Pith. sign in

REVIEW 4 major objections 7 minor 68 references

A Game-Theoretic Approach to the Study of Blockchain's Robustness

T0 review · 4 major / 7 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Ethereum's proof-of-stake protocol is safe but only probabilistically live, this thesis argues.

desk verdict A serious thesis on Ethereum PoS with a novel attack and the first real analysis of the inactivity leak, but the headline liveness probability is an upper bound that omits the actual crux of the attack. read the letter →

arxiv 2411.19175 v1 pith:GYUQPJ3S submitted 2024-11-28 cs.CR cs.GT

Ulysse Pavloff This is my paper · ORCID
classification cs.CRcs.GT
keywords BlockchainEthereumProof-of-StakeLivenessSafetyInactivityleakGametheoryByzantinefaulttolerance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This thesis argues that Ethereum's proof-of-stake protocol is robust in a narrow distributed-systems sense—safety holds—but that its liveness guarantee is weaker than commonly claimed: it is probabilistic, not deterministic. The author formalizes the protocol from its specifications, proves safety, and then exhibits a 'probabilistic bouncing attack' that can postpone finality for k epochs with probability $(1 - \alpha^j)^k$, where $\alpha$ is the honest stake fraction and $j$ is the number of safe slots before views lock. The thesis then studies the inactivity leak, a mechanism intended to restore finality during long partitions, and shows that it can lead two conflicting chains to finalize and can push Byzantine stake above the one-third safety threshold even when the initial Byzantine fraction is below one-third. A final game-theoretic analysis models proposers and attesters as rational players and identifies conditions under which they can profit from deviating from the protocol's prescribed strategy.

What carries the argument

The load-bearing machinery is the probabilistic bouncing attack built on the protocol's safe-slots constant $j = \texttt{SAFE\_SLOTS\_TO\_UPDATE\_JUSTIFIED}$. A Byzantine proposer sends a block just before slot $j$ so that roughly one-third of honest validators update their justified-checkpoint view and the rest do not, making the canonical chain bounce; the attack continues while a Byzantine validator is proposer in one of the first $j$ slots, yielding the formula $P(\text{bouncing } k \text{ times}) = (1 - \alpha^j)^k$. For the inactivity leak analysis, the central object is the stake-evolution equation $s'(t) = -I(t)s(t)/2^{26}$ together with the inactivity-score random walk, from which the thesis derives a log-normal stake distribution and computes when the Byzantine-to-total stake ratio crosses one-third. In the game-theoretic part, the key objects are the attester reward schedule and the proposer reward function, which together determine when deviating from the fork choice rule is profitable.

What would settle it

Run a partially synchronous simulation with a favorable initial fork, a fixed honest fraction $\alpha$, and safe slots $j=8$: the paper's formula predicts finality is delayed for $k$ epochs with probability $(1 - \alpha^j)^k$. If, over many independent runs, the observed delay frequency for each $k$ is zero or diverges from the formula, or if a liveness proof is found in this model, the probabilistic liveness claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that Ethereum PoS does not provide a deterministic liveness guarantee in the partially synchronous model. The thesis proves safety: no two conflicting checkpoints can be finalized. It then exhibits a probabilistic bouncing attack: a Byzantine proposer releases a block on a competing chain just before the safe-slots window closes, splitting honest validators' views so that justification bounces between two chains and finality is delayed. The probability that this attack lasts k epochs is $(1 - \alpha^j)^k$. The thesis also shows that when the inactivity leak is active, two conflicting chains can be finalized after a long partition, and Byzantine validators can, by being semi-active, raise their stake proportion above one-third on both branches even when their initial proportion is below one-third. Finally, the game-theoretic model defines payoffs for proposers and attesters and shows that the obedient strategy is not always the unique best response: a cunning proposer can sometimes increase its reward by choosing a parent block that diverges from the fork choice rule, provided its block later becomes canonical.

Load-bearing premise

The probabilistic bouncing attack depends on a favorable setup where, at some epoch, a checkpoint on a competing chain is justifiable, and on Byzantine validators being able to time message delivery so that about one-third of honest validators update their view just before the safe-slot lock and the rest just after it.

Editorial extensions

If this is right

  • If the probabilistic bouncing attack is real, Ethereum PoS cannot promise liveness in the usual deterministic sense; the best available guarantee is that the probability of non-liveness decays exponentially with the number of epochs.
  • The safe-slots patch reduces the attack window but does not eliminate the attack; reducing $j$ to zero would prevent bouncing but would also prevent honest validators from reconciling different views, a more severe liveness threat.
  • An inactivity leak lasting more than roughly 4686 epochs with honest validators only can finalize two conflicting chains, so safety is bounded by partition duration.
  • With an initial Byzantine proportion close to one-third, semi-active Byzantine validators can push their stake proportion above one-third on both branches of a fork even during the synchronous period.
  • Under the game-theoretic payoffs, a proposer who builds on an older block can collect more attestation rewards and transaction fees than the obedient proposer, so the protocol is not automatically incentive compatible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The formula $(1 - \alpha^j)^k$ can be inverted: an application that requires finality with error at most $\varepsilon$ should wait $k$ epochs satisfying $(1 - \alpha^j)^k < \varepsilon$, converting the paper's probabilistic liveness claim into a concrete waiting-time rule.
  • The paper leaves implicit that the one-third Byzantine threshold is not a fixed invariant once penalties are active; the same stake-shifting effect it identifies in the inactivity leak could be probed for other penalty designs.
  • A testable extension is to simulate the probabilistic bouncing attack under the paper's own network assumptions and measure whether the required split of honest views is actually achievable; the current analysis conditions on that split rather than deriving it.
  • The game-theoretic result suggests that proposer-boost parameters and reward fractions could be tuned so that deviating from the fork choice rule is never profitable, which would make the protocol more robust to rational validators.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The thesis formalizes the Ethereum Proof-of-Stake protocol from the public specifications and analyzes its robustness under three models: a distributed-systems model without incentives, a distributed-systems model with the inactivity-leak penalties, and a game-theoretic model of rational proposers and attesters. The central claims are that Ethereum PoS satisfies safety but is only probabilistically live, that the inactivity leak can lead to safety violations (conflicting finalization or Byzantine stake exceeding the one-third threshold) even when the initial Byzantine proportion is below one-third, and that a game-theoretic analysis can identify profitable deviations from the prescribed protocol.

Significance. If the results hold, the thesis would be a valuable contribution because it connects the actual Ethereum specification to explicit protocol constants and derives quantitative predictions (e.g., the probability of a bouncing attack and the time to conflicting finalization) without fitting parameters. The pseudo-code extraction from the specifications and the explicit treatment of the inactivity-leak stake dynamics are strengths. However, the quantitative liveness claim rests on an unmodeled timing capability, and the safety proof is informal. These gaps make the current version unsuitable for publication without substantial revision.

major comments (4)
  1. [III.3.3A, Theorem III.2, Eq. (III.1)] The probability (1 - alpha^j)^k is derived solely from the event that a Byzantine validator is selected as proposer in one of the first j slots of each epoch. The attack description, however, also requires that the Byzantine proposer release its block so that a specific fraction of honest validators receives it before the justified-checkpoint update window closes and the complementary fraction receives it after the window (the 'last minute delivery' splitting condition). Proposer selection does not imply that this split is realizable in a given epoch, and no probability is assigned to the split condition. Therefore Eq. (III.1) is not the probability that the attack lasts k epochs; it is at best an upper bound conditional on a strong, unmodeled timing capability. Since this formula is the quantitative basis for the claim that Ethereum PoS is 'probabilistically live' and is reused in Section IV.5.3, this is a load-bearing gap.
  2. [III.3.1, Lemma III.2, Theorem III.1] The proof of Lemma III.2 is not rigorous. The sentence 'no justification occurred on a different chain before its finalization' is asserted without proof, but this is essentially the statement to be established. The argument then uses the fact that honest validators vote for the chain with the highest justified checkpoint, yet the interaction between finalization, the highest-justified-checkpoint rule, and the last-four-checkpoints condition in Algorithm 9 is never formalized. Since Theorem III.1 follows directly from this lemma, the claimed safety proof is incomplete.
  3. [III.3.2, Property III.2] The notion of 'probabilistic liveness' is never formally defined. Property III.2 defines liveness as an infinite-time property: the finalized chain is ever growing. The described attack only shows that finalization can be delayed for k epochs with probability (1 - alpha^j)^k, which tends to zero as k grows. It does not establish a positive probability of an infinite liveness violation. The paper should either define a finite-horizon probabilistic liveness property and prove the claim with respect to it, or explain why a measure-zero set of executions suffices to negate the deterministic liveness guarantee. As written, the connection between Theorem III.2 and the conclusion that the protocol is 'only probabilistically live' is not established.
  4. [IV.5.3, Eqs. (IV.18)-(IV.24)] The calculation that Byzantine stake exceeds the one-third threshold in the synchronous period is conditional on the probabilistic bouncing attack persisting, and the continuation probability is the contested Eq. (III.1) from Chapter III. In addition, the log-normal approximation allows the inactivity score to become negative, and the ejection and capping boundaries are inserted only through Eq. (IV.20) after the fact. The authors state that this is conservative, but the direction of the approximation error is not proved. The conclusion that Byzantine validators can exceed the safety threshold during the synchronous period is therefore conditional rather than established.
minor comments (7)
  1. [III.2.2, Algorithm 9] The procedure name 'jutificationFinalization' is a typo for 'justificationFinalization'.
  2. [IV and V] The symbol s is used both for stake (e.g., s_i(t) in Chapter IV) and for the number of slots (e.g., in Section V.2), which creates ambiguity across chapters.
  3. [IV.5.1, Eq. (IV.5)] The notation 'e−t2/225' is ambiguous: it could be read as e^{-t^2/2^25} or e^{-t^2/225}. The exponents should be written consistently and the base (2^26 versus the text '226') clarified.
  4. [IV.5.1] The citation '[Edg3]' appears without a full reference entry; please complete the citation.
  5. [V.2.1, Eq. (V.2)] The summation index 'nX j=n−ϕk' uses n for the number of slots, while n was previously used for the number of validators; a distinct symbol such as s should be used for the number of slots.
  6. [I.6.2 and III.3.3A] The introduction states that the attack assumes the adversary knows the network delay but does not control it, whereas the attack description says the Byzantine proposer releases its block 'just in time' to split the honest validators. The paper should clarify exactly which message-scheduling capabilities the adversary has.
  7. [Figure III.10] The y-axis label 'Probability 0' appears to be a typo, and the x-axis label should state the unit (epochs).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the thesis's equations are derived from protocol specifications and stated assumptions, not from their own conclusions.

full rationale

I walked the derivation chain of the three technical chapters and found no step in which a claimed prediction is equivalent to its own input by construction. The probabilistic-liveness result (Theorem III.2, Eq. III.1) is computed from the probability of a Byzantine proposer appearing in the first j slots, and the paper explicitly assumes the favorable setup and timing capabilities ('Our analysis focuses on the course of action of the attackers during the attack rather than the conditions necessary for it to occur'). The missing per-epoch timing-split probability is a validity/assumption gap, not a circular reduction, because the formula is not defined in terms of the conclusion it is meant to establish. The inactivity-leak safety results follow by solving the stake-evolution equations (IV.2)-(IV.24) under explicitly specified scenarios; initial proportions and behaviors are inputs, not fitted outputs, and no parameter is renamed as a prediction. The game-theoretic chapter defines payoffs from the protocol reward schedule (V.1)-(V.2) and evaluates strategies against those payoffs, so the equilibrium statements do not presuppose the desired outcome. Self-citations [PAT23], [PAT24a], [PAT24b] point to the author's own published versions of the same chapters, but the actual proofs appear in the manuscript and do not rely on those citations for their force. For these reasons no circular step can be quoted, and the score is 0.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No new physical or computational entities are postulated. The free parameters are scenario variables for adversarial configurations, not fitted to observed outcomes. The main assumptions are the standard distributed-systems model, the network timing capabilities of the adversary, and the continuous approximations used for analytical tractability.

free parameters (2)
  • p0 = scenario variable in [0,1]
    Initial proportion of honest validators active on branch 1. Central to Eqs IV.5, IV.9, IV.10, and the threshold analysis; varied by hand rather than estimated from data.
  • beta0 = scenario variable below 1/3
    Initial Byzantine stake proportion. The claims about Byzantine validators exceeding 1/3 depend on beta0 being in particular ranges, but beta0 itself is a scenario input, not a fitted constant.
assumptions (5)
  • domain assumption Static Byzantine adversary with beta < 1/3, partially synchronous network with GST, synchronized clocks, and signed best-effort broadcast.
    This is the standard model stated in Chapter II and used in all distributed-systems analyses.
  • domain assumption Byzantine validators can equivocate, withhold messages, and communicate across partitions, but cannot manipulate message delays between honest validators.
    Stated in Chapters II and III. This is essential for the splitting attack timing and the inactivity-leak scenarios.
  • domain assumption Central limit theorem and continuous log-normal approximation apply to the inactivity score distribution during a bouncing attack, including letting the score pass below zero.
    Used in Section IV.5.3 and Appendix A.2. The text acknowledges the nonnegativity bound is disregarded for analytical tractability.
  • domain assumption For the game model, the network is fully synchronous with zero latency, events per slot are atomic, and blocks can contain unlimited transactions and attestations.
    Stated in Chapter V, following [CKWN16]. The game analysis depends on this simplification.
  • domain assumption In the inactivity-leak analysis, the stake function is continuous and differentiable, and validators behave as active, semi-active, or inactive.
    Assumed in Section IV.4.3 and used in all the finalization-time formulas.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Game-Theoretic Approach to the Study of Blockchain's Robustness." pith.science (2026). https://pith.science/paper/GYUQPJ3S

@misc{pith2026241119175,
  author       = {Pith},
  title        = {Pith review of: A Game-Theoretic Approach to the Study of Blockchain's Robustness},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GYUQPJ3S}},
  note         = {Machine review of arXiv:2411.19175}
}
read the original abstract

Blockchains have sparked global interest in recent years, gaining importance as they increasingly influence technology and finance. This thesis investigates the robustness of blockchain protocols, specifically focusing on Ethereum Proof-of-Stake. We define robustness in terms of two critical properties: Safety, which ensures that the blockchain will not have permanent conflicting blocks, and Liveness, which guarantees the continuous addition of new reliable blocks. Our research addresses the gap between traditional distributed systems approaches, which classify agents as either honest or Byzantine (i.e., malicious or faulty), and game-theoretic models that consider rational agents driven by incentives. We explore how incentives impact the robustness with both approaches. The thesis comprises three distinct analyses. First, we formalize the Ethereum PoS protocol, defining its properties and examining potential vulnerabilities through a distributed systems perspective. We identify that certain attacks can undermine the system's robustness. Second, we analyze the inactivity leak mechanism, a critical feature of Ethereum PoS, highlighting its role in maintaining system liveness during network disruptions but at the cost of safety. Finally, we employ game-theoretic models to study the strategies of rational validators within Ethereum PoS, identifying conditions under which these agents might deviate from the prescribed protocol to maximize their rewards. Our findings contribute to a deeper understanding of the importance of incentive mechanisms for blockchain robustness and provide insights into designing more resilient blockchain protocols.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

68 extracted references · 60 canonical work pages

  1. [1]

    Ittai Abraham, Lorenzo Alvisi, and Joseph Y. Halpern. Distributed computing meets game theory: combining insights from two fields. SIGACT News , 42(2):69--76, 2011

    work page 2011

  2. [2]

    Rational vs byzantine players in consensus-based blockchains

    Yackolley Amoussou - Guenou, Bruno Biais, Maria Potop - Butucaru, and Sara Tucci Piergiovanni . Rational vs byzantine players in consensus-based blockchains. In Proceedings of the 19th International Conference on Autonomous Agents and Multiagent Systems, AAMAS '20, Auckland, New Zealand, May 9-13, 2020 , pages 43--51. International Foundation for Autonomo...

    work page 2020

  3. [3]

    Alturki, Jing Chen, Victor Luchangco, Brandon M

    Musab A. Alturki, Jing Chen, Victor Luchangco, Brandon M. Moore, Karl Palmskog, Lucas Pe \ n a, and Grigore Rosu. Towards a verified model of the algorand consensus protocol in coq. In Formal Methods. FM 2019 International Workshops - Porto, Portugal, October 7-11, 2019, Revised Selected Papers, Part I , volume 12232 of Lecture Notes in Computer Science ,...

    work page 2019

  4. [4]

    Security analysis of ripple consensus

    Ignacio Amores - Sesar, Christian Cachin, and Jovana Micic. Security analysis of ripple consensus. In 24th International Conference on Principles of Distributed Systems, OPODIS 2020, December 14-16, 2020, Strasbourg, France (Virtual Conference) , volume 184 of LIPIcs , pages 10:1--10:16. Schloss Dagstuhl - Leibniz-Zentrum f \" u r Informatik, 2020

    work page 2020

  5. [5]

    Tenderbake - A solution to dynamic repeated consensus for blockchains

    Lacramioara Astefanoaei, Pierre Chambart, Antonella Del Pozzo, Thibault Rieutord, Sara Tucci Piergiovanni , and Eugen Zalinescu. Tenderbake - A solution to dynamic repeated consensus for blockchains. In 4th International Symposium on Foundations and Applications of Blockchain 2021, FAB 2021, May 7, 2021, University of California, Davis, California, USA (V...

    work page 2021

  6. [6]

    Blockchain abstract data type

    Emmanuelle Anceaume, Antonella Del Pozzo , Romaric Ludinard, Maria Potop - Butucaru, and Sara Tucci - Piergiovanni . Blockchain abstract data type. In The 31st ACM on Symposium on Parallelism in Algorithms and Architectures, SPAA 2019, Phoenix, AZ, USA, June 22-24, 2019 , pages 349--358. ACM , 2019

    work page 2019

  7. [7]

    Correctness of tendermint-core blockchains

    Yackolley Amoussou - Guenou, Antonella Del Pozzo , Maria Potop - Butucaru, and Sara Tucci - Piergiovanni. Correctness of tendermint-core blockchains. In 22nd International Conference on Principles of Distributed Systems, OPODIS 2018, December 17-19, 2018, Hong Kong, China , pages 16:1--16:16, 2018

    work page 2018

  8. [8]

    On finality in blockchains

    Emmanuelle Anceaume, Antonella Del Pozzo , Thibault Rieutord, and Sara Tucci - Piergiovanni. On finality in blockchains. In 25th International Conference on Principles of Distributed Systems, OPODIS 2021, December 13-15, 2021, Strasbourg, France , pages 6:1--6:19, 2021

    work page 2021

Show all 68 references
  1. [9]

    The synchronization power of auditable registers

    Hagit Attiya, Antonella Del Pozzo, Alessia Milani, Ulysse Pavloff, and Alexandre Rapetti. The synchronization power of auditable registers. In 27th International Conference on Principles of Distributed Systems, OPODIS 2023, December 6-8, 2023, Tokyo, Japan , volume 286 of LIPI...

    2023

  2. [10]

    Dissecting tendermint

    Yackolley Amoussou - Guenou, Antonella Del Pozzo, Maria Potop - Butucaru, and Sara Tucci - Piergiovanni . Dissecting tendermint. In Networked Systems - 7th International Conference, NETYS 2019, Marrakech, Morocco, June 19-21, 2019, Revised Selected Papers , volume 11704 of Lec...

    2019

  3. [11]

    A partial hash collision based postage scheme, 1997

    Adam Back. A partial hash collision based postage scheme, 1997

    1997

  4. [12]

    Hashcash - a denial of service counter-measure, 2002

    Adam Back. Hashcash - a denial of service counter-measure, 2002

    2002

  5. [13]

    The blockchain folk theorem

    Bruno Biais, Christophe Bisière, Matthieu Bouvard, and Catherine Casamatta. The blockchain folk theorem. Review of Financial Studies , 32:1662--1715, 05 2019

    2019

  6. [14]

    Cartwright, Darren Hurley - Smith, and Julio C

    Alpesh Bhudia, Anna Cartwright, Edward J. Cartwright, Darren Hurley - Smith, and Julio C. Hernandez - Castro. Game theoretic modelling of a ransom and extortion attack on ethereum validators. In Proceedings of the 18th International Conference on Availability, Reliability and ...

    2023

  7. [15]

    Casper the friendly finality gadget

    Vitalik Buterin and Virgil Griffith. Casper the friendly finality gadget. CoRR , abs/1710.09437, 2017

    2017 arXiv

  8. [16]

    Vitalik Buterin, Diego Hernandez, Thor Kamphefner, Khiem Pham, Zhi Qiao, Danny Ryan, Juhyeok Sin, Ying Wang, and Yan X. Zhang. Combining GHOST and casper. CoRR , abs/2003.03052, 2020

    2003 arXiv

  9. [17]

    The latest gossip on BFT consensus

    Ethan Buchman, Jae Kwon, and Zarko Milosevic. The latest gossip on BFT consensus. CoRR , abs/1807.04938, 2018

    2018 arXiv

  10. [18]

    Eric A. Brewer. Towards robust distributed systems (abstract). In Gil Neiger, editor, Proceedings of the Nineteenth Annual ACM Symposium on Principles of Distributed Computing, July 16-19, 2000, Portland, Oregon, USA , page 7. ACM , 2000

    2000

  11. [19]

    Incentives in ethereum's hybrid casper protocol

    Vitalik Buterin, Dani \" e l Reijsbergen, Stefanos Leonardos, and Georgios Piliouras. Incentives in ethereum's hybrid casper protocol. Int. J. Netw. Manag. , 30(5), 2020

    2020

  12. [20]

    Ethereum: A next-generation smart contract and decentralized application platform, 2014

    Vitalik Buterin. Ethereum: A next-generation smart contract and decentralized application platform, 2014

    2014

  13. [21]

    Untraceable electronic cash

    David Chaum, Amos Fiat, and Moni Naor. Untraceable electronic cash. In Advances in Cryptology - CRYPTO '88, 8th Annual International Cryptology Conference, Santa Barbara, California, USA, August 21-25, 1988, Proceedings , volume 403 of Lecture Notes in Computer Science , pages...

    1988

  14. [22]

    Blind signatures for untraceable payments

    David Chaum. Blind signatures for untraceable payments. In David Chaum, Ronald L. Rivest, and Alan T. Sherman, editors, Advances in Cryptology: Proceedings of CRYPTO '82, Santa Barbara, California, USA, August 23-25, 1982 , pages 199--203. Plenum Press, New York, 1982

    1982

  15. [23]

    Kalodner, S

    Miles Carlsten, Harry A. Kalodner, S. Matthew Weinberg, and Arvind Narayanan. On the instability of bitcoin without the block reward. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, October 24-28, 2016 , pages 154--167...

    2016

  16. [24]

    Practical byzantine fault tolerance

    Miguel Castro and Barbara Liskov. Practical byzantine fault tolerance. In Proceedings of the Third USENIX Symposium on Operating Systems Design and Implementation (OSDI), New Orleans, Louisiana, USA, February 22-25, 1999 , pages 173--186. USENIX Association, 1999

    1999

  17. [25]

    Algorand: A secure and efficient distributed ledger

    Jing Chen and Silvio Micali. Algorand: A secure and efficient distributed ledger. Theor. Comput. Sci. , 777:155--183, 2019

    2019

  18. [26]

    Teku consensus client, 2022

    Consensys. Teku consensus client, 2022

    2022

  19. [27]

    B-money, 1998

    Wei Dai. B-money, 1998

    1998

  20. [28]

    Stockmeyer

    Danny Dolev, Cynthia Dwork, and Larry J. Stockmeyer. On the minimal synchronism needed for distributed consensus. J. ACM , 34(1):77--97, 1987

    1987

  21. [29]

    Lynch, and Larry J

    Cynthia Dwork, Nancy A. Lynch, and Larry J. Stockmeyer. Consensus in the presence of partial synchrony. J. ACM , pages 288--323, 1988

    1988

  22. [30]

    Pricing via processing or combatting junk mail

    Cynthia Dwork and Moni Naor. Pricing via processing or combatting junk mail. In Advances in Cryptology - CRYPTO '92, 12th Annual International Cryptology Conference, Santa Barbara, California, USA, August 16-20, 1992, Proceedings , volume 740 of Lecture Notes in Computer Scien...

    1992

  23. [31]

    A technical handbook on Ethereum's move to proof of stake and beyond

    Ben Edgington. A technical handbook on Ethereum's move to proof of stake and beyond . ETH2 Book , 2023-

    2023

  24. [32]

    Majority is not enough: Bitcoin mining is vulnerable

    Ittay Eyal and Emin G \" u n Sirer. Majority is not enough: Bitcoin mining is vulnerable. In Financial Cryptography and Data Security - 18th International Conference, FC 2014, Christ Church, Barbados, March 3-7, 2014, Revised Selected Papers , volume 8437 of Lecture Notes in C...

    2014

  25. [33]

    Majority is not enough: bitcoin mining is vulnerable

    Ittay Eyal and Emin G \" u n Sirer. Majority is not enough: bitcoin mining is vulnerable. Commun. ACM , 61(7):95--102, 2018

    2018

  26. [34]

    Mail from finney to, 2008

    Hal Finney. Mail from finney to, 2008

    2008

  27. [35]

    On incentive compatible role-based reward distribution in algorand

    Mehdi Fooladgar, Mohammad Hossein Manshaei, Murtuza Jadliwala, and Mohammad Ashiqur Rahman. On incentive compatible role-based reward distribution in algorand. In 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2020, Valencia, Spain, June...

    2020

  28. [36]

    Consensus specifications github

    Ethereum Foundation. Consensus specifications github. https://github.com/ethereum/consensus-specs/tree/a42d6706d89c414764eda7e2d0103e19f1e23761/specs, 2024

    2024

  29. [37]

    Garay, Aggelos Kiayias, and Nikos Leonardos

    Juan A. Garay, Aggelos Kiayias, and Nikos Leonardos. The bitcoin backbone protocol: Analysis and applications. In Advances in Cryptology - EUROCRYPT 2015 - 34th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Sofia, Bulgaria, April 2...

    2015

  30. [38]

    Resilience of hybrid casper under varying values of parameters

    Letterio Galletta, Cosimo Laneve, Ivan Mercanti, and Adele Veschetti. Resilience of hybrid casper under varying values of parameters. Distributed Ledger Technol. Res. Pract. , 2(1):5:1--5:25, 2023

    2023

  31. [39]

    L.M. Goodman. Tezos — a self-amending crypto-ledger, 2014

    2014

  32. [40]

    Selfish mining in ethereum

    Cyril Grunspan and Ricardo P \' e rez - Marco. Selfish mining in ethereum. In 2nd International Conference on Mathematical Research for Blockchain Economy, MARBLE 2020, online, August 24, 2020 , Springer Proceedings in Business and Economics, pages 65--90. Springer, 2020

    2020

  33. [41]

    Deconstructing stellar consensus

    \' A lvaro Garc \' a - P \' e rez and Maria Anna Schett. Deconstructing stellar consensus. In 23rd International Conference on Principles of Distributed Systems, OPODIS 2019, December 17-19, 2019, Neuch \^ a tel, Switzerland , volume 153 of LIPIcs , pages 5:1--5:16. Schloss Da...

    2019

  34. [42]

    An enciphering scheme based on a card shuffle

    Viet Tung Hoang, Ben Morris, and Phillip Rogaway. An enciphering scheme based on a card shuffle. In Advances in Cryptology -- CRYPTO 2012 . Springer Berlin Heidelberg, 2012

    2012

  35. [43]

    Halpern and Xavier Vila c a

    Joseph Y. Halpern and Xavier Vila c a. Rational consensus: Extended abstract. In Proceedings of the 2016 ACM Symposium on Principles of Distributed Computing, PODC 2016, Chicago, IL, USA, July 25-28, 2016 , pages 137--146. ACM , 2016

    2016

  36. [44]

    Resource pools and the cap theorem, 2020

    Andrew Lewis-Pye and Tim Roughgarden. Resource pools and the cap theorem, 2020

    2020

  37. [45]

    Shostak, and Marshall C

    Leslie Lamport, Robert E. Shostak, and Marshall C. Pease. The byzantine generals problem. ACM Trans. Program. Lang. Syst. , 4(3):382--401, 1982

    1982

  38. [46]

    Bitcoin: A peer-to-peer electronic cash system, 2008

    Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system, 2008

    2008

  39. [47]

    Analysis of bouncing attack on ffg, 2019

    Ryuya Nakamura. Analysis of bouncing attack on ffg, 2019

    2019

  40. [48]

    Prevention of bouncing attack on ffg, 2019

    Ryuya Nakamura. Prevention of bouncing attack on ffg, 2019

    2019

  41. [49]

    Stubborn mining: Generalizing selfish mining and combining with an eclipse attack

    Kartik Nayak, Srijan Kumar, Andrew Miller, and Elaine Shi. Stubborn mining: Generalizing selfish mining and combining with an eclipse attack. In IEEE European Symposium on Security and Privacy, EuroS & P 2016, Saarbr \" u cken, Germany, March 21-24, 2016 , pages 305--320. IEEE , 2016

    2016

  42. [50]

    Moroz, Rithvik Rao, and David C

    Michael Neuder, Daniel J. Moroz, Rithvik Rao, and David C. Parkes. Defending against malicious reorgs in tezos proof-of-stake. In AFT '20: 2nd ACM Conference on Advances in Financial Technologies, New York, NY, USA, October 21-23, 2020 , pages 46--58, 2020

    2020

  43. [51]

    Ebb-and-flow protocols: A resolution of the availability-finality dilemma

    Joachim Neu, Ertem Nusret Tas, and David Tse. Ebb-and-flow protocols: A resolution of the availability-finality dilemma. In 42nd IEEE Symposium on Security and Privacy, SP 2021, San Francisco, CA, USA, 24-27 May 2021 , pages 446--465. IEEE , 2021

    2021

  44. [52]

    Two more attacks on proof-of-stake ghost/ethereum

    Joachim Neu, Ertem Nusret Tas, and David Tse. Two more attacks on proof-of-stake ghost/ethereum. In Proceedings of the 2022 ACM Workshop on Developments in Consensus, ConsensusDay 2022, Los Angeles, CA, USA, 7 November 2022 , pages 43--52. ACM , 2022

    2022

  45. [53]

    Ethereum proof-of-stake under scrutiny

    Ulysse Pavloff, Yackolley Amoussou - Guenou, and Sara Tucci - Piergiovanni . Ethereum proof-of-stake under scrutiny. In Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing, SAC 2023, Tallinn, Estonia, March 27-31, 2023 , pages 212--221. ACM , 2023

    2023

  46. [54]

    Byzantine attacks exploiting penalties in ethereum pos

    Ulysse Pavloff, Yackolley Amoussou - Guenou, and Sara Tucci - Piergiovanni . Byzantine attacks exploiting penalties in ethereum pos. In 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2024, Brisbane, Australia, June 24-27, 2024 , pages 53...

    2024

  47. [55]

    Incentive compatibility of ethereum's pos consensus protocol

    Ulysse Pavloff, Yackolley Amoussou - Guenou, and Sara Tucci - Piergiovanni. Incentive compatibility of ethereum's pos consensus protocol. In 28th International Conference on Principles of Distributed Systems, OPODIS 2024, December 11-13, 2024, Lucca, Italy , volume 287 of LIPI...

    2024

  48. [56]

    Code consensus client, 2022

    Prysm. Code consensus client, 2022

    2022

  49. [57]

    Proof of stake instead of proof of work, 2011

    QuantumMechanic. Proof of stake instead of proof of work, 2011

    2011

  50. [58]

    Bouncing attack patch, 2019

    Specification Pull Request. Bouncing attack patch, 2019

    2019

  51. [59]

    Transaction fee mechanism design for the ethereum blockchain: An economic analysis of EIP-1559

    Tim Roughgarden. Transaction fee mechanism design for the ethereum blockchain: An economic analysis of EIP-1559 . CoRR , abs/2012.00854, 2020

    2012 arXiv

  52. [60]

    Blockchain without Waste: Proof-of-Stake

    Fahad Saleh. Blockchain without Waste: Proof-of-Stake . The Review of Financial Studies , 34(3):1156--1190, 2020

    2020

  53. [61]

    Three attacks on proof-of-stake ethereum

    Caspar Schwarz - Schilling, Joachim Neu, Barnab \' e Monnot, Aditya Asgaonkar, Ertem Nusret Tas, and David Tse. Three attacks on proof-of-stake ethereum. In Financial Cryptography and Data Security - 26th International Conference, FC 2022, Grenada, May 2-6, 2022, Revised Selec...

    2022

  54. [62]

    Optimal selfish mining strategies in bitcoin

    Ayelet Sapirshtein, Yonatan Sompolinsky, and Aviv Zohar. Optimal selfish mining strategies in bitcoin. In Financial Cryptography and Data Security - 20th International Conference, FC 2016, Christ Church, Barbados, February 22-26, 2016, Revised Selected Papers , volume 9603 of ...

    2016

  55. [63]

    Secure high-rate transaction processing in bitcoin

    Yonatan Sompolinsky and Aviv Zohar. Secure high-rate transaction processing in bitcoin. In Financial Cryptography and Data Security - 19th International Conference, FC 2015, San Juan, Puerto Rico, January 26-30, 2015, Revised Selected Papers , 2015

    2015

  56. [64]

    The gap game

    Itay Tsabary and Ittay Eyal. The gap game. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, ON, Canada, October 15-19, 2018 , pages 713--728. ACM , 2018

    2018

  57. [65]

    Polkadot: Vision for a heterogeneous multi-chain framework

    Gavin Wood. Polkadot: Vision for a heterogeneous multi-chain framework. White paper , 21(2327):4662, 2016

    2016

  58. [66]

    Reiter, Guy Golan - Gueta, and Ittai Abraham

    Maofan Yin, Dahlia Malkhi, Michael K. Reiter, Guy Golan - Gueta, and Ittai Abraham. Hotstuff: BFT consensus with linearity and responsiveness. In Proceedings of the 2019 ACM Symposium on Principles of Distributed Computing, PODC 2019, Toronto, ON, Canada, July 29 - August 2, 2...

    2019

  59. [67]

    Efficient MDP analysis for selfish-mining in blockchains

    Roi Bar Zur, Ittay Eyal, and Aviv Tamar. Efficient MDP analysis for selfish-mining in blockchains. In AFT '20: 2nd ACM Conference on Advances in Financial Technologies, New York, NY, USA, October 21-23, 2020 , pages 113--131. ACM , 2020

    2020

  60. [68]

    Max attestation matters: Making honest parties lose their incentives in ethereum pos

    Mingfei Zhang, Rujia Li, and Sisi Duan. Max attestation matters: Making honest parties lose their incentives in ethereum pos. IACR Cryptol. ePrint Arch. , page 1622, 2023

    2023

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.