Proof-of-Work versus Proof-of-Stake: John, Rivera & Saleh (2025)

What this is. The paper’s core results, the model it builds, and the propositions it derives: enough to know what it found and how, without reading all 50 pages. To replicate or extend it, read the full source at the original.

Related literature. The paper builds on Pagnotta (2022) (blockchain security via a crisis-of-confidence attack model), Hinzen, John, and Saleh (2022) (limited adoption model for Bitcoin), and Huberman, Leshno, and Moallemi (2021) (cutoff equilibrium structure for blockchain users). It extends Saleh (2021) (PoS sustainability) by providing the first comparative security analysis across protocols, and adopts Nakamoto (2008)‘s 51% attack definition as the baseline PoW attack model.

TL;DR

John, Rivera, and Saleh compare equilibrium security across Proof-of-Work (PoW) and Proof-of-Stake (PoS) blockchains in a unified OLG model. They derive a general condition (Proposition 3, eq. 52) showing that PoS is more (less) secure than PoW when the relative cost to attack PoS exceeds (falls below) a threshold. Applying real-world parameter estimates for mining depreciation (46.5%-89% annually) and DeFi returns (3.73%-4.85% annually), they show that the sufficient condition for PoS security dominance is met for any attacker leverage up to 453%-568% above PoW, a level far beyond what current overcollateralized lending markets permit. They also show that PoS’s security advantage is particularly salient at high scale: scaling generates full insecurity for PoW at lower scale than PoS, and achieves full security for PoS at lower scale than PoW.

Core results

Magnitudes and significance are as reported. Locators point into the source PDF.

#	Result	Locator	Magnitude
R1	PoS generates higher validation investment than PoW for all model parameters because stakers avoid depreciation and energy costs	Proposition 3, eq. 52-53, p. 1979; Section 3, p. 1979	PoS validation investment exceeds PoW whenever PoW and PoS generate identical validator revenues; ratio given by threshold zeta = [e^{-2rho} psi] / [e^{-2rho} psi + 1 - (1-delta)/(1+kappa_h)] <= 1
R2	Under real-world parameters (delta_1Y in [46.5%, 89%]; psi_1Y in [3.73%, 4.85%]) PoS generates higher equilibrium security than PoW	Corollary 1, p. 1984-1985; Tables 1-2, pp. 1983-1984	PoS more secure than PoW whenever lambda <= 453% (most conservative) or lambda <= 568% (less conservative); lambda approx 1 in practice so condition is always satisfied
R3	The PoS security advantage requires only mining hardware depreciation (delta_1Y) > DeFi return (psi_1Y) and a standard supermajority threshold (eta <= 2/3)	Proposition 4, eq. 54-55, p. 1980; Remark 1, p. 1981	Sufficient condition: lambda <= (1/2)(1 + log(1+delta_T)/log(1+psi_T)); horizon-invariant per eq. 55
R4	Scaling generates full insecurity (pi^p = 0) for a larger set of attacker benefits under PoW than under PoS	Proposition 5, eq. 57, p. 1986; Section 4.1	Sigma_0^{PoS} subset of Sigma_0^{PoW}: the set of attacker benefits generating full insecurity at scale is weakly larger for PoW
R5	PoW becomes fully insecure at lower scale than PoS for any fixed maximal attacker benefit	Proposition 6, eq. 59, p. 1987	Lambda_0^{PoS} >= Lambda_0^{PoW}: the scale at which PoW loses positive security is weakly lower than for PoS
R6	Scaling generates full security (pi^p = 1) for a larger set of attacker benefits under PoS than under PoW	Proposition 7, eq. 64, p. 1989; Section 4.2	Sigma_1^{PoW} subset of Sigma_1^{PoS}: scaling achieves full security for PoS in cases where it does not for PoW
R7	PoS achieves full security at lower scale than PoW for any fixed maximal attacker benefit	Proposition 8, eq. 66, p. 1990	Lambda_1^{PoS} <= Lambda_1^{PoW}: PoS reaches full security at a weakly lower scale than PoW
R8	Equilibrium user fees decrease in blockchain scale and go to zero as scale grows, reducing validator revenues and undermining security; this negative effect is more acute for PoW than PoS	eq. 60, p. 1987; Section 4, pp. 1985-1991	f^p_{(i,t)} = (c_{(i,t)} / Lambda) integral_0^{c_{(i,t)}} x dG(x); fee decreases in Lambda (1/Lambda factor); the two scaling effects on security (fee reduction vs. adoption increase) favor PoS more broadly

Overall (paper’s conclusion). Under current real-world conditions, PoS blockchains are more secure than equivalent PoW blockchains for any realistic scale. The security advantage of PoS relative to PoW is particularly salient at high scale: PoW is rendered fully insecure at lower scale, and PoS reaches full security at lower scale, than the respective counterpart. The results provide a formal foundation for understanding blockchain protocol design in the tokenomics and decentralized finance context.

Theory / model

The paper models a single blockchain as either PoW or PoS. The economy is populated by overlapping generations of agents, each living three periods.

Users. Each generation-$t$ agent $i \in [0,1]$ possesses a unit endowment and has utility:

$$\mathcal{U}^p_{(i,t)} = \max\{U^p_{(i,t)}, 1+\sigma\} \tag{1}$$

where $1+\sigma$ is the outside option return (p. 1961) and $U^p_{(i,t)}$ is the expected utility from adopting the blockchain under protocol $p \in \{PoW, PoS\}$. An agent adopts if and only if her wait disutility cost $c_{(i,t)}$ falls below a cutoff $c^p$, determined in equilibrium. The agent allocates her endowment between DeFi investment (fraction $1-\omega^p$) and blockchain validation (fraction $\omega^p$) to maximize:

$$\omega^p_{(i,t)} = \arg\max_{\omega \in [0,1]} \omega \cdot \mathbb{E}_t[R^p_t] + (1-\omega) \cdot \mathbb{E}_t[R^{DeFi}_t] \tag{2}$$

where $R^p_t$ is the period $t$ to $t+2$ return from validation and $R^{DeFi}_t = \frac{P_{t+2}}{P_t} \cdot (1+\psi)$ is the DeFi return, with $\psi$ the gross DeFi return and $P_t$ the cryptoasset price (p. 1966, eq. 11).

Wait disutility and fees. The blockchain has transaction rate $\Lambda > 0$. User $i$ pays a fee $f^p_{(i,t)} \geq 0$ to prioritize processing. The expected wait time when paying fee $f$ given others’ fees $f_{-(i,t)}$ is (p. 1963, eq. 6):

$$W^p(f, f_{-(i,t)}) = \frac{1}{\Lambda} \times \int \mathbf{1}\{f^p_{(j,t)} \leq f\} \, dG(c_{(j,t)}) \tag{6}$$

Each adopting agent optimally solves:

$$f^p_{(i,t)} = \arg\max_{f \geq 0} \left[ \Pi^p_{(i,t)} - f - c_{(i,t)} \cdot W^p(f, f_{-(i,t)}) \right] \tag{4}$$

and the equilibrium fee function satisfies $f^p_{(i,t)} = \frac{c_{(i,t)}}{\Lambda} \int_0^{c_{(i,t)}} x \, dG(x)$ for adopters (Lemma 1, eq. 33, p. 1975).

Blockchain cryptoasset supply. The total supply follows:

$$M_{t+1} = M_t e^{\rho}, \qquad B_t = M_t(e^{\rho}-1) \tag{7-8}$$

where $\rho \geq 0$ is the asset growth rate and $B_t$ is the block reward distributed in period $t$ (p. 1963).

PoW validation return. A miner born in period $t$ buys mining hardware at upfront cost per unit hash power $1+\kappa_h$ (energy plus equipment), mines in period $t+1$, and liquidates equipment at depreciated value $1-\delta$ (p. 1964). The lifetime return to mining is (eq. 9, p. 1965):

$$R^{PoW}_t = \frac{H_{t+1}(1-\delta) + \left(B_{t+1} + \frac{\int f^{PoW}_{(i,t-1)} dG(c_{(i,t-1)})}{P^{PoW}_{t+1}}\right) P^{PoW}_{t+2}}{H_{t+1}(1+\kappa_h)} \tag{9}$$

where $H_{t+1}$ is aggregate hash power, $B_{t+1}$ are block rewards, and $\delta \in [0,1]$ is hardware depreciation. The key feature is that miners must pay both energy ($\kappa_h$) and equipment depreciation ($\delta$) costs, making PoW validation more expensive than PoS staking.

PoS validation return. A staker born in period $t$ purchases coins at price $P^{PoS}_t$, stakes them in period $t+1$, and liquidates in $t+2$. Letting $S_{t+1}$ be total staked capital (p. 1966, eq. 10):

$$R^{PoS}_t = \frac{S_{t+1} P^{PoS}_{t+2} + \left(B_{t+1} + \frac{\int f^{PoS}_{(i,t-1)} dG(c_{(i,t-1)})}{P^{PoS}_{t+1}}\right) P^{PoS}_{t+2}}{S_{t+1} P^{PoS}_{t+2}} \tag{10}$$

Crucially, stakers recover their principal $S_{t+1} P^{PoS}_{t+2}$ in full (no depreciation, no energy cost), so only the opportunity cost of foregone DeFi investment matters.

Attacker. A malicious agent draws benefit $\Gamma_t \sim U[0, \bar\Gamma]$ from disrupting the blockchain each period, and solves (p. 1967, eq. 12):

$$\max_{A_t \geq 0} \Gamma_t \cdot \nu^p_{t+1}(A_t) - A_t \tag{12}$$

where $\nu^p_{t+1}(A_t)$ is the probability of a successful attack given resources $A_t$. For PoW, success requires $A_t \geq H_{t+1}(1+\kappa_h)$ (51% attack, eq. 13). For PoS, success requires acquiring and staking a fraction $1-\eta$ of total staked coins, i.e., $A_t \geq \alpha \cdot S_{t+1}$, where $\alpha := \frac{1-\eta}{\lambda \eta} \in [0,1]$ is the relative cost of attacking PoS (eqs. 15-17, p. 1969-1970).

Method

The paper derives closed-form stationary cutoff equilibria for both protocols. The solution method is: (1) solve for optimal fees (Lemma 1), (2) derive the equilibrium return to validation for each protocol (Propositions 1 and 2), (3) characterize the equilibrium adoption cutoff $c^p$ as the supremum of cutoffs at which all agents with $c < c^p$ prefer the blockchain to the outside option, and (4) compare survival probabilities $\pi^p$ across protocols.

PoW equilibrium (Proposition 1, pp. 1975-1977). The equilibrium fraction of wealth invested in mining is (eq. 34):

$$\omega^{PoW}(c^{PoW}) := \min\left\{\frac{(1-e^{-2\rho})G(c^{PoW}) + fees(c^{PoW})}{G(c^{PoW})\left(e^{-2\rho}\psi + 1 - \frac{1-\delta}{1+\kappa_h}\right)}, 1\right\} \tag{34}$$

The equilibrium hash power and survival probability (eqs. 36, 38-39):

$$H^\*(1+\kappa_h) = \min\left\{\frac{(1-e^{-2\rho})G(c^{PoW}) + fees(c^{PoW})}{e^{-2\rho}\psi + 1 - \frac{1-\delta}{1+\kappa_h}}, G(c^{PoW})\right\} \tag{36}$$ $$\pi^{PoW} = \min\left\{\frac{H^\*(1+\kappa_h)}{\bar\Gamma}, 1\right\} \tag{38}$$

PoS equilibrium (Proposition 2, pp. 1977-1978). The equilibrium staked capital and survival probability (eqs. 45, 47-48):

$$S^\*(c^{PoS}) = \min\left\{\frac{(1-e^{-2\rho})G(c^{PoS}) + fees(c^{PoS})}{e^{-2\rho}\psi}, G(c^{PoS})\right\} \tag{45}$$ $$\pi^{PoS} = \min\left\{\frac{\alpha \cdot S^\*}{\bar\Gamma}, 1\right\} \tag{47}$$

Key comparison threshold. Proposition 3 (eq. 52-53) derives the threshold:

$$\zeta := \frac{e^{-2\rho}\psi}{e^{-2\rho}\psi + 1 - \frac{1-\delta}{1+\kappa_h}} \leq 1 \tag{53}$$

Then $\alpha \leq \zeta \Rightarrow \pi^{PoW} \geq \pi^{PoS}$ and $\alpha \geq \zeta \Rightarrow \pi^{PoS} \geq \pi^{PoW}$. Because $\zeta \leq 1$ always holds, PoS validation investment exceeds PoW investment whenever both generate the same revenues. Whether this advantage overcomes PoS’s lower attack threshold ($\alpha \leq 1$) depends on which side of $\zeta$ the parameter $\alpha$ lies.

Sufficient condition (Proposition 4). If the PoS supermajority threshold $\eta \leq 2/3$ and annual depreciation $\delta_{1Y} > \psi_{1Y}$ (DeFi return), then the condition $\alpha \geq \zeta$ holds whenever (eq. 54):

$$\lambda \leq \frac{1}{2}\left(1 + \frac{\log(1+\delta_T)}{\log(1+\psi_T)}\right) \tag{54}$$

This is horizon-invariant because $\frac{\log(1+\delta_T)}{\log(1+\psi_T)} = \frac{\log(1+\delta_{1Y})}{\log(1+\psi_{1Y})}$ for all $T$.

Empirical specifications

The paper is a theory paper with no regression specifications. The calibration in Section 3.3 provides real-world parameter estimates, comparing the model’s sufficient condition to data.

Mining equipment depreciation (Table 1, p. 1983). Using theblock.co ASIC price index (three efficiency tiers, August 2021-August 2023), the paper documents average annual price declines of 60.4%-66.38% across all tiers. Academic sources (Prat and Walter 2021: 47.7%-61.3%; De Vries and Stoll 2021: 46.5%-89%; Stinner 2021: 61.45%) confirm $\delta_{1Y} \in [46.5\%, 89\%]$.

DeFi return estimates (Table 2, p. 1984; Table 3, p. 1985). Using Compass Financial Technologies daily ETH staking return data (October 2023 to June 2024): average $\psi_{1Y} = 4.32\%$ (min 3.73%, max 4.85%). AAVE lending data (Chaudhary, Kozhan, and Vishwanath-Natraj 2023) gives 0.13%-2.28% for ETH and up to 8.957% for USDC. All estimates satisfy $\delta_{1Y} > \psi_{1Y}$ over the entire range.

Parameter bounds. Applying the most conservative values ($\delta_{1Y} = 46.5\%$, $\psi_{1Y} = 4.85\%$) to eq. 54 gives $\lambda \leq 453\%$. Less conservative values ($\delta_{1Y} = 55\%$, $\psi_{1Y} = 4.32\%$) give $\lambda \leq 568\%$. Since current lending markets are overcollateralized and $\lambda \approx 1$ in practice, the sufficient condition is always satisfied (Corollary 1, pp. 1984-1985).

Datasets used

Dataset	Role in paper	Wiki page
theblock.co ASIC Price Index (three efficiency tiers, Aug 2021-Aug 2023)	Estimate annual mining hardware depreciation rate $\delta_{1Y}$	No page yet
Compass Financial Technologies daily ETH staking return data (Oct 2023-Jun 2024)	Estimate annual DeFi return $\psi_{1Y}$ for PoS staking	No page yet
AAVE ETH/USDC lending rate data (Chaudhary, Kozhan, Vishwanath-Natraj 2023)	Robustness estimate of $\psi_{1Y}$ via DeFi lending rates	No page yet

Note: the core results are theoretical propositions derived from the equilibrium model; the datasets above are used only to calibrate model parameters and verify that the sufficient condition (eq. 54) holds under realistic values. The paper is primarily a theory paper with no econometric identification.

When to read the full paper

Use the original if you are: (1) building a model of blockchain security or protocol design; (2) evaluating whether a PoW or PoS blockchain is more secure for a specific parameter range (the threshold $\zeta$ in eq. 53 is the key object); (3) studying DeFi ecosystem interactions with blockchain security; or (4) calibrating mining depreciation and DeFi yield parameters for a blockchain model. The proofs of all eight propositions are in Appendix B (pp. 1994-2002); replication code is at https://doi.org/10.7910/DVN/5VTIMI.

Attribution and rights

Source: peer-reviewed, The Review of Financial Studies 38(7), 2025. This distillation was extracted by an LLM on 2026-06-06 and is not human-verified or independently reproduced. The paper is paywalled; reproduction rights follow OUP standard publication reuse rights. Extract-only.

John, Kose, Thomas J. Rivera, and Fahad Saleh. “Proof-of-Work versus Proof-of-Stake: A Comparative Economic Analysis.” The Review of Financial Studies 38, no. 7 (2025): 1955-2004. DOI: 10.1093/rfs/hhaf013.