Herring: Parallel Batch-Order-Fairness on DAG-based Blockchain Consensus
Pith reviewed 2026-05-25 02:56 UTC · model grok-4.3
The pith
Herring parallelizes the fairness computation in DAG BFT consensus by moving graph construction after ordering and resolving missing edges via the existing broadcast layer.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
Herring is the first γ-batch-OF DAG BFT protocol whose fairness layer parallelizes the dominant graph construction cost across committed subdags by combining post-consensus graph construction with explicit missing edge resolution piggybacked on the DAG's reliable broadcast layer, turning fair ordering from a per-round serial bottleneck into a CPU-bound task.
What carries the argument
The post-consensus graph construction paired with piggybacked missing-edge resolution on the reliable broadcast layer, which distributes fairness work across subdags.
If this is right
- Herring tracks Narwhal & Tusk throughput closely up to roughly 10,000 tx/s.
- It reaches roughly 90% higher saturation throughput than FairDAG-RL.
- It reaches roughly 100% higher saturation throughput than DoD-W.
- It substantially lowers execution latency at saturation compared with prior batch-OF designs.
- It supplies patches that close previously unreported liveness vulnerabilities in FairDAG-RL and DoD.
Where Pith is reading between the lines
- The same piggyback technique could be reused in other DAG protocols that need auxiliary graph information without adding a separate communication round.
- Because the fairness step is now CPU-bound rather than latency-bound, further gains may come from multi-core scheduling of the graph-construction workers.
- The approach removes the single-leader bottleneck that appears in both leader-based and serial DAG fairness designs, suggesting similar restructuring may apply to other ordering properties.
Load-bearing premise
Piggybacking missing edge resolution on the reliable broadcast layer adds negligible overhead and creates no new liveness or safety problems.
What would settle it
A workload in which the added messages for missing-edge resolution measurably reduce the base DAG's throughput or allow a malicious client to stall the fairness layer indefinitely.
Figures
read the original abstract
Transaction ordering attacks extract billions of dollars annually from decentralized finance users in the form of Maximal Extractable Value (MEV). Byzantine Fault-Tolerant (BFT) consensus protocols guarantee total order but place no constraint on how that order is chosen, leaving the door open for adversarial reordering. Batch-order-fairness (batch-OF) protocols close this gap, but existing designs pay a steep performance price for this guarantee. Leader-based protocols such as Themis concentrate all fairness decisions at a single replica, while recent DAG-based proposals FairDAG and DAG of DAGs (DoD) force their fairness layer into strictly serial execution despite running on multi-proposer DAGs. We present Herring, the first $\gamma$-batch-OF DAG BFT protocol whose fairness layer parallelizes the dominant graph construction cost across committed subdags. Herring combines post-consensus graph construction with explicit missing edge resolution piggybacked on the DAG's reliable broadcast layer, a pairing that turns fair ordering from a per-round serial bottleneck into a CPU-bound task. We also uncover previously unreported liveness vulnerabilities in both FairDAG-RL and DoD that a malicious client can trigger to halt the fairness layer indefinitely, and propose patches that we integrate into our reimplementations. We implement Herring on top of the Rust implementation of Narwhal \& Tusk and evaluate it against FairDAG-RL, DoD-W, and Themis. Herring tracks the throughput of Narwhal \& Tusk closely up to roughly $10{,}000$\,tx/s, achieves roughly $90\%$ higher saturation throughput than FairDAG-RL and $100\%$ higher than DoD-W, and substantially reduces execution latency at saturation.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript presents Herring, the first γ-batch-OF DAG BFT protocol whose fairness layer parallelizes the dominant graph construction cost across committed subdags by combining post-consensus graph construction with explicit missing edge resolution piggybacked on the DAG's reliable broadcast layer. This is claimed to convert fair ordering from a per-round serial bottleneck into a CPU-bound task. The paper also identifies previously unreported liveness vulnerabilities in FairDAG-RL and DoD that a malicious client can trigger to halt the fairness layer, proposes patches, and reports an implementation on Narwhal & Tusk that tracks base throughput up to ~10,000 tx/s while achieving ~90% higher saturation throughput than FairDAG-RL and ~100% higher than DoD-W with reduced latency.
Significance. If the design holds and the piggybacking assumption is validated, this would be a meaningful contribution to practical batch-order-fairness in DAG-based BFT systems, enabling better MEV resistance without the serial bottlenecks of prior fairness layers. The parallelization approach, identification of liveness issues in existing protocols, and concrete implementation provide tangible value for the field.
major comments (2)
- [Design of fairness layer] Design description (turning fair ordering into a CPU-bound task): The central claim that explicit missing-edge resolution piggybacked on reliable broadcast adds negligible overhead and introduces no new liveness or safety issues lacks any message-complexity bounds, formal argument that the augmented broadcast preserves the original properties under Byzantine clients, or micro-benchmarks isolating the piggyback cost. This is load-bearing for the parallelization benefit, as the manuscript states that the underlying DAG construction remains the throughput bottleneck.
- [Evaluation] Evaluation claims (throughput and latency numbers): The reported gains (90% higher saturation throughput than FairDAG-RL, 100% higher than DoD-W) are presented without error bars, full experimental setup details, or statistical analysis. This limits assessment of whether the parallelization delivers the claimed practical benefits.
minor comments (1)
- The abstract references concrete implementation and evaluation but the manuscript should include explicit pseudocode or algorithmic steps for the piggybacking mechanism to support reproducibility.
Simulated Author's Rebuttal
We thank the referee for the constructive feedback on our manuscript. The two major comments identify areas where additional rigor would strengthen the presentation, and we address each point below with plans for revision.
read point-by-point responses
-
Referee: [Design of fairness layer] Design description (turning fair ordering into a CPU-bound task): The central claim that explicit missing-edge resolution piggybacked on reliable broadcast adds negligible overhead and introduces no new liveness or safety issues lacks any message-complexity bounds, formal argument that the augmented broadcast preserves the original properties under Byzantine clients, or micro-benchmarks isolating the piggyback cost. This is load-bearing for the parallelization benefit, as the manuscript states that the underlying DAG construction remains the throughput bottleneck.
Authors: We agree that the manuscript would benefit from a more formal treatment of this load-bearing claim. Section 4 explains that missing-edge information is appended to existing reliable broadcast messages of the underlying DAG layer and authenticated using the same mechanisms, preserving the original broadcast properties without introducing new message types or rounds. However, we did not supply explicit message-complexity bounds or a lemma establishing preservation under Byzantine clients. We will add a dedicated paragraph and lemma in the design section providing these bounds and the preservation argument. We will also include micro-benchmarks isolating the piggyback cost in the evaluation. These additions will be incorporated in the revised version. revision: yes
-
Referee: [Evaluation] Evaluation claims (throughput and latency numbers): The reported gains (90% higher saturation throughput than FairDAG-RL, 100% higher than DoD-W) are presented without error bars, full experimental setup details, or statistical analysis. This limits assessment of whether the parallelization delivers the claimed practical benefits.
Authors: We concur that greater statistical detail would improve interpretability of the results. The experiments were conducted on a 10-replica cluster using the Rust Narwhal & Tusk codebase with synthetic workloads ramped to saturation; the reported saturation points are averages across runs. We did not include error bars or variance analysis in the submitted version. In revision we will expand the experimental setup subsection with full hardware and workload parameters, add error bars derived from at least five independent runs per configuration, and include a short statistical note on the significance of the observed throughput differences. These changes will be made. revision: yes
Circularity Check
No circularity: new protocol construction with empirical evaluation
full rationale
The paper presents Herring as a novel combination of post-consensus graph construction and piggybacked missing-edge resolution on an existing reliable broadcast layer. No equations, fitted parameters, or predictions are defined in terms of the claimed outputs. No self-citations are used to justify uniqueness theorems or load-bearing assumptions. The performance claims rest on direct implementation and benchmarking against external baselines (Narwhal & Tusk, FairDAG-RL, DoD-W, Themis), which are independent of any internal fitting. The design is therefore self-contained against external benchmarks.
Axiom & Free-Parameter Ledger
free parameters (1)
- γ
axioms (1)
- domain assumption Byzantine fault model with fewer than one-third faulty replicas
Reference graph
Works this paper leans on
-
[1]
Orestis Alpos, Ignacio Amores-Sesar, Christian Cachin, and Michelle Yeo. 2023. Eating sandwiches: modular and lightweight elimination of transaction re- ordering attacks. In27th International Conference on Principles of Distributed Systems, OPODIS 2023, Tokyo, Japan, December 6-8, 2023
work page 2023
-
[2]
Balaji Arun, Zekun Li, Florian Suri-Payer, Sourav Das, and Alexander Spiegel- man. 2025. Shoal++: high throughput DAG BFT can be fast and robust! In22nd USENIX Symposium on Networked Systems Design and Implementation, NSDI
work page 2025
-
[3]
https://www.usenix.org/conference/nsdi25/presentation/arun
-
[4]
Kushal Babel, Andrey Chursin, George Danezis, Anastasios Kichidis, Lefteris Kokoris-Kogias, Arun Koshy, Alberto Sonnino, and Mingwei Tian. 2025. Mys- ticeti: reaching the latency limits with uncertified dags. In32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025
work page 2025
-
[5]
Henri Bal, Dick Epema, Cees de Laat, Rob van Nieuwpoort, John Romein, Frank Seinstra, Cees Snoek, and Harry Wijshoff. 2016. A Medium-Scale Distributed System for Computer Science Research: Infrastructure for the Long Term. Computer
work page 2016
-
[6]
Massimo Bartoletti and Roberto Zunino. 2025. A theoretical basis for MEV. InFinancial Cryptography and Data Security - 29th International Conference, FC 2025, Miyakojima, Japan, April 14-18, 2025, Revised Selected Papers, Part II (Lecture Notes in Computer Science). Christina Garman and Pedro Moreno- Sanchez, (Eds.) Springer, 225–242. doi:10.1007/978-3-03...
-
[7]
Christian Cachin and Jovana Micic. 2024. Quick order fairness: implementation and evaluation. InIEEE International Conference on Blockchain and Cryptocur- rency, ICBC 2024, Dublin, Ireland, May 27-31, 2024
work page 2024
-
[8]
Miguel Castro and Barbara Liskov. 1999. Practical byzantine fault tolerance. InProceedings of the Third USENIX Symposium on Operating Systems Design and Implementation (OSDI), New Orleans, Louisiana, USA, February 22-25, 1999. Margo I. Seltzer and Paul J. Leach, (Eds.) USENIX Association, 173–186. https: //dl.acm.org/citation.cfm?id=296824
work page 1999
-
[9]
Chainlink. 2023. What Is Maximal Extractable Value (MEV)? https://chain.link /education-hub/maximal-extractable-value-mev. (2023)
work page 2023
-
[10]
Wuhui Chen, Yikai Feng, Jianting Zhang, Zhongteng Cai, Hong-Ning Dai, and Zibin Zheng. 2024. Auncel: fair byzantine consensus protocol with high perfor- mance. InIEEE INFOCOM 2024 - IEEE Conference on Computer Communications
work page 2024
-
[11]
George Danezis, Lefteris Kokoris-Kogias, Alberto Sonnino, and Alexander Spiegelman. 2022. Narwhal and tusk: a dag-based mempool and efficient bft consensus. InProceedings of the Seventeenth European Conference on Computer Systems
work page 2022
-
[12]
Neil Giridharan, Florian Suri-Payer, Ittai Abraham, Lorenzo Alvisi, and Natacha Crooks. 2024. Autobahn: seamless high speed BFT. InProceedings of the ACM SIGOPS 30th Symposium on Operating Systems Principles, SOSP 2024, Austin, TX, USA, November 4-6, 2024
work page 2024
-
[13]
Suyash Gupta, Sajjad Rahnama, Jelle Hellings, and Mohammad Sadoghi. 2020. Resilientdb: global scale resilient blockchain fabric.Proc. VLDB Endow
work page 2020
-
[14]
Philipp Jovanovic, Lefteris Kokoris-Kogias, Bryan Kumara, Alberto Sonnino, Pasindu Tennage, and Igor Zablotchi. 2025. Mahi-mahi: low-latency asyn- chronous BFT dag-based consensus. In45th IEEE International Conference on Distributed Computing Systems, ICDCS 2025, Glasgow, United Kingdom, July 21-23, 2025
work page 2025
-
[15]
Dakai Kang, Junchao Chen, Anh Dinh, and Mohammad Sadoghi. 2025. Fairdag: consensus fairness over multi-proposer causal design.Proc. VLDB Endow
work page 2025
-
[16]
2014.Introduction to Modern Cryptography, Second Edition
Jonathan Katz and Yehuda Lindell. 2014.Introduction to Modern Cryptography, Second Edition. CRC Press.isbn: 9781466570269. https://www.crcpress.com/Int roduction-to-Modern-Cryptography-Second-Edition/Katz-Lindell/p/book/9 781466570269
work page 2014
-
[17]
Alireza Kavousi, Duc Viet Le, Philipp Jovanovic, and George Danezis. 2025. Blindperm: efficient MEV mitigation with an encrypted mempool and permu- tation. In29th International Conference on Principles of Distributed Systems, OPODIS 2025. doi:10.4230/LIPICS.OPODIS.2025.36
-
[18]
Idit Keidar, Eleftherios Kokoris-Kogias, Oded Naor, and Alexander Spiegelman
-
[19]
InProceedings of the 2021 ACM Symposium on Principles of Distributed Computing
All you need is dag. InProceedings of the 2021 ACM Symposium on Principles of Distributed Computing
work page 2021
-
[20]
Idit Keidar, Oded Naor, Ouri Poupko, and Ehud Shapiro. 2023. Cordial min- ers: fast and efficient consensus for every eventuality. In37th International Symposium on Distributed Computing, DISC 2023, October 10-12, 2023, L’Aquila, Italy
work page 2023
-
[21]
Mahimna Kelkar, Soubhik Deb, Sishan Long, Ari Juels, and Sreeram Kannan
-
[22]
InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security
Themis: fast, strong order-fairness in byzantine consensus. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security
work page 2023
-
[23]
Mahimna Kelkar, Fan Zhang, Steven Goldfeder, and Ari Juels. 2020. Order- fairness for byzantine consensus. InAdvances in Cryptology – CRYPTO 2020: 40th Annual International Cryptology Conference, CRYPTO 2020, Santa Barbara, CA, USA, August 17–21, 2020, Proceedings, Part III
work page 2020
-
[24]
Aggelos Kiayias, Nikos Leonardos, and Yu Shen. 2024. Ordering transactions with bounded unfairness: definitions, complexity and constructions. InAd- vances in Cryptology - EUROCRYPT 2024 - 43rd Annual International Conference on the Theory and Applications of Cryptographic Techniques(Lecture Notes in Computer Science). Springer, 34–63. doi:10.1007/978-3-0...
-
[25]
Klaus Kursawe. 2020. Wendy, the good little fairness widget: achieving order fairness for blockchains. InProceedings of the 2nd ACM Conference on Advances in Financial Technologies, AFT 2020, New York, NY, USA, October 21-23, 2020
work page 2020
-
[26]
Razya Ladelsky and Roy Friedman. 2025. On quorum sizes in dag-based bft pro- tocols. In2025 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)
work page 2025
-
[27]
Dahlia Malkhi and Pawel Szalachowski. 2022. Maximal extractable value (MEV) protection on a DAG. In4th International Conference on Blockchain Economics, Security and Protocols, Tokenomics 2022. doi:10.4230/OASICS.TOKENOMICS.20 22.6
-
[28]
Ke Mu, Bo Yin, Alia Asheralieva, and Xuetao Wei. 2024. Separation is good: A faster order-fairness byzantine consensus. In31st Annual Network and Dis- tributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024
work page 2024
-
[29]
Heena Nagda, Sidharth Sankhe, Sakshi Sinha, Keon Attarha, Mohammad Javad Amiri, and Boon Thau Loo. 2025. DAG of dags: order-fairness made practical. Proc. ACM Manag. Data, 3, 6, 1–27. doi:10.1145/3769777
-
[30]
Heena Nagda, Shubhendra Pal Singhal, Mohammad Javad Amiri, and Boon Thau Loo. 2024. Rashnu: data-dependent order-fairness.Proc. VLDB Endow., 17, 9, 2335–2348. doi:10.14778/3665844.3665861
-
[31]
Eunchan Park, Taeung Yoon, Hocheol Nam, Deepak Maram, and Min Suk Kang. 2025. On frontrunning risks in batch-order fair systems for blockchains (extended version).IACR Cryptol. ePrint Arch
work page 2025
-
[32]
Nikita Polyanskii, Sebastian Mueller, and Ilya Vorobyev. 2025. Starfish: a high throughput BFT protocol on uncertified DAG with linear amortized communi- cation complexity. Cryptology ePrint Archive, Paper 2025/567. (2025). https://e print.iacr.org/2025/567
work page 2025
- [33]
-
[34]
Pengkun Ren, Hai Dong, Nasrin Sohrabi, Zahir Tari, and Pengcheng Zhang
-
[35]
Proof-carrying fair ordering: asymmetric verification for BFT via incre- mental graphs.CoRR. arXiv: 2510.14186. doi:10.48550/ARXIV.2510.14186. 14 Herring: Parallel Batch-Order-Fairness on DAG-based Blockchain Consensus
-
[36]
Alexander Spiegelman, Balaji Arun, Rati Gelashvili, and Zekun Li. 2024. Shoal: improving DAG-BFT latency and robustness. InFinancial Cryptography and Data Security - 28th International Conference, FC 2024, Willemstad, Curaçao, March 4-8, 2024, Revised Selected
work page 2024
-
[37]
Alexander Spiegelman, Neil Giridharan, Alberto Sonnino, and Lefteris Kokoris- Kogias. 2022. Bullshark: DAG BFT protocols made practical. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022. ACM. doi:10.1145/3548606.3559361
-
[38]
Chrysoula Stathakopoulou, Signe Rüsch, Marcus Brandenburger, and Marko Vukolic. 2021. Adding fairness to order: preventing front-running attacks in BFT protocols using tees. In40th International Symposium on Reliable Distributed Systems, SRDS 2021, Chicago, IL, USA, September 20-23, 2021
work page 2021
-
[39]
Mohammad Amin Vafadar and Majid Khabbazian. 2023. Condorcet attack against fair transaction ordering. In5th Conference on Advances in Financial Technologies, AFT 2023. Joseph Bonneau and S. Matthew Weinberg, (Eds.), 15:1– 15:21. doi:10.4230/LIPICS.AFT.2023.15
-
[40]
Yang Wang, Xiaofei Xing, Guojun Wang, Yuheng Zhang, and Peiqiang Li. 2025. Dikaios: position-anchored group ordering with reputation for fair and efficient byzantine consensus.Comput. Netw
work page 2025
-
[41]
David Yakira, Avi Asayag, Gad Cohen, Ido Grayevsky, Maya Leshkowitz, Ori Rottenstreich, and Ronen Tamari. 2021. Helix: A fair blockchain consensus protocol resistant to ordering manipulation.IEEE Trans. Netw. Serv. Manag
work page 2021
-
[42]
Reiter, Guy Golan-Gueta, and Ittai Abraham
Maofan Yin, Dahlia Malkhi, Michael K. Reiter, Guy Golan-Gueta, and Ittai Abraham. 2019. Hotstuff: BFT consensus with linearity and responsiveness. In Proceedings of the 2019 ACM Symposium on Principles of Distributed Computing, PODC 2019, Toronto, ON, Canada, July 29 - August 2, 2019. Peter Robinson and Faith Ellen, (Eds.) ACM, 347–356. doi:10.1145/329361...
-
[43]
Pouriya Zarbafian and Vincent Gramoli. 2023. Lyra: fast and scalable resilience to reordering attacks in blockchains. InIEEE International Parallel and Dis- tributed Processing Symposium, IPDPS 2023, St. Petersburg, FL, USA, May 15-19, 2023
work page 2023
-
[44]
Jianting Zhang and Aniket Kate. 2025. No fish is too big for flash boys! frontrun- ning on dag-based blockchains. InIEEE Annual Computer Security Applications Conference, ACSAC
work page 2025
-
[45]
Yunhao Zhang, Srinath T. V. Setty, Qi Chen, Lidong Zhou, and Lorenzo Alvisi
-
[46]
Byzantine ordered consensus without byzantine oligarchy. In14th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2020, Virtual Event, November 4-6, 2020. 9 Open Science This paper presents Herring, a DAG-based consensus protocol that is designed to ensure batch-order fairness without sacrificing high performance. To support reproducib...
work page 2020
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.