LibraryConsensus2017Design paperCorpus record
Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol
Cardano. Aggelos Kiayias, Alexander Russell, Bernardo David, Roman Oliynykov.
The academic protocol Cardano's settlement layer is built around. It gives a proof-of-stake chain a stated security argument in a synchronous model, with stake electing slot leaders.
Ouroboros elects slot leaders from a stake distribution, and it argues that forging a chain still costs an adversary more stake than the honest majority, without burning energy on empty hashes.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 6
Code
Source, repository, and what is actually hosted
- IACR ePrint 2016/889https://eprint.iacr.org/2016/889.pdf
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
- Validator operations — not a yield
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
Proof of work buys a lottery with electricity
Bitcoin's leader is whoever finds a hash. Ouroboros wants the same kind of public lottery, but the tickets are stake, and the draw is a matter of record rather than of burned power.
Claim 02 · Paper model
Time is divided into slots and epochs
An epoch has a stake snapshot. Inside it, each slot has a leader who may extend the chain. Empty slots are allowed. The chain is the longest valid history under the stated rule.
Claim 03 · Paper model
The draw has to be unbiased
If the leader election can be grinded, a large stakeholder can keep re-rolling until they like the future. The paper's cryptographic work is there: a randomness beacon that the adversary cannot cheaply bias.
Claim 04 · Paper model
Stake is a moving target
Leaders are elected from a past snapshot, not from the stake that will exist after this block. That lag is what makes the distribution a fact instead of a value the current leader can rewrite.
Claim 05 · Paper model
The proof is about a model
Security is argued against a synchronous adversary who holds less than half the stake. Real networks drop messages, and later Ouroboros variants change the assumptions. Name the variant.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 Proof of work buys a lottery with electricity
Observation
What the study says
Bitcoin's leader is whoever finds a hash. Ouroboros wants the same kind of public lottery, but the tickets are stake, and the draw is a matter of record rather than of burned power.
Model
What has to hold
Honest stake is a majority in the model the proof uses, and stake cannot be rented invisibly outside that model.
Falsifier
What would retire it
Which Ouroboros variant is implemented, and which network assumption does its proof use?
02 Time is divided into slots and epochs
Observation
What the study says
An epoch has a stake snapshot. Inside it, each slot has a leader who may extend the chain. Empty slots are allowed. The chain is the longest valid history under the stated rule.
Model
What has to hold
Honest stake is a majority in the model the proof uses, and stake cannot be rented invisibly outside that model.
Falsifier
What would retire it
How far behind the tip is the stake snapshot?
03 The draw has to be unbiased
Observation
What the study says
If the leader election can be grinded, a large stakeholder can keep re-rolling until they like the future. The paper's cryptographic work is there: a randomness beacon that the adversary cannot cheaply bias.
Model
What has to hold
The randomness mechanism matches the paper. A simpler hash of the previous block is not a substitute.
Falsifier
What would retire it
What happens to a leader who signs two forks?
04 Stake is a moving target
Observation
What the study says
Leaders are elected from a past snapshot, not from the stake that will exist after this block. That lag is what makes the distribution a fact instead of a value the current leader can rewrite.
Model
What has to hold
Honest stake is a majority in the model the proof uses, and stake cannot be rented invisibly outside that model.
Falsifier
What would retire it
How far behind the tip is the stake snapshot?
05 The proof is about a model
Observation
What the study says
Security is argued against a synchronous adversary who holds less than half the stake. Real networks drop messages, and later Ouroboros variants change the assumptions. Name the variant.
Model
What has to hold
Honest stake is a majority in the model the proof uses, and stake cannot be rented invisibly outside that model.
Falsifier
What would retire it
Which Ouroboros variant is implemented, and which network assumption does its proof use?
03 Sequence
One action, as an operating tape
- 01At the start of an epoch, the protocol fixes the stake distribution from a settled point in the past.
- 02A shared random seed for the epoch is derived from the previous epoch's output, under the paper's verifiable random function or coin-tossing construction.
- 03For each slot, every stakeholder can locally compute whether they are the leader. Others can check that claim.
- 04The leader publishes a block. Honest nodes adopt the chain that the fork rule selects.
- 05Rewards and the next snapshot update only after the epoch's rules say the history is stable.
04 Load-bearing
The argument, and where a pitch drops it
Why the snapshot lags
The cut
If the leader of this slot could move stake and immediately elect themselves again, the lottery would be circular. The paper freezes the electorate. Any implementation that elects from unconfirmed stake has left the proof.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Publishing a proof about Ouroboros is not a statement about Cardano's market, clients or governance.
Randomness is the whole game
The cut
A proof-of-stake chain that lets a proposer grind the seed will be captured by the grinder, even if they hold a minority. Ouroboros is useful because it treats biasable randomness as a break, not as a tuning issue.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Publishing a proof about Ouroboros is not a statement about Cardano's market, clients or governance.
Nothing-at-stake is a fork rule problem
The cut
If signing two forks is free, rational leaders sign both. The paper's security argument needs a rule that makes a second history unprofitable or punishable. A pitch that says 'we use Ouroboros' and then omits the fork choice is borrowing the name.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Publishing a proof about Ouroboros is not a statement about Cardano's market, clients or governance.
05 Register
What has to be true
Stake and threshold · Not re-measured
Honest stake is a majority in the model the proof uses, and stake cannot be rented invisibly outside that model.
Network · Not re-measured
Messages arrive within the slot bounds the protocol assumes. A quiet partition is a different theorem.
Cryptography · Not re-measured
The randomness mechanism matches the paper. A simpler hash of the previous block is not a substitute.
Network · Not re-measured
Keys of elected leaders are online when their slot arrives, or a delegation scheme has been specified.
06 Divergence
What happened after the paper
Cardano shipped Praos, Genesis and other descendants. Delegation, stake pools and the network's reward formula are later specifications. The 2017 paper is the first place the lottery-plus-snapshot argument is made carefully. It is not a description of today's node.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
Early proof-of-stake proposals were often engineering sketches. Ouroboros asks for a protocol that says who may extend the chain, how randomness is produced, and which assumptions the security proof actually uses.
What the design proposes
- Time is divided into epochs and slots. A stakeholder is elected leader of a slot in proportion to stake.
- Leaders propose blocks. Honest majority of stake, not of hash power, is the assumption.
- Randomness for the next epoch is derived from the protocol rather than from an outside beacon that nobody accounts for.
How the mechanism is specified
- The paper works in a synchronous setting and says so. Network delay assumptions are part of the result.
- Stake distribution is taken from a settled earlier state so the current election cannot be rewritten cheaply.
- Follow-on papers (Praos, Genesis, and others) change the model. They are not this paper.
What this page does not treat as proven
- Publishing a proof about Ouroboros is not a statement about Cardano's market, clients or governance.
- The proof does not cover every later feature added around the settlement layer.
- Synchronous assumptions fail in messy networks. The paper's value is that it names them.
Why the desk still reads it
When a venture says 'we use proof of stake', ask which protocol, which honesty assumption, and which paper. Ouroboros is the example of a design that can be pointed at.
09 Lexicon
Terms, opened into the record
- Slot
- A unit of time that has at most one elected leader.
- Epoch
- A run of slots that share one stake snapshot and one random seed.
- Stake snapshot
- The distribution used to elect leaders, taken from a settled point so the current leader cannot rewrite the electorate.
- Grinding
- Re-rolling a leader-election seed until the future looks favourable. A proof-of-stake design has to make this expensive or impossible.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.