Explanation: Proof of Stake is a consensus model in cryptocurrencies. Block producers (miners) get selected according to the amount of coins they hold or stake. The more coins a miner holds the higher is his probability to get selected in order to validate a block.
The basic idea behind proof of stake is to internalize the scarce resource for miner selection. The scarce resource here is the cryptocurrency itself instead the electricity and hardware with proof of work. Instead of using money to buy mining hardware/electricity and with this creating consensus the intermediary step is eliminated by transforming money into consensus directly.
Different algorithms of Proof of Stake
There are different types and algorithms of Proof of Stake. Proof of stake algorithms can be distinguished whether the block validator needs to merely hold a certain amount or whether he needs to deposit it.
Byzantine based vs. Chain based vs. Committee based PoS
Chain based PoS is the earliest idea of proof of stake. It basically simulates the Nakamoto Proof of Work algorithm where a hash puzzle needs to be solved in order to determine the next block producer.
Peercoin and Nxt used a chain based PoS.
A committee based approach selects block producers (or validators) from a given set of candidates. Usually the order and the validators are chosen from a previous state of the blockchain including the stake of each candidate. The order is fixed here for each epoch and resembles a round robin model.
In Byzantine fault tolerant (BFT) based proof of stake we have two stages. 1. block producer selection and 2. finalizing. The first stage is done by a committee based algorithm or by a chain based algorithm. It is also possible to apply a hybrid PoW-PoS scheme. The finalization (2nd stage) is done by voting for each block by signing through the validators. if 2/3 of the validators signed a block, it is considered as irreversible and thus as finalized.
Deposit vs. holding
The simplest form of proof of stake is to include all holders of a particular cryptocurrency. The actual miner or block producer is selected by a random choice. Such a choice could be “follow the Satoshi”. The problem here is that many users who don’t want to participate in the consensus model get selected. This holds up the whole network.
Another concept is that users who want to participate in the PoS consensus algorithm need to register in a smart contract and deposit a certain amount. The probability of getting selected as a miner depends on the actual deposit. The more a user stakes the higher is the probability.
Penalty vs no penalty
If a block validator doesn’t behave according to the protocol or doesn’t reliably respond he could either be punished or simply ignored. A punishment could be to burn his deposit (stake). Although a punishment creates more security it adds some complexity to the whole process and increases the risk for block validators to accidentally loosing their locked up funds.
Coin age vs. no coin age
In the basic model each coin has the same weight. So, if user A holds 10 BTC and user B 10 BTC, user B has the same chance to be selected as a block validator. Here, it is unimportant how long the coin belongs to this user or how long it hasn’t been moved.
Another approach is to include the coin age into the calculation of the weight. The longer a coin remains on the same address the higher is its weight. If user A and B have 10 BTC each but user A hasn’t moved its coins for a long time and user B has received it just shortly then user A has a higher probability to get selected as a block validator.
Advantages of Proof of Stake
Proof of Stake has several advantages compared to proof of work (PoW).
Energy efficiency: Block validators don’t need to solve an energy consuming puzzle.
Security: It has some security advantages. The cost for an attacker can in some circumstances be higher. It is argued that gaining 51 % of the available coins is harder than gaining 51 % of the hashing power. Beside that having 51 % of stake means to potentially loosing this amount.  https://vitalik.ca/general/2020/11/06/pos2020.html
Decentralization: The hardware requirements are lower and more people can participate in it. Depending on the concrete implementation everybody who holds this cryptocurrency can participate. But in reality a certain minimum amount is required in most cases.
Beside that PoS is ASIC resistant.
Disadvantages of Proof of Stake
Complexity: in order to prevent the nothing at stake problem and long range attacks additional rules need to be implemented. Also, the block validator selection is more difficult and must be protected against denial of service attacks or hold ups.
Centralization: If a block validator holds for example 30 % of all staked coins, he also received 30 % of all newly created coins and transaction fees. There is no need to spend those coins for hardware or electricity, which means he would have those 30% of staking power forever. And with transaction fees he could accumulate even more staking power over time.
Security: In some circumstances the cost of an attack can be lower, especially if an attack seems likely the price of this currency can drop making it even cheaper to buy up to 51 % of the staked deposit.
Block validator selection in PoS
There are different schemes how to choose a block validator.
Simple Round Robin
The easiest scheme would be a round robin approach. Here block validators register in a list and each validator is chosen in a predefined order. When reaching the end of the list, the selection process starts over.
So if you have four validators 0, 1, 2, 3 they would be chosen in this order. And after 3 has validated its block the selection starts with 0 again.
This could be implemented with a modulo calculation.
- b % N = i
- b: block height: increases with every block
- N: number of registered block validators
- i: index of the next block validator
- %: modulo operation
We start at block 0
N = 4 (four block validators)
|b % N = i||0||1||2||3||0||1||2||3|
But this scheme would not take the number of coins into account.
Round Robin with Stake
In order to tie the voting power to the funds a deposit is necessary when registering. One could define a minimum deposit for each slot (or index). If the minimum amount is 2 BTC then an block validator with a budget of 8 BTC could register for four slots by distributing its coins.
The downsides of the round robin approach are that the order of block validators is predefined which could facilitate coordination between the block validators.
Virtual Mining/Simulated Mining Rig
In order to overcome the deterministic block validator selection a random element must be introduced. The following formula can be used for this purpose: [1a]
SHA-256(Hn-1+address+timestamp+R)<= 2^256*(coin_age * deposit)/diff
- SHA-256: hash function.
- Hn-1 is the block header of the previous block
- address: coinbase address
- timestamp: timestamp
- R: random value
- coin age: (optional) time the coins haven’t been moved
- deposit: amount the block validator has staked on the given address
- diff: difficulty parameter
The left side of this inequality must be lower than the target given on the right side. The higher the coin age and the deposit the easier is it to fulfill the inequation. The higher the difficulty parameter is the hard is it to solve the puzzle.
The calculation is done in rounds. If no miner is selected the difficulty parameter gets adjusted and the calculation is repeated. A question that needs to be addressed is which block producer gets selected, if there are more than one fulfilling the inequation.
There are different variations of this approach. Nxt coin raises the target every second no block was found. 
The random element can be calculated in different ways. Without a random element block producers could engage in stake grinding where other elements like block hash or address are chosen that the inequation in the next round favours this block producer.
Random shuffling is similar to a round robin approach. But the order is determined randomly.  This involves again a random element.
Random shuffling is employed by Ethereum 2.0.
Proof of Stake and Scalability
Proof of stake doesn’t improve scalability. Network latency and block size are still limiting factors. But it allows other scaling techniques like sharding without reducing the security. In contrast, in PoW systems sharding is possible too but it would reduce the security of each shard.
Security of Proof of Stake
The security of proof of stake is highly discussed. It is often compared to PoW and there are arguments in both directions. Here, we highlight the most salient security aspects.
PoS provides a lower entrance barrier compared then PoW to contribute to the consensus. There is no highly specialized hardware necessary and there is no significant difference in electricity costs depending on the location. So, also people with medium technical skills can join the validator pool.
But details can make a difference. If staking requires a high minimum amount of coins this can pose a serious obstacle for mass adoption. Beside that, if CPUs are used for mining it is easier for users to become a miner.
Another aspect of centralization is the ability to gain and maintain 51 % of the stake or mining power. In PoW external miners can (theoretically) enter the market anytime by buying new hardware with fiat currency. Beside that miners have to spend a substantial portion of their block reward in order to pay for electricity and hardware (and maybe workforce)
In PoS validators receive the block reward which is the only source of this scarce resource in this scheme. If validators don’t sepend their block reward they can accumulate it. And due to the low operating costs, there is no need to spend much of the block reward. That way they can maintain and even strengthen their position as validator.
Cost of 51 % attack
There is an article by Vitalik Buterin addressing this topic: https://vitalik.ca/general/2020/11/06/pos2020.html
The idea behind that is that miners in PoW add more hardware and electricity until their costs are almost as high as their block reward. If there is a block reward of let’s say 10 coins per day, miners would spend almost 10 coins on hardware (renting or write-off) and electricity per day.
An attacker would need to spend more than that amount in order to overtake the original chain. The cost are here approximately 10 coins/day.
In PoS validators would want to earn interest on their stake. We neglect hardware and electricity costs for the sake of simplicity. If they strive for an annual return of 5%, they would have a return per day of 5%/365 = 0.0137%. If there is a daily reward of 10 coins, this would attract a deposit of 10/0.0137 = 730 coins.
This is a significantly higher amount than with proof of work and hence considered as safer.
Proof of Work is battle-tested and has proven its security (and insecurity). PoW is also a more streamlined concept than PoS with its necessary additional features like slashing and checkpoints to overcome inherent weaknesses. The more complex a system is the higher is the chance to find vulnerabilities in it.
Crypto Currencies with Proof of Stake
There are various blockchains with proof of stake consensus models:
- Ethereum 2.0
Types of PoS consensus: https://arxiv.org/pdf/1904.04098.pdf