Revision — Consensus: Proof of Stake & The Merge

Every earlier Part in this book taught the machine: an account-based world state, transactions that mutate it, a gas-metered EVM, and a state root that fingerprints the result. This Part answered the one question the machine cannot answer for itself — which transactions come next, and in what order — for a network of strangers who may lie, vanish, or actively try to rewrite history. That is consensus, and it is the sharp end of the book’s throughline: how do untrusting strangers agree on the state of a shared world computer, and what does it cost to run one?

This page is a prose recap. It does not re-derive the mechanisms — the eight pages before it did that — it re-connects them, so that by the end you can trace a single line from “someone locked up 32 ETH” all the way to “this checkpoint can never be reverted,” and name the price paid at every step. If a claim here feels thin, follow the link back to the page that proves it.

The core swap: scarce energy for scarce capital

Start with the problem all permissionless chains share, the one the overview named: the Sybil problem. On an open network anyone can spin up a million identities for free, so you cannot decide “the majority rules” by counting nodes — the majority is trivially fake. Influence over the next block has to be anchored to some scarce resource that no software trick can counterfeit.

Proof of Work anchored influence to energy: burn electricity racing to find a hash below a target, and the heaviest chain wins. The cost is external and spent — the burn leaves the system as heat, and that irreversible burn is the security. Proof of Stake anchors the same influence to capital: lock up coins as a bond. The cost is internal and at risk — nothing is continuously burned, but the protocol can destroy part of your bond if you cheat.

   PROOF OF WORK (old Ethereum, Bitcoin)     PROOF OF STAKE (Ethereum since 2022)
   ─────────────────────────────────────     ────────────────────────────────────
   scarce resource : energy + hardware        scarce resource : staked capital (ETH)
   cost is         : external, SPENT           cost is         : internal, AT RISK
   security is     : the burn itself           security is     : the bond you'd lose
   attack means    : out-hash the network      attack means    : acquire a huge stake,
                                                                 then watch it get slashed

The unit of participation is the validator, and its price of admission is a bond of 32 ETH — covered in Validators & Staking. That number is not arbitrary. It is large enough that running an honest validator is a real financial commitment (so identities are genuinely scarce, defeating Sybil attacks), yet small enough that the set of validators is huge — hundreds of thousands of them — which is exactly the diffusion of trust an untrusting network needs. Each validator gets equal weight; wealth beyond 32 ETH buys more validators, not a louder one. The bond is the thing an attacker stands to lose, and because it lives inside the ledger as capital the protocol itself can destroy, Ethereum can offer something Proof of Work never could: fast, explicit finality.

Gasper: two cooperating mechanisms

The single most important frame in this Part is that Ethereum’s consensus does two distinct jobs, handled by two different algorithms bolted together. The combined protocol is called Gasper. Confusing the two jobs is the number-one source of confusion about PoS, so the recap pins them down first.

   JOB 1 — FORK CHOICE          "Which chain head should I build on RIGHT NOW?"
     algorithm: LMD-GHOST        answered every slot, ~every 12 seconds
     property : always yields a  answer can still change as new blocks and votes
                single head        arrive; the recent tip is provisional

   JOB 2 — FINALITY             "Which checkpoints can NEVER be reverted?"
     algorithm: Casper FFG       answered every ~2 epochs, ~every 12.8 minutes
     property : once finalized,  reverting it costs an attacker at least 1/3 of
                it's permanent     ALL staked ETH — an economic, capital-backed guarantee

LMD-GHOST is the fast head, covered in Attestations & LMD-GHOST Fork Choice. LMD stands for “Latest Message Driven” — only each validator’s most recent vote counts. GHOST means “Greedy Heaviest-Observed Sub-Tree”: starting at the last agreed point, you always walk toward the child block carrying the most accumulated validator votes (weight), not the longest chain. It gives every honest node a single head to build on right now, updated roughly every 12 seconds. But that head is provisional — a better-supported fork can still overtake it as new votes land.

Casper FFG is the irreversible ratchet, covered in Checkpoints, Casper FFG & Finality. FFG stands for “Friendly Finality Gadget.” It runs on a slower clock, does not care about individual blocks, and answers only one question: which checkpoints are now permanent? Where LMD-GHOST is fast and revisable, FFG is slow and absolute. The two cooperate: fork choice keeps the chain live (always making progress on a single head), while finality keeps it safe (past a point, history is set). Liveness and safety are the two properties every consensus system must trade against, and Gasper deliberately assigns one to each mechanism instead of forcing a single algorithm to do both.

The clock: slots, epochs, and dual-purpose votes

Both jobs run on a shared heartbeat, laid out in Slots, Epochs & Committees. Time is chopped into fixed slots of 12 seconds, and 32 slots make one epoch of 6.4 minutes. The clock is what lets strangers act in lockstep without a central coordinator: everyone agrees, from genesis, exactly which slot it is right now.

   1 slot  = 12 seconds            → one chance to propose a block
   1 epoch = 32 slots = 6.4 min    → the accounting period for finality
   every epoch, every validator is assigned to attest exactly once, in one committee

Each slot, one validator is pseudo-randomly chosen as proposer and builds a block; the rest of that slot’s committee attests. An attestation is the atomic act of participation, and its cleverness is that it is a dual-purpose vote, carrying two ballots in one signed message:

• an LMD-GHOST vote for the head block the validator currently sees (feeding Job 1, the fast fork choice), and
• an FFG vote — a source → target checkpoint link — feeding Job 2, finality.

One signature, two jobs. This is why the attestation is the workhorse of the whole system: the same messages that keep the head moving also accumulate toward permanence. Committees exist so that not every validator has to verify every other validator’s vote directly — the validator set is sharded across committees per slot, which keeps message volume tractable at hundreds of thousands of validators.

Finality: justification, then finalization

FFG turns a flood of attestations into an irreversible decision using a two-step, 2/3-supermajority rule over epoch-boundary checkpoints. The reason it takes two steps rather than one is the same reason a careful person confirms a decision twice: a single supermajority proves the network currently agrees, but finalizing demands proof that agreement will stick.

   Step 1 — JUSTIFY:   a checkpoint gets FFG votes from validators controlling
                       ≥ 2/3 of the total staked ETH  →  it becomes "justified"

   Step 2 — FINALIZE:  when a justified checkpoint's DIRECT CHILD checkpoint is
                       also justified by ≥ 2/3, the parent becomes "finalized"
                       → permanent; reverting it now costs an attacker ≥ 1/3 of
                         ALL staked ETH, which the protocol will slash

Because checkpoints sit on epoch boundaries and finalization needs two of them in a row, finality lands roughly every two epochs — about 12.8 minutes in the healthy case. The guarantee is economic, not cryptographic: nothing makes reverting a finalized checkpoint mathematically impossible, but doing it would require an attacker to have voted two contradictory ways with at least a third of all staked capital, which the protocol can then provably destroy. Safety is priced, and the price is a third of the entire bond pool. That is the deepest answer this book gives to “what does it cost to attack the shared world computer”: not electricity you could out-spend, but capital you must own and then forfeit.

The Merge: swapping the engine live

For seven years Ethereum ran the machine (execution) and the ordering (Proof of Work consensus) fused in one program. On 15 September 2022, The Merge replaced the consensus engine underneath a running chain — no restart, no new coins, no snapshot-and-relaunch — the way you might swap a plane’s engine mid-flight. The move worked precisely because ordering and computing are cleanly separable, exactly as the overview promised: execution is downstream of ordering, so you can replace how blocks are ordered without touching how their transactions are computed.

The Merge crystallized that separation into two layers that now talk over a small, well-defined interface:

   ┌─────────────────────────────┐        ┌─────────────────────────────┐
   │   CONSENSUS LAYER (CL)       │        │   EXECUTION LAYER (EL)      │
   │   beacon chain: Gasper       │◄──────►│   the EVM + state machine  │
   │   validators, slots, epochs, │ Engine │   accounts, gas, state root │
   │   attestations, finality     │  API   │   (the "world computer")   │
   └─────────────────────────────┘        └─────────────────────────────┘
      decides the ORDER of blocks             computes the STATE from that order

The consensus layer (the “beacon chain,” which had already been running PoS in parallel since December 2020) decides the order; the execution layer computes the resulting state. The headline consequence was energy: The Merge cut Ethereum’s energy use by roughly 99.95% — a 2022 estimate, best treated as an order-of-magnitude truth rather than a lab constant. In throughline terms, the cost to run the shared world computer dropped from a nation-scale electricity bill to something closer to the hardware and locked capital of its validators. The security budget did not vanish; it moved — out of the power grid and into the stake at risk.

The incentive edges: slashing, leaks, and withdrawals

Finality’s promise (“reverting costs a third of the stake”) is only as real as the protocol’s ability to actually take that stake. That enforcement is Slashing & the Inactivity Leak, the two disciplinary edges that make the economics bite.

Slashing punishes provable equivocation — signing two conflicting attestations or two blocks for the same slot, the exact moves an attacker would make to fork or double-finalize the chain. It is deliberately reserved for unambiguous protocol violations, because the evidence is a self-contained pair of signatures anyone can verify. A slashed validator loses a chunk of its bond and is ejected. Honest validators effectively never get slashed; you have to sign contradictory messages to trigger it.

The inactivity leak solves a different, subtler failure: what if more than a third of validators simply go offline, so no checkpoint can reach the 2/3 supermajority and the chain stops finalizing? Rather than freezing forever, the protocol slowly bleeds the stake of the non-participating validators until the online set once again controls two-thirds of the (now-shrunken) total — at which point finality resumes. It is the mechanism that lets the chain heal from a mass outage without human intervention, trading a slow, fair penalty for the offline for a guarantee that the online can always eventually finalize.

Finally, a note on sequencing that shaped the validator economy: for the first seven months after The Merge, staked ETH was locked with no exit. Withdrawals, Rewards & the Validator Economy covers how the Shapella upgrade of April 2023 finally enabled withdrawals, letting validators claim rewards and exit their 32 ETH bond. That deferral was a deliberate trade: ship the security-critical consensus swap first, prove it stable under real conditions, and only then open the door that lets capital leave. It closes the economic loop — a validator can now bond in, earn issuance and priority fees for honest work, be slashed for cheating, bled for absence, and eventually withdraw.

The whole line, in one breath

Put end to end, this Part traces a single arc. A stranger locks 32 ETH as a bond, becoming one validator among hundreds of thousands, each with equal weight. A 12-second slot / 6.4-minute epoch clock lets them all act in lockstep without a coordinator. Every slot, a proposer builds a block and a committee attests — one signed message that is simultaneously an LMD-GHOST vote for the current head (keeping the chain live) and an FFG checkpoint vote (driving it toward safe). When checkpoints collect a 2/3 supermajority two epochs running, they finalize — permanent, because reverting them would cost an attacker a third of all staked capital, which the protocol will slash. If too many validators vanish, the inactivity leak heals finality; when honest validators are done, withdrawals let their bond leave.

That is how untrusting strangers agree on the state of a shared world computer. And the cost to run it is now legible in a single sentence: not burned energy, but capital at risk — a bond you must own to influence the chain, and forfeit if you attack it. From here, the book turns from how the chain agrees to what gets built on top of that agreement.