While the energy consumption of proof-of-work is indeed an issue, for many trust-critical crypto projects (including effectively all cryptocurrencies) proof-of-stake has even bigger problems, as was demonstrated a decade ago when BTC was still under 10 USD:

https://bitcointalk.org/index.php?topic=897488.msg10182752#m...

>I will formulate the attack: The "Second Pirate Savings and Trust" attack on Proof-of-Stake

>1. The attacker creates the "Second Pirate Savings and Trust" modelled after the "First Pirate Savings and Trust" later called "Bitcoin Savings and Trust" https://bitcointalk.org/index.php?topic=50822.msg605957#msg6.... This is done in a falling market.

>2. The "trust" offers a very attractive rate of interest payable in the POS coin. This rate is significantly higher than the stake rate

>3. The "trust" allows investors to leave the interest in the "trust" and roll over the investment.

>4. The "trust specifically disclaims that it is a HYIP / Ponzi scam https://bitcointalk.org/index.php?topic=50822.msg605981#msg6...

>5. The attacker sells a portion of the borrowed POS coin say 50% for XBT, another POW alt-coin, one or more fiat currencies etc. This will becomes the attackers profit at the end. This will also depress the price by short selling creating the "bear raid"

>6. A portion of the received POS coins is used to repay interest to those investors that do not reinvest their interest. This is the "ponzi" component; however see below.

>7. The rest of the borrowed POS coin is kept by the attacker, accumulated and staked.

>At this point this is no different from any bear raid on a stock, fiat currency POW currency etc. If the market exchange rate falls faster than 2x the interest rate less the stake rate then in the 50% example above, the attacker is actually in the black and there is no ponzi. In the normal bear raid the attacker, if the attacker can depress the price enough and cover the short, can actually walk away with a profit. The problem with the simple bear raid is that in covering the short the exchange rate can rise sharply. This converts the bear raid into a ponzi and the scheme collapses in a rising market. This is what happened to "First Pirate Savings and Trust". It collapsed during a rise in the Bitcoin price.

>It is at this point where the specific to Proof-of-Stake part of the attack comes into play.

>8. The attacker continues the ponzi until he has accumulated enough stake to launch a network attack.

>9. The attacker is also accumulating a greater debt in the POS coin and can even continue selling 50% of the borrowed coin to increase his profit.

>10. The attacker launches the attack on the coin causing its value to fall to zero. This wipes out the attacker's stake, but more importantly also wipes out the attacker's debt. The specifics of the attack will of course depend on the particular POS coin.

>11. The attacker is left with is profit in some other currency, a worthless amount of the POS coin and a debt denominated in the now worthless POS currency.

>Countermeasure:

>The only known countermeasure is the intervention of the state.

And to quote the same poster's thoughts as of a few months ago:

https://www.reddit.com/r/Monero/comments/hpfjk8/could_monero...

>Proof of stake is ultimately based upon the premise that the holder of the staked coins has a financial incentive to act in the best interest of the crypto currency, in order to protect her stake. In other words she is net long the crypto currency. The trouble is that the network has no way of knowing if she is short or long, is acting as a dishonest custodian of somebody else's coins while staking them, has borrowed and sold a much larger number of coins creating net short position, has take a massive short position using leveraged derivatives, etc. In fact the network cannot even tell if she is a beneficial owner of the staked coins or just a nominee.

>Based upon this I formulated The Second Pirate Savings and Trust attack on Proof-of-Stake over 5 years ago. https://bitcointalk.org/index.php?topic=897488.msg10182752#m... Those who were around Bitcoin in 2011 - 2012 may remember the The First Pirate Savings and Trust, where a massive short position in Bitcoin was created, it then evolved into a ponzi scheme as the price of 1 BTC started to rise above 2 USD towards ~15 USD. At this point that whole thing blew up in default. Then the US SEC got to work fitting its promoter for an orange jumpsuit. Bitcoin survived because it is POW. If Bitcoin had been POS, then the promoter could have used the BTC under his control to wreck havoc on the Bitcoin network, causing the price to crash effectively making his debts worthless and very likely avoiding prosecution.