long-range attack

A long-range attack is a threat unique to proof of stake: an adversary builds an alternative chain branching from a point far back in history and tries to present it to newcomers as the real one. The danger comes from a subtle asymmetry. In proof of work, rewriting old blocks requires redoing all their computation, which is physically impossible to fake after the fact. In proof of stake, blocks are just signatures, and signing is free — so given the right keys, an attacker can re-sign a whole alternate history almost instantly.

The keys are the crux. Validators who have exited and withdrawn their stake no longer have anything to lose, yet their old signing keys still validate against old states. An attacker who buys or obtains the keys of validators that controlled a supermajority of stake back at some past epoch can forge a fully valid-looking chain from that epoch forward — complete with attestations and finalized checkpoints — because slashing cannot punish keys whose stake is long gone. To a node syncing from genesis with no other information, this fake chain can be indistinguishable from the true one by the protocol rules alone.

The standard defense is weak subjectivity: a syncing node must start from a recent, trusted finalized checkpoint rather than from genesis, obtained out-of-band from a friend, client default, or block explorer. Any chain that conflicts with that checkpoint is rejected outright, no matter how internally consistent. Supporting defenses include bounding how fast validators may exit (the exit queue and withdrawal delays), so the keys backing a finalized checkpoint cannot all become consequence-free quickly. This is the key reason proof of stake cannot offer the pure, trust-free from-genesis syncing that proof of work does.