Pith. sign in

REVIEW 3 major objections 4 minor 41 references

Nakamoto Consensus from Multiple Resources

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A blockchain's weight rule is secure exactly when it is monotone and homogeneous in the timed resources.

desk verdict A clean iff characterization of secure weight functions for multi-resource longest-chain consensus, with an honest but unresolved replotting caveat. read the letter →

arxiv 2508.01448 v1 pith:Q36L3OGE submitted 2025-08-02 cs.CR cs.DC

Mirza Ahad Baig , Christoph U. Günther , Krzysztof Pietrzak This is my paper
classification cs.CRcs.DC
keywords Nakamotoconsensuslongest-chainruleweightfunctionprivatedouble-spendingattackproofofspaceverifiabledelayworkreplotting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks which weight functions, formulas that score a block by the disk space, sequential computation, and parallel work recorded in it, make a longest-chain blockchain secure against private double-spending. In an idealized continuous model, it proves a complete answer: the weight function must be monotonically increasing and homogeneous of degree one in the two timed resources, meaning that scaling both V and W by the same factor scales the weight by that factor. Bitcoin's rule Γ = W and Chia's rule Γ = S·V pass this test, while Γ = W² fails because an adversary who privately squeezes the time on its fork can inflate the recorded weight. The classification extends to discrete blockchains with an extra condition that weight grow at most linearly in space, and it certifies practical new ways to combine multiple proofs of work.

What carries the argument

The central object is the weight function Γ: $ℝ^{{k₁}}$_{>0} × $ℝ^{{k₂}}$_{>0} × $ℝ^{{k₃}}$_{>0} → ℝ_{>0}, which assigns a weight to a block from the space, sequential work, and parallel work it records, together with the continuous chain model in which a chain's weight is the time-integral ∫ Γ(S(t),V(t),W(t)) dt. The key modeling move is that the adversary, when creating its private fork, may stretch or squeeze time: this multiplies the recorded timed resources V and W by a factor φ(t) while leaving cumulative totals otherwise unchanged. Homogeneity in V and W is precisely the condition that makes this time manipulation weight-neutral, and monotonicity prevents the adversary from winning by simply omitting resources; the proof shows these conditions are also necessary because any violation yields an explicit squeezing or stretching attack.

What would settle it

Settle the classification by exhibiting a monotonically increasing, V-W-homogeneous weight function that nevertheless allows a private double-spending attack in the continuous model, or by constructing a multi-epoch replotting attack that beats the difficulty-capped scheme of Section 4.3.2 despite η < ρ; either outcome would show the paper's security statement is incomplete.

Watch

Extended reading notes

Core claim

The paper's central discovery is a full classification of secure weight functions Γ(S,V,W) for Nakamoto-style, heaviest-chain consensus in the fully-permissionless setting over the physical resources of disk space S, sequential work V, and parallel work W. Theorems 1 and 2 state that Γ is secure against private double-spending attacks, under the honest-majority assumption measured by Γ itself, if and only if it is monotonically increasing and positively homogeneous in V and W, i.e. α·Γ(S,V,W) = Γ(S,αV,αW) for all α > 0. The only-if direction is proved constructively: for any monotone weight function that fails homogeneity, the paper builds an explicit time-stretching or time-squeezing attack that makes the adversary's private fork heavier than the honest chain even while the adversary has strictly less resource weight. In the discrete model, Theorem 3 shows that the same two conditions, together with subhomogeneity in S (roughly, at most linear growth in space), yield (δ, $δ^{{1/4}}$)-security. The classification also has direct consequences: solely space-based long-chain protocols do not satisfy the conditions, while Γ = √(W₁W₂) and Γ = min(W₁,...,W_k) are newly certified secure compositions of multiple proofs of work.

Load-bearing premise

The classification rests on an idealized continuous model in which the adversary's only extra power is stretching or squeezing the time recorded on its private fork, and it explicitly excludes replotting attacks; Section 4.3.1 shows that a replotting adversary can break even the classified-secure Chia rule unless an extra difficulty cap is added, and that cap is not proven secure across multiple difficulty epochs.

Editorial extensions

If this is right

  • Any new longest-chain blockchain over physical resources must use a weight function that is monotone and homogeneous of degree one in V and W; otherwise it is vulnerable to private double-spending even under an honest majority of resources.
  • Bitcoin's rule Γ = W and Chia's rule Γ = S·V are confirmed secure in this model, while a rule like Γ = W² is insecure, demonstrating concretely why recorded work must count linearly.
  • Combining multiple proof-of-work types with Γ = √(W₁·W₂) or Γ = min(W₁,...,W_k) is secure, and unlike the additive rule W₁+W₂, these compositions push miners to invest across all PoWs rather than only the cheapest one.
  • Space-only Nakamoto-like chains, such as Spacemint's design, cannot be secure against double-spending in the fully-permissionless setting; a stronger permissionless setting or an additional resource is necessary.
  • In the discrete model, security survives with a quantitative gap: resources may fluctuate by a factor of ξ = δ^{1/4} within blocks, provided the weight function grows at most linearly in space.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The homogeneity test gives protocol designers a cheap screening criterion: any proposed weight rule can be checked against α·Γ(S,V,W) = Γ(S,αV,αW) before attempting a full security proof, and functions failing it can be rejected immediately.
  • The same classification likely extends to any pair of per-second resources, since only the timed-versus-reusable distinction drives the argument; on-chain resources such as stake might be capturable as reusable resources in a richer model.
  • The replotting caveat suggests that, in practice, space-based chains should state their honest-majority assumption over space jointly with a proof-of-replication or similar commitment, effectively moving them toward the quasi-permissionless regime the paper identifies as necessary for Γ = S.
  • A natural next test is whether the δ^{1/4} fluctuation bound in Theorem 3 is tight; constructing a (δ,ξ)-attack with ξ < δ^{1/4} would show the discrete-model security statement is quantitatively optimal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper studies longest-chain blockchains whose blocks record up to three physical resources (disk space S, sequential speed V, parallel work W) and whose fork-choice rule sums a weight function Gamma(S,V,W) over blocks. The main result is a complete classification in an idealized continuous model: Gamma is secure against private double-spending attacks if and only if it is monotonically increasing and homogeneous of degree one in the timed resources V and W. This captures Bitcoin's Gamma=W and Chia's Gamma=S*V, and excludes functions such as Gamma=W^2. A discrete model is then introduced, where the same characterization holds under an additional subhomogeneity condition in S and a quantitative resource-smoothness assumption. The paper also discusses replotting attacks against space-based chains, gives a concrete attack on Chia's weight function when replotting is allowed, and proposes a difficulty-bound mitigation that is not proven secure across multiple difficulty epochs.

Significance. If the formal claims are taken at face value, Theorem 2 is a clean and useful classification: it reduces the design of resource-weighted longest-chain protocols to a monotonicity and homogeneity condition, and it suggests new multi-resource weight functions such as sqrt(W1*W2) and min(W1,W2). The paper is self-contained relative to its definitions, and the proofs are amenable to close checking. The main reservation is that the paper's most prominent space-based example, Chia, is nevertheless shown in Section 4.3 to be vulnerable to replotting attacks in the discrete model, and the proposed mitigation is explicitly left unproven across epochs. The practical security message for space-based chains is therefore conditional, even though the continuous-model classification is internally sound. The paper also deserves credit for being transparent about this limitation and about the fact that the private-double-spending attack is not proven to be the worst attack in the multi-resource setting.

major comments (3)
  1. [Section 4.3, Definition 11, Eq. (3)] The discrete-model security theorem assumes that a block's recorded space S■(b) is bounded between the infimum and supremum of the actual space profile, and replotting attacks violate exactly this assumption. Section 4.3.1 gives a concrete attack showing that Chia's Gamma=S*V, which satisfies the conditions of Theorem 3, can be broken when an adversary replots once in a block, and Section 4.3.3 states that the difficulty-bound fix does not formally prevent replotting attacks spanning several epochs where D resets. Since Chia is one of the two flagship examples in the abstract and Section 1.2.1 claims that Gamma=S*V is secure by Theorem 1, the paper's practical message for space-based chains is not fully supported. The authors should either provide a formal multi-epoch replotting-security proof for the difficulty-bound mechanism, or prominently qualify the abstract, Theorem 1, and Section 1.2.1 so that the classification is understood to apply only to chains that record space exactly and cannot be replotted within a block.
  2. [Appendix A, Lemma 3] The first sentence of Lemma 3 claims that if Gamma is constant, then it is not secure 'as the preconditions on the resource profiles can not be met.' This is backwards: a constant Gamma would be vacuously secure, because no resource profiles can satisfy the strict inequality in Eq. (2) of Definition 10. This sentence also contradicts Remark 4, which explicitly excludes constant weight functions precisely to avoid vacuous security. The sentence should be corrected, and the proof should either mention the exclusion in Definition 6 or handle the constant case consistently.
  3. [Appendix B, proof of Theorem 3] In the honest-chain bound, the line '= 1/xi^2 sum ... Gamma(SH_max, VH_max, WH_max)' is written as an equality, but only a '>= ' is justified after applying xi-smoothness together with subhomogeneity in S and homogeneity in (V,W). Similarly, in the adversarial-chain bound, the line '= xi^2 sum ... Gamma(SA_min, VA_min, WA_min)' should be '<= '. The displayed proof as written is formally invalid at these two lines, even though the intended inequalities are clear and the theorem statement is otherwise correct. These signs should be fixed.
minor comments (4)
  1. [Section 1.3.5] The phrase 'One the other hand' should read 'On the other hand'.
  2. [Section 3.3.1] The word 'squeezeing' should be 'squeezing'.
  3. [Section 4.2, Theorem 3 statement] The statement 'a weight function is Gamma(S,V,W) is (delta, 4th-root delta)-secure' contains a duplicated 'is'; it should read 'a weight function Gamma(S,V,W) is ...'.
  4. [Section 1.3.4] The paper candidly notes that it does not prove that private double-spending is the worst attack in the multi-resource setting, relying instead on evidence from prior work for PoW and Chia. This caveat is important enough that it should be reflected in the abstract or the introduction's informal Theorem 1, not only in the model discussion.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the main iff classification is proved from the paper's own security definition, and the self-citations and replotting exclusion are contextual, not load-bearing inputs.

full rationale

The paper's central claim, Theorem 2 (Section 3.4, proven in Appendix A), is a mathematical iff statement relative to Definition 10. The if-direction (Lemma 1) uses only monotonicity and homogeneity to bound the adversarial chain weight by the adversarial resource weight through a change of variables; the only-if direction (Lemmas 2 and 3) constructs explicit resource profiles satisfying the Definition 10 preconditions and produces an adversarial chain at least as heavy as the honest chain. No quantity is fitted to data and then reported as a prediction, and no condition is assumed that is equivalent to the conclusion. Theorem 3 (Section 4.2, Appendix B) is likewise an explicit proof from monotonicity, homogeneity in V and W, and subhomogeneity in S, with the quantitative xi/delta tradeoff derived rather than assumed. The only externally imported premise is that private double-spending is the worst attack (Section 1.3.4), which the paper explicitly labels as evidence from DKT+20 and GKR20 and leaves as future work to generalize; this is a threat-model assumption, not a circular reduction. The replotting attacks of Section 4.3 are explicitly excluded from Theorem 1 (Section 1.1: 'we will explicitly exclude replotting in the statement of the theorem below'), are shown in Section 4.3.1 to violate the model's space-recording assumption (Eq. 3), and Section 4.3.3 concedes that the difficulty-bound mitigation is not formally proven across multiple epochs. This is an honest limitation on applicability, not a circular step. The self-citations (e.g., CP19, PKF+18, BP25) are used for context, for known attack mitigations, or as external published results; the main proof does not reduce to any of them. No circularity found.

Assumptions & free parameters 0 free parameters · 7 assumptions · 0 invented entities

The central theorem is a mathematical result about an idealized model; the axioms above are the modeling choices that define the setting. No numbers are fitted to data and no new physical entities are introduced. The most consequential assumptions are the restriction to PDS attacks and the exclusion of replotting.

assumptions (7)
  • standard math Standard measure-theoretic integration and change-of-variables are used without formalization.
    Used throughout Appendices A and B for integrals over resource and chain profiles.
  • domain assumption External physical resources S, V, W are positive, Lebesgue-integrable functions of time; V and W are timed resources measured per second while S is a reusable snapshot.
    Definitions 4 through 9. This is the basis for allowing the adversary to multiply V and W by the squeezing factor phi while S is only re-sampled.
  • domain assumption The blockchain continuously and exactly records the resources used to create it; probabilistic PoW, network delay, and limited block space are abstracted away.
    Definitions 5 through 7 and Section 1.3.3. The iff theorem is proven in this idealized model; the paper argues real systems introduce only a multiplicative factor on honest resources.
  • domain assumption The only adversarial advantage modeled in PDS is stretching or squeezing time, plus discarding resources; the adversary cannot otherwise forge recorded resource profiles.
    Definition 9. This defines the attack class; homogeneity of Gamma is necessary exactly because phi scales V and W.
  • domain assumption Security against private double-spending attacks is taken as the relevant notion; DKT+20 and GKR20 suggest it is the worst attack, but the paper does not prove this for its multi-resource setting.
    Section 1.3.4 explicitly says 'cannot rule out that a worse attack than PDS exists' and leaves generalization to future work.
  • ad hoc to paper Replotting attacks are excluded from the main theorem; it is assumed they can be prevented by difficulty bounds eta<rho, but no formal security proof is given for multi-epoch replotting.
    Section 4.3 and Theorem 1 statement. Without this assumption, Chia's S*V is insecure even under honest majority, as shown in Section 4.3.1.
  • domain assumption In the discrete model, resources are xi-smooth within each block and honest parties create one block per unit interval; the adversary may partition time arbitrarily without overlapping blocks.
    Definitions 14 through 16 and Theorem 3. These hypotheses are needed for the quantitative (delta, fourth-root-of-delta) security statement.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Nakamoto Consensus from Multiple Resources." pith.science (2026). https://pith.science/paper/Q36L3OGE

@misc{pith2026250801448,
  author       = {Pith},
  title        = {Pith review of: Nakamoto Consensus from Multiple Resources},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Q36L3OGE}},
  note         = {Machine review of arXiv:2508.01448}
}
read the original abstract

The blocks in the Bitcoin blockchain record the amount of work W that went into creating them through proofs of work. When honest parties control a majority of the work, consensus is achieved by picking the chain with the highest recorded weight. Resources other than work have been considered to secure such longest-chain blockchains. In Chia, blocks record the amount of space S (via a proof of space) and sequential computational steps V (via a VDF). In this paper, we ask what weight functions {\Gamma}(S,V,W) (that assign a weight to a block as a function of the recorded space, speed, and work) are secure in the sense that whenever the weight of the resources controlled by honest parties is larger than the weight of adversarial parties, the blockchain is secure against private double-spending attacks. We completely classify such functions in an idealized "continuous" model: {\Gamma}(S,V,W) is secure against private double-spending attacks if and only if it is homogeneous of degree one in the timed resources V and W, i.e., {\alpha}{\Gamma}(S,V,W)={\Gamma}(S,{\alpha}V, {\alpha}W). This includes Bitcoin rule {\Gamma}(S,V,W)=W and Chia rule {\Gamma}(S,V,W) = SV. In a more realistic model where blocks are created at discrete time-points, one additionally needs some mild assumptions on the dependency on S (basically, the weight should not grow too much if S is slightly increased, say linear as in Chia). Our classification is more general and allows various instantiations of the same resource. It provides a powerful tool for designing new longest-chain blockchains. E.g., consider combining different PoWs to counter centralization, say the Bitcoin PoW W_1 and a memory-hard PoW W_2. Previous work suggested to use W_1+W_2 as weight. Our results show that using {\sqrt}(W_1){\cdot}{\sqrt}(W_2), {\min}{W_1,W_2} are also secure, and we argue that in practice these are much better choices.

Figures

Figures reproduced from arXiv: 2508.01448 by the authors.

Figure 1
Figure 1. Bitcoin’s weight function W and how it reacts to stretching and squeezing. The shaded area is the weight. We now have all ingredients to define when a weight function is secure against PDS attacks. On a high level, the definition states that an adversary having resources of less weight than the honest parties18 cannot create a private chain that is heavier than the honest parties one—even by manipulating time. In mo… view at source ↗
Figure 2
Figure 2. Chia’s weight function S · V and how it reacts to stretching and squeezing. The shaded are is the weight. Definition 10 (Weight Function Security Against PDS, Continuous Model). A weight function Γ is secure against private double-spending attack in the continuous model if for all RH = (S H(t),V H(t),WH(t))[0,Tend] and RA = (S A(t),V A(t),WA(t))[0,Tend] such that Γ(S A(t),V A(t),WA(t)) ≤ Γ(S H(t),V H(t),WH(t)) ∀t ∈ … view at source ↗
Figure 3
Figure 3. Consider two PoWs W1, W2, and two weight functions Γ(W1, W2) = W1 · W2 and Γ ′ (W1, W2) = √ W1 · W2. The top row show the real resources W1, W2 (left) and how squeezing them by ϕ(·) = 2 (left) results in Wg1, Wg2 (right). The bottom row shows that Γ is not secure because R 2 0 W · V < R 1 0 Wf · eV , i.e., squeezing increases the weight. In contrast, Γ ′ is not affected by the squeezing. in W and V (i.e., αΓ(S,V ,W)… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Discretization of parties. Here, honest parties discretize in fixed time intervals, [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 40 canonical work pages

  1. [1]

    Le, Marko Vukoli\' c , and Luca Zanolini

    Sarah Azouvi, Christian Cachin, Duc V. Le, Marko Vukoli\' c , and Luca Zanolini. Modeling Resources in Permissionless Longest-Chain Total-Order Broadcast . In Eshcar Hillel, Roberto Palmieri, and Etienne Rivi\` e re, editors, 26th International Conference on Principles of Distributed Systems (OPODIS 2022) , volume 253 of Leibniz International Proceedings ...

    work page 2022

  2. [2]

    Derkani, Jie Hou, Henrique Moniz, Alex North, Matej Pavlovic, Aayush Rajasekaran, Alejandro Ranchal-Pedrosa, Jorge M

    Steven Allen, Masih H. Derkani, Jie Hou, Henrique Moniz, Alex North, Matej Pavlovic, Aayush Rajasekaran, Alejandro Ranchal-Pedrosa, Jorge M. Soares, Jakub Sztandera, Marko Vukolic, and Jennifer Wang. Fast Finality in Filecoin (F3) . https://github.com/filecoin-project/FIPs/blob/master/FIPS/fip-0086.md, 2023

    work page 2023

  3. [3]

    Verifiable delay functions

    Dan Boneh, Joseph Bonneau, Benedikt B \"u nz, and Ben Fisch. Verifiable delay functions. In Hovav Shacham and Alexandra Boldyreva, editors, CRYPTO 2018, Part I , volume 10991 of LNCS , pages 757--788. Springer, Cham, August 2018

    work page 2018

  4. [4]

    Proof-of-stake longest chain protocols: Security vs predictability

    Vivek Kumar Bagaria, Amir Dembo, Sreeram Kannan, Sewoong Oh, David Tse, Pramod Viswanath, Xuechao Wang, and Ofer Zeitouni. Proof-of-stake longest chain protocols: Security vs predictability. In Jorge M. Soares, Dawn Song, and Marko Vukolic, editors, Proceedings of the 2022 ACM Workshop on Developments in Consensus, ConsensusDay 2022, Los Angeles, CA, USA,...

    work page 2022

  5. [5]

    Ouroboros genesis: Composable proof-of-stake blockchains with dynamic availability

    Christian Badertscher, Peter Gazi, Aggelos Kiayias, Alexander Russell, and Vassilis Zikas. Ouroboros genesis: Composable proof-of-stake blockchains with dynamic availability. In David Lie, Mohammad Mannan, Michael Backes, and XiaoFeng Wang, editors, ACM CCS 2018 , pages 913--930. ACM Press, October 2018

    work page 2018

  6. [6]

    Ouroboros genesis: Composable proof-of-stake blockchains with dynamic availability

    Christian Badertscher, Peter Gazi, Aggelos Kiayias, Alexander Russell, and Vassilis Zikas. Ouroboros genesis: Composable proof-of-stake blockchains with dynamic availability. In David Lie, Mohammad Mannan, Michael Backes, and XiaoFeng Wang, editors, Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, O...

    work page 2018

  7. [7]

    Proof of activity: Extending bitcoin's proof of work via proof of stake [extended abstract]y

    Iddo Bentov, Charles Lee, Alex Mizrahi, and Meni Rosenfeld. Proof of activity: Extending bitcoin's proof of work via proof of stake [extended abstract]y. SIGMETRICS Perform. Eval. Rev. , 42(3):34–37, December 2014

    work page 2014

  8. [8]

    On the (in)security of proofs-of-space based longest-chain blockchains

    Mirza Ahad Baig and Krzysztof Pietrzak. On the (in)security of proofs-of-space based longest-chain blockchains. Financial Cryptography and Data Security FC , 2025

    work page 2025

Show all 41 references
  1. [9]

    https://docs.chia.net/green-paper-abstract/, 2019

    The chia network blockchain. https://docs.chia.net/green-paper-abstract/, 2019

    2019

  2. [10]

    The chia network blockchain

    Bram Cohen and Krzysztof Pietrzak. The chia network blockchain. https://docs.chia.net/files/Precursor-ChiaGreenPaper.pdf, 2019. This is an early proposal and differs significantly from the implemented version chia2

    2019

  3. [11]

    Proofs of space

    Stefan Dziembowski, Sebastian Faust, Vladimir Kolmogorov, and Krzysztof Pietrzak. Proofs of space. In Rosario Gennaro and Matthew J. B. Robshaw, editors, CRYPTO 2015, Part II , volume 9216 of LNCS , pages 585--605. Springer, Berlin, Heidelberg, August 2015

    2015

  4. [12]

    Ouroboros praos: An adaptively-secure, semi-synchronous proof-of-stake blockchain

    Bernardo David, Peter Gazi, Aggelos Kiayias, and Alexander Russell. Ouroboros praos: An adaptively-secure, semi-synchronous proof-of-stake blockchain. In Jesper Buus Nielsen and Vincent Rijmen, editors, EUROCRYPT 2018, Part II , volume 10821 of LNCS , pages 66--98. Springer, C...

    2018

  5. [13]

    Everything is a race and nakamoto always wins

    Amir Dembo, Sreeram Kannan, Ertem Nusret Tas, David Tse, Pramod Viswanath, Xuechao Wang, and Ofer Zeitouni. Everything is a race and nakamoto always wins. In Jay Ligatti, Xinming Ou, Jonathan Katz, and Giovanni Vigna, editors, ACM CCS 2020 , pages 859--878. ACM Press, November 2020

    2020

  6. [14]

    PoSAT : Proof-of-work availability and unpredictability, without the work

    Soubhik Deb, Sreeram Kannan, and David Tse. PoSAT : Proof-of-work availability and unpredictability, without the work. In Nikita Borisov and Claudia D \'i az, editors, FC 2021, Part II , volume 12675 of LNCS , pages 104--128. Springer, Berlin, Heidelberg, March 2021

    2021

  7. [15]

    Snow white: Robustly reconfigurable consensus and applications to provably secure proof of stake

    Phil Daian, Rafael Pass, and Elaine Shi. Snow white: Robustly reconfigurable consensus and applications to provably secure proof of stake. In Ian Goldberg and Tyler Moore, editors, FC 2019 , volume 11598 of LNCS , pages 23--41. Springer, Cham, February 2019

    2019

  8. [16]

    Majority is not enough: Bitcoin mining is vulnerable

    Ittay Eyal and Emin G \"u n Sirer. Majority is not enough: Bitcoin mining is vulnerable. In Nicolas Christin and Reihaneh Safavi-Naini , editors, FC 2014 , volume 8437 of LNCS , pages 436--454. Springer, Berlin, Heidelberg, March 2014

    2014

  9. [17]

    Filecoin

    Filecoin. Filecoin. https://filecoin.io, 2024

    2024

  10. [18]

    Minotaur: Multi-resource blockchain consensus

    Matthias Fitzi, Xuechao Wang, Sreeram Kannan, Aggelos Kiayias, Nikos Leonardos, Pramod Viswanath, and Gerui Wang. Minotaur: Multi-resource blockchain consensus. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , CCS '22, page 1095–1108, ...

    2022

  11. [19]

    Algorand: Scaling byzantine agreements for cryptocurrencies

    Yossi Gilad, Rotem Hemo, Silvio Micali, Georgios Vlachos, and Nickolai Zeldovich. Algorand: Scaling byzantine agreements for cryptocurrencies. In Proceedings of the 26th Symposium on Operating Systems Principles , SOSP '17, page 51–68, New York, NY, USA, 2017. Association for ...

    2017

  12. [20]

    Garay, Aggelos Kiayias, and Nikos Leonardos

    Juan A. Garay, Aggelos Kiayias, and Nikos Leonardos. The bitcoin backbone protocol: Analysis and applications. In Elisabeth Oswald and Marc Fischlin, editors, EUROCRYPT 2015, Part II , volume 9057 of LNCS , pages 281--310. Springer, Berlin, Heidelberg, April 2015

    2015

  13. [21]

    Tight consistency bounds for bitcoin

    Peter Gazi, Aggelos Kiayias, and Alexander Russell. Tight consistency bounds for bitcoin. In Jay Ligatti, Xinming Ou, Jonathan Katz, and Giovanni Vigna, editors, ACM CCS 2020 , pages 819--838. ACM Press, November 2020

    2020

  14. [22]

    Filecoin proof of useful space - technical report

    Irene Giacomelli and Luca Nizzardo. Filecoin proof of useful space - technical report

  15. [23]

    Bitcoin's latency-security analysis made simple

    Dongning Guo and Ling Ren. Bitcoin's latency-security analysis made simple. In Maurice Herlihy and Neha Narula, editors, Proceedings of the 4th ACM Conference on Advances in Financial Technologies, AFT 2022, Cambridge, MA, USA, September 19-21, 2022 , pages 244--253. ACM , 2022

    2022

  16. [24]

    Practical settlement bounds for proof-of-work blockchains

    Peter Gazi, Ling Ren, and Alexander Russell. Practical settlement bounds for proof-of-work blockchains. In Heng Yin, Angelos Stavrou, Cas Cremers, and Elaine Shi, editors, ACM CCS 2022 , pages 1217--1230. ACM Press, November 2022

    2022

  17. [25]

    Practical settlement bounds for longest-chain consensus

    Peter Gazi, Ling Ren, and Alexander Russell. Practical settlement bounds for longest-chain consensus. In Helena Handschuh and Anna Lysyanskaya, editors, CRYPTO 2023, Part I , volume 14081 of LNCS , pages 107--138. Springer, Cham, August 2023

    2023

  18. [26]

    Weight-based nakamoto-style blockchains

    Simon Holmgaard Kamp, Bernardo Magri, Christian Matt, Jesper Buus Nielsen, S ren Eller Thomsen, and Daniel Tschudi. Weight-based nakamoto-style blockchains. In Patrick Longa and Carla R \`a fols, editors, Progress in Cryptology -- LATINCRYPT 2021 , pages 299--319, Cham, 2021. ...

    2021

  19. [27]

    Ppcoin: Peer-to-peer crypto-currency with proof-of-stake

    Sunny King and Scott Nadal. Ppcoin: Peer-to-peer crypto-currency with proof-of-stake. 2012

    2012

  20. [28]

    Ouroboros: A provably secure proof-of-stake blockchain protocol

    Aggelos Kiayias, Alexander Russell, Bernardo David, and Roman Oliynykov. Ouroboros: A provably secure proof-of-stake blockchain protocol. In Jonathan Katz and Hovav Shacham, editors, CRYPTO 2017, Part I , volume 10401 of LNCS , pages 357--388. Springer, Cham, August 2017

    2017

  21. [29]

    Byzantine generals in the permissionless setting

    Andrew Lewis-Pye and Tim Roughgarden. Byzantine generals in the permissionless setting. In Foteini Baldimtsi and Christian Cachin, editors, FC 2023, Part I , volume 13950 of LNCS , pages 21--37. Springer, Cham, May 2023

    2023

  22. [30]

    Permissionless consensus

    Andrew Lewis-Pye and Tim Roughgarden. Permissionless consensus. https://arxiv.org/abs/2304.14701, 2024

    2024 arXiv

  23. [31]

    Bitcoin: A peer-to-peer electronic cash system

    Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. http://www.bitcoin.org/bitcoin.pdf, 2009

    2009

  24. [32]

    Simple verifiable delay functions

    Krzysztof Pietrzak. Simple verifiable delay functions. In Avrim Blum, editor, ITCS 2019 , volume 124, pages 60:1--60:15. LIPIcs , January 2019

    2019

  25. [33]

    SpaceMint : A cryptocurrency based on proofs of space

    Sunoo Park, Albert Kwon, Georg Fuchsbauer, Peter Gazi, Jo \"e l Alwen, and Krzysztof Pietrzak. SpaceMint : A cryptocurrency based on proofs of space. In Sarah Meiklejohn and Kazue Sako, editors, FC 2018 , volume 10957 of LNCS , pages 480--499. Springer, Berlin, Heidelberg, Feb...

    2018

  26. [34]

    Rethinking large-scale consensus

    Rafael Pass and Elaine Shi. Rethinking large-scale consensus. In Boris Köpf and Steve Chong, editors, CSF 2017 Computer Security Foundations Symposium , pages 115--129. IEEE Computer Society Press, 2017

    2017

  27. [35]

    Analysis of the blockchain protocol in asynchronous networks

    Rafael Pass, Lior Seeman, and abhi shelat . Analysis of the blockchain protocol in asynchronous networks. In Jean-S \' e bastien Coron and Jesper Buus Nielsen, editors, EUROCRYPT 2017, Part II , volume 10211 of LNCS , pages 643--673. Springer, Cham, April / May 2017

    2017

  28. [36]

    Analysis of Nakamoto consensus

    Ling Ren. Analysis of Nakamoto consensus. Cryptology ePrint Archive, Report 2019/943, 2019

    2019

  29. [37]

    Accelerating Bitcoin 's transaction processing

    Yonatan Sompolinsky and Aviv Zohar. Accelerating Bitcoin 's transaction processing. F ast money grows on trees, not chains. Cryptology ePrint Archive, Report 2013/881, 2013

    2013

  30. [38]

    Permissionless consensus in the resource model

    Benjamin Terner. Permissionless consensus in the resource model. In Ittay Eyal and Juan Garay, editors, Financial Cryptography and Data Security , pages 577--593, Cham, 2022. Springer International Publishing

    2022

  31. [39]

    On-chain timestamps are accurate

    Apostolos Tzinas, Srivatsan Sridhar, and Dionysis Zindros. On-chain timestamps are accurate. Cryptology ePrint Archive, Report 2023/1648, 2023

    2023

  32. [40]

    Efficient verifiable delay functions

    Benjamin Wesolowski. Efficient verifiable delay functions. In Yuval Ishai and Vincent Rijmen, editors, EUROCRYPT 2019, Part III , volume 11478 of LNCS , pages 379--407. Springer, Cham, May 2019

    2019

  33. [41]

    Ethereum: A secure decentralised generalised transaction ledger

    Gavin Wood. Ethereum: A secure decentralised generalised transaction ledger

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.