<p>This problem is generally known as "nothing at stake" or "costless simulation", where there is indeed nothing preventing anybody from making arbitrarily long chains where they are the only participants in the network. If you were an early majority holder of the altcoin, emulating a massive network with thousands of users and then presenting that to peers valid would be trivial and effectively costless. Compromised private keys or "empty" private keys purchased from early participants in the network would also be a viable choice for bootstrapping an attack like this. </p>

<p>The proposed solution in NXT is that nodes will refuse to reorganize very deeply (more than a day or two), making a weak assumption that the first chain you have seen is probably going to be the one the rest of the network is on. Ethereum has proposed for their move to Proof of Stake that they will use a "phone a friend" cryptosystem, essentially requiring users to confirm that they are on the same root proof of stake block chain using real world out of band communication (like a phone call or Royal Mail). </p>

<p>Neither has particularly strong assurances of validity, and is simply one of the realities of a Proof of Stake system that has the cost and reward internalized. In Proof of Work there is a significant real world cost to attempting competing chains, and given the choice of two there are clear rules for nodes to distinguish them. </p>

CC BY-SA 3.0
2015-07-06T09:26:06.900Z
What about reorganizing not very deeply, say 10-15 blocks away? That would require the dishonest user to have many coins on different addresses right?
Luca Matteis
CC BY-SA 3.0
2015-07-06T09:33:15.903Z
That sort of rule only works if you assume no new nodes ever join the network, that network connectivity is perfect and can't be split into pieces by failed interconnects or malicious influence, and that all nodes are online continuously. Absent these someone can split the network, make each half follow a small fork, and then the network will be permanently divided.
Claris
CC BY-SA 3.0
2015-07-06T08:45:42.397Z
2015-07-06T08:51:49.910Z
2015-07-06T08:51:49.910Z
Claris
<p>I'm studying how Proof-of-Stake systems work. This answer on "<a href="https://bitcoin.stackexchange.com/a/20037/8717">How does proof-of-stake “mining” work?</a>" explains specifically the Nextcoin implementation of PoS. The idea is that the next "miner" is chosen randomly from a pool of online users. However, my main concern with this system is: how do you stop someone from simply building a longer chain (from scratch) of made up transactions towards thousand of addresses that were randomly created by the malicious user? If it were higher than the current "valid" chain, wouldn't the fake one replace the valid one?</p>

CC BY-SA 3.0
2015-07-06T08:50:13.660Z
I meant that you wrote proof of work, and I think you meant proof of stake.
Nick ODell
<proof-of-stake>
What is stopping someone from creating their own "chain" in Proof-of-Stake systems?
Luca Matteis
# What is stopping someone from creating their own "chain" in Proof-of-Stake systems?

(Asked by: username_0 on 2015-07-06)

I'm studying how Proof-of-Stake systems work. This answer on "[How does proof-of-stake “mining” work?](https://bitcoin.stackexchange.com/a/20037/8717)" explains specifically the Nextcoin implementation of PoS. The idea is that the next "miner" is chosen randomly from a pool of online users. However, my main concern with this system is: how do you stop someone from simply building a longer chain (from scratch) of made up transactions towards thousand of addresses that were randomly created by the malicious user? If it were higher than the current "valid" chain, wouldn't the fake one replace the valid one?

**Tags:** proof-of-stake

> **Comments:**
> **username_1**: I meant that you wrote proof of work, and I think you meant proof of stake.  

---

## 1 answers

### Answer by username_2 on 2015-07-06. Score: 6 | Accepted answer

This problem is generally known as "nothing at stake" or "costless simulation", where there is indeed nothing preventing anybody from making arbitrarily long chains where they are the only participants in the network. If you were an early majority holder of the altcoin, emulating a massive network with thousands of users and then presenting that to peers valid would be trivial and effectively costless. Compromised private keys or "empty" private keys purchased from early participants in the network would also be a viable choice for bootstrapping an attack like this.

The proposed solution in NXT is that nodes will refuse to reorganize very deeply (more than a day or two), making a weak assumption that the first chain you have seen is probably going to be the one the rest of the network is on. Ethereum has proposed for their move to Proof of Stake that they will use a "phone a friend" cryptosystem, essentially requiring users to confirm that they are on the same root proof of stake block chain using real world out of band communication (like a phone call or Royal Mail).

Neither has particularly strong assurances of validity, and is simply one of the realities of a Proof of Stake system that has the cost and reward internalized. In Proof of Work there is a significant real world cost to attempting competing chains, and given the choice of two there are clear rules for nodes to distinguish them.

> **Comments:**
> **username_0**: What about reorganizing not very deeply, say 10-15 blocks away? That would require the dishonest user to have many coins on different addresses right?  
> **username_2**: That sort of rule only works if you assume no new nodes ever join the network, that network connectivity is perfect and can't be split into pieces by failed interconnects or malicious influence, and that all nodes are online continuously. Absent these someone can split the network, make each half follow a small fork, and then the network will be permanently divided.  

---

