Pith. sign in

REVIEW 4 major objections 6 minor 38 references

Eunomia: A Permissionless Parallel Chain Protocol Based on Logical Clock

T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Eunomia claims that a virtual logical clock computed from the block graph can order blocks across parallel chains without a dedicated synchronization chain, and that UTXO sharding removes cross-chain double spends.

desk verdict Eunomia is a genuine new combination—logical-clock ordering with UTXO sharding—but its main security proof hinges on an unproven independence assumption that the paper itself admits. read the letter →

arxiv 1908.07567 v1 pith:EXV2DYQ7 submitted 2019-08-20 cs.DC cs.CR

Jianyu Niu This is my paper · ORCID
classification cs.DCcs.CR
keywords parallelchainslogicalclockglobalblockorderingUTXOshardingsimplepaymentverificationproofofworkpermissionlessblockchainscalability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

A blockchain made of many parallel proof-of-work chains can only scale if blocks from different chains are fused into one agreed order. Eunomia's proposal is to do that fusion with a virtual logical clock: every block is timestamped by a counter computed from the blocks it references, chains synchronize by pointing at the block with the largest clock, and the global sequence is just the per-chain confirmed blocks sorted by clock and chain index. The paper argues this preserves the causal order of blocks, needs no extra ordering blocks, and makes the ordering rule incentive-compatible, since a miner who references the wrong synchronized block risks mining an invalid block. A separate fine-grained UTXO sharding assigns each unspent output to a single chain, so conflicting transactions cannot appear in two chains and light clients can verify payments with a bounded backtrace. If the proofs hold, a permissionless proof-of-work system can approach the network's bandwidth limit while tolerating up to half adversarial computing power.

What carries the argument

The load-bearing object is the virtual logical clock computed by Algorithm 1 (logicalClockCompute): for each new block, the clock is the synchronized block's clock plus one, with an invalid value returned if the parent clock is larger. The synchronized block is the block with the largest clock among the m main chains, referenced in the new block's header, so the m chains exchange timing information in a fully distributed way and no chain acts as a unique clock. The second mechanism is fine-grained UTXO sharding: each UTXO carries a sharding index naming the only chain where it can be spent, which removes cross-chain double spending and limits the backtrace a light client needs to a T-block confirmation window.

What would settle it

Run the protocol with two chains and a small confirmation depth, and let the adversary delay every synchronized block until just after the next block referencing it is mined. If an honest miner's block can then be rejected because its parent clock exceeds the synchronized clock—or if one honest node's globally confirmed sequence is not a prefix of another's—the independence assumption fails. This can be checked in a discrete-event simulation before deployment.

Watch

Extended reading notes

Core claim

The central claim is that block ordering in a parallel chain is an event-ordering problem, and a virtual logical clock—a counter derived from the block graph rather than wall-clock time—solves it without a dedicated synchronization chain or extra ordering blocks. Each block receives a clock equal to the clock of a synchronized block, the last block with the largest clock among the m chains, plus one, provided the parent block's clock does not exceed the synchronized clock; otherwise the block is invalid. Blocks across chains are globally ordered by the pair (clock, chain index), and only per-chain confirmed blocks with clock below the synchronized bar enter the globally confirmed sequence. The paper also claims that tagging each UTXO with a sharding index restricts any output to be spent in one specific chain, so conflicting transactions cannot appear in separate chains, and light clients can verify payments by backtracing inputs within a T-block window. Together these mechanisms are claimed to yield consistency, liveness, and throughput approaching the network capacity while tolerating less than 1/2 adversarial computing power.

Load-bearing premise

The argument assumes each of the m chains behaves exactly like one independent proof-of-work chain, even though a block's validity depends on a synchronized block from another chain; the report asserts this independence but leaves the cross-chain dependency unproved.

Editorial extensions

If this is right

  • Throughput scales roughly with the number m of parallel chains, because every chain mines and confirms blocks concurrently and ordering does not wait on a single chain.
  • No special synchronization chain or attachment block is needed; the ordering information rides inside ordinary block headers, so protocol overhead stays low.
  • The ordering respects block causality: a block cannot be ordered before blocks it references, avoiding the inverted-order attack vector of pre-defined sequences.
  • A rational miner has an economic incentive to reference the true largest-clock synchronized block, since deviating can produce a rejected block.
  • Light clients need only headers plus a T-block backtrace to detect invalidated cross-chain UTXOs, making SPV feasible in the parallel setting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not push this further, but the same clock rule could be applied to DAG-based ledgers if a tie-break policy is added for blocks with multiple parents.
  • This suggests a concrete stress test: delay synchronized-block delivery in a simulation and measure whether any chain's growth rate drops; a drop would contradict the assumed independence of chains.
  • One observable design cost is that cross-chain UTXO spends wait through the T-block window, so an implementation should measure whether this erases the parallelism latency gain for cross-chain payments.
  • The incentive argument implies a rational attacker would mine on low-clock ancestor blocks to suppress global confirmation; quantifying the economic break-even point would make the 1/2 bound more precise.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Eunomia, a permissionless parallel-chain protocol based on m independent Nakamoto Consensus chains, m-for-1 PoW, a virtual logical clock for global block ordering, and fine-grained UTXO sharding. The central claims are that Eunomia satisfies consistency and liveness under less than 1/2 adversarial computation power and approaches the network bandwidth limit, while also being SPV-friendly. The security argument in Sec. VI proceeds by first lifting known Nakamoto Consensus properties to each chain (Lemma 1) and then combining per-chain properties to prove global consistency, growth, and quality (Lemmas 2–4). The paper also presents an informal incentive argument in Sec. V-D intended to deter denial-of-ordering attacks.

Significance. If the main theorem were established, the result would be significant: it would show that a parallel-chain protocol can achieve near-optimal throughput without a dedicated synchronization chain or additional ordering blocks, while preserving the simple security analysis of Nakamoto Consensus and providing SPV support. The paper also makes a useful design point by connecting logical clocks in distributed systems to block ordering. However, the central proof depends on an independence assumption that the paper itself acknowledges is violated, and the supporting lemmas are only sketched. The contribution is therefore not currently substantiated by the provided analysis.

major comments (4)
  1. [Sec. VI-A, Lemma 1] The proof of Lemma 1 asserts that each chain Ci of Eunomia runs 'in the same way' as a single Nakamoto chain and therefore inherits the properties of Theorem 1. This is not justified under Algorithm 1. In lines 6–14 of Algorithm 1, a newly mined block is valid only if its parent clock vi does not exceed the clock vj of the referenced synchronized block; otherwise its clock is set to -1 and the block is rejected. Because the synchronized block is normally the largest-clock block among all chains, the validity of a block on chain Ci depends on the timely availability and relative clock value of blocks on other chains. An adversary controlling message delivery can delay synchronized blocks from fast chains, causing otherwise valid honest PoW solutions to be rejected and lowering the honest block-generation rate below p. The paper itself concedes this in Sec. VII-A: 'each chain's block generation cannot be viewed as independent with each other anymore, which deviates from the design goal and makes the analysis complicated.' The following sentence asserts without proof that relaying synchronized blocks keeps the chains independent. Lemma 1 is therefore not established, and the subsequent lift of consistency, chain-growth, and chain-quality to Eunomia is unsupported.
  2. [Sec. VI-B, Lemma 3] The proof of Lemma 3 does not establish the claimed 4T/pn bound for global confirmation. It argues that by time t1 = t0 + 2T/pn each chain has at least T blocks attached, and that by the chain-quality property 'there must have one block of honest participants which synchronizes its belonging chain to the value x', where x is the largest virtual clock among the last per-chain confirmed blocks at time t0. This is a non sequitur: chain-quality only guarantees a fraction of honest blocks in a window; it does not guarantee that any of them references the particular synchronized block with clock x. Moreover, the proof uses the undefined term 'partially confirmed' when moving from t1 to t2, and it only addresses the single clock x rather than all per-chain confirmed blocks at t0. A formal argument deriving the confirmation delay from the stated growth and quality properties is missing and is load-bearing for liveness.
  3. [Sec. VI-B, Lemma 4] The proof of Lemma 4 is only a sketch and does not derive the L-growth and L-quality statements. It states that each chain has at least γT blocks becoming newly 'partially-confirmed' from t0 to t1 = t0 + γ·2T/pn and then invokes 'Lemma 4' to conclude the proof; the correct reference should be Lemma 3, and even with that replacement the argument does not quantify how the global sequence grows by m·γ·T blocks per (γ+2)·2T/pn rounds. The notions 'partially-confirmed' and 'per-chain confirmed' are not formally defined in the proof, and the relationship between per-chain growth, the global ordering rule (Sec. V-C), and the global sequence length is not shown. Since Theorem 2's liveness claim rests on these lemmas, the main theorem is not proven.
  4. [Sec. V-D] The incentive-compatibility claim against denial-of-ordering attacks is informal. The text argues that a miner who chooses a non-maximal synchronized block will either produce invalid blocks or blocks that do not extend the longest chain, and therefore 'will suffer from economic loss.' No utility model, adversary strategy space, or equilibrium notion is defined, and no formal statement connects this argument to the protocol's security properties. As this is presented as a distinct contribution (denial-of-ordering resistance), it should be stated as a theorem with a proof or explicitly labeled as a heuristic discussion.
minor comments (6)
  1. [Sec. VI-B, Theorem 2] In the paragraph after Theorem 2, the text says 'Theorem 1 shows that the globally confirmed block sequence L satisfies...' but it should refer to Theorem 2; Theorem 1 is the external Nakamoto Consensus corollary and does not mention L.
  2. [Algorithm 1] The input/output notation is inconsistent: the output is declared as a real number v ∈ R, but the algorithm returns integer clock values and -1. The genesis condition 'B ∈ (Gi)^n_i=0' uses n where m is intended, and the indexing should be over the m genesis blocks.
  3. [Sec. V-C] The notation for the synchronized bar is written as min^m_{i=0}{vi} and later as min^{m−1}_{i=0}; the bounds should be made consistent, and the global ordering rule needs a precise definition of how blocks with equal clocks are ordered beyond 'tie breaking of i'.
  4. [Sec. IV-D] The SPV verification procedure for light clients is described only by example. The 'T-traced verification' is not specified as an algorithm, and no proof is given that a light client can detect invalid cross-chain UTXO references with only block headers and Merkle proofs.
  5. [Sec. VII-A] The sentence 'It is hard for the node to invoke Algorithm 1' is unclear; the subsequent discussion of storing synchronized-block headers and Merkle proofs should be stated as a precise storage and verification rule rather than an informal remark.
  6. [Sec. II-C] The claim that a vector clock 'cannot exploit its advantage' in forked branches is not explained; a sentence justifying this would help the reader understand why logical clocks are chosen over vector clocks.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: Eunomia's ordering and UTXO-sharding rules are design choices, and the security proof lifts external Nakamoto-consensus theorems without self-citation or fitted parameters.

full rationale

The derivation chain in Eunomia is not circular. The protocol's virtual logical clock is a defined algorithmic rule, not a quantity fitted to the target consistency/liveness properties; the global block order is constructed from that clock and then analyzed. The security argument rests on Theorem 1, imported externally from Pass et al. [5], and Lemma 1 attempts to connect each Eunomia chain to that external Nakamoto-consensus baseline. There are no fitted parameters renamed as predictions, no self-citations, no uniqueness theorem imported from the authors' prior work, and no ansatz smuggled in through the authors' own earlier papers. The one notable weakness is Sec. VII-A's explicit admission that cross-chain synchronized-block dependencies mean 'each chain's block generation cannot be viewed as independent with each other anymore, which deviates from the design goal and makes the analysis complicated.' That is a real proof gap or unsupported independence assumption, but it is a correctness/soundness concern, not circularity: the paper does not define the per-chain Nakamoto properties in terms of the global-order output, nor does it reduce the target theorem to its own assumptions by construction. The UTXO sharding rule also solves transaction conflicts by definitional design, but that is the protocol mechanism itself, not a claimed prediction derived from the same mechanism. Overall, the paper is self-contained against external benchmarks and merits a non-circularity finding.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The protocol's central claims rest on standard blockchain model assumptions (random oracle, bounded-delay network, honest majority) and on the imported security theorem of Pass et al. The load-bearing independence assumption (each chain behaves as an independent Nakamoto chain) is asserted in Lemma 1 but not derived, so it is an unproven premise rather than a free parameter.

assumptions (6)
  • domain assumption Random oracle model for the PoW hash function
    Used throughout the protocol definition and security analysis (Sec. II-B, III).
  • domain assumption Bounded-delay asynchronous network, all messages delivered within Δ
    Stated in Sec. III and used in the proofs that lift Nakamoto properties.
  • domain assumption Adversarial computational power is bounded by ρ < 1/2
    Stated in Sec. III and required by Theorem 1, which the paper imports from [5].
  • domain assumption Nakamoto consensus satisfies consistency, chain-growth, and chain-quality (Corollary 3 in [5])
    Imported as Theorem 1 in Sec. VI-A and used as the base for the Eunomia security proofs.
  • domain assumption UTXO model with unspent transaction outputs
    Adopted in Sec. II-A and used for the sharding design.
  • domain assumption The last log2(m) bits of a block's hash are uniformly distributed, so each chain receives blocks with equal probability
    Assumed in Lemma 1 and Sec. II-B to argue that each chain has the same block generation rate.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Eunomia: A Permissionless Parallel Chain Protocol Based on Logical Clock." pith.science (2026). https://pith.science/paper/EXV2DYQ7

@misc{pith2026190807567,
  author       = {Pith},
  title        = {Pith review of: Eunomia: A Permissionless Parallel Chain Protocol Based on Logical Clock},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EXV2DYQ7}},
  note         = {Machine review of arXiv:1908.07567}
}
read the original abstract

The emerging parallel chain protocols represent a breakthrough to address the scalability of blockchain. By composing multiple parallel chain instances, the whole systems' throughput can approach the network capacity. How to coordinate different chains' blocks and to construct them into a global ordering is critical to the performance of parallel chain protocol. However, the existed solutions use either the global synchronization clock with the single-chain bottleneck or pre-defined ordering sequences with distortion of blocks' causality to order blocks. In addition, the prior ordering methods rely on that honest participants faithfully follow the ordering protocol, but remain silent for any denial of ordering (DoR) attack. On the other hand, the conflicting transactions included into the global block sequence will make Simple Payment Verification (SPV) difficult. Clients usually need to store a full record of transactions to distinguish the conflictions and tell whether transactions are confirmed. However, the requirement for a full record will greatly hinder blockchains' application, especially for mobile scenarios. In this technical report, we propose Eunomia, which leverages logical clock and fine-grained UTXO sharding to realize a simple, efficient, secure and permissionless parallel chain protocol. By observing the characteristics of the parallel chain, we find the blocks ordering issue in parallel chain has many similarities with the event ordering in the distributed system. Eunomia thus adopts "virtual" logical clock, which is optimized to have the minimum protocol overhead and runs in a distributed way. In addition, Eunomia combines the mining incentive with block ordering, providing incentive compatibility against DoR attack. What's more, the fine-grained UTXO sharding does well solve the conflicting transactions in parallel chain and is shown to be SPV-friendly.

Figures

Figures reproduced from arXiv: 1908.07567 by the authors.

Figure 1
Figure 1. for an illustration. In m-for-1 PoW, each block contains m hash references, each of which links to the last block in m main chains. Each main chain is independently chosen by certain rules (e.g., LCR in NC and the heaviest subtree rule in the GHOST protocol [11]). When a valid nonce is found, the last log2 m bits of the block’s hash value can index to one of the m chains that the block belongs to [14]. Here, the has… view at source ↗
Figure 2
Figure 2. Data structure of the block and the Merkle tree of tran [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The infectious window for Cross-chain UTXO due to orp [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: A Simple Case for chained confirmation for SPV in Eunom [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: An illustration of globally confirmed blocks [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 37 canonical work pages

  1. [1]

    Bitcoin: A peer-to-peer electronic cash s ystem,

    S. Nakamoto, “Bitcoin: A peer-to-peer electronic cash s ystem,” W orking Paper, 2008

    work page 2008

  2. [2]

    Map of coins: Btc map,

    mapofcoins, “Map of coins: Btc map,” 2018. [Online]. Ava ilable: http://mapofcoins.com/bitcoin

    work page 2018

  3. [3]

    Lay down the common metrics: Eva luating proof-of-work consensus protocols’ security,

    R. Zhang and B. Preneel, “Lay down the common metrics: Eva luating proof-of-work consensus protocols’ security,” in Proceedings of the 40th IEEE Symposium on Security and Privacy , ser. S&P . IEEE, 2019. 9

    work page 2019

  4. [4]

    The Bitcoin Back bone Protocol: Analysis and Applications,

    J. Garay, A. Kiayias, and N. Leonardos, “The Bitcoin Back bone Protocol: Analysis and Applications,” in Advances in Cryptology - EUROCRYPT 2015, E. Oswald and M. Fischlin, Eds. Springer Berlin Heidelberg, 2015, pp. 281–310

    work page 2015

  5. [5]

    Analysis of the Blockc hain Protocol in Asynchronous Networks,

    R. Pass, L. Seeman, and A. Shelat, “Analysis of the Blockc hain Protocol in Asynchronous Networks,” in Advances in Cryptology – EUROCRYPT 2017, J.-S. Coron and J. B. Nielsen, Eds. Springer International Publishing, 2017, pp. 643–673

    work page 2017

  6. [6]

    The Bitcoin Back bone Pro- tocol with Chains of V ariable Difficulty,

    J. Garay, A. Kiayias, and N. Leonardos, “The Bitcoin Back bone Pro- tocol with Chains of V ariable Difficulty,” in Advances in Cryptology – CRYPTO 2017 , J. Katz and H. Shacham, Eds. Cham: Springer International Publishing, 2017, pp. 291–323

    work page 2017

  7. [7]

    A Better Method t o Analyze Blockchain Consistency,

    L. Kiffer, R. Rajaraman, and A. Shelat, “A Better Method t o Analyze Blockchain Consistency,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’18. New Y ork, NY , USA: ACM, 2018, pp. 729–744

    work page 2018

  8. [8]

    On the necessity of a prescribed block validity consensus: Analyzing bitcoin unlimited mining protocol,

    R. Zhang and B. Preneel, “On the necessity of a prescribed block validity consensus: Analyzing bitcoin unlimited mining protocol,” in Proceed- ings of the 13th International Conference on Emerging Netwo rking EXperiments and Technologies , ser. CoNEXT ’17. New Y ork, NY , USA: ACM, 2017, pp. 108–119

    work page 2017

Show all 38 references
  1. [9]

    Bitc oin- ng: A scalable blockchain protocol,

    I. Eyal, A. E. Gencer, E. G. Sirer, and R. V . Renesse, “Bitc oin- ng: A scalable blockchain protocol,” in 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16) . Santa Clara, CA: USENIX Association, 2016, pp. 45–59

    2016

  2. [10]

    Spectre: A fast and scalable cryptocurrency protocol,

    Y . Sompolinsky, Y . Lewenberg, and A. Zohar, “Spectre: A fast and scalable cryptocurrency protocol,” IACR Cryptology ePrint Archive , vol. 2016, p. 1159, 2016

    2016

  3. [11]

    Secure high-rate transac tion processing in bitcoin,

    Y . Sompolinsky and A. Zohar, “Secure high-rate transac tion processing in bitcoin,” in Financial Cryptography and Data Security . Berlin, Heidelberg: Springer Berlin Heidelberg, 2015, pp. 507–527

    2015

  4. [12]

    Parallel chains: Improving throughput and latency of blockchain protocols via paralle l composi- tion,

    M. Fitzi, P . Gazi, A. Kiayias, and A. Russell, “Parallel chains: Improving throughput and latency of blockchain protocols via paralle l composi- tion,” Cryptology ePrint Archive, Report 2018/1119 , 2018

    2018

  5. [13]

    Decon- structing the blockchain to approach physical limits,

    V . Bagaria, S. Kannan, D. Tse, G. Fanti, and P . Viswanath , “Decon- structing the blockchain to approach physical limits,” arXiv preprint arXiv:1810.08092, 2018

    2018 arXiv

  6. [14]

    Ohie: Blockcha in scaling made simple,

    H. Y u, I. Nikolic, R. Hou, and P . Saxena, “Ohie: Blockcha in scaling made simple,” in Proceedings of the 41th IEEE Symposium on Security and Privacy , ser. S&P . SAN FRANCISCO, CA, USA: IEEE, 2020

    2020

  7. [15]

    Time, Clocks, and the Ordering of Events in a Distributed System,

    L. Lamport, “Time, Clocks, and the Ordering of Events in a Distributed System,” Commun. ACM , vol. 21, no. 7, pp. 558–565, 1978

    1978

  8. [16]

    Timestamps in message-passing systems th at preserve the partial ordering,

    C. J. Fidge, “Timestamps in message-passing systems th at preserve the partial ordering,” Proc. of the 11th Australian Computer Science Conference (ACSC’88) , pp. 56–66, Feb. 1987

    1987

  9. [17]

    Virtual time and global states of distributed systems,

    F. Mattern et al., “Virtual time and global states of distributed systems,” Proc. W orkshop on Parallel and Distributed Algorithms , pp. 215–226, 1988

    1988

  10. [18]

    Omniledger: A secure, scale-out, decentralized l edger via sharding,

    E. Kokoris-Kogias, P . Jovanovic, L. Gasser, N. Gailly, E. Syta, and B. Ford, “Omniledger: A secure, scale-out, decentralized l edger via sharding,” in 2018 IEEE Symposium on Security and Privacy (SP) , May 2018, pp. 583–598

    2018

  11. [19]

    A secure sharding protocol for open blockchains,

    L. Luu, V . Narayanan, C. Zheng, K. Baweja, S. Gilbert, an d P . Saxena, “A secure sharding protocol for open blockchains,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communicatio ns Security, ser. CCS ’16. New Y ork, NY , USA: ACM, 2016, pp. 17–30

    2016

  12. [20]

    A next-generation smart contract and decentralized application platform,

    V . Buterin et al. , “A next-generation smart contract and decentralized application platform,” white paper , 2014. [Online]. Available: https://github.com/ethereum/wiki/wiki/White-Paper

    2014

  13. [21]

    A. S. Tanenbaum and M. van Steen, Distributed Systems: Principles and Paradigms. Upper Saddle River, NJ: Pearson Prentice Hall, 2007

    2007

  14. [22]

    Rethinking large-scale consensus,

    R. Pass and E. Shi, “Rethinking large-scale consensus, ” in 2017 IEEE 30th Computer Security F oundations Symposium (CSF) , Aug 2017, pp. 115–129

    2017

  15. [23]

    Protocols for public key cryptosystems,

    R. C. Merkle, “Protocols for public key cryptosystems, ” in 1980 IEEE Symposium on Security and Privacy , April 1980, pp. 122–122

    1980

  16. [24]

    Secure names for bit-stri ngs,

    S. Haber and W. S. Stornetta, “Secure names for bit-stri ngs,” in Pro- ceedings of the 4th ACM Conference on Computer and Communica tions Security, ser. CCS ’97. New Y ork, NY , USA: ACM, 1997, pp. 28–35

    1997

  17. [25]

    Majority is not enough: Bitcoin mining is vulnerable,

    I. Eyal and E. G. Sirer, “Majority is not enough: Bitcoin mining is vulnerable,” Commun. ACM , vol. 61, no. 7, pp. 95–102, Jun. 2018

    2018

  18. [26]

    Optimal selfish mining strategies in Bitcoin,

    A. Sapirshtein, Y . Sompolinsky, and A. Zohar, “Optimal selfish mining strategies in Bitcoin,” in International Conference on Financial Cryp- tography and Data Security . Berlin, Heidelberg: Springer, 2016, pp. 515–532

    2016

  19. [27]

    On the security and performance of proof of wo rk blockchains,

    A. Gervais, G. O. Karame, K. W¨ ust, V . Glykantzis, H. Rit zdorf, and S. Capkun, “On the security and performance of proof of wo rk blockchains,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’16. Vienna, Austria: ACM, 2016...

    2016

  20. [28]

    Bitcoin unlimited faq,

    T. B. U. C. Organization., “Bitcoin unlimited faq,” 201 9. [Online]. Available: https://www.bitcoinunlimited.info/faq

  21. [29]

    Enhancing bitcoin security and performance with strong co nsistency via collective signing,

    E. K. Kogias, P . Jovanovic, N. Gailly, I. Khoffi, L. Gasse r, and B. Ford, “Enhancing bitcoin security and performance with strong co nsistency via collective signing,” in 25th USENIX Security Symposium (USENIX Security 16) . Austin, TX: USENIX Association, 2016, pp. 279–296

    2016

  22. [30]

    Rapidchain: Sc aling blockchain via full sharding,

    M. Zamani, M. Movahedi, and M. Raykova, “Rapidchain: Sc aling blockchain via full sharding,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’18. New Y ork, NY , USA: ACM, 2018, pp. 931–948

    2018

  23. [31]

    Hybrid Consensus: Efficient Consens us in the Permissionless Model,

    R. Pass and E. Shi, “Hybrid Consensus: Efficient Consens us in the Permissionless Model,” in 31st International Symposium on Distributed Computing (DISC 2017) , ser. Leibniz International Proceedings in Informatics (LIPIcs), vol. 91. Dagstuhl, Germany: Schloss Dagstuhl– Leibniz...

    2017

  24. [32]

    Practical byzantine fault tol erance,

    M. Castro and B. Liskov, “Practical byzantine fault tol erance,” in Proceedings of the Third Symposium on Operating Systems Des ign and Implementation , ser. OSDI ’99. Berkeley, CA, USA: USENIX Association, 1999, pp. 173–186

    1999

  25. [33]

    Phantom: A scalable block dag protocol

    Y . Sompolinsky and A. Zohar, “Phantom: A scalable block dag protocol.” IACR Cryptology ePrint Archive , vol. 2018, p. 104, 2018

    2018

  26. [34]

    Scaling n akamoto consensus to thousands of transactions per second,

    C. Li, P . Li, D. Zhou, W. Xu, F. Long, and A. Y ao, “Scaling n akamoto consensus to thousands of transactions per second,” arXiv preprint arXiv:1805.03870, 2018

    2018 arXiv

  27. [35]

    Chainweb: A proof-of-work parallel-c hain architecture for massive throughput,

    S. and Popejoy, “Chainweb: A proof-of-work parallel-c hain architecture for massive throughput,” 2018. [Online]. Ava ilable: https://kadena.io/docs/chainweb-v15.pdf

    2018

  28. [36]

    Chainweb pro- tocol security calculations,

    M. Quaintance and W. Martino, “Chainweb pro- tocol security calculations,” 2018. [Online]. Available: https://kadena.io/docs/chainweb calculations v7.pdf

    2018

  29. [37]

    Monoxide: Scale out Blockchains wi th Asyn- chronous Consensus Zones,

    J. Wang and H. Wang, “Monoxide: Scale out Blockchains wi th Asyn- chronous Consensus Zones,” in 16th {USENIX} Symposium on Net- worked Systems Design and Implementation ( {NSDI} 19). Boston, MA: {USENIX} Association, 2019, pp. 95–112

    2019

  30. [38]

    The hon ey badger of bft protocols,

    A. Miller, Y . Xia, K. Croman, E. Shi, and D. Song, “The hon ey badger of bft protocols,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’16. New Y ork, NY , USA: ACM, 2016, pp. 31–42. 10

    2016

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.