p>
</blockquote>

<p>This is known as costless simulation. </p>

<p>The system again falls to the simple fact that there is nothing inherently hard about resigning blocks. Given some coins at the start of the block chain (owned, stolen, "empty" wallets purchased), in a proof of stake system an attacker can simply rebuild the entire chain to the present day with themselves as the only participant. Given the option of two chains (in this case, the attacking and main chain), a client has no way of knowing which if either they should be trusting as real. </p>

<p>Proof of Stake altcoins often attempt to solve this by having centralized "checkpoints" which prevent the chain from deviating, though one could argue against this system being decentralized at all. Others simply have nodes in the network refuse to reorganize to other chains after a certain amount of time, which doesn't protect new users joining the network and being presented with false chains. Ethereum PoS will attempt a "phone a friend" system, where users are prompted to contact other network participants out of band and manually confirm that they are on the same main block chain. </p>

<p>Section 6.4 of <a href="https://download.wpsoftware.net/bitcoin/alts.pdf" rel="nofollow">A Treatise on Altcoins</a> covers these topics in a little more depth. </p>

CC BY-SA 3.0
2015-07-09T23:34:19.033Z
2015-07-09T23:34:19.033Z
Claris
<p>I understand that every second the timestamp &amp; potential transactions is hashed.  </p>

<p>I guess there exists a "start time" on the block chain we can't roll the clock before because transactions with timestamps already exist on the chain.  But could we roll back say just a few minutes? Could this gain us anything?</p>

<p>Anyway, even if we can't roll back in time, could we edit the program to try as many hashes as possible every second.  For example, suppose we try 100 times to hash instead of once, for a given second, we then broadcast the block.  Would other nodes on the network accept the block, even though it will be a little late?  Do other nodes on the network use some API to get the actual time? Surely the system must allow a fudge factor to account for the latencies?</p>

<p>Even if they do reject, what about this: time is 5 seconds past six, we then repeatedly try to hash the 10 second timestamp - we get 5 whole seconds to do this.  If we succeed and no one else has, we can broadcast the block.</p>

<p>Basically, in the PoW system it's provably impossible to gain an advantage without buying more hardware - a node can tamper with code and clocks as much as they want, they won't get an advantage.  It's not clear to me how PoS systems are protected, since they must rely on code integrity &amp; clocks?</p>

<p>Similarly could minting be tricked? If it uses a random number generator, where does this random number come from? Can it be forged?</p>

<p>I'm a technical guy, so happy for fully technical explanations - no holding back! :)</p>

<proof-of-work><peercoin><proof-of-stake>
How does Peercoin (or other PoS) prevent timestamp forging effecting hash attempts or random minting?
samthebest
# How does Peercoin (or other PoS) prevent timestamp forging effecting hash attempts or random minting?

(Asked by: username_0 on 2015-07-09)

I understand that every second the timestamp & potential transactions is hashed.

I guess there exists a "start time" on the block chain we can't roll the clock before because transactions with timestamps already exist on the chain. But could we roll back say just a few minutes? Could this gain us anything?

Anyway, even if we can't roll back in time, could we edit the program to try as many hashes as possible every second. For example, suppose we try 100 times to hash instead of once, for a given second, we then broadcast the block. Would other nodes on the network accept the block, even though it will be a little late? Do other nodes on the network use some API to get the actual time? Surely the system must allow a fudge factor to account for the latencies?

Even if they do reject, what about this: time is 5 seconds past six, we then repeatedly try to hash the 10 second timestamp - we get 5 whole seconds to do this. If we succeed and no one else has, we can broadcast the block.

Basically, in the PoW system it's provably impossible to gain an advantage without buying more hardware - a node can tamper with code and clocks as much as they want, they won't get an advantage. It's not clear to me how PoS systems are protected, since they must rely on code integrity & clocks?

Similarly could minting be tricked? If it uses a random number generator, where does this random number come from? Can it be forged?

I'm a technical guy, so happy for fully technical explanations - no holding back! :)

**Tags:** proof-of-work, peercoin, proof-of-stake


---

## 2 answers

### Answer by username_1 on 2015-07-10. Score: 0 | Accepted answer

All these possible attacks have been studied in Neucoin (Peercoin fork) white paper available here:

<http://www.neucoin.org/en/whitepaper/download>

Here is their conclusion on the stake grinding attack (3.3.3):

> To conclude this discussion on grinding in proof-of-stake, here is a
> statistic for the critics who say it is “costless” mini to grind
> through the blockspace: if an attacker owned 10% of NeuCoin’s staked
> currency and had access to all of the hash power of the Bitcoin
> network, his odds of success in a grinding attack would be one out of
> ∼10⁸⁷. By the way, there are only ∼10⁸⁰ atoms in the observable
> universe.

These two attacks have also been described on Peercoin forum:

Time-drift: <https://www.peercointalk.org/index.php?topic=2976.msg27924#msg27924>

Stake-grinding: <https://www.peercointalk.org/index.php?topic=2976.msg27789#msg27789>

> **Comments:**
> **username_2**: That's interesting, but how does it do that?  
> **username_1**: Hi username_2, the grinding attack against PoS is explained in detail in Neucoin white paper (link above) starting on page 32.  Feel free to ask if there is something you don't understand.  I won't be of much help on the mathematical part of it though ;)  
> **username_0**: This explains the attacks comprehensively and explains possible ways to prevent them, so I'm accepting this answer.  

---

### Answer by username_3 on 2015-07-09. Score: 4

The general problems you are describing are inherent flaws in PoS, but you've caught onto some of the basic principles that are going to impact the security and integrity of the cryptosystem.

> Anyway, even if we can't roll back in time, could we edit the program to try as many hashes as possible every second. For example, suppose we try 100 times to hash instead of once, for a given second, we then broadcast the block.

This is known as stake grinding.

The selection of the next signer in the block chain is almost always (this varies by implementation) directly or indirectly deterministic based on the previous block information. As there is nothing inherently preventing a person from resigning previous blocks as much as they like, they can continue until the head of the chain also assigns them to be the next signer of a block as well. Under this attack either one person gains a vastly inflated amount of power over the chain, or if everybody is attempting to stake grind it breaks down to a particularly inefficient proof of work system with badly described properties.

Proof of Stake altcoins generally attempt to solve this by making the signer selection RNG seed come from earlier in the chain, say a thousand blocks prior to the head, with the idea that it is impossible for someone to influence the outcome from that far back in time.

> I guess there exists a "start time" on the block chain we can't roll the clock before because transactions with timestamps already exist on the chain. But could we roll back say just a few minutes? Could this gain us anything?

This is known as costless simulation.

The system again falls to the simple fact that there is nothing inherently hard about resigning blocks. Given some coins at the start of the block chain (owned, stolen, "empty" wallets purchased), in a proof of stake system an attacker can simply rebuild the entire chain to the present day with themselves as the only participant. Given the option of two chains (in this case, the attacking and main chain), a client has no way of knowing which if either they should be trusting as real.

Proof of Stake altcoins often attempt to solve this by having centralized "checkpoints" which prevent the chain from deviating, though one could argue against this system being decentralized at all. Others simply have nodes in the network refuse to reorganize to other chains after a certain amount of time, which doesn't protect new users joining the network and being presented with false chains. Ethereum PoS will attempt a "phone a friend" system, where users are prompted to contact other network participants out of band and manually confirm that they are on the same main block chain.

Section 6.4 of [A Treatise on Altcoins](https://download.wpsoftware.net/bitcoin/alts.pdf) covers these topics in a little more depth.


---

