Day 25 · Gas & Proof-of-Stake

You’ve built the whole machine: accounts (Day 21), a world state with a root (Day 22), a gas-metered VM (Day 23), and deployable contracts (Day 24). Today is the why behind two of its deepest choices. First: gas isn’t a fee-grab, it’s the only known way to safely run arbitrary code on a shared computer — a practical answer to a problem computer science proved is unsolvable. Second: the chain still has to decide whose version of the state is canonical, and in 2022 Ethereum changed that mechanism wholesale, from proof-of-work to proof-of-stake. We’ll take each qualitatively and honestly.

Gas is the answer to the halting problem

Here is the trap a programmable blockchain walks into. It promised to run anyone’s code. But “will this program ever stop?” — the halting problem — is one of the most famous results in computer science: Alan Turing proved in 1936 that no algorithm can decide, for every possible program, whether it halts. You cannot, in general, look at a contract and determine whether it loops forever. So a public chain can’t screen out infinite loops by inspection; the question is provably undecidable.

Gas sidesteps the impossibility instead of solving it. You don’t need to know whether a program halts if you guarantee it halts within a budget:

   undecidable:  "does this program halt?"             ← can't answer, ever (Turing 1936)
   decidable:    "does this program halt within N gas?" ← always answer: run it, count down

Every contract execution now has exactly two endings: it finishes on its own, or it runs out of gas and is halted. There is no third option, no hang. You felt this directly in the Day 23 test where JUMPDEST; PUSH 0; JUMP — a deliberate infinite loop — terminated as OutOfGas after its budget drained. The meter converts an undecidable question into a counted-down certainty. That is what gas is for; the fee is a side effect of needing a finite, ownerless resource to count.

Under the hood — gas turns Turing-completeness from a liability into a feature

A loop-free language is decidably terminating by construction — it simply can’t express an infinite loop, so you never need to bound it. That’s a real design choice: Bitcoin’s Script has no general loops on purpose, which is why Bitcoin needs no gas. Ethereum wanted the opposite — full Turing-completeness, so contracts can express arbitrary logic — and that power is precisely what reintroduces the halting problem. Gas is the toll you pay to keep Turing-completeness without keeping the danger: the language stays as expressive as you like, and every program is still guaranteed to stop, because the budget stops it. The expressiveness and the safety are bought separately — one by the VM, one by the meter.

The cost of Turing-completeness

So gas is the price of a powerful idea, and it’s worth seeing the trade-off laid bare against Project 5:

	Bitcoin Script	Ethereum / ethmini
Loops?	no (bounded by construction)	yes (Turing-complete)
Can express arbitrary contracts?	no	yes
Needs metering?	no — it always terminates	yes — or it might not
Halting guaranteed by…	the language’s limits	the gas budget
Failure mode to defend against	limited	infinite loops, runaway state

Bitcoin bought safety by giving up expressiveness; Ethereum kept expressiveness and bought safety back with gas. Neither is free. The brilliance of gas is that it makes the cost local and paid-for: whoever runs a heavy computation pays for the burden they place on every node, and a whole block has a gas ceiling, so no single block can demand unbounded work from the network.

By the numbers — the block budget that bounds a whole chain

Per-call gas bounds one contract; a block gas limit bounds an entire block of transactions. For years Ethereum’s block gas limit sat around 30 million gas; through 2025 it was raised in steps to 60 million gas (with a target of half the limit under EIP-1559’s fee market). Put our counter’s 312 gas next to that: a block can fit on the order of 60,000,000 ÷ 312 ≈ 190,000 counter-increments worth of computation — and not one unit more. The ceiling is what guarantees every node can process every block in bounded time, no matter what code the block contains. Gas meters a call; the block limit meters the planet. (Treat the exact figures as round and time-sensitive; the mechanism — a hard per-block computational ceiling — is the durable point.)

Whose state is canonical? PoW → PoS

Gas decides how much the chain will compute. A separate question decides whose sequence of blocks everyone accepts as the real history — consensus. In Project 5 you built proof-of-work (PoW): miners burn electricity racing to find a hash below a target, and the chain with the most cumulative work wins. Security comes from the sheer cost of redoing that work to rewrite history.

On 15 September 2022, in an event called The Merge, Ethereum replaced PoW with proof-of-stake (PoS) — one of the largest live re-architectings any production system has attempted. The swap changes what secures the chain:

   Proof-of-Work (Bitcoin, old Ethereum)     Proof-of-Stake (Ethereum since 2022)
   ─────────────────────────────────────     ────────────────────────────────────
   miners spend ELECTRICITY + hardware        validators LOCK UP capital (stake)
   most cumulative work wins                  protocol pseudo-randomly picks a proposer
   attack = out-compute the network's         attack = acquire and RISK a huge stake;
            hashpower (buy/run more rigs)               misbehaviour is SLASHED (burned)
   security from external cost (energy)       security from internal cost (capital at risk)

In PoS, instead of mining, you become a validator by staking capital (on Ethereum, a minimum of 32 ETH per validator). The protocol pseudo-randomly selects validators to propose and attest to blocks; honest attestation earns rewards, and provable misbehaviour — like signing two conflicting blocks — is punished by slashing, destroying part of the offender’s stake. The security argument shifts from “an attacker would have to out-spend everyone on electricity” to “an attacker would have to buy and then risk losing an enormous amount of the very asset they’re attacking.” The cost of cheating moves from external (energy burned) to internal (capital forfeited).

It actually happened — The Merge and a ~99.9% energy drop

Before The Merge, Ethereum’s proof-of-work consumed energy on the scale of a small country — estimates put it in the tens of terawatt-hours per year. When PoS went live on 15 September 2022, that mining work vanished overnight: independent estimates (e.g. from the Cambridge and Ethereum Foundation analyses) put the drop in Ethereum’s energy use at roughly 99.9%+ — frequently quoted near 99.95%. It is the single largest sustainability change in the industry’s history, and it happened on a live chain securing tens of billions of dollars without halting it. Treat the precise percentage as approximate, but the order of magnitude — a thousandfold-plus reduction — is well established. The point for this project: consensus and execution are separable. We could swap PoW for PoS under Ethereum because the state machine you built — accounts, world state, the VM, gas — never had to change. Consensus decides the order of transactions; everything downstream of the order is the deterministic machine of Day 22.

PoS is not magic — the honest caveats

PoS trades one set of worries for another, and a first-principles book should say so. Critics point to capital concentration (wealth begets validators begets rewards), reliance on a handful of large staking providers, and subtler attacks (long-range, censorship) that the design must guard against with mechanisms like slashing and finality checkpoints. PoW’s defenders value its anchoring in a real-world physical cost. The fair summary as of ~2025: PoS dramatically cut energy use and changed the security model from physics to economics — a genuine improvement on sustainability and a different, not obviously strictly-stronger, set of trust assumptions. Knowing what you traded is the literacy that matters.

The thread, closed

This project ran two questions at once. What problem did Ethereum solve? — it turned a ledger into a world computer: a shared, mutable state machine anyone can deploy logic to, made safe by gas (every program halts) and made agreed-upon by consensus (everyone accepts one order of transactions). And the playbook’s question — what does building this force you to understand, and what is Rust’s compiler protecting you from? — found its account-model answer across five days: atomic mutation of shared state. A reverted call must leave no trace but its nonce; the VM must halt untrusted code without panicking; the world must reduce to one deterministic root. Rust’s ownership and move semantics made the hard part — “commit the new state or drop it entirely, never half” — the natural shape at every level, from the VM’s working storage clone to apply’s snapshot. You didn’t just read how a blockchain works; you built one whose safety is enforced partly by a gas meter you wrote and partly by a compiler that wouldn’t let the state machine alias itself.

Next, Project 7 leaves the EVM behind for a chain built in Rust from the ground up — Solana — where the account model you just internalised takes a very different, parallel-execution form.

→ Next: Project 7 · Solana → · Prev: Day 24 · Smart Contracts · Back to the Project 6 overview

Check your understanding

1. State the halting problem and Turing’s 1936 result. Explain precisely how gas sidesteps it rather than solving it.
2. Bitcoin needs no gas; Ethereum does. What property of each system’s scripting language accounts for the difference, and what did each system give up to get its safety?
3. What are the two — and only two — ways a contract execution can end in ethmini? Which Day 23 test demonstrated the second one?
4. Contrast PoW and PoS on what an attacker must spend to rewrite history. In PoS, what is “slashing” and why does it change the cost of cheating from external to internal?
5. The page argues consensus and execution are “separable,” and cites The Merge as proof. Explain why Ethereum could swap PoW for PoS without changing the state machine you built this week.

Show answers

1. The halting problem asks whether an arbitrary program will ever stop; Turing proved in 1936 that no algorithm can decide this for all programs. Gas doesn’t answer “does it halt?” (still undecidable) — it makes the different, decidable question “does it halt within N gas?” the one that matters, by metering each step and forcing termination when the budget hits zero. Every execution then either finishes or is halted; there’s no hang.
2. Bitcoin Script has no general loops — it’s bounded by construction, so it always terminates and needs no meter; the price was expressiveness (it can’t express arbitrary contracts). Ethereum chose Turing-completeness (arbitrary logic), which reintroduces the halting problem, so it needs gas to guarantee termination; the price was needing the meter (and its fees) at all.
3. It finishes on its own (a clean STOP/RETURN), or it runs out of gas and is halted (OutOfGas). The Day 23 infinite_loop_is_bounded_by_gas test — JUMPDEST; PUSH 0; JUMP — demonstrated the second: an infinite loop terminated as OutOfGas once its budget drained.
4. PoW: an attacker must out-spend the network’s electricity + hardware to redo more cumulative work than honest miners. PoS: an attacker must acquire and risk a huge stake of the asset. Slashing is the protocol destroying part of a validator’s staked capital for provable misbehaviour (e.g. signing conflicting blocks). It makes cheating cost internal capital you forfeit, rather than external energy you burn — you lose the very asset you were attacking.
5. Because consensus only decides the order of transactions, and everything after the order — applying each transaction, mutating accounts, running the VM, computing the state root — is the deterministic state machine of Day 22. Swapping PoW for PoS changed how validators agree on the order, but the apply function and the world state it produces were untouched, so the execution layer carried over unchanged.