Casper the Friendly Finality Gadget

TL;DR

Casper addresses the security and efficiency gap between PoW chains and PoS finality by overlaying a stake-based finality mechanism on top of an existing PoW blockchain. It introduces accountability via slashing of deposits for violating finality rules, a dynamic validator set managed by dynasties, and a fork-choice rule that finalizes a chain anchored on justified checkpoints. The paper proves accountable safety and plausible liveness under reasonable assumptions, and discusses defenses against long-range revisions and catastrophic crashes, including inactivity leaks. The Casper design offers a modular upgrade path for PoW chains seeking stronger finality guarantees, while acknowledging remaining challenges and outlining future work toward a full PoS protocol with dynamic weights.

Abstract

We introduce Casper, a proof of stake-based finality system which overlays an existing proof of work blockchain. Casper is a partial consensus mechanism combining proof of stake algorithm research and Byzantine fault tolerant consensus theory. We introduce our system, prove some desirable features, and show defenses against long range revisions and catastrophic crashes. The Casper overlay provides almost any proof of work chain with additional protections against block reversions.

Figures (6)

• Figure 1: Illustrating a checkpoint tree, the height function, and a justified chain within the checkpoint tree.
• Figure 2: The two Casper Commandments. Any validator who violates either of these commandments gets its deposit slashed.
• Figure 3: Figure for Theorem \ref{['theorem:safety']} (Accountable Safety).
• Figure 4: Attack from dynamic validator sets. Without the validator set stitching mechanism, it's possible for two conflicting checkpoints $c$ and $c^\prime$ to both be finalized without any validator getting slashed. In this case $c$ and $c^\prime$ are the same height thus violating commandment I, but because the validator sets finalizing $c$ and $c^\prime$ are disjoint, no one gets slashed.
• Figure 5: The long range attack. As long as a client gains complete knowledge of the justified chain at a regular interval, it will not be susceptible to a long range attack.

Theorems & Definitions (4)

• Theorem 1: Accountable Safety
• proof
• Theorem 2: Plausible Liveness
• proof