Coded Merkle Tree: Solving Data Availability Attacks in Blockchains

Abstract

In this paper, we propose coded Merkle tree (CMT), a novel hash accumulator that offers a constant-cost protection against data availability attacks in blockchains, even if the majority of the network nodes are malicious. A CMT is constructed using a family of sparse erasure codes on each layer, and is recovered by iteratively applying a peeling-decoding technique that enables a compact proof for data availability attack on any layer. Our algorithm enables any node to verify the full availability of any data block generated by the system by just downloading a Θ(1) byte block hash commitment and randomly sampling Θ(log b) bytes, where b is the size of the data block. With the help of only one connected honest node in the system, our method also allows any node to verify any tampering of the coded Merkle tree by just downloading Θ(log b) bytes. We provide a modular library for CMT in Rust and Python and demonstrate its efficacy inside the Parity Bitcoin client.

Concentrated Stopping Set Design for Coded Merkle Tree: Improving Security Against Data Availability Attacks in Blockchain Systems

“…Similar to the Merkle tree introduced in [2], a CMT is constructed by applying an LDPC code to each layer of the Merkle tree before hashing the layer to generate its parent layer. While we focus on the relevant issues of the CMT, specific details regarding the CMT can be found in [1]. We consider a blockchain network with full nodes and light nodes, where only full nodes can produce new blocks.…”

“…Networks in which light nodes are connected to a majority of malicious full nodes are susceptible to data availability (DA) attacks [1], [3] where a malicious full node generates a block with invalid transactions, publishes a Merkle root that satisfies the Merkle proof (thus allowing light nodes to successfully verify the inclusion of the transactions in the block), and hides the invalid portion of the block so that honest full nodes are unable to validate the block and notify the light nodes of the malicious behaviour. Light nodes can independently detect a DA attack if an anonymous request for a portion of the block is rejected by the full node that generates the block.…”

“…To alleviate this problem, authors in [3] introduced the method of coding the block using erasure codes such that it forces the adversary to hide a larger portion of the block which, then, can be detected with a high probability by the light nodes using random sampling. Work in [1] extends the idea into a technique called Coded Merkle Tree (CMT) that uses Low-Density Parity-Check (LDPC) codes to encode each layer of the Merkle tree. The advantage of an LDPC code is that it enables the use of a polynomial time peeling decoder at the full nodes to decode the coded symbols.…”

“…The peeling decoder fails to fully decode a layer of the CMT if the malicious node hides coded symbols corresponding to a stopping set of the LDPC code used in the layer. Since the malicious node can hide the smallest stopping set of the LDPC code, the probability of failure (at a particular layer) for the light nodes to detect a DA attack using random sampling depends on the stopping ratio (size of the smallest stopping set divided by the codeword length [1]) of the LDPC code.…”

“…The CMT can be constructed using any LDPC code. In [1], authors used codes from a well studied random LDPC ensemble that guarantees a certain stopping ratio with high probability. Despite the high stopping set ratio, these codes were originally designed for other types of channels (i.e., BSC) and are not necessarily optimal for this specific application.…”