LibraryConsensus2018Design paperCorpus record
Stake-Bleeding Attacks on Proof-of-Stake Blockchains
Stake bleeding. Peter Gaži, Aggelos Kiayias and Alexander Russell.
The paper shows a long-range style attack in which past stake keeps producing an alternative history unless the protocol makes that history obviously stale.
A reading of the public paper. Not a copy, not a benchmark, and not a claim about any later network.
If a design has no answer to stake that has already withdrawn, it has not answered this paper.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 3
- Records linked
- 2
Code
Source, repository, and what is actually hosted
- ePrint 2018/248https://eprint.iacr.org/2018/248
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
The defect
A proof-of-stake history can be extended by an adversary who once held stake and keeps using it after the honest chain has moved on.
Claim 02 · Paper model
The proposal
The paper shows a long-range style attack in which past stake keeps producing an alternative history unless the protocol makes that history obviously stale.
Claim 03 · Paper model
Old keys are not burned by the passage of blocks alone.
A checkpoint or a key-evolving rule is a defence, not a slogan.
Claim 04 · Paper model
The bound
The paper is an attack, not a product.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 The defect
Observation
What the study says
A proof-of-stake history can be extended by an adversary who once held stake and keeps using it after the honest chain has moved on.
Falsifier
What would retire it
Can withdrawn stake still sign old slots?
02 The proposal
Observation
What the study says
The paper shows a long-range style attack in which past stake keeps producing an alternative history unless the protocol makes that history obviously stale.
Model
What has to hold
The paper is an attack, not a product.
Falsifier
What would retire it
Can withdrawn stake still sign old slots?
03 Old keys are not burned by the passage of blocks alone.
Observation
What the study says
A checkpoint or a key-evolving rule is a defence, not a slogan.
Model
What has to hold
A checkpoint taken from a website is a trust assumption. Name it.
Falsifier
What would retire it
Is the defence in the protocol or in a social checkpoint?
04 The bound
Observation
What the study says
The paper is an attack, not a product.
Model
What has to hold
The paper is an attack, not a product.
Falsifier
What would retire it
Can withdrawn stake still sign old slots?
03 Sequence
One action, as an operating tape
- 01Take stake that was valid in an old slot.
- 02Grow a private history that honest nodes who were offline cannot immediately reject.
- 03Compare that history with whatever rule the protocol uses to discount the past.
- 04What does a node that has been offline for a year accept?
04 Load-bearing
The argument, and where a pitch drops it
What the paper is for
The cut
If a design has no answer to stake that has already withdrawn, it has not answered this paper.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
The paper is an attack, not a product.
What happened after
The cut
Weak subjectivity and key-evolving signatures are later answers. They are not this attack paper.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
The paper is an attack, not a product.
05 Register
What has to be true
Model · Not re-measured
The paper is an attack, not a product.
Stake and threshold · Not re-measured
It does not say every proof-of-stake system is currently broken.
Model · Not re-measured
A checkpoint taken from a website is a trust assumption. Name it.
06 Divergence
What happened after the paper
Weak subjectivity and key-evolving signatures are later answers. They are not this attack paper.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 3 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
A proof-of-stake history can be extended by an adversary who once held stake and keeps using it after the honest chain has moved on.
What the design proposes
- Old keys are not burned by the passage of blocks alone.
- A checkpoint or a key-evolving rule is a defence, not a slogan.
- The attack is about history, not about a short reorg.
How the mechanism is specified
- Take stake that was valid in an old slot.
- Grow a private history that honest nodes who were offline cannot immediately reject.
- Compare that history with whatever rule the protocol uses to discount the past.
What this page does not treat as proven
- The paper is an attack, not a product.
- It does not say every proof-of-stake system is currently broken.
- A checkpoint taken from a website is a trust assumption. Name it.
Why the desk still reads it
If a design has no answer to stake that has already withdrawn, it has not answered this paper.
09 Lexicon
Terms, opened into the record
- Stake bleeding
- Old stake continuing to extend a history the honest chain has left.
- Long-range
- An alternative history built behind the current tip.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
Concepts
Papers
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.