The Economic Limits of Permissionless Consensus (2405.09173v2)

Abstract: The purpose of a consensus protocol is to keep a distributed network of nodes "in sync," even in the presence of an unpredictable communication network and adversarial behavior by some of the participating nodes. In the permissionless setting, these nodes may be operated by unknown players, with each player free to use multiple identifiers and to start or stop running the protocol at any time. Establishing that a permissionless consensus protocol is "secure" thus requires both a distributed computing argument (that the protocol guarantees consistency and liveness unless the fraction of adversarial participation is sufficiently large) and an economic argument (that carrying out an attack would be prohibitively expensive for an attacker). There is a mature toolbox for assembling arguments of the former type; the goal of this paper is to lay the foundations for arguments of the latter type. An ideal permissionless consensus protocol would, in addition to satisfying standard consistency and liveness guarantees, render consistency violations prohibitively expensive for the attacker without collateral damage to honest participants. We make this idea precise with our notion of the EAAC (expensive to attack in the absence of collapse) property, and prove the following results: 1. In the synchronous and dynamically available setting, with an adversary that controls at least one-half of the overall resources, no protocol can be EAAC. 2. In the partially synchronous and quasi-permissionless setting, with an adversary that controls at least one-third of the overall resources, no protocol can be EAAC. 3. In the synchronous and quasi-permissionless setting, there is a proof-of-stake protocol that, provided the adversary controls less than two-thirds of the overall stake, satisfies the EAAC property. All three results are optimal with respect to the size of the adversary.

• The paper reveals that economic factors, including resource thresholds like 50% and 33.33%, are key to deterring attacks on permissionless consensus protocols.
• The paper utilizes theoretical analysis to derive impossibility results in fully permissionless settings while proposing the PosT protocol for quasi-permissionless scenarios.
• The paper demonstrates that incorporating multi-voting stages and extended timeouts can economically burden adversaries and enhance blockchain security.

Understanding the Security of Permissionless Consensus Protocols: Asymmetry in Blockchain Protocols

Overview

Blockchain technology powers cryptocurrencies like Bitcoin and Ethereum. A critical aspect of blockchain is its permissionless consensus protocols, which allow an evolving set of participants to agree on the state of the blockchain without needing a central authority. Unlike permissioned consensus protocols with a fixed set of known participants, permissionless protocols face unique challenges involving unknown participants, player inactivity, and the Sybil attack, where one participant pretends to be many.

This paper explores the economic aspects of permissionless consensus protocols, exploring the cost of attacks that disrupt the consensus. By understanding these economic consequences, we aim to design more secure blockchain protocols.

Challenges in Permissionless Consensus

Before diving into the main results, let's recapitulate the fundamental challenges in permissionless consensus:

1. Unknown Players: The set of active participants isn’t fixed or known beforehand.
2. Player Inactivity: Participants can enter or leave the protocol at any time.
3. Sybil Attacks: A participant can present multiple identities.

These factors make security in permissionless consensus not just a computer science problem, but one that necessitates economic reasoning.

Economic Costs of Attacks

An attack's economic consequences are pivotal in deterrence. The paper uses several illustrative scenarios:

1. No Consequences (Cheap Attack): An attack doesn't affect the adversary's resource valuation.
2. Expensive Due to Collapse: The attack harms the entire system, including honest participants.
3. Expensive Without Collapse: The attack is expensive solely for the adversary, sparing honest participants.

The goal is to develop protocols where attacks are "expensive without collapse," avoiding collateral damage to honest players.

Key Definitions

EAAC Protocol

An EAAC (Economically Asymmetric and Accountable) protocol ensures two conditions:

• Honest participants’ investments are safeguarded.
• Adversaries suffer economic losses sufficient to deter attacks.

Theoretical Insights

Impossibility Results

1. Dynamically Available Setting:
   • Balance Threshold: If an adversary controls ≥50% of resources, no protocol can ensure both liveness and EAAC properties.
   • This holds true even with synchronous communications and time-invariant resource balances.
2. Partially Synchronous Setting:
   • Balance Threshold: In settings where message delays are uncertain but eventually bounded, attackers controlling ≥33.33% of resources can't be economically deterred post-attack.

In essence, these results highlight the difficulty in designing protocols that are both fault-tolerant and capable of imposing meaningful economic losses on attackers in fully permissionless or semi-permissionless settings.

Possibility Results

Despite the grim outlook from the impossibility results, an intriguing development emerges in quasi-permissionless settings (where all honest, resource-holding players are always active). The paper presents PosT (Proof-of-Stake Tendermint), an adaptation of the Tendermint protocol:

1. Key Mechanisms:
   • Epochs: Periodic intervals to fix validator sets.
   • Certificates of Guilt: Proof of Byzantine behavior produced during consistency violations.
   • Recovery Procedure: Uses a canonical protocol to achieve consensus on new states post-violation.
2. Guardrails:
   • Three Voting Stages: Ensures messages confirming guilt are universally disseminated.
   • Extended Timeout Mechanisms: Account for worst-case network delays, ensuring validators operate within realistic, bounded timeframes.
3. Outcomes:
   • Resilience: Achieves EAAC properties if adversaries control ≤67% of resources and assuming delays are bounded within a practical timeframe.
   • Economic Security: Even strong attackers suffer economically deterring attacks, especially in a partially synchronous setting.

Practical and Theoretical Implications

These findings underscore the intricate interplay between computer science and economics in blockchain protocol design. They suggest that while certain models expose vulnerabilities (like cheap attacks), enhancements such as extended timeouts, deliberate slashing mechanisms, and robust confirmation protocols can bolster security.

In practice:

• Protocol developers can use these insights to enhance blockchain security paradigms, especially in dynamic and partially reliable networks.
• The adoption of multi-vote stages and economic deterrents provides a viable approach to mitigate severe network and adversarial conditions.

Future Directions

Exploring protocols achieving EAAC under various practical constraints and refining economic models for adversarial behavior remain promising frontiers. The evolution of blockchain technology, through such rigorous analysis, paves the way for more secure, reliable, and economically robust decentralized systems.

Conclusion

This paper delves deep into the economics of consensus in blockchain systems, identifying key challenges and offering both sobering impossibility results and hopeful pathways for achieving economically secure permissionless protocols. With advancements like PosT and the rigorous frameworks outlined, the quest for secure, decentralized consensus continues with renewed vigor and insight.