Long-range attacks on Proof of Stake

Goal

PoS removes mining energy cost — and with it, the natural cost of rewriting history. This note reviews long-range attacks on Proof-of-Stake protocols and the mitigations surveyed in A Survey on Long-Range Attacks for Proof of Stake Protocols (Deirmentzoglou, Papakyriakopoulos, Patsakis; IEEE).

Mirror copy: https://mirror.xyz/zer0luck.eth/s8oFS1oNkrNg7vdGdpStHN4jLSk0OEsYT5y5Duddtgc

Costless simulation and weak subjectivity

Validators in PoS do not burn hashpower to propose. Building an alternate branch from genesis can be cheap — costless simulation / nothing-at-stake. Optimal short-run behavior for a validator who does not know which fork will win is to attest on many forks. That undercuts finality.

Weak subjectivity hits two node classes: brand-new joins, and nodes that were offline long enough to lose a live view of the canonical tip. Online, synced nodes watch the chain continuously and are harder to trick into a sudden alternate history. Fresh or stale nodes see many plausible branches from genesis and lack a cheap objective rule that picks the honest one.

Neighboring consensus attacks (context)

Long-range attacks sit among a wider catalogue: double-spend as end goal; Sybil identity flooding (costly in PoW, cheaper where stake or identity is weak); race / bribery / liveness denial / censorship; 51% and selfish mining in PoW; grinding and coin-age tricks in older PoS; eclipse at the network layer. Most of these eventually aim at conflicting spends or stalled honest progress. Long-range is the PoS-native way to rebuild history from deep in the past.

Long-range attack family

A long-range attacker forks from near genesis and grows a branch with a different (partial or full) history. Success means that branch outruns or outranks the main chain for some victims. Three textbook shapes:

• Simple
• Posterior corruption
• Stake bleeding

Related to PoW selfish mining (secret blocks), but PoW cannot cheaply rewind to genesis — hashpower forbids it. PoS often can.

Running example: three equal-stake validators (Bob, Alice, Mallory ≈ 33.3% each).

Simple (timestamp forgery)

If nodes do not check timestamps, Mallory forks from genesis and pre-builds blocks on a private branch.

Genesis still lists the same validator set, so Mallory cannot outpace the main chain honestly. She forges timestamps and emits blocks early so her branch catches up.

Without timestamp checks, both branches look valid.

Posterior corruption

Now assume timestamps are checked. Mallory alone is too slow. She needs other validators' keys for early slots.

Validators rotate and retire. After Bob cashes out stake, protecting the old signing key is no longer his problem — but that key can still sign the first n blocks on any branch. Bribe or steal the key and Mallory signs as Bob on the malicious fork (posterior corruption).

The alternate branch stops looking sparse; it can race the main chain.

Stake bleeding

Mallory forks privately again, but also slows the main chain: when elected on the honest chain she skips her slot (hurting liveness, sometimes enough to look like denial). On her private branch she alone collects fees and rewards, compounding stake. She may copy main-chain transactions onto her branch to farm fees with less obvious divergence.

Her private stake share rises; election frequency rises; eventually the branch can overtake. Slow in wall-clock time if done naively (survey example: ~30% stake needing years of history) — but costless simulation can compress that history.

Mitigations (none is complete alone)

S1 — Longest chain rule. Default fork choice; always paired with something else in PoS. PoW can lean on work; PoS length alone does not settle weak subjectivity.

S2 — Moving checkpoints. Only the last N blocks may reorg (Peercoin-scale windows are an example). Long-range rewinds that touch finalized prefixes fail; the attack collapses toward short-range.

S3 — Key-evolving cryptography (KES). Private keys advance by epoch; old keys cannot re-sign old slots. Posterior corruption loses its stolen-key leverage (eprint 2017/573).

S4 — Context-aware transactions. Transactions embed a prior-block hash (or time hash). Copying them onto an unrelated fork breaks validity, so fee-farming by cloning main-chain txs gets harder.

S5 — Plenitude rule (Ouroboros Genesis). Compare block density across conflicting branches after the fork point. An attacker who starts minority-sparse cannot fake the early density of the honest majority branch even if later stake bleeding densifies the tip.

S6 — Economic finality / slashing. Equivocation or dual-signing burns stake. Does not erase long-range mathematically; it raises the price of misbehavior while keys are still bonded.

S7 — TEE-backed signing. Keep keys inside an enclave (e.g. SGX) so theft outside the TEE fails. Adoption needs remote attestation that peers actually use TEEs — a deployment tax, not a free patch.

Takeaway

Long-range attacks are a design-class problem in PoS, not a single bug. Costless simulation plus weak subjectivity create the opening; simple, posterior-corruption, and stake-bleeding variants fill it. Checkpoints, KES, context-aware txs, plenitude, slashing, and TEEs each cut a slice. The survey's conclusion still holds: no one countermeasure covers the whole family, and protocols compose different subsets. Hardware TEEs look promising on paper and remain uneven in production.

Reference

• Deirmentzoglou et al., A Survey on Long-Range Attacks for Proof of Stake Protocols — https://ieeexplore.ieee.org/document/8653269/
• Related crypto / Genesis material — https://eprint.iacr.org/2017/573.pdf