Overview — Consensus: Proof of Stake & The Merge

Everything up to here has been about the machine: an account-based world state, transactions that mutate it, a gas-metered EVM that runs contract code, and a state root that fingerprints the result. But that machine only ever computes one thing at a time: given a state and the next transaction, produce the next state. It says nothing about which transaction is next, or whose version of history the thousands of independent nodes running that machine should all accept as real.

That missing piece is consensus, and it is the hardest problem in the book. This Part answers the throughline head-on for Ethereum: how do untrusting strangers agree on the state of a shared world computer — and what does it cost to run one? The short version is that, since 15 September 2022, Ethereum answers it with staked capital instead of burned energy. This overview frames the question, names the two jobs consensus must do, and lays out the road through the rest of the Part.

The problem restated: ordering, not computing

Recall the state-transition function from the accounts Part — conceptually, apply(state, tx) → state'. It is deterministic: feed every honest node the same starting state and the same ordered list of transactions and they all land on the exact same state root, byte for byte. That determinism is a gift. It means the entire disagreement between nodes collapses to one question:

   deterministic (solved):   given an ORDER of txs, everyone computes the same state
   the hard part (this Part): agreeing on WHAT that order is, among strangers who
                              may lie, vanish, or actively try to rewrite history

Consensus does not compute the state. It agrees on the ordered sequence of blocks whose transactions get fed to the machine. Get the order agreed, and the world state — every balance, nonce, storage slot, and contract — follows for free. This is why we could spend five Parts on execution before spending one on consensus: execution is downstream of ordering, and cleanly separable from it. (The Merge is the living proof of that separability, as we’ll see.)

Why swap mining for staking at all

Earlier Parts established the Sybil problem: on an open network anyone can spin up a million identities for free, so you cannot decide “the majority rules” by counting nodes — the majority is trivially fake. Every permissionless chain needs a way to make influence over the next block expensive, anchored to some scarce resource no software trick can counterfeit.

Proof of Work — which you should already know from earlier material and from Bitcoin — rations influence with energy: to earn the right to propose a block you burn electricity racing to find a hash below a target, and the chain with the most cumulative work wins. The cost is external and spent: the burn leaves the system as heat, and that irreversible burn is the security.

Proof of Stake (PoS) rations the same influence with capital. Instead of burning energy, you lock up coins as a bond. The cost is internal and at risk: nothing is continuously burned, but the protocol can destroy part of your bond if you cheat.

   PROOF OF WORK (old Ethereum, Bitcoin)     PROOF OF STAKE (Ethereum since 2022)
   ─────────────────────────────────────     ────────────────────────────────────
   scarce resource : energy + hardware        scarce resource : staked capital (ETH)
   to influence    : spend electricity        to influence    : lock 32 ETH as a bond
   cost is         : external, SPENT           cost is         : internal, AT RISK
   security is     : the burn itself           security is     : the bond you'd lose
   attack means    : out-hash the network      attack means    : acquire & risk a huge
                                                                 stake — then get slashed

The headline consequence is energy: The Merge cut Ethereum’s energy use by roughly 99.95% (a 2022 estimate — treat it as an order-of-magnitude truth, not a lab constant). The deeper consequence is that the thing an attacker stands to lose now lives inside the ledger, as capital the protocol itself can slash — which is what makes fast, explicit finality possible.

The two jobs: fork choice vs finality

Here is the single most important frame for this whole Part. Ethereum’s consensus does two distinct jobs, and they are handled by two different algorithms bolted together. Confusing them is the number-one source of confusion about PoS, so pin them down now:

   JOB 1 — FORK CHOICE          "Which chain head should I build on RIGHT NOW?"
     algorithm: LMD-GHOST        answered every slot, ~every 12 seconds
     property : always gives a   answer can still change as new blocks/votes
                single head        arrive; recent tip is provisional

   JOB 2 — FINALITY             "Which checkpoints can NEVER be reverted?"
     algorithm: Casper FFG       answered every ~2 epochs, ~every 12.8 minutes
     property : once finalized,  reverting costs an attacker ≥1/3 of ALL staked
                it's permanent     ETH — an economic, capital-backed guarantee

Fork choice is the moment-to-moment question. Blocks arrive, occasionally two appear near the same time, and every validator needs a rule to pick one head to extend — instantly, with only the information it has. Ethereum uses LMD-GHOST (Latest Message Driven — Greediest Heaviest Observed SubTree): follow the subtree with the most accumulated validator votes. Its answer is always well-defined but provisional — a very recent block might still get orphaned as more votes come in.

Finality is the slower, sharper question. It answers: at what point is a past checkpoint so heavily voted-on that undoing it would require an attacker to lose an economically ruinous fraction of all staked ETH? Ethereum uses Casper FFG (Friendly Finality Gadget), which runs on top of the fork choice and periodically stamps checkpoints as justified and then finalized. A finalized checkpoint is permanent in a way Bitcoin’s probabilistic “wait for more confirmations” finality never quite reaches.

The combined system — LMD-GHOST for fork choice plus Casper FFG for finality — has a name you’ll see everywhere:

   LMD-GHOST   +   Casper FFG   =   GASPER
   (fork choice)   (finality)       (Ethereum's PoS consensus)

Everything in this Part is, in one way or another, an elaboration of Gasper: who the voters are (validators), how their votes are scheduled (slots, epochs, committees), what a vote is (attestations), how those votes feed each job (LMD-GHOST and Casper FFG), and what happens to voters who cheat or vanish (slashing and the inactivity leak).

What The Merge established: two layers, one chain

The Merge did not bolt PoS onto the old design. It cleaved Ethereum into two layers that talk over a narrow interface:

   ┌─────────────────────────────────────────────┐
   │  CONSENSUS LAYER  (the "Beacon Chain")       │
   │  validators · slots/epochs · attestations ·  │  ← decides the ORDER of blocks
   │  LMD-GHOST fork choice · Casper FFG finality  │
   └───────────────────────┬─────────────────────┘
                           │  Engine API (a thin RPC)
   ┌───────────────────────┴─────────────────────┐
   │  EXECUTION LAYER  (the EVM you already built) │
   │  accounts · world state · transactions ·      │  ← COMPUTES the state from that order
   │  gas · the EVM · the state root               │
   └─────────────────────────────────────────────┘

The execution layer is everything from the previous Parts — it takes an ordered list of transactions and computes the new world state. The consensus layer (the Beacon Chain) decides what that order is. They communicate over the Engine API: consensus hands execution a payload of ordered transactions and says “compute this”; execution replies “valid, here’s the resulting state root” or “invalid.”

This separation is why The Merge was even possible. The Beacon Chain ran PoS in parallel for ~21 months (it launched 1 December 2020) before The Merge simply swapped which layer decided block ordering — from PoW mining to the already-running consensus layer. The execution machine you internalised earlier did not change at all. Consensus decides the order; everything downstream of the order is the deterministic machine you already know.

Roadmap for this Part

Read these in order. Each one takes a single piece of Gasper and builds it from first principles.

#	Page	What it builds	One-line purpose
2	Validators & Staking 32 ETH	The voters	Who gets a say, why the bond is exactly 32 ETH, and how staking replaces mining rigs
3	Slots, Epochs & Committees	The clock	How time is sliced into 12-second slots and 32-slot epochs, and how validators are pseudo-randomly assigned to propose and attest
4	Attestations & LMD-GHOST Fork Choice	Job 1	What a validator’s vote is, and how counting votes by weight picks the current chain head
5	Checkpoints, Casper FFG & Finality	Job 2	How checkpoints get justified then finalized, and why reverting a finalized block costs ≥1/3 of all stake
6	The Merge — Swapping the Engine Live	The event	How the consensus and execution layers were joined on 15 Sept 2022 without halting the chain
7	Slashing & the Inactivity Leak	The stick	How provable cheating gets a validator’s bond destroyed, and how a stalled chain recovers finality
8	Withdrawals, Rewards & the Validator Economy	The economy	How validators are paid, how stake exits the system, and what running the world computer actually costs
900	Revision — Consensus: Proof of Stake & The Merge	Recap	Every idea in the Part, drilled with questions

If you take one map away from this page, take this one: pages 2–3 introduce the voters and their schedule, pages 4–5 are the two jobs (fork choice, then finality), page 6 is the event that wired it to the execution layer, and pages 7–8 are the incentives — the penalties that keep voters honest and the rewards that keep them showing up.

The thread

How do untrusting strangers agree on the state of a shared world computer — and what does it cost to run one? Ethereum’s post-2022 answer is: they don’t need to trust each other’s identities or intentions — they need that anyone trying to corrupt the agreed order stands to lose something large and unfakeable. Proof of Work made that “something” energy already spent; Proof of Stake makes it capital the protocol can destroy. Strangers converge on one order because deviating from the honest majority’s votes either wastes an attestation opportunity or, if you contradict yourself, gets your bond slashed. The cost of running the world computer moves from a power bill paid to the outside world to a bond posted inside the ledger — and, as a bonus, that internal bond buys explicit finality that a purely external burn cannot. Whether an internal bond is a sturdier anchor than an external burn is a genuinely unsettled debate; Bitcoin bet on the burn, and Ethereum, as of 2022, bet on the bond.

Check your understanding

Consensus is described as solving “ordering, not computing.” Given that the state-transition function is deterministic, why does agreeing on the order of transactions fully determine the world state?
Both Proof of Work and Proof of Stake make influence over the next block expensive. Name the scarce resource each uses, and say whether its cost is “spent” or “at risk.”
Ethereum’s consensus does two distinct jobs. Name each job, the algorithm that handles it, and the roughly-how-often each one produces an answer.
What does “Gasper” refer to, and which two components combine to form it?
The Merge established a split into a consensus layer and an execution layer. What does each layer do, and why did that separation make it possible to swap PoW for PoS without changing the execution machine from earlier Parts?

Show answers

Because apply(state, tx) → state' is deterministic: feed every honest node the same starting state and the same ordered list of transactions and they all compute the exact same state root, byte for byte. So the only thing nodes can disagree about is the order of blocks/transactions; once the order is agreed, the resulting world state (every balance, nonce, storage slot, contract) follows automatically. Consensus therefore only has to agree on the ordered sequence of blocks, not on the computation.
Proof of Work uses energy + hardware, and that cost is spent — electricity is irreversibly burned as heat, and the burn itself is the security. Proof of Stake uses staked capital (ETH), and that cost is at risk — coins are locked as a bond the protocol can slash if you cheat; nothing is continuously burned.
Job 1 — fork choice: “which chain head do I build on right now?”, handled by LMD-GHOST, answered every slot (~every 12 seconds); its answer is provisional. Job 2 — finality: “which checkpoints can never be reverted?”, handled by Casper FFG, answered every ~2 epochs (~every 12.8 minutes); its answer is permanent, backed by ≥1/3-of-all-stake economics.
Gasper is the name for Ethereum’s Proof of Stake consensus as a whole. It combines LMD-GHOST (the fork-choice rule) with Casper FFG (the finality gadget): fork choice + finality = Gasper.
The consensus layer (Beacon Chain) decides the order of blocks — validators, slots/epochs, attestations, LMD-GHOST fork choice, Casper FFG finality. The execution layer computes the world state from that order — accounts, transactions, gas, the EVM, the state root. Because execution is purely downstream of ordering, The Merge only had to change who decides the order (from PoW miners to the already-running consensus layer, over the Engine API); the deterministic state machine that applies the ordered transactions never had to change.