The Combinatorics of the Longest-Chain Rule: Linear Consistency for Proof-of-Stake Blockchains

Abstract

Blockchain data structures maintained via the longest-chain rule have emerged as a powerful algorithmic tool for consensus algorithms. e technique-popularized by the Bitcoin protocol-has proven to be remarkably flexible and now supports consensus algorithms in a wide variety of se ings. Despite such broad applicability and adoption, current analytic understanding of the technique is highly dependent on details of the protocol's leader election scheme. A particular challenge appears in the proof-of-stake se ing, where existing analyses suffer from quadratic dependence on suffix length.We describe an axiomatic theory of blockchain dynamics that permits rigorous reasoning about the longestchain rule in quite general circumstances and establish bounds-optimal to within a constant-on the probability of a consistency violation. is se les a critical open question in the proof-of-stake se ing where we achieve linear consistency for the first time.Operationally, blockchain consensus protocols achieve consistency by instructing parties to remove a suffix of a certain length from their local blockchain. While the analysis of Bitcoin guarantees consistency with error 2 −k by removing O(k) blocks, recent work on proof-of-stake (PoS) blockchains has suffered from quadratic dependence: (PoS) blockchain protocols, exemplified by Ouroboros (Crypto 2017), Ouroboros Praos (Eurocrypt 2018) and Sleepy Consensus (Asiacrypt 2017), can only establish that the length of this suffix should be Θ(k 2 ).is consistency guarantee is a fundamental design parameter for these systems, as the length of the suffix is a lower bound for the time required to wait for transactions to se le. Whether this gap is an intrinsic limitation of PoS-due to issues such as the "nothing-at-stake" problem-has been an urgent open question, as deployed PoS blockchains further rely on consistency for protocol correctness: in particular, security of the protocol itself relies on this parameter. Our general theory directly improves the required suffix length from Θ(k 2 ) to Θ(k). us we show, for the first time, how PoS protocols can match proof-of-work blockchain protocols for exponentially decreasing consistency error.Our analysis focuses on the articulation of a two-dimensional stochastic process that captures the features of interest, an exact recursive closed form for the critical functional of the process, and tail bounds established for associated generating functions that dominate the failure events. Finally, the analysis provides an explicit polynomial-time algorithm for exactly computing the exponentially-decaying error function which can directly inform practice.Direct consequences. Our results establish consistency bounds in a quite general se ing-see below: In particular, they directly imply exp(−Θ(k)) consistency for the Sleepy consensus (Snow White) [21], Ouroboros [13], Ouroboros Praos [6], and Ouroboros Genesis [2] blockchain protocols. ( e Ouroboros Praos and Ouroboros Genesis analyses in fact directly relied on an earlier e-print version of the present...

Minotaur: Multi-Resource Blockchain Consensus

“…The analysis of our main security theorem, Theorem 6.1, draws from [21]. A more careful and improved analysis appears in [5], from which we may obtain the refined bound 1 − 𝑅𝐿(𝑒 −Ω (𝛿 3 𝜅) + 𝑒 −𝜆 ) for the statement of Theorem 6.1. In this section we analyze a private chain attack and show a corresponding lower bound.…”

Private attacks in longest chain proof-of-stake protocols with single secret leader elections

“…Previous works have proposed formal analyses of PoS blockchains based on PLEs [3,7,13]. In most of them, the proof revolves around finding a special block that guarantees security of the protocol and bounding the probability that this type of block does not appear in a sequence of 𝑛 consecutive blocks.…”

“…While this limits the generality of our work, we believe that, due to the conjecture above, studying the private attack alone gives a good proxy for the security of PoS longest-chain protocols. Furthermore, this simplifying assumption allows us to get exact bounds, as opposed to the loose bounds obtained by other analyses [3,7,11,13], usually based on Chebyshev's inequality or similar inequalities. Loose bounds on the probability of successful attacks would not be sufficient to meaningfully quantify the difference between SSLE and PLE in longest-chain PoS blockchains as even if one bound is smaller than the other, this does not say anything about how the exact probabilities compare.…”

“…In order to study the private games, we define the concept of gap, already introduced by Blum et al [7]. For 𝑛 ∈ [1, .…”

The Power of Random Symmetry-Breaking in Nakamoto Consensus

“…Another line of work [11,27] considers how the uniformly-at-random symmetry breaking strategy affects incentive-compatible selfish mining attacks; our analysis applies to general attacks. Random walks have been used to analyze the probability of consistency violations in proofs-of-stake protocols [3]; ours is the first work that uses coalescing random walks to analyze the common-prefix and chain quality of Bitcoin and other proof-of-work protocols.…”