Pith. sign in

REVIEW 3 major objections 6 minor 52 references

Slow and Steady: Preventing MEV with Verifiable Delays

T0 review · 3 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A verifiable delay before each transaction stops front-running MEV

desk verdict A clean VDF-based transaction-delay idea with a real formal gap: the theorems assume every MEV claim requires reactive, content-dependent front-running, which misses precomputed and back-running strategies. read the letter →

arxiv 2608.13271 v1 pith:35SDP3SO submitted 2026-08-13 cs.CR

Zeta Avarikioti , Dimitris Karakostas , Karl Kreder , Shreekara Shastry This is my paper · ORCID
classification cs.CR
keywords MEVmaximalextractablevalueverifiabledelayfunctionfront-runninginputcausalitydistributedledgerNashequilibriumtransactioncensorship
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a mechanism to stop front-running MEV in distributed ledgers by forcing every transaction to carry the output of a verifiable delay function evaluated on a commitment of its own payload. The central result is that if the enforced delay $\tau$ exceeds the ledger's liveness parameter $u$, no valid transaction can be created that meaningfully depends on an honest transaction before that transaction is finalized. In the game-theoretic model, the same transformation turns a ledger that is an approximate equilibrium in the absence of MEV into an approximate equilibrium in its presence. The paper also exhibits a collusive equilibrium in which all parties censor a MEV-bearing transaction, and it argues from implementation benchmarks and historical MEV data that the delay is practically affordable for most real-world cases.

What carries the argument

The load-bearing object is the transformed validity predicate $\mathrm{Validate}_{\mathrm{VDF,CS}}(tx,L) = \mathrm{Validate}(m,L) \land \mathrm{Verify}(C,y,\pi) \land \mathrm{Reveal}(C,m)=1$, where $C$ is a commitment to the transaction payload $m$ and $(y,\pi)$ is a VDF output and proof on $C$. The predicate forces every valid transaction to be produced only after a sequential VDF evaluation on its own commitment, making the delay unavoidable and efficiently checkable. Sequentiality of the VDF supplies the time bound, binding of the commitment ties the delay to the specific payload, and hiding of the commitment allows the VDF work to be outsourced without revealing the payload.

What would settle it

Find a single valid transaction that depends on a freshly broadcast honest transaction and is included in the ledger before the honest transaction is finalized, under the transformed predicate with $\tau > u$; its existence would falsify the input-causality claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that applying the validity predicate transformation $\mathrm{Validate}_{\mathrm{VDF,CS}}$ to any live, censorship-compliant ledger protocol $\Pi$ produces a protocol that guarantees blockchain input causality in the Byzantine setting when the VDF delay $\tau$ is larger than the liveness bound $u$. A transformed transaction is a pair consisting of the original payload $m$ and a VDF output/proof pair $(y,\pi)$ computed on a commitment of $m$; validity requires both the original validity predicate and the VDF verification, plus a successful reveal of the commitment. Because the VDF is sequential, an adversary that observes an honest transaction broadcast at round $r$ cannot produce a valid dependent transaction before round $r+\tau$, while the honest transaction is finalized by round $r+u$. The game-theoretic result states that if $\Pi$ is an $\epsilon$-Nash equilibrium when no MEV exists, the transformed protocol is an $(\epsilon+\mathrm{negl}(\lambda))$-Nash equilibrium when MEV exists, and censorship compliance is preserved. The negative result is a strategy profile in which all parties censor a MEV-bearing transaction for $\tau$ rounds, which is itself an $\epsilon$-Nash equilibrium.

Load-bearing premise

The proof assumes that the only way to capture a MEV opportunity is to observe an honest transaction and then create a new dependent transaction, and that this requires censoring the honest transaction for at least $\tau$ rounds; attacks that need no such dependency or censorship are outside the model.

Editorial extensions

If this is right

  • A ledger that is live and an approximate equilibrium without MEV can be converted into a ledger that is an approximate equilibrium with MEV by requiring a VDF delay longer than its liveness parameter.
  • No valid front-running transaction can be created before the honest transaction it depends on is finalized, eliminating content-dependent front-running attacks.
  • If a majority of validators colludes to censor a MEV-bearing transaction for the full delay, that collusive behavior forms an equilibrium, so the defense does not stop cartel-level MEV.
  • For the VDF construction the paper recommends, proof verification stays below about 800 milliseconds even for a 60-minute delay, making the added validity check cheap for network nodes.
  • Historical MEV datasets cited in the paper show that the overwhelming majority of opportunities are worth less than a few hundred dollars, so a delay of tens of minutes would cover most real-world cases without crippling usability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to apply the delay selectively at the smart-contract level only to transactions that touch price-sensitive state, keeping ordinary transfers fast while shrinking the MEV surface where it matters.
  • The collusive equilibrium suggests the mechanism deters unilateral deviation but not coordinated censorship; pairing the delay with slashing conditions or deposits could make the censorship equilibrium unstable, a question the paper leaves open.
  • Because the VDF is evaluated on a commitment, users could set their own delay parameter per transaction, letting urgency be priced by the market rather than fixed system-wide; the paper does not explore per-transaction delay parameters.
  • Combining this delay with an encrypted-mempool or order-fairness layer could close the back-running gap the paper explicitly leaves out of scope.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes a mechanism to mitigate MEV in distributed ledgers by requiring every transaction to include a VDF evaluation over a commitment to its payload, so that a valid transaction can only be constructed tau rounds after its payload is fixed. The authors define blockchain input causality and prove (Theorem 1) that applying this transformation to any ledger with liveness parameter u and choosing tau > u guarantees input causality. In a rational model, they argue the transformed protocol is an epsilon-Nash equilibrium when the original is one without MEV (Theorem 2), present a negative equilibrium (Theorem 3), and a compliance result (Theorem 4). They also report experiments on VDF candidates and historical MEV data to argue practical viability.

Significance. The idea of using VDFs to delay transaction creation is original and, if valid, would be a useful addition to the MEV countermeasure toolkit. The paper is clearly structured, the reduction of the Byzantine result to liveness is an elegant idea, and the implementation section with concrete VDF benchmarks and a large empirical MEV dataset is valuable. However, the positive results only hold for a restricted class of MEV attacks, namely reactive, content-dependent front-running, and the paper does not state or prove this restriction; as written, the central claims overstate the mechanism's power. The ambiguity in Definition 4's 'meaningfully relies on' is the crux of the problem.

major comments (3)
  1. [Section 3, Definition 4 and Theorem 1 proof] The statement 'Any transaction tx' which meaningfully relies on tx is created on round r at the earliest' is an assumption, not a consequence of the model. An adversary can precompute a valid transaction whose payload does not reference tx (e.g., a DEX buy order) before round r, and broadcast it immediately after observing tx; such a transaction is valid at round r and bypasses the VDF delay. If 'meaningfully relies' is intended as content-dependence, then Definition 4 does not cover this attack; if it is intended as economic dependence, the timing claim is false. The proof of Theorem 1 thus does not establish input causality for all MEV-relevant adversarial transactions.
  2. [Theorems 2 and 4] The claim 'the only way to claim a transaction's MEV opportunity is to censor it for at least tau > u rounds' is false: back-running MEV requires no censorship and is explicitly admitted out of scope in Section 4.3, and precomputed front-running transactions can be broadcast without censoring the honest transaction. Since this claim is the core of the rational-setting proofs, Theorems 2 and 4 are not proven as stated.
  3. [Abstract and Introduction] The abstract's claim that 'a block creator cannot react to the appearance of a MEV opportunity without breaking liveness' and the introduction's statement that the mechanism 'eliminates MEV opportunities' are not supported by the formal results, which at best address reactive front-running. The conclusion's caveat 'albeit only non-predictable ones' (Section 5) contradicts the earlier unqualified claims and should be reflected in the abstract and theorems.
minor comments (6)
  1. [Section 2.3] The proportionality property is stated as an upper bound on the probability that a party produces a block, but the proofs in Theorems 2 and 3 use it as if it also gives a lower bound on honest block production; the relationship should be clarified.
  2. [Section 4.1] The recommendation to set the VDF delay to 'twice the safety parameter' should be reconciled with the earlier use of the liveness parameter u as the threshold in Theorems 1, 2, and 4.
  3. [Section 4.2] The link between the empirical MEV data and the mechanism's effectiveness is not quantified; the data do not indicate what fraction of MEV opportunities are content-dependent and created after observing the victim, which is the class the mechanism can address.
  4. [Theorem 3] The strategy S_MEV is parameterized by the transaction tx, but the proof's deviation analysis sometimes refers to 'all other parties' attempting to claim the MEV opportunity without specifying whether the deviating party also follows the censoring strategy; the argument would benefit from a more explicit game tree.
  5. [Section 2.2] The notion of compliance is introduced by citing [28] rather than being defined in the manuscript; a self-contained definition of the infraction-predicate-based compliance notion would improve readability and verifiability.
  6. [Footnote 15] Describing a 516-byte proof on a roughly 400-byte transaction as a 'significant' size increase seems overstated; 'modest' would be more accurate.

Circularity Check

0 steps flagged · score 2.0 of 10

No load-bearing circularity; the central theorems follow from VDF sequentiality plus assumed liveness/equilibrium properties, with only a minor non-load-bearing self-citation.

full rationale

The derivation chain is not circular. Eq. (1) defines the transformed validity predicate Validate_{VDF,CS}(tx,L) = Validate(m,L) AND Verify(C,y,pi) AND Reveal(C,m)=1, an explicit construction that adds a VDF proof on the payload commitment to the underlying ledger's validity predicate. Theorem 1 then proves input causality from the VDF sequentiality property, the liveness parameter u of Pi, and tau>u; Theorem 2 proves the equilibrium statement from the same delay bound plus the assumed epsilon-Nash property of Pi in MEV-free executions; Theorems 3 and 4 make analogous reductions. No parameter is fitted to the historical MEV data and then renamed a prediction: tau is recommended as twice the safety parameter, and the data section is only practical motivation. The only self-citation is the compliance framework of [28], used in Definition 5 and Theorem 4. That framework provides the definition of infraction predicates and compliance; Theorem 4's proof then reasons from that definition, liveness, and the bound on party power, so the self-citation is definitional rather than load-bearing. The skeptic's precomputed-front-running concern is a correctness/scope gap in the assertion that claiming MEV requires censorship, not a case where the conclusion is equal to an input by construction. Consequently no circular step is identified; the score 2 reflects the minor non-load-bearing self-citation, not circularity in the main result.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The mechanism adds a VDF check to the validity predicate; it does not invent new cryptographic entities, but it assumes standard primitives and an unstated restriction on the attack model.

free parameters (2)
  • VDF delay parameter tau = tau > u in theory; about 60 minutes Bitcoin, about 30 minutes Ethereum in the implementation recommendation
    Hand-chosen delay controlling the mechanism; not fitted to MEV data, but must exceed the underlying ledger's liveness parameter.
  • Power threshold T = unspecified between 0 and 1, never given a concrete value
    Assumption in Theorems 2-4 bounding any party's live power; without a concrete value the liveness and equilibrium conditions are not fully instantiated.
assumptions (5)
  • domain assumption VDF is sequential, unique, and efficiently verifiable; the commitment scheme is binding and modeled as a random oracle (Remark 2).
    Required for Eq. (1) validity and for the earliest valid adversarial transaction at round r+tau in Theorem 1.
  • domain assumption Underlying ledger Pi is safe, live with parameter u, and has the proportionality property (Section 2.3).
    The transformation inherits security only under these assumptions; Theorems 1 and 2 rely on them.
  • ad hoc to paper Any adversarial MEV transaction meaningfully relies on the honest transaction and cannot be created or made valid before round r (Theorem 1 proof).
    Excludes precomputed order-independent front-running transactions, which would bypass the VDF delay.
  • domain assumption No party controls more than T live power, and honest parties control at least 1-T, in Theorems 2-4.
    Used to argue unilateral censorship cannot break liveness; T is not instantiated.
  • domain assumption PRAM computation steps can be converted to ledger rounds so tau and u are comparable (Remark 1).
    Needed for the condition tau > u to be meaningful.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Slow and Steady: Preventing MEV with Verifiable Delays." pith.science (2026). https://pith.science/paper/35SDP3SO

@misc{pith2026260813271,
  author       = {Pith},
  title        = {Pith review of: Slow and Steady: Preventing MEV with Verifiable Delays},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/35SDP3SO}},
  note         = {Machine review of arXiv:2608.13271}
}
read the original abstract

Our work presents a defense mechanism against Maximal Extractable Value (MEV) opportunities in distributed ledgers. The mechanism relies on the idea of enforcing a verifiable delay when generating transactions, such that a block creator cannot react to the appearance of a MEV opportunity without breaking liveness. We present positive results both in the Byzantine setting and in a game theoretic model of rational participants. We additionally present negative bounds that outline the limitations of this line of defense. Finally, we explore real-world implementation details of verifiable delays and show that, based on historical MEV data, our mechanism could realistically help prevent most existing MEV threats.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

52 extracted references · 39 canonical work pages

  1. [1]

    In: The Aesop for Children

    Aesop, Winter, M.: The hare & the tortoise. In: The Aesop for Children. Chicago: Rand, McNally & Co (1919),https://www.loc.gov/item/19014083

    work page arXiv 1919

  2. [2]

    In: Bessani, A., D´ efago, X., Nakamura, J., Wada, K., Yamauchi, Y

    Alpos, O., Amores-Sesar, I., Cachin, C., Yeo, M.: Eating sandwiches: Modular and lightweight elimination of transaction reordering attacks. In: Bessani, A., D´ efago, X., Nakamura, J., Wada, K., Yamauchi, Y. (eds.) 27th International Conference on Principles of Distributed Systems, OPODIS 2023, December 6-8, 2023, Tokyo, Japan. LIPIcs, vol. 286, pp. 12:1–...

    doi:10.4230/lipics.opodis.2023.12 2023

  3. [3]

    In: 2018 IEEE 26th International Conference on Network Protocols (ICNP)

    Asayag, A., Cohen, G., Grayevsky, I., Leshkowitz, M., Rottenstreich, O., Tamari, R., Yakira, D.: A fair consensus protocol for transaction ordering. In: 2018 IEEE 26th International Conference on Network Protocols (ICNP). pp. 55–65. IEEE (2018)

    work page 2018

  4. [4]

    Cryptology ePrint Archive, Paper 2020/332 (2020).https://doi

    Attias, V., Vigneri, L., Dimitrov, V.: Implementation study of two verifiable de- lay functions. Cryptology ePrint Archive, Paper 2020/332 (2020).https://doi. org/10.4230/OASIcs.Tokenomics.2020.9,https://eprint.iacr.org/2020/332, https://eprint.iacr.org/2020/332

    work page doi:10.4230/oasics.tokenomics.2020.9 2020

  5. [5]

    SoK: Tools for Game Theoretic Models of Security for Cryptocurrencies

    Azouvi, S., Hicks, A.: Sok: Tools for game theoretic models of security for cryptocurrencies. CoRRabs/1905.08595(2019),http://arxiv.org/abs/1905. 08595

    work page Pith review arXiv 2019

  6. [6]

    In: Proceedings of the 2022 ACM Workshop on Developments in Consensus

    Bagaria, V., Dembo, A., Kannan, S., Oh, S., Tse, D., Viswanath, P., Wang, X., Zeitouni, O.: Proof-of-stake longest chain protocols: Security vs predictability. In: Proceedings of the 2022 ACM Workshop on Developments in Consensus. pp. 29–42 (2022) 18 Zeta Avarikioti, Dimitris Karakostas, Karl Kreder, and Shreekara Shastry

    work page 2022

  7. [7]

    Bagourd, A., Francois, L.G.: Quantifying mev on layer 2 networks (2023)

    work page 2023

  8. [8]

    Cryptology ePrint Archive, Paper 2017/1153 (2017),https://eprint.iacr.org/2017/1153

    Bentov, I., Ji, Y., Zhang, F., Li, Y., Zhao, X., Breidenbach, L., Daian, P., Juels, A.: Tesseract: Real-time cryptocurrency exchange using trusted hardware. Cryptology ePrint Archive, Paper 2017/1153 (2017),https://eprint.iacr.org/2017/1153

    work page 2017

Show all 52 references
  1. [9]

    bloxRoute: bloxroute (2024),https://docs.bloxroute.com/apis/mev-solution

    2024

  2. [10]

    In: Annual international cryptology conference

    Boneh, D., Bonneau, J., B¨ unz, B., Fisch, B.: Verifiable delay functions. In: Annual international cryptology conference. pp. 757–788. Springer (2018)

    2018

  3. [11]

    Cryptol- ogy ePrint Archive, Paper 2018/712 (2018),https://eprint.iacr.org/2018/712, https://eprint.iacr.org/2018/712

    Boneh, D., B¨ unz, B., Fisch, B.: A survey of two verifiable delay functions. Cryptol- ogy ePrint Archive, Paper 2018/712 (2018),https://eprint.iacr.org/2018/712, https://eprint.iacr.org/2018/712

    2018

  4. [12]

    Boost, M.: Mev boost (2024),https://github.com/flashbots/mev-boost

    2024

  5. [13]

    Buterin, V.: State of research: Increasing censorship resistance of transactions under proposer/builder separation (pbs) (2022),https://notes.ethereum.org/ @vbuterin/pbs_censorship_resistance

    2022

  6. [14]

    GitHub repository1, 22–23 (2013)

    Buterin, V., et al.: Ethereum white paper. GitHub repository1, 22–23 (2013)

    2013

  7. [15]

    In: Annual International Cryptology Conference

    Cachin, C., Kursawe, K., Petzold, F., Shoup, V.: Secure and efficient asynchronous broadcast protocols. In: Annual International Cryptology Conference. pp. 524–541. Springer (2001)

    2001

  8. [16]

    In: IEEE International Conference on Blockchain and Cryp- tocurrency, ICBC 2024, Dublin, Ireland, May 27-31, 2024

    Cachin, C., Micic, J.: Quick order fairness: Implementation and eval- uation. In: IEEE International Conference on Blockchain and Cryp- tocurrency, ICBC 2024, Dublin, Ireland, May 27-31, 2024. pp. 230–

    2024

  9. [17]

    In: Eyal, I., Garay, J.A

    Cachin, C., Micic, J., Steinhauer, N., Zanolini, L.: Quick order fairness. In: Eyal, I., Garay, J.A. (eds.) Financial Cryptography and Data Security - 26th Interna- tional Conference, FC 2022, Grenada, May 2-6, 2022, Revised Selected Papers. Lecture Notes in Computer Science, ...

    2022 doi

  10. [18]

    Cryptology ePrint Archive, Paper 2000/067 (2000),https://eprint

    Canetti, R.: Universally composable security: A new paradigm for cryptographic protocols. Cryptology ePrint Archive, Paper 2000/067 (2000),https://eprint. iacr.org/2000/067

    2000

  11. [19]

    Chia: vdfcontest2results (2019),https://github.com/Chia-Network/ vdfcontest2results

    2019

  12. [20]

    Cryptology ePrint Archive, Paper 2018/183 (2018),https://eprint.iacr.org/2018/183,https: //eprint.iacr.org/2018/183

    Cohen, B., Pietrzak, K.: Simple proofs of sequential work. Cryptology ePrint Archive, Paper 2018/183 (2018),https://eprint.iacr.org/2018/183,https: //eprint.iacr.org/2018/183

    2018

  13. [21]

    In: 2020 IEEE Symposium on Security and Privacy (SP)

    Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach, L., Juels, A.: Flash boys 2.0: Frontrunning in decentralized exchanges, miner ex- tractable value, and consensus instability. In: 2020 IEEE Symposium on Security and Privacy (SP). pp. 910–927. IEEE (2020)

    2020

  14. [22]

    In: Annual international cryptology conference

    Dwork, C., Naor, M.: Pricing via processing or combatting junk mail. In: Annual international cryptology conference. pp. 139–147. Springer (1992)

    1992

  15. [23]

    In: Annual Cryptology Conference

    Dziembowski, S., Faust, S., Kolmogorov, V., Pietrzak, K.: Proofs of space. In: Annual Cryptology Conference. pp. 585–605. Springer (2015)

    2015

  16. [24]

    Flashbots: Flashbots auction (2022),https://docs.flashbots.net/ flashbots-auction/overview

    2022

  17. [26]

    Jakobsson, M., Juels, A.: Proofs of work and bread pudding protocols. In: Secure Information Networks: Communications and Multimedia Security IFIP TC6/TC11 Joint Working Conference on Communications and Multimedia Security (CMS’99) September 20–21, 1999, Leuven, Belgium. pp. 2...

    1999

  18. [27]

    Chainlink Blog (2020),https://blog.chain.link/ chainlink-fair-sequencing-services-enabling-a-provably-fair-defi-ecosystem/

    Juels, A., Breidenbach, L., Tramer, F.: Fair sequencing services: Enabling a provably fair defi ecosystem. Chainlink Blog (2020),https://blog.chain.link/ chainlink-fair-sequencing-services-enabling-a-provably-fair-defi-ecosystem/

    2020

  19. [28]

    In: Herlihy, M., Narula, N

    Karakostas, D., Kiayias, A., Zacharias, T.: Blockchain nash dynamics and the pursuit of compliance. In: Herlihy, M., Narula, N. (eds.) Proceedings of the 4th ACM Conference on Advances in Financial Technologies, AFT 2022, Cambridge, MA, USA, September 19-21, 2022. pp. 281–293....

    2022

  20. [29]

    IACR Cryptol

    Kavousi, A., Le, D.V., Jovanovic, P., Danezis, G.: Blindperm: Efficient MEV miti- gation with an encrypted mempool and permutation. IACR Cryptol. ePrint Arch. p. 1061 (2023),https://eprint.iacr.org/2023/1061

    2023

  21. [30]

    In: 9th IEEE Euro- pean Symposium on Security and Privacy, EuroS&P 2024, Vienna, Austria, July 8-12, 2024

    Kavousi, A., Wang, Z., Jovanovic, P.: Sok: Public randomness. In: 9th IEEE Euro- pean Symposium on Security and Privacy, EuroS&P 2024, Vienna, Austria, July 8-12, 2024. pp. 216–234. IEEE (2024).https://doi.org/10.1109/EUROSP60621. 2024.00020,https://doi.org/10.1109/EuroSP60621...

    2024

  22. [31]

    In: Cruz, J.P., Yanai, N

    Kelkar, M., Deb, S., Kannan, S.: Order-fair consensus in the permissionless setting. In: Cruz, J.P., Yanai, N. (eds.) APKC ’22: Proceedings of the 9th ACM on ASIA Public-Key Cryptography Workshop, APKC@AsiaCCS 2022, Nagasaki, Japan, 30 May 2022. pp. 3–14. ACM (2022).https://do...

    2022

  23. [32]

    In: Micciancio, D., Ristenpart, T

    Kelkar, M., Zhang, F., Goldfeder, S., Juels, A.: Order-fairness for byzantine consensus. In: Micciancio, D., Ristenpart, T. (eds.) Advances in Cryptology - CRYPTO 2020 - 40th Annual International Cryptology Conference, CRYPTO 2020, Santa Barbara, CA, USA, August 17-21, 2020, P...

    2020 doi

  24. [33]

    IACR Cryptol

    Kiayias, A., Leonardos, N., Shen, Y.: Ordering transactions with bounded un- fairness: Definitions, complexity and constructions. IACR Cryptol. ePrint Arch. p. 1253 (2023),https://eprint.iacr.org/2023/1253

    2023

  25. [34]

    In: Proceedings of the 2nd ACM Conference on Advances in Financial Technologies

    Kursawe, K.: Wendy, the good little fairness widget: Achieving order fairness for blockchains. In: Proceedings of the 2nd ACM Conference on Advances in Financial Technologies. pp. 25–36 (2020)

    2020

  26. [35]

    gov/econres/notes/feds-notes/what-is-programmable-money-20210623.html

    Lee, A.: What is programmable money? (2021),https://www.federalreserve. gov/econres/notes/feds-notes/what-is-programmable-money-20210623.html

    2021

  27. [36]

    CoRR abs/2411.09981(2024).https://doi.org/10.48550/ARXIV.2411.09981, https://doi.org/10.48550/arXiv.2411.09981

    Li, Z., Pournaras, E.: Sok: Consensus for fair message ordering. CoRR abs/2411.09981(2024).https://doi.org/10.48550/ARXIV.2411.09981, https://doi.org/10.48550/arXiv.2411.09981

    2024 doi arXiv

  28. [37]

    Cryptology ePrint Archive, Paper 2011/553 (2011),https://eprint.iacr

    Mahmoody, M., Moran, T., Vadhan, S.: Publicly verifiable proofs of sequential work. Cryptology ePrint Archive, Paper 2011/553 (2011),https://eprint.iacr. org/2011/553,https://eprint.iacr.org/2011/553

    2011

  29. [38]

    Medley, L., Loe, A.F., Quaglia, E.A.: Sok: Delay-based cryptography. Cryptol- ogy ePrint Archive, Paper 2023/687 (2023),https://eprint.iacr.org/2023/687, https://eprint.iacr.org/2023/687 20 Zeta Avarikioti, Dimitris Karakostas, Karl Kreder, and Shreekara Shastry

    2023

  30. [39]

    Cryptology ePrint Archive, Paper 2023/626 (2023),https://eprint.iacr

    Mirkin, M., Zhou, L., Eyal, I., Zhang, F.: Sprints: Intermittent blockchain pow min- ing. Cryptology ePrint Archive, Paper 2023/626 (2023),https://eprint.iacr. org/2023/626,https://eprint.iacr.org/2023/626

    2023

  31. [40]

    Nakamoto, S.: Bitcoin: A peer-to-peer electronic cash system (2008)

    2008

  32. [41]

    arXiv preprint arXiv:2112.01472 (2021)

    Obadia, A., Salles, A., Sankar, L., Chitra, T., Chellani, V., Daian, P.: Unity is strength: A formalization of cross-domain maximal extractable value. arXiv preprint arXiv:2112.01472 (2021)

    2021 arXiv

  33. [42]

    Cryptology ePrint Archive, Pa- per 2018/627 (2018).https://doi.org/10.4230/LIPIcs.ITCS.2019.60,https: //eprint.iacr.org/2018/627,https://eprint.iacr.org/2018/627

    Pietrzak, K.: Simple verifiable delay functions. Cryptology ePrint Archive, Pa- per 2018/627 (2018).https://doi.org/10.4230/LIPIcs.ITCS.2019.60,https: //eprint.iacr.org/2018/627,https://eprint.iacr.org/2018/627

    2018 doi

  34. [43]

    Qin, K., Zhou, L., Gervais, A.: Quantifying blockchain extractable value: How dark is the forest? In: 2022 IEEE Symposium on Security and Privacy (SP). pp. 198–214. IEEE (2022)

    2022

  35. [44]

    ACM Transactions on Programming Languages and Systems (TOPLAS)16(3), 986–1009 (1994)

    Reiter, M.K., Birman, K.P.: How to securely replicate services. ACM Transactions on Programming Languages and Systems (TOPLAS)16(3), 986–1009 (1994)

    1994

  36. [45]

    In: Kim, Y., Kim, J., Vigna, G., Shi, E

    Thyagarajan, S.A.K., Gong, T., Bhat, A., Kate, A., Schr¨ oder, D.: Opensquare: Decentralized repeated modular squaring service. In: Kim, Y., Kim, J., Vigna, G., Shi, E. (eds.) CCS ’21: 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, Republic ...

    2021

  37. [46]

    Werner, S.M., Perez, D., Gudgeon, L., Klages-Mundt, A., Harz, D., Knottenbelt, W.J.: Sok: Decentralized finance (defi) (2022)

    2022

  38. [47]

    Cryptology ePrint Archive, Paper 2018/623 (2018),https://eprint.iacr.org/2018/623,https://eprint

    Wesolowski, B.: Efficient verifiable delay functions. Cryptology ePrint Archive, Paper 2018/623 (2018),https://eprint.iacr.org/2018/623,https://eprint. iacr.org/2018/623

    2018

  39. [48]

    CoRRabs/2212.05111(2022)

    Yang, S., Zhang, F., Huang, K., Chen, X., Yang, Y., Zhu, F.: Sok: MEV countermeasures: Theory and practice. CoRRabs/2212.05111(2022). https://doi.org/10.48550/ARXIV.2212.05111,https://doi.org/10.48550/ arXiv.2212.05111

    2022 doi arXiv

  40. [49]

    In: Zhou, L., Qin, K

    Yang, S., Zhang, F., Huang, K., Chen, X., Yang, Y., Zhu, F.: Sok: MEV coun- termeasures. In: Zhou, L., Qin, K. (eds.) Proceedings of the Workshop on Decen- tralized Finance and Security, DeFi 2024, Salt Lake City, UT, USA, October 14- 18, 2024. pp. 21–30. ACM (2024).https://do...

    2024

  41. [50]

    In: 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20)

    Zhang, Y., Setty, S., Chen, Q., Zhou, L., Alvisi, L.: Byzantine ordered consensus without byzantine oligarchy. In: 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). pp. 633–649 (2020)

    2020

  42. [51]

    Cryptology ePrint Archive, Paper 2022/755 (2022), https://eprint.iacr.org/2022/755,https://eprint.iacr.org/2022/755

    Zhu, D., Tian, J., Li, M., Wang, Z.: Low-latency hardware architecture for vdf evaluation in class groups. Cryptology ePrint Archive, Paper 2022/755 (2022), https://eprint.iacr.org/2022/755,https://eprint.iacr.org/2022/755

    2022

  43. [234]

    IEEE (2024).https://doi.org/10.1109/ICBC59979.2024.10634386, https://doi.org/10.1109/ICBC59979.2024.10634386

    2024

  44. [2021]

    3447–3464

    pp. 3447–3464. ACM (2021).https://doi.org/10.1145/3460120.3484809, https://doi.org/10.1145/3460120.3484809

    2021

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.