Two kinds of "done"
Pay a friend with cash and the deal is over the instant the note leaves your hand — nobody can reach into the past and undo it. Pay the same friend by bank transfer and the money looks settled, yet for days it could be reversed by a fraud claim or a clawback. Blockchains face exactly this question: once a transaction is in a block, is it done, or just probably done? The answer is the idea of finality — and proof-of-stake chains give a sharper answer than the chains that came before them.
Bitcoin and other proof-of-work chains only ever offer probabilistic finality. A block is never absolutely irreversible; instead, the deeper it gets buried under later blocks, the more total work an attacker would have to redo to rewrite it. The probability of a reversal falls off roughly exponentially with each confirmation, which is why exchanges wait for, say, six confirmations before crediting a Bitcoin deposit. Six is a custom, not a law of physics: with enough hash power, an attacker could in principle reorganize any number of blocks.
Proof-of-stake aims for something stronger: economic finality, where after a short delay a block is declared final and reverting it would cost a fixed, enormous, knowable amount of money. Not "increasingly unlikely" but "to undo this, someone must provably destroy a third of all the staked capital on the network." That guarantee is built by a finality gadget bolted on top of the chain. On Ethereum that gadget is called Casper, and the full consensus that contains it is called Gasper.
The calendar: slots, epochs, and checkpoints
Finality needs a clock, so Ethereum chops time into a strict grid. The smallest unit is a slot of 12 seconds, in which one validator is chosen to propose a block. Thirty-two slots make one epoch, which is therefore 32 × 12 = 384 seconds, or 6.4 minutes. This slot-and-epoch structure is the heartbeat of the whole consensus: validators are organized into committees per epoch, and every active validator gets to attest exactly once per epoch.
The key trick: Casper does not try to finalize every single block — that would be far too much voting. Instead it only ever votes on checkpoints, defined as the block in the first slot of each epoch. Finalizing a checkpoint automatically finalizes every block before it, so settling one checkpoint per epoch is enough to settle the whole chain behind it.
SECONDS_PER_SLOT = 12 SLOTS_PER_EPOCH = 32 # one epoch = 12 * 32 = 384 seconds = 6.4 minutes slot = 1_000_000 # the chain's current slot number epoch = slot // SLOTS_PER_EPOCH # -> epoch 31250 # A block is a CHECKPOINT only if it sits in the first slot of an epoch: is_checkpoint = (slot % SLOTS_PER_EPOCH == 0) # Casper FFG only ever votes on checkpoints (block, epoch) pairs, # never on every block -- that is what keeps the voting cheap.
Casper FFG: justification, then finalization
Casper FFG (the Friendly Finality Gadget) is the part of Gasper that actually stamps blocks as final. It works through a two-stage ratchet — justification then finalization — and the unit it counts is stake, never head-count. Every attestation a validator makes carries an FFG vote shaped like an arrow: a source checkpoint it builds on, and a target checkpoint it is voting to confirm. A target gains a supermajority link when attestations representing at least two-thirds of all staked ETH agree on the same source→target arrow.
- Vote. During epoch N, every validator's attestation names a source (the latest already-justified checkpoint) and a target (the epoch-N checkpoint).
- Justify. When attestations worth ≥ 2/3 of total stake share the same source→target link, the target becomes justified. Justified means "strongly supported," but not yet irreversible.
- Finalize. When a checkpoint B is justified and the very next checkpoint C is justified by a direct link B→C, then B becomes finalized. Two justified checkpoints in a row, linked back-to-back, lock in the earlier one.
- Cascade. Finalizing B finalizes every block at or before B. Under healthy conditions this happens every epoch, so finality trails the chain head by about two epochs — roughly 12.8 minutes.
# Tally FFG votes by STAKE behind them, not by validator count.
# A "supermajority link" needs >= 2/3 of ALL staked ETH.
def on_supermajority_link(source, target, stake_for_link, total_stake):
if stake_for_link >= (2 * total_stake) // 3:
target.justified = True # stage 1: justify the target
# stage 2: if the link is between CONSECUTIVE checkpoints
# and the source was already justified, finalize the source.
if source.justified and source.epoch + 1 == target.epoch:
source.finalized = True
# ...which finalizes every block at or before `source` too.Concretely: say the epoch-99 checkpoint A is already justified. Through epoch 100, validators attest with source A and target B (the epoch-100 checkpoint); once ≥ 2/3 of stake has done so, B is justified. Through epoch 101 they attest source B, target C; when that link crosses 2/3, C is justified — and because B was justified with its direct child C now justified too, B is finalized. From that moment, no honest node will ever build a chain that excludes B.
LMD-GHOST: choosing the head between finalizations
Finality only lands every couple of epochs, but blocks are produced every 12 seconds. Between finalizations the network still has to agree on which block is the current head — which fork to extend. That job belongs to a fork-choice rule called LMD-GHOST: Latest-Message-Driven Greediest Heaviest-Observed SubTree. Gasper is exactly the marriage of the two — Casper FFG for finality, LMD-GHOST for the live head — which is why "Gasper" is sometimes spelled out as GHOST + Casper.
LMD-GHOST works like a weighted tournament at every fork. Take each validator's latest attestation (latest-message-driven — only the most recent vote counts, so an attacker can't pad weight with old votes), and treat it as that validator's stake voting for a particular block. At each branch point, walk down into the subtree carrying the most accumulated stake-weight, and keep walking until you reach a leaf. That leaf is the head. Crucially, the search doesn't start from genesis — it starts from the latest justified checkpoint, so the fork choice is fenced inside whatever Casper has already half-settled.
Why finality is worth at least a third of all stake
Here is the heart of economic finality, a result called accountable safety. Suppose two conflicting checkpoints — on incompatible forks — both somehow got finalized. Casper's slashing rules forbid two things: a validator must never cast two different votes for the same target epoch (a double vote), and never cast a vote whose source-to-target span surrounds an earlier vote of its own (a surround vote). You can prove mathematically that for two conflicting checkpoints to both finalize, validators holding at least one-third of the total stake must have broken one of those two rules.
And those broken rules are attributable: the two contradictory signatures are public, permanent evidence of exactly which validators cheated, so every one of them can be slashed. That converts "reverting finality" from a probability into a bill. With well over 30 million ETH staked, a third is more than 10 million ETH — tens of billions of dollars — that an attacker would have to burn, not merely risk, and the protocol can identify and destroy it on sight. This is the precise sense in which a finalized Ethereum block is irreversible.
Contrast this with a proof-of-work 51% attack: there the attacker rents or builds hash power, rewrites history, and then keeps the hardware — the cost is recoverable and there is no on-chain receipt naming the culprit. Proof-of-stake's slashing makes the attack self-incriminating and unrecoverable. That is the entire trade it offers: you give up the option to ever reverse a finalized block, and in exchange you get a guarantee priced in destroyed capital rather than in fading probability.
Honest limits: 13 minutes, leaks, and weak subjectivity
This guarantee is real but not free. The most obvious cost is latency: finality takes about two epochs, so roughly 12.8 minutes pass before a block is truly locked. For a coffee that is forever; for a $50M settlement it is wonderfully fast. Researchers are actively chasing single-slot finality — finalizing within one 12-second slot instead of two epochs — but it demands aggregating attestations from the entire validator set every slot, which is hard at Ethereum's scale and is still an open engineering problem.
Second, finality can stall. If more than a third of validators go offline, no link can reach the 2/3 supermajority and the chain stops finalizing — though LMD-GHOST keeps producing blocks, so it stays live. To heal this, the inactivity leak slowly bleeds the stake of the validators who are failing to attest, until the still-online set climbs back above two-thirds of the (now smaller) total and finality resumes. It is a deliberate choice of liveness over instant safety: rather than halt forever, the chain sacrifices absent validators to recover.
This is not hypothetical. On 11–12 May 2023, Ethereum mainnet failed to finalize for several epochs — about 25 minutes the first time — when a surge of attestations referencing old data triggered a resource-exhaustion bug in the Prysm and Teku consensus clients. The chain kept producing blocks the whole time and resumed finalizing once nodes were patched and load eased. No funds were lost; the episode showed finality is a strictly stronger property than liveness, and one the network can temporarily lose while still moving forward.
Finally, finality reshapes how new nodes bootstrap. A proof-of-work newcomer can trust the heaviest chain objectively from genesis. A proof-of-stake newcomer cannot, because old validator keys could be used to cheaply forge an alternative history — the long-range attack. So Ethereum leans on weak subjectivity: a node syncing from scratch (or after months offline) must be handed a recent finalized checkpoint hash from a trusted source, and only trusts chains consistent with it. It is a modest, honest concession — one fresh fingerprint of reality — and the price of trading objective-but-soft finality for subjective-but-hard finality.