Ordering by Unanimity: Giving Applications Sequencing Rights Without Breaking Composability

Abstract: Blockchain applications may have preferences over the order in which transactions execute: an automated market maker may use an external feed to price its liquidity, and require that the oracle update incorporating this price execute before any swap; an exchange may want to execute cancellations of limit orders before incoming market orders; an application may run an on-chain auction by executing bids from highest to lowest, so that the first bid wins. However, the ordering of transactions is chosen by the underlying blockchain and may not be compatible with the requirements of a specific application. In this paper, I tackle this problem by introducing an algorithm called unanimity override. The intuition is that when all the applications agree on how to order two transactions, the underlying blockchain should respect this agreement; a default order - the order in which transactions appear in the block - settles the rest. The problem with this naive approach is that application unanimity may form cycles, which the algorithm must break. Cycle-breaking is also the rule's main vulnerability because an attacker can insert transactions to manufacture a cycle. Yet two guarantees hold against any attacker who sets the default order, deploys applications, and inserts transactions. All transactions that interact with a single application that expressed preferences are ordered according to that application's preferences, even when they also interact with other applications that did not express preferences. Also, gated transactions - those that cannot be outranked in the unanimity order by any transaction crafted by an attacker - always execute as the applications unanimously prefer, even when they touch many applications. The two guarantees identify the preferences the protocol can protect, and they tell applications and senders in advance which transactions will execute in the intended order.

• The paper introduces the Unanimity Override protocol to embed application-level sequencing preferences into blockchain execution while preserving composability.
• It employs a cycle-breaking demotion mechanism to resolve conflicts in multi-opinion transactions, ensuring robust ordering for single-opinion and gated cases.
• The method balances application expressivity with security trade-offs, demonstrating enhanced resilience against front-running and adversarial manipulation.

Application-Level Transaction Sequencing and Composability: The Unanimity Override Protocol

Problem Setting and Motivation

Contemporary blockchain platforms host multiple composable applications (dApps), which collectively benefit from shared state and atomic composability. However, current architectures allocate transaction sequencing rights to the chain-level proposer or sequencer, effectively constraining application-specific sequencing requirements. This restricts advanced mechanisms such as oracle-gated AMMs, prioritized cancellations in order-book DEXs, or on-chain auctions needing custom sequencing over bids. Application designers often adopt protocol-level workarounds—dedicated chains, rollups, or off-protocol sequencing—to enforce their ordering policies, typically at the cost of composability.

The central question addressed in "Ordering by Unanimity: Giving Applications Sequencing Rights Without Breaking Composability" (2607.06144) is how to grant applications sequencing rights in a way that preserves composability and safety, and to what extent, if at all, application intent over execution order can be guaranteed in adversarial environments, including with an attacker controlling the default block order.

The Unanimity Override Protocol

The paper proposes unanimity override: an execution protocol that interleaves application-expressed sequencing preferences with a fallback default ordering. The protocol operates as follows:

1. Application Preferences: Each application specifies a ranking over the transactions it can interact with, forming a partial order. Importantly, a transaction may interact with multiple applications, and some applications are "opinionated" (i.e., have non-constant preferences).
2. Unanimity Relation: For transaction pairs that interact with intersecting sets of applications, a directed unanimity relationship is determined: $x$ precedes $y$ if all relevant applications agree, and at least one expresses a strict preference for $x$ before $y$. The resulting partial order is, in general, incomplete and intransitive.
3. Cycle Breaking: Since application-induced preferences can generate cycles (particularly via multi-opinion transactions), the protocol employs a fallback based on demotion—a cycle-involved multi-opinion transaction with lowest default priority is demoted, and its application comparisons are disregarded, ensuring termination and acyclicity.
4. Execution Order Extension: The acyclic repaired partial unanimity preference is extended into a total execution order via a reverse-Kahn topological sort, prioritizing default ordering within each layer.

Security Guarantees and Threat Model

The adversarial model assumes a worst-case attacker who controls the block's default ordering, can deploy applications and inject arbitrary transactions, but cannot censor or modify honest transactions. The paper formalizes two principal guarantees:

• Single-Opinion Guarantee: Any strict comparison between transactions for which only a single opinionated application is relevant is preserved under every attack strategy. Such transactions are never on cycles and hence never demoted; their order is enforced in line with application preference.
• Gated Region Guarantee: Extends the above to gated transactions—transactions that are unconditionally top-ranked in the unanimity partial order and unreachable by any attacker-crafted transaction. These are also protected against reordering.

Multi-opinion transactions are less protected, as an attacker may introduce cycles and, through fee or default ordering manipulation, induce the fallback to demote such transactions, thereby overriding their intended position.

These guarantees strictly improve upon the baseline where only the proposer determines execution order, and they generalize to any acyclic, Paretian aggregation rule that gives applications veto power over pairs for which they are the sole arbiters.

Comparative Analysis with Fee-Only Sequencing

Under priority-fee ordering, front-running is contained to outbidding: an attack requires paying higher fees. Unanimity override preserves the impossibility of front-running for protected single-opinion and gated transactions. For multi-opinion transactions, however, the cost structure for attack changes. In some instances, as the paper demonstrates, attacker-induced cycles may allow a griefing or front-running attacker to reverse application intent at lower cost than under pure fee order, by exploiting application preference conflicts and demotion selection. Conversely, in cases where applications are aligned or transactions are single-opinion, attacks are impossible even if the attacker pays maximal fees.

Griefing is distinctively enabled—an attacker can reorder pairs of honest transactions by cycle creation, which is provably impossible under pure fee ordering. Thus, while the protocol expands protected expressivity, it may broaden the attack surface for some multi-opinion, composable scenarios.

Composability and Application Design Trade-offs

A key implication is that application designers and senders must internalize the mechanism's exposed regions: as soon as a transaction is multi-opinionated (i.e., touches several relevant applications expressing preferences), it loses the protocol’s strongest guarantees. This introduces economic and interface incentives: rational senders will route sensitive transactions as single-opinion when protection is required (e.g., isolated bids in auctions, direct cancellations). Application architects can reason statically about which scenarios their sequencing preferences are robust to adversarial manipulation.

The protocol matches and extends the channel-specific sequencing guarantees of isolated rollups but without forgoing global composability: e.g., cross-application cancellations are possible when all touched applications cooperate and gate position.

Generalization, Fixed-Point Complexity, and Future Directions

The theoretical analysis is generalized to all aggregation rules satisfying Paretianity, provided the cycle-breaking procedure discards non-unanimity comparisons first. Application interaction sets can be declared up-front (trading expressive guarantees for static, easier verification), or may in principle be defined by actual execution (raising fixed-point existence, uniqueness, and cheap validation issues, left as future work).

While the demotion fallback uses a fee-based selection rule, more expressive topology-aware demotion (e.g., demoting the transaction on the most cycles) could narrow the attack region further. Integrating with order-fairness protocols, censorship-resistance mechanisms, and more expressive inclusion lists is suggested as a future research line.

Conclusion

Unanimity override provides a formal method for embedding application-level sequencing preferences into blockchain execution while preserving composability. It establishes clear boundaries for what application sequencing guarantees are immune to adversarial ordering, delineating the economic and architectural trade-offs for dApp designers and users. While the protocol cannot universally enforce all conceivable preferences in the presence of malicious block proposers and conflicting multi-application sequencing policies, it maximally preserves application intent where compatible. The mechanism signals an evolution toward programmable, composable sequencing in decentralized protocols, subject to ongoing work in fixed-point computation, more robust demotion logic, and integration with advanced censorship-resistance schemes.