Pith. sign in

REVIEW 2 major objections 32 references

Techreport: Evaluating Tor-based Location Privacy for Ethereum Validators

T0 review · 2 major / 0 minor · reviewed 2026-06-29 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Tor push protocol lets Ethereum validators hide IP addresses from their identities with 614 ms average added latency.

desk verdict A deployed Nimbus PoC shows Tor adds ~614 ms latency for validator messages on Goerli, but the mainnet scaling case is untested. read the letter →

arxiv 2605.29131 v1 pith:BJBR2N5M submitted 2026-05-27 cs.CR

Muhammad Umar Janjua , Akshaya Mani , Uğur Şen , Daniel Kaiser This is my paper · ORCID
classification cs.CR
keywords ethereumtorvalidatorprivacylocationipunlinkabilityblockchainsecurityproofofconcept
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper evaluates a Tor-based method to prevent attackers from linking validator identities to IP addresses, which could otherwise enable DoS, MEV, and finality attacks. It reviews prior network and consensus privacy techniques, then presents Tor push as a protocol that routes attestations, aggregations, and proposals through Tor. A working proof-of-concept was built inside the Nimbus client and run on the Goerli testnet. Measurements indicate the approach adds 613.82 ms latency on average while leaving overall network performance intact.

What carries the argument

Tor push protocol that forwards validator messages (attestations, aggregations, block proposals) through the Tor network to break IP-to-identity linkage.

What would settle it

Direct measurement on mainnet showing that Tor push either adds latency far above 614 ms on average or allows successful IP-identity correlation under attack traffic.

Watch

Extended reading notes

Core claim

Tor push decouples validator IDs from beacon-node IP addresses by sending messages over Tor, achieving unlinkability that makes end-to-end correlation difficult. The Goerli deployment of the Nimbus implementation shows this is feasible with an average 613.82 ms overhead and no compromise to network operation.

Load-bearing premise

The latency and security behavior measured on the Goerli testnet PoC will match what occurs on the production Ethereum mainnet under realistic load and attack conditions.

Editorial extensions

If this is right

  • Validators gain protection against IP-targeted DoS and correlation-based MEV or finality attacks.
  • Existing Ethereum clients can incorporate the mechanism without breaking consensus or network throughput.
  • Unlinkability holds as long as Tor circuits remain uncompromised by the attacker.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same routing idea could be tested on other proof-of-stake networks that expose validator IPs.
  • Combining Tor push with existing consensus-layer privacy methods might create defense in depth.
  • Longer-term monitoring on mainnet would be needed to check whether circuit churn affects attestation timeliness.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 0 minor

Summary. The paper reviews network- and consensus-layer techniques for Ethereum validator privacy, introduces a Tor-based 'Tor push' protocol to unlink validator IDs from beacon node IP addresses, describes a deployed PoC implementation in the Nimbus client that routes attestations, aggregations, and proposals over Tor to the Goerli testnet, reports an average latency overhead of 613.82 ms from this deployment, and provides a security analysis, concluding that Tor integration yields tolerable overhead while enhancing location privacy without compromising overall network performance.

Significance. If the measured latency and unlinkability properties hold under realistic conditions, the work supplies direct empirical evidence from a working PoC for a practical mechanism to mitigate IP-based attacks (DoS, MEV, finality risks) on Ethereum validators. The deployed Nimbus implementation on Goerli is a concrete strength, offering a falsifiable performance data point rather than purely theoretical analysis.

major comments (2)
  1. [Evaluation / Experimental Results] The central performance claim rests on the reported 613.82 ms average latency overhead (abstract and evaluation), yet the manuscript provides no description of experimental methodology, number of trials, statistical analysis, variance, or comparison baselines. This directly weakens the evidence for the 'tolerable' and 'without compromising overall network performance' assertions.
  2. [Discussion / Scalability Analysis] The PoC was run on Goerli (~10k validators, low stakes). The manuscript does not analyze or measure behavior under mainnet-scale conditions (>500k validators, 12-second slots, higher bandwidth contention, Tor circuit churn, or combined timing/traffic-analysis adversaries), which is load-bearing for the claim that results generalize and network performance remains uncompromised.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback. Below we respond point by point to the major comments.

read point-by-point responses

  1. Referee: [Evaluation / Experimental Results] The central performance claim rests on the reported 613.82 ms average latency overhead (abstract and evaluation), yet the manuscript provides no description of experimental methodology, number of trials, statistical analysis, variance, or comparison baselines. This directly weakens the evidence for the 'tolerable' and 'without compromising overall network performance' assertions.

    Authors: We agree that the evaluation section lacks sufficient methodological detail. The reported 613.82 ms figure originates from latency measurements collected during the Nimbus PoC deployment on Goerli, but the manuscript does not describe the number of trials, variance, statistical methods, or non-Tor baselines. We will revise the evaluation section to include these elements, thereby strengthening support for the performance claims. revision: yes

  2. Referee: [Discussion / Scalability Analysis] The PoC was run on Goerli (~10k validators, low stakes). The manuscript does not analyze or measure behavior under mainnet-scale conditions (>500k validators, 12-second slots, higher bandwidth contention, Tor circuit churn, or combined timing/traffic-analysis adversaries), which is load-bearing for the claim that results generalize and network performance remains uncompromised.

    Authors: The manuscript presents results from a proof-of-concept on the Goerli testnet and does not claim direct generalization to mainnet. We will add an explicit discussion of scalability limitations, including factors such as validator count, slot timing, bandwidth, circuit churn, and potential adversaries, to better delineate the scope of the current findings. Full mainnet-scale measurements lie outside the scope of this techreport. revision: partial

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: central claim rests on direct PoC measurements

full rationale

The paper reports empirical latency and security results from a deployed Nimbus PoC on Goerli testnet (average overhead 613.82 ms). No equations, fitted parameters, model-based predictions, or derivation chain appear in the provided text. The claim is supported by direct experimental data rather than any reduction to inputs by construction, self-citation load-bearing, or renamed known results. External validity concerns (Goerli vs. mainnet) are separate from circularity.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

This is an empirical techreport with no mathematical derivations; no free parameters are fitted, no domain axioms beyond standard networking assumptions are invoked, and no new entities are postulated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Techreport: Evaluating Tor-based Location Privacy for Ethereum Validators." pith.science (2026). https://pith.science/paper/BJBR2N5M

@misc{pith2026260529131,
  author       = {Pith},
  title        = {Pith review of: Techreport: Evaluating Tor-based Location Privacy for Ethereum Validators},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BJBR2N5M}},
  note         = {Machine review of arXiv:2605.29131}
}
read the original abstract

Privacy and anonymity of validators, especially regarding IP address linkability, are essential to protect the Ethereum network from various attacks. Network-level attacks, such as DoS, can interrupt validators and affect the overall security of the Ethereum network. Correlating the IP addresses of validators with their identities, along with knowledge about their action slots can be exploited by attackers to cause network delays, MEV exploitation, and finality risks. Therefore, ensuring the unlinkability of a validator's IP and identity is crucial for maintaining the network's trust and resilience. In this techreport, we first provide a review of the existing network and consensus layer techniques that have been proposed for maintaining validator privacy in the Ethereum blockchain. Secondly, we evaluate a Tor-based protocol named Tor push that helps unlink validator identities (IDs) from their nodes' IP addresses, thereby making it difficult to determine any end-to-end correlation between validator IDs and IP addresses of validators' beacon nodes. To evaluate the effectiveness of Tor push, we present a working, deployed proof-of-concept (PoC) implementation in the Nimbus Ethereum client. Our PoC deployment pushes attestations, aggregations, and block proposals over Tor to the Goerli testnet. Furthermore, we also analyse the security and latency of Tor push. Our experimental results suggest that Tor can be incorporated into the existing Ethereum network with a tolerable latency overhead of 613.82 ms on average and without compromising the overall network performance while enhancing the location privacy of validators in the Ethereum network.

Figures

Figures reproduced from arXiv: 2605.29131 by the authors.

Figure 1
Figure 1. Different solutions for improving validators’ privacy in the blockchain. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Illustration of Tor push protocol that incorporates both non-Tor connection endpoint and Tor push connection endpoint. As shown in the figure, Tor push shifts all communication over the Tor network (except peer discovery). observer to correlate Tor traffic with standard GossipSub traf￾fic, thereby linking the validator’s Tor connection to its public identity. Furthermore, only data messages are transmitted via Tor p… view at source ↗
Figure 3
Figure 3. Latency analysis of non-Tor (Direct) and Tor message delivery (i.e., time to reach from sender to receiver for each attestation) in Ethereum blockchain [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Effectiveness of a single Tor validator in the deployment. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 6
Figure 6. Figure 6: Comparative analysis of ten Tor-based validators in terms of average [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 3 canonical work pages

  1. [1]

    Analysis of ethereum network properties and behavior of influential nodes,

    S. H. Maeng, M. Essaid, and H. T. Ju, “Analysis of ethereum network properties and behavior of influential nodes,” in2020 21st Asia-Pacific Network Operations and Management Symposium (APNOMS), 2020, pp. 203–207

    2020

  2. [2]

    Eclipse attacks on Bitcoin’s Peer-to-Peer network,

    E. Heilman, A. Kendler, A. Zohar, and S. Goldberg, “Eclipse attacks on Bitcoin’s Peer-to-Peer network,” in24th USENIX Security Symposium (USENIX Security 15). Washington, D.C.: USENIX Association, Aug. 2015, pp. 129–144. [Online]. Available: https://www.usenix.org/ conference/usenixsecurity15/technical-sessions/presentation/heilman

    2015

  3. [3]

    Proof-of-stake validator sniping research,

    D. S. B ¨urgel, “Proof-of-stake validator sniping research,” Jun 2023. [Online]. Available: https://medium.com/hoprnet/ proof-of-stake-validator-sniping-research-8670c4a88a1c

    2023

  4. [4]

    GOSSIPSUB-TOR-PUSH,

    “GOSSIPSUB-TOR-PUSH,” https://lip.logos.co/ift-ts/raw/ gossipsub-tor-push.html?highlight=tor-p#gossipsub-tor-push, 2026, [Accessed 26-02-2026]

    2026

  5. [5]

    Integrated onion routing for peer-to-peer validator privacy in the ethereum network,

    D. M. Kelen, I. A. Seres, F. B ´eres, and A. A. Bencz ´ur, “Integrated onion routing for peer-to-peer validator privacy in the ethereum network,” 2023

    2023

  6. [6]

    Accessed May 29, 2026

    Nym tech. Accessed May 29, 2026. [Online]. Available: https: //nymtech.net/

    2026

  7. [7]

    Accessed May 29, 2026

    Hopr net. Accessed May 29, 2026. [Online]. Available: https: //hoprnet.org/

    2026

  8. [8]

    Dandelion: Redesigning the bitcoin network for anonymity,

    S. Bojja Venkatakrishnan, G. Fanti, and P. Viswanath, “Dandelion: Redesigning the bitcoin network for anonymity,”Proceedings of the ACM on Measurement and Analysis of Computing Systems, vol. 1, no. 1, pp. 1–34, 2017

    2017

Show all 32 references
  1. [9]

    On the anonymity of peer- to-peer network anonymity schemes used by cryptocurrencies,

    P. K. Sharma, D. Gosain, and C. Diaz, “On the anonymity of peer- to-peer network anonymity schemes used by cryptocurrencies,”arXiv preprint arXiv:2201.11860, 2022

    2022

  2. [10]

    Dandelion++ lightweight cryptocurrency networking with formal anonymity guarantees,

    G. Fanti, S. B. Venkatakrishnan, S. Bakshi, B. Denby, S. Bhargava, A. Miller, and P. Viswanath, “Dandelion++ lightweight cryptocurrency networking with formal anonymity guarantees,”Proceedings of the ACM on Measurement and Analysis of Computing Systems, vol. 2, no. 2, pp. 1–35, 2018

    2018

  3. [11]

    Accessed 14 Sept

    I2p. Accessed 14 Sept. 2023. [Online]. Available: https://geti2p.net/

    2023

  4. [12]

    Accessed May 29, 2026

    Ethereum: Distributed ledger specs. Accessed May 29, 2026. [Online]. Available: https://github.com/ethereum/distributed-validator-specs/

    2026

  5. [13]

    Accessed May 29, 2026

    Secret leader election. Accessed May 29, 2026. [Online]. Available: https://ethereum.org/en/roadmap/secret-leader-election/

    2026

  6. [14]

    Accessed on 4 March 2024

    Whisk: A practical shuffle-based ssle protocol for ethereum. Accessed on 4 March 2024. [Online]. Available: https://ethresear. ch/t/whisk-a-practical-shuffle-based-ssle-protocol-for-ethereum/11763

    2024

  7. [15]

    [Online]

    Secret non-single leader election. [Online]. Available: https://ethresear. ch/t/secret-non-single-leader-election/11789

  8. [16]

    Simulation of dissemination strategies on temporal networks,

    L. Serena, M. Zichichi, G. D’Angelo, and S. Ferretti, “Simulation of dissemination strategies on temporal networks,” in2021 Annual Modeling and Simulation Conference (ANNSIM). IEEE, 2021, pp. 1– 12

    2021

  9. [17]

    ethp2psim: Evaluating and deploying privacy-enhanced peer-to-peer routing proto- cols for the ethereum network,

    F. B ´eres, I. A. Seres, D. M. Kelen, and A. A. Bencz ´ur, “ethp2psim: Evaluating and deploying privacy-enhanced peer-to-peer routing proto- cols for the ethereum network,”arXiv preprint arXiv:2306.15024, 2023

    2023

  10. [18]

    Probabilistic analysis of anonymity,

    V . Shmatikov, “Probabilistic analysis of anonymity,” inProceedings 15th IEEE Computer Security Foundations Workshop. CSFW-15. IEEE, 2002, pp. 119–128

    2002

  11. [19]

    Vida: How to use bayesian inference to de-anonymize persistent communications,

    G. Danezis and C. Troncoso, “Vida: How to use bayesian inference to de-anonymize persistent communications,” inInternational Symposium on Privacy Enhancing Technologies Symposium. Springer, 2009, pp. 56–72

    2009

  12. [20]

    Anonymity trilemma: Strong anonymity, low bandwidth overhead, low latency-choose two,

    D. Das, S. Meiser, E. Mohammadi, and A. Kate, “Anonymity trilemma: Strong anonymity, low bandwidth overhead, low latency-choose two,” in2018 IEEE Symposium on Security and Privacy (SP). IEEE, 2018, pp. 108–126

    2018

  13. [21]

    Performance and security improvements for tor: A survey,

    M. AlSabah and I. Goldberg, “Performance and security improvements for tor: A survey,”ACM Computing Surveys (CSUR), vol. 49, no. 2, pp. 1–36, 2016

    2016

  14. [22]

    Tor path specification,

    R. Dingledine and N. Mathewson, “Tor path specification,” https://spec. torproject.org/path-spec, 2024, accessed: April 2026

    2024

  15. [23]

    Passive attack analysis for connection-based anonymity systems,

    A. Serjantov and P. Sewell, “Passive attack analysis for connection-based anonymity systems,” inComputer Security–ESORICS 2003: 8th Euro- pean Symposium on Research in Computer Security, Gjøvik, Norway, October 13-15, 2003. Proceedings 8. Springer, 2003, pp. 116–131

    2003

  16. [24]

    Timing attacks in low-latency mix systems,

    B. N. Levine, M. K. Reiter, C. Wang, and M. Wright, “Timing attacks in low-latency mix systems,” inFinancial Cryptography: 8th International Conference, FC 2004, Key West, FL, USA, February 9-12, 2004. Revised Papers 8. Springer, 2004, pp. 251–265

    2004

  17. [25]

    Sampled traffic analysis by internet- exchange-level adversaries,

    S. J. Murdoch and P. Zieli ´nski, “Sampled traffic analysis by internet- exchange-level adversaries,” inInternational workshop on privacy en- hancing technologies. Springer, 2007, pp. 167–183

    2007

  18. [26]

    Bitcoin over tor isn’t a good idea,

    A. Biryukov and I. Pustogarov, “Bitcoin over tor isn’t a good idea,” in2015 IEEE Symposium on Security and Privacy. IEEE, 2015, pp. 122–134

    2015

  19. [27]

    Low- resource routing attacks against tor,

    K. Bauer, D. McCoy, D. Grunwald, T. Kohno, and D. Sicker, “Low- resource routing attacks against tor,” inProceedings of the 2007 ACM workshop on Privacy in electronic society, 2007, pp. 11–20

    2007

  20. [28]

    On the accuracy of tor bandwidth estima- tion,

    R. Jansen and A. Johnson, “On the accuracy of tor bandwidth estima- tion,” inPassive and Active Measurement: 22nd International Confer- ence, PAM 2021. Springer, 2021, pp. 467–482

    2021

  21. [29]

    Stealthy traf- fic analysis of low-latency anonymous communication using throughput fingerprinting,

    P. Mittal, A. Khurshid, J. Juen, M. Caesar, and N. Borisov, “Stealthy traf- fic analysis of low-latency anonymous communication using throughput fingerprinting,” inProceedings of the 18th ACM conference on Computer and Communications Security, 2011, pp. 215–226

    2011

  22. [30]

    Low-cost traffic analysis of tor,

    S. J. Murdoch and G. Danezis, “Low-cost traffic analysis of tor,” in2005 IEEE Symposium on Security and Privacy (S&P’05). IEEE, 2005, pp. 183–195

    2005

  23. [31]

    How much anonymity does network latency leak?

    N. Hopper, E. Y . Vasserman, and E. Chan-Tin, “How much anonymity does network latency leak?”ACM Transactions on Information and System Security (TISSEC), vol. 13, no. 2, pp. 1–28, 2010

    2010

  24. [32]

    Gossip- Sub: Attack-resilient message propagation in the filecoin and ETH2.0 networks,

    D. Vyzovitis, Y . Napora, D. D. Falco, D. Dias, and L. Team, “Gossip- Sub: Attack-resilient message propagation in the filecoin and ETH2.0 networks,” arXiv preprint arXiv:2007.02754, 2020

    2007

Pith tools

Reviewed June 29, 2026 · model on record in the stance chip above.