An increasingly large share of people in and around the cryptocurrency community are pinning their hopes on proof-of-stake (PoS) as a way to enjoy the benefits of cryptocurrency while avoiding the energy costs of proof-of-work (PoW). That’s unfortunate because as Paul Sztorc put it back in 2015, nothing is cheaper than proof of work. Proof-of-stake only obfuscates costs, it doesn’t eliminate them. Here we explore why proof-of-work is like democracy: it is the worst possible solution, except for all the others. This essay will sidestep the question of whether securing a cryptocurrency is "worth" the costs and focus only on whether proof-of-stake is an efficient approach
The best cryptocurrency buys security cheaply
To properly compare PoW and PoS we will need to account for both costs (carbon footprint) and benefits (blockchain security). So we can either ask "For a given level of security, does proof-of-stake have a lower environmental cost?" or we can ask “For a given cost, does proof-of-stake have a higher level of security?” The two questions are logically equivalent. For the purposes of this essay we’ll use the second framing:
We need a certain amount of security to run a currency and the technology that buys that security the most efficiently will have the smallest environmental footprint. That’s a useful way to think about it because it lets us leverage a profound economic law: marginal revenue equals marginal cost. Spending $X on blockchain security means that miners will spend a total of $X competing for those rewards.
Axiom #2: If a cryptocurrency buys $X worth of security its validators will collectively accrue $X worth of expenses.
This is an ironclad economic law of competition. Any miners that spend less than they earn will be outcompeted by miners willing to spend more to win, and any miners that spend more than they earn will eventually go bankrupt. Spending $X on blockchain security will always result in miners spending $X to secure it. How those expenses are distributed will vary but they will always add up to $X. The difference will be like the difference between a pound of feathers and a pound of lead.
Electricity is only part of the story
When people talk about Bitcoin wasting energy they generally mean the electricity used to power mining rigs, which is ironic because that is both an incomplete picture of Bitcoin’s total energy usage and it is very precisely the subset which is most directly used to secure the blockchain and is therefore the least wasted. To fully account for Bitcoin’s carbon footprint we need to also account for hardware costs (both creation and disposal) and ordinary business operations like maintaining an office for employees and flying to and from Bitcoin conferences. The latter categories are fuzzier and harder to estimate than the first one, but they are just as important to understanding the implications of the system.
There is a certain amount of wastage at each of these layers. Some blocks are inevitably orphaned and the energy spent mining those blocks is wasted. Some hardware is built but then not operated at full efficiency. And some business expenses are necessary while others are just waste. The more tightly coupled an expense is to the actual act of validating the blockchain the more efficiently it will buy security. That’s similar to how physical machines are more efficient when they have fewer degrees of freedom - each additional joint leaks a certain amount of energy. Economic systems have the same property - more moving parts means less efficiency.
For example a business trip to maintain relationships with other major industry players may in some abstract way contribute back to business efficiency and therefore mining security - but it is pretty removed and probably does not contribute nearly as much to security as spending that same budget directly on electricity for mining rigs would have. A cryptocurrency buys the most security when it spends its security budget directly on electricity and it buys the least security with the money spent on business operations. Mining CEOs may be necessary for mining businesses to succeed but they don’t do anything to secure the network themselves.
Axiom #4: The more tightly coupled an expense is with the actual act of validating, the more efficiently it will buy security.
So you will sometimes see people talk about ASICs1 as though they are bad for the environmental footprint of a cryptocurrency, but actually the opposite is true. By specializing in cryptocurrency mining they generate more hashpower per unit of hardware, which means less of the budget is spent on hardware and more is spent on electricity. That’s a good thing for efficiency - ASIC mining is fundamentally greener than mining on traditional CPUs because running an ASIC translates energy into security more cheaply than building a CPU does.
This misconception is also why "proof-of-space" coins like Chia (which perform blockchain validation using memory instead of computational power) are actually bad for the environment. Using hard drives as the sacrificial resource doesn’t actually reduce the costs, it just shifts security budget out of electricity and into hardware. If you measure the energy footprint of a cryptocurrency only by looking at its electricity consumption that looks like a huge win - but if you take into account hardware costs as well it is actually a huge loss in efficiency.
Chia is subsidized for a while by the wasted hard drive space not currently being used, but that runway is finite. Once any cryptocurrency successfully monetizes computer memory the same thing will happen to hard drives that has already happened to GPUs. More importantly the resulting system will be less secure than an equally sized one based on proof-of-work because security budget spent building hard drives is less efficient than security budget spent directly on energy.
Chia Coin Spurs HDD Shortage: Prices Up, High Capacities Sell Out
Conclusion #1: The most environmentally friendly cryptocurrency is the one whose security expenses are the most tightly coupled to the act of validation.
Locked capital is a real expense with real costs
Chia and other proof-of-space approaches are relatively straightforward to compare to proof-of-work approaches because it is easy to imagine landfills full of old hard drives, so it is easy to think of the environmental impact as "real." But the environmental impact of lost capital is real as well. It is money could have been spent on carbon capture projects or energy efficiency R&D or any number of other things. The fact that it feels free is because humans are bad at reasoning about time-value. If it were actually free miners wouldn’t need to be paid to do it.
You sometimes see people argue that proof-of-stake is individually costly but not socially costly, as Dan Robinson does here:
It is actually precisely the opposite. Locking capital up is not personally costly because you are being paid by the staking algorithm to do it - the capital is not lost, it is working for you earning a yield at the expense of every other ETH holder. Locking capital up is not the same as giving it away to a stranger because there is no stranger that now has it. Validators don’t "give their capital equally to everyone" because they are paid equally by everyone (in newly minted ETH) for their work - and thanks to Axiom #2 we know they will be paid exactly the cost of capital.
On the other hand locked capital is socially costly because that capital is no longer available to build factories or pay for research or do any other socially useful thing. Consider the Great Financial Crisis of 2008 - no factories or houses were destroyed, no physical assets were lost. All of the damage was in lost capital - but it was still a very real and very harmful social cost. Capital is a special kind of accumulated information about where resources are best allocated. Losing information isn’t the same as losing a physical object but it can be just as costly or even worse.
So keeping in mind Axioms #1 and #2 a fair comparison between PoS and PoW should look something like this:
Proof of stake doesn’t (and can’t) eliminate miner expenses, it simply transmutes them from electricity expenses into capital expenses. There is a complex and nuanced discussion to be had about what the externalities of staked capital are in comparison to direct energy consumption - but unfortunately what advocates for proof-of-stake systems do more often is just pretend electricity is the only cost that really exists:
This deceptive comparison comes from the official Ethereum blog.
This is disappointing. The Ethereum foundation knows perfectly well that energy per transaction is a nonsense metric, using it in this way is deliberately dishonest. The real argument is not about whether proof-of-stake uses less electricity - it does, but that isn’t a complete picture. The real argument is about whether it is better to consume capital or electricity. Any argument that advocates for proof-of-stake without acknowledging the cost of capital is fundamentally flawed.
Efficiency of staking vs mining
One benefit that proof-of-stake systems have in the PoW/PoS debate is that a fully decentralized proof-of-stake system doesn’t exist yet, which means supporters are free to assume the eventual solution will be arbitrarily efficient and elegant. Known mining algorithms are not perfectly efficient (e.g. selfish mining) and there is no reason to believe that proof-of-stake systems will be perfectly efficient either - but until the solution is fully specified proof-of-stake systems don’t have to account for any specific strategy validators might use to game the system.
The more opportunity there is to game the system, the less tightly coupled security budget will be to actual validation. Since "real proof-of-stake has never been tried" we don’t even know how well security budget would translate into staked capital in the first place, let alone how efficiently staked capital would buy security. Proof-of-work is tightly coupled to validation by definition, but proof-of-stake at time of writing is still not completely defined.
Externalities of staking vs mining
If you assume for the sake of argument that capital staking and hash-mining are equally efficient from a security efficiency perspective, the last remaining argument boils down to externalities, and is in my opinion a place where reasonable people can disagree about the trade-offs.
Proof-of-work competes with other projects for energy in the short term, but in the long term it subsidizes the development and production of cheap energy which lowers the cost of electricity (both financial and environmental) for everyone over time. Cheap electricity will enable new technology and more production.
Proof-of-stake competes with other projects for capital in the short term, but it cannot subsidize the creation of more capital so it will also raise the cost of capital for everyone over time. More expensive capital means fewer projects - less factories but also less research.
Whether you prefer PoW externalities to PoS externalities probably boils down to whether you think we are better off meeting the environmental crisis by investing in future technology or reducing present consumption.2 Do we save the world by making renewable things cheap or by making everything expensive?
Observation #2: Proof of work encourages investment in the future. Proof of stake discourages it.
Proof-of-stake might not even work
As we alluded to earlier a fully decentralized proof-of-stake system is not yet known. The existing cryptocurrencies that describe themselves as PoS generally rely on some kind of centralized coordinator or checkpoint as a crutch. Ethereum has been working on transitioning to a fully-decentralized PoS system since launch in 2015 - and they just released a Phase 0 which allows staking … but doesn’t yet support any way to spend or withdraw your money once locked.
There are very real theoretical arguments about whether PoS systems can ever be secure (see long range attacks, nothing-at-stake, work is timeless/stake is not). These are open research questions, not items on an implementation todo list. We don’t know how long it will take to find good solutions and there may not be any good solutions to find. Consider this thread from 2017:
Proof-of-stake might also "work" but in a pathological way. Proof-of-work favors those with access to cheap electricity and rewards them with capital. Not perfectly egalitarian but not a feedback loop. Proof-of-stake favors those with access to cheap capital and it rewards them with more capital, creating a feedback loop. The rich get richer and the richer they get the easier it is to get rich.
If proof-of-stake "works" but results in all the power being concentrated in a small number of ultra-wealthy institutions with effectively permanent control over the system, it will have failed to solve the problems cryptocurrency was meant to solve. We may as well stick with our current system of central banks and Cantillion insiders. We want cryptocurrencies to disrupt the banks not redenominate them.
Conclusions:
- Axiom #1: The most environmentally responsible cryptocurrency is the one that buys security the most efficiently.
- Axiom #2: If a cryptocurrency buys $X worth of security its validators will collectively accrue $X worth of expenses.
- Axiom #3: To account for the carbon footprint of a system you must account for all categories of validator expense.
- Axiom #4: The more tightly coupled an expense is with the actual act of validating, the more efficiently it will buy security.
- Conclusion #1: The most environmentally friendly cryptocurrency is the one whose security expenses are the most tightly coupled to the act of validation.
- Observation #1: Proof-of-work is tightly coupled with security. It is not yet known how tightly coupled proof-of-stake will be.
- Observation #2: Proof of work encourages investment in the future. Proof of stake discourages it.
- Observation #3: Proof of work exists and has demonstrated that it works at scale. Proof of stake is still an unsolved problem.
Unfortunately on careful examination most of the apparent gains of proof-of-stake are not as robust as they appear at first glance and the open challenges remaining are quite significant. It is a utopian dream but not yet a realistic strategy. In spite of its shortcomings proof-of-work remains the best (and indeed the only) known solution to building a network of trust without a central authority.