<p>First of all, proof of stake is not a single algorithm. There are many different implementations. For example, the algorithm that is used in Cardano is completely different from the one that is used in Peercoin, which is quite close but still different from e.g. Blackcoin algorithm, which has been derived from Peercoin. Qtum, for example uses Blackcoin algorithm. And again, all this is very different from what Ethereum plans to do.</p>

<p>So, your question cannot be answered in general. We can only talk about concrete implementations of proof of stake. The largest family of PoS coins is based on Peercoin, but many different modifications have been implemented.</p>

<p>So let's talk specifically about family derived from Peercoin. This includes coins like Qtum, Emercoin, Navcoin, Stratis, NovaCoin, Blackcoin, PIVX, Neblio, ABBC Coin, Particl, ...</p>

<p>As mentioned already, there are many different flavors of the algorithm among these coins. But in general, they work as follows.</p>

<p>They implement a special kind of transaction called coinstake (CS) transaction. This transaction is used to prove that the block was created correctly accordingly to the used PoS protocol. Just as with proof of work, in prove of stake there is the adjustable difficulty and the target that each block needs to satisfy. Just as in Bitcoin, the target is 256 bit number. The coinstake transaction's first input is called kernel. And usually the rule is something like this:</p>

<pre><code>SHA256(SM || PT || KH || KN || T) &lt;= WT
</code></pre>

<p>where </p>

<ul>
<li><p>SM is StakeModifier - There are several flavours on how this is actually calculated. One example is that <code>SM_n = SHA256(SM_(n-1) || KH)</code>, where <code>n</code> is block number (height);</p></li>
<li><p>PT is time of the block where the coin (UTXO) used as kernel in CS was created,</p></li>
<li><p>KH is prevout hash of the kernel,</p></li>
<li><p>KN is orevout N of the kernel,</p></li>
<li><p>T is block time,</p></li>
<li><p>WT is weighted target, calculated as <code>WT = Target * (value of kernel UTXO)</code>.</p></li>
</ul>

<p>So if you are PoS block producer, you have wallet with all your coins and what you do is that you periodically check whether one of your coins cannot satisfy the rule above. If you have such a coin, you are allowed to create a block. You can observe that is the time passes, <code>T</code> changes, so you get new and new hashes on the left side with every new coin, so eventually it happens that some coin on the network will pass the rule for the given target.</p>

<p>The longest chain concept is very similar to Bitcoin again. <code>chain work</code> is again sum of block difficulties, and the longest chain is the one with the most chain work. However, due to stake grinding attack, there are limits to the application of the longest chain rule. In some coins, so-called maximal reorganisation length is introduced, in others it is called dynamic checkpoints et cetera. This prevents a node to switch to a better chain if it would need to replace too many blocks from its currently best chain.</p>

<p>There are many other technical details and subtleties, but this is the basic concept. Note that in this family of PoS algorithms, you cannot lose the stake. I'm actually not aware of any finished implementation of PoS in which you could lose your stake. The idea here usually is that rather than taking the stake away from dishonest nodes, the protocol is attempted to be designed in a way that cheating is not possible. However, this attempt is very hard to meet perfectly because of certain properties such as <code>nothing at stake</code>.</p>

CC BY-SA 4.0
2019-05-26T10:35:28.277Z
2019-05-26T10:35:28.277Z
Wapac
<p>I know that in Proof of Work (PoW) once a node has found the solution (the nonce) they announce it to the network. Then the rest of the nodes can easily verify the correctness of the block hash and append it to the chain.</p>

<p>But in case the solution is not correctly verified, the block is finally not appended to the longest chain and therefore the dishonest block is discarded.</p>

<p>I know that in case of PoS, the dishonest node would lose the stake, but,</p>

<p><strong>How does this procedure works in the case of Proof of Stake (PoS)?</strong></p>

<p>I mean how is the validity of a block checked and how the bad node lose the stake?</p>

<proof-of-work><transaction-verification><proof-of-stake><validation><block-validity>
How does Proof of Stake prevents dishonest behaviour compared to PoW?
Gerard Bosch
# How does Proof of Stake prevents dishonest behaviour compared to PoW?

(Asked by: username_0 on 2018-02-14)

I know that in Proof of Work (PoW) once a node has found the solution (the nonce) they announce it to the network. Then the rest of the nodes can easily verify the correctness of the block hash and append it to the chain.

But in case the solution is not correctly verified, the block is finally not appended to the longest chain and therefore the dishonest block is discarded.

I know that in case of PoS, the dishonest node would lose the stake, but,

**How does this procedure works in the case of Proof of Stake (PoS)?**

I mean how is the validity of a block checked and how the bad node lose the stake?

**Tags:** proof-of-work, transaction-verification, proof-of-stake, validation, block-validity


---

## 1 answers

### Answer by username_1 on 2019-05-26. Score: 2 | Accepted answer

First of all, proof of stake is not a single algorithm. There are many different implementations. For example, the algorithm that is used in Cardano is completely different from the one that is used in Peercoin, which is quite close but still different from e.g. Blackcoin algorithm, which has been derived from Peercoin. Qtum, for example uses Blackcoin algorithm. And again, all this is very different from what Ethereum plans to do.

So, your question cannot be answered in general. We can only talk about concrete implementations of proof of stake. The largest family of PoS coins is based on Peercoin, but many different modifications have been implemented.

So let's talk specifically about family derived from Peercoin. This includes coins like Qtum, Emercoin, Navcoin, Stratis, NovaCoin, Blackcoin, PIVX, Neblio, ABBC Coin, Particl, ...

As mentioned already, there are many different flavors of the algorithm among these coins. But in general, they work as follows.

They implement a special kind of transaction called coinstake (CS) transaction. This transaction is used to prove that the block was created correctly accordingly to the used PoS protocol. Just as with proof of work, in prove of stake there is the adjustable difficulty and the target that each block needs to satisfy. Just as in Bitcoin, the target is 256 bit number. The coinstake transaction's first input is called kernel. And usually the rule is something like this:

```
SHA256(SM || PT || KH || KN || T) <= WT

```

where

* SM is StakeModifier - There are several flavours on how this is actually calculated. One example is that `SM_n = SHA256(SM_(n-1) || KH)`, where `n` is block number (height);
* PT is time of the block where the coin (UTXO) used as kernel in CS was created,
* KH is prevout hash of the kernel,
* KN is orevout N of the kernel,
* T is block time,
* WT is weighted target, calculated as `WT = Target * (value of kernel UTXO)`.

So if you are PoS block producer, you have wallet with all your coins and what you do is that you periodically check whether one of your coins cannot satisfy the rule above. If you have such a coin, you are allowed to create a block. You can observe that is the time passes, `T` changes, so you get new and new hashes on the left side with every new coin, so eventually it happens that some coin on the network will pass the rule for the given target.

The longest chain concept is very similar to Bitcoin again. `chain work` is again sum of block difficulties, and the longest chain is the one with the most chain work. However, due to stake grinding attack, there are limits to the application of the longest chain rule. In some coins, so-called maximal reorganisation length is introduced, in others it is called dynamic checkpoints et cetera. This prevents a node to switch to a better chain if it would need to replace too many blocks from its currently best chain.

There are many other technical details and subtleties, but this is the basic concept. Note that in this family of PoS algorithms, you cannot lose the stake. I'm actually not aware of any finished implementation of PoS in which you could lose your stake. The idea here usually is that rather than taking the stake away from dishonest nodes, the protocol is attempted to be designed in a way that cheating is not possible. However, this attempt is very hard to meet perfectly because of certain properties such as `nothing at stake`.


---

