Casanova

TL;DR

Casanova is a novel leaderless optimistic consensus protocol for permissioned blockchains that utilizes a DAG structure and combines voting with block production to handle conflicting transactions.

Contribution

It introduces a leaderless consensus protocol that produces a DAG and integrates voting with block creation to improve blockchain scalability and conflict resolution.

Findings

Produces blocks in a DAG rather than a chain

Combines voting rounds with block production

Handles conflicting transactions effectively

Abstract

We introduce Casanova, a leaderless optimistic consensus protocol designed for a permissioned blockchain. Casanova produces blocks in a DAG rather than a chain, and combines voting rounds with block production by singling out individual conflicting transactions.

Equations

$$\mathbb{E}=\underset{i\in I}{⨆}{\mathcal{E}}_i$$

$$\nexists D^{\prime }.D_W\subset D^{\prime }{e}_i^{\prime }=decid{e}_i(D^{\prime })\in {\mathcal{E}}_i{e}_i^{\prime }\ne e_i.$$

$$scor{e}_V(b):=\{W_b\}\cup \bigcup _{c\in children(b)}scor{e}_V(c).$$

$$\forall U\in S:weight(viewscor{e}_V(U,b))\ge k$$

$$weight(S)\ge k.$$

Full text

1 Introduction

The problem of achieving consensus over an asynchronous network between mutually distrustful parties has been a subject of research for several decades. After Nakamoto introduced Bitcoin [1], a new class of consensus algorithms emerged, making use of either miners or some kind of leader election. These include: proof of work (PoW), proof of stake (PoS), and proof of elapsed time (PoET) protocols, among others. Classical protocols, by contrast, tend to rely on rounds of message passing[2]. Proof of work algorithms are inherently inefficient because their security properties come from “wasted” computation, e.g. brute forcing hash preimages. The blockchain community is naturally interested in finding reliable and scalable consensus algorithms suited to use in a proof of stake context.

We present Casanova, a leaderless optimistic consensus protocol optimized for the blockchain, but which borrows from pre-Nakamoto consensus protocols. It would be appropriate for a proof-of-stake blockchain, but can be used in a variety of applications. It shows that one can pipeline voting and message-passing rounds by combining block creation with votes, and optimizes for the overwhelmingly common case that a transaction is not a double spend.

Casanova emerged from two principal observations. The first is that, as a rule, transactions on a blockchain do not conflict. The majority of users do not double spend because they want their transactions to clear quickly. Despite this fact, modern consensus protocols spend resources coming to consensus among alternatives on every transaction, regardless of whether or not any conflicting transactions have been seen. This is excessive and inefficient. Casanova achieves safety, liveness, and scalability by primarily running a conflict exclusion protocol, using a choice consensus protocol only when necessary for the occasional double spend, and only for the conflicting transactions. Conflicting transactions do not delay non-conflicting transactions in the same block.

Classical consensus algorithms are generally not suited to take advantage of this apparent lack of conflict because they make two assumptions that are not true in a blockchain context:

Processors begin with an initial value $v\in V$, where $V$ is the value domain. 2. 2.

Values $v\in V$ are readily forged. This assumption is usually implicit in the defenses against Byzantine behavior.

Casanova is able to take advantage of the general absence of double spends by removing these assumptions.

The second observation is that transactions do not need to be totally ordered. A partial order will suffice, as most transactions are unrelated. Current blockchains record transactions in a single chain, creating a total order between all transactions. Unrelated transactions do not need to be ordered, only related transactions (e.g. I received some money I later spent). By structuring transactions in a partial order, rather than a total order, Casanova is able to allow each validator to produce blocks at a regular interval rather than requiring mining or leader election to produce a single block at a regular interval.

For this reason, in Casanova, blocks do not form a chain, but a directed acyclic graph.

2 Preliminaries

2.1 Network Requirements

To achieve liveness we assume partial synchrony, which is that the network delivers any message within some finite time bound $\Delta$. We do not need to know, or even have an estimate of $\Delta$ at any point. To achieve safety, on the other hand, our network can be totally asynchronous. Messages can be arbitrarily dropped, reordered, or duplicated.

2.2 Events and Transactions

We assume some set of all possible events, $\mathbb{E}$. We also assume that $\mathbb{E}$ is suitably partitioned into mutually exclusive alternatives:

[TABLE]

for some indexing set $I$. That is, each event $e\in\mathbb{E}$ belongs to exactly one $\mathcal{E}_{i}$ and at most one such event could have occurred. We call the events transactions if there exists some $\mathcal{E}_{i}$ that contains more than one event. We assume from any transaction $e_{i}$ that the conflict index $i$ can be computed, and that we have a suitable function $index:index(e_{i}\in\mathcal{E}_{i})=i$

2.3 Graph theoretic notions

A directed acyclic graph (DAG) is a directed graph with no cycles. A cycle is a path along graph edges whose source and target are the same vertex. In the case of Casanova, any edge in the DAG has as its source a child block and as its target a direct parent of the child. A leaf is a graph vertex that is the source to some (possibly empty) set of edges but target to none.

Note that a finite nonempty DAG always has a nonempty set of leaves. To find a leaf, one can choose a vertex at random and follow any reverse path until termination. In the DAG consisting of one vertex (and no edges), that vertex is a leaf. In particular, the genesis block alone is a leaf. To disambiguate nodes in a DAG from nodes in the network, we use the term validator to refer to a network node, and block to refer to a node in the DAG.

Casanova builds a DAG of blocks instead of a chain. Each block contains a reference to one or more parents. An individual validator is not allowed to produce a block that is not a descendant of their most recent block. Violating this requirement is called equivocation and is a fault.

We will occasionally abuse notation and treat a DAG as either a set of blocks or a set of transactions. When we treat it as a set of blocks, we mean the underlying set of blocks, and when we treat it as a set of transactions, we mean the union of transactions over the underlying set of blocks. We also use $+$ to represent adding a block to a DAG. The meaning should be clear as the block contains its parent links.

2.4 Consensus on a DAG

A DAG-consensus algorithm for a set of partitioned events $\mathbb{E}=\bigsqcup\limits_{i\in I}\mathcal{E}_{i}$ is a protocol together with a family of functions $decide_{i}$, $i\in I$, from DAGs to $\mathcal{E}_{i}+\mathcal{P}(\mathcal{E}_{i})$, the disjoint union of $\mathcal{E}_{i}$ with the powerset of $\mathcal{E}_{i}$. It either returns the decision or a set of known alternatives when no decision has been reached. If $decide_{i}(D)\in\mathcal{E}_{i}$, then we say a validator with DAG $D$ has decided on $e_{i}=decide_{i}(D)$. If $decide_{i}(D)=\varnothing$, then $D$ does not include any transaction $e_{i}\in\mathcal{E}_{i}$. If $decide_{i}(D)=E_{i}\in\mathcal{P}(\mathcal{E}_{i})E_{i}\neq\varnothing$, then $E_{i}$ is the set of currently known alternatives. In particular if $|E_{i}|=1$, this is not the same as a decision. In the absence of new alternatives a representative from $E_{i}$ will eventually be chosen.

Stating the requirement about “eventually chosen” more formally: If $decide_{i}(D)=E_{i}\subset\mathcal{E}_{i}$, ${E_{i}\neq\varnothing},{D\subset D^{\prime}},decide_{i}(D^{\prime})\in\mathcal{E}_{i}$ and $D^{\prime}$ does not contain any transactions in $\mathcal{E}_{i}$ not already in $D$, then $decide_{i}(D^{\prime})$ must be an element of $E_{i}$.

2.4.1 Safety

Assume that we have a DAG $D$ as seen by a validator $V$ such that $e_{i}=decide_{i}(D)\in\mathcal{E}_{i}$ for some $i$. For every validator $W\neq V$ let $D_{W}$ be the induced sub-DAG created by taking the most-recent blocks created by $W$ and every ancestor block of those blocks. A DAG-consensus algorithm is safe if for every correct validator $W\neq V$ the protocol cannot create a DAG $D^{\prime}$ which contains $D_{W}$ as a subgraph s.t. $e^{\prime}_{i}=decide_{i}(D^{\prime})\in\mathcal{E}_{i}$ and $e^{\prime}_{i}\neq e_{i}$. More succinctly:

[TABLE]

Informally, this means that if a correct validator decides, no other correct validator can make a different decision.

2.4.2 Liveness

A DAG-consensus algorithm is live if the protocol guarantees that for all $i\in I$, a correct validator $V$ either has only seen DAGs $D$ such that $decide_{i}(D)=\varnothing$ or $V$ eventually sees a DAG $D$ such that $decide_{i}(D)\in\mathcal{E}_{i}$.

2.5 Algorithm Structure

We use the communicating event loop model, in which a single thread pulls an event from a queue and processes it before handling the next event. Each of the algorithms included is presented as an initial state and several event handlers. The event handlers each include a comment indicating the state that gets read. We underline any state that gets modified. Events may contain information; that information is presented as arguments to the event handler.

2.6 Validators and Byzantine behavior

A Byzantine validator is one which behaves arbitrarily. We denote by $N$ then number of validators and $f$ the number of Byzantine validators in our network. A correct validator is one that is not byzantine. We define a Non-Faulty Majority ($NFM$) as $\lceil\frac{N-f+1}{2}\rceil$, and a Fault Tolerant Majority ($FTM$) as $\lceil\frac{N+f+1}{2}\rceil=NFM+f$. Given an $NFM$, any $FTM$ will contain at least one validator from the $NFM$.

2.7 Layout of what follows

The rest of the paper has the following structure: In §3.1 we build Casanova-attest, a simple attestation protocol that gives structure to the trivial consensus protocol. In §3.2 we expand Casanova-attest to Casanova-conflict-attest, which can handle conflicting transactions by using an auxiliary consensus protocol. After defining some relevant terms in §4, in §5.1 we expand Casanova-conflict-attest to Casanova-conflict-exclude, which shows when we can avoid having to use the auxiliary protocol. Finally, in §5.2 we show how to build consensus natively into the structure with Casanova.

3 Using attestation to identify and resolve conflicts

3.1 An attestation protocol

In the majority of blockchain applications, the network’s responsibility more closely resembles one of attestation rather than consensus. Here we use attest to mean record with evidence. More specifically, the problem of attestation is to record events supplied by users in a partial order. Users can request that a particular event $e$ follow some other event $e^{\prime}$. In the absence of double spends, this is exactly what a blockchain is doing, as creation of outputs must precede the spending of those outputs. We sketch a simple attestation protocol Casanova-attest:

Starting with the empty record (a genesis block), validators build a DAG both by adding blocks of their own and by listening to their peers. To produce its own block, a validator listens for (event-data, parent-hashes) tuples to record from clients. The parent-hashes are hashes of events that must have been recorded in order to record this tuple. If a validator has recorded events matching all the parent hashes the user requested, it will add the tuple to its next block. Otherwise it ignores the request. Validators periodically produce blocks $b$ whose events are all of the unrecorded tuples they have received and whose parents are all the leaves of the DAG they have seen so far. Once a validator adds $b$ to its DAG, it communicates $b$ to the rest of the validators. For pseudocode, see Algorithm 1.

When a validator receives a block from a peer, if it has all of the block’s parents, it adds the block to its DAG. If not, it waits until it has the parents in its DAG, and then adds the block to its DAG.

If a validator has recorded an event, nothing in the protocol allows it to alter this record. Assuming all messages are eventually delivered, every correct validator will eventually record the event as well. In essence, Casanova-attest is a trivial consensus protocol—consensus over a set of size 1—where attestations grow in a DAG. Note that this does not contradict the standard impossibility result[3], because we are essentially building consensus on sets of size 1.

3.2 From attestation to consensus

Casanova-attest only works if there is no possibility of conflict between the events to be recorded. We call events with the possibility of conflict transactions. Assume that we can handle up to $f$ Byzantine faults, where $N\geq 3f+1$. We modify Casanova-attest as follows to produce Casanova-conflict-attest:

When a validator receives two blocks that contain conflicting transactions $e_{i},e^{\prime}_{i}\in\mathcal{E}_{i}$, it attests to the fact that it observed the conflict. The validators can then use some other means (like Algorithm 22 from “Consensus in the Presence of Partial Synchrony” [4]) to come to consensus on some representative $e_{i}\in\mathcal{E}_{i}$. Upon achieving consensus, each validator records the decision and the evidence produced by the side protocol in the DAG. Assuming that some validator sees the conflict first and the others see it within $\Delta$, the side protocol will have a delay of at most $2\Delta$, and so will eventually decide. For pseudocode, see Algorithm 2.

3.3 Selective consensus

If every transaction admits at least two conflicting alternatives, the above protocol could require a run of Algorithm 22 for every transaction. It would be nice if we could lean on the attestation DAG to avoid some of these runs. We will need to introduce some DAG terminology in order to describe a protocol that does so.

4 DAG Properties

4.1 Scoring blocks in a DAG

We want to solve the problem of assigning a set of validators (voters) to the blocks in a DAG. We call this set the score. Given the set, we can compute either a count or, more generally, a weight. We are computing the score set as seen by validator $V$. The score of a block is the union over all self-or-descendant blocks of the validators that created those blocks. More formally, for each block $b$, let $W_{b}$ be the validator that created the block. The score of $b$ as computed by $V$ is

[TABLE]

This can be efficiently computed via any reverse topological traversal.

4.2 Observed Sets

Each validator $V$ also needs to compute the score as seen by other validators when they created their blocks. In $V$’s view of the DAG, there is one most recent block created by each correct validator. If there is more than one such block for a validator $U$, $U$ must have equivocated. A block $b$ is most recent for validator $U$ if $V$ has not seen a block created by $U$ that is a descendant of $b$. A validator’s most recent block may be the genesis block, which is treated as if it were created by all the validators. For each validator $U$, $V$’s view of $U$’s score is computed as above, but on the induced subgraph of the most recent block. If a validator $U$ has two or more most-recent blocks, $V$ can simply exclude them entirely and reduce $N$ and $f$ both by one, as $V$ has proof that $U$ is faulty. We will represent $V$’s view of $U$’s score at block $b$ as $viewscore_{V}(U,b)$

Assume some weighting function $weight$ which maps validators to integer weights. In the simple case, $weight$ can be the constant function $1$. We can extend this function to sum over a set of validators. Given such a function, we define a $k$-observed set as follows: A $k$-observed set, for a block $b$ is a set $S$ of validators such that:

[TABLE]

and

[TABLE]

There is a straightforward algorithm to check for the existence of a $k$-observed set.

We will compute the score of transactions in a similar manner, and unless otherwise modified, the score of a transaction is the score of the block that contained it. If a transaction is in more than one block, its score is the union of the scores of the blocks that contain it.

For the purpose of conflict resolution, some attestations have rounds attached to them. When looking for a $k$-observed set, the attestations must all belong to the same round. Blocks from later rounds should be excluded when traversing the DAG, and blocks from earlier rounds don’t count when calculating the score for this round.

5 Using the DAG to remove the side consensus protocol

We now have enough DAG machinery to allow attestation to do some of the consensus work.

5.1 Selective Consensus: Exclusion

We change Casanova-conflict-attest as follows to produce Casanova-conflict-exclude. Note that the attestations described here only apply to finding an $FTM$-observed set, and are not part of the side protocol.

When a validator $V$ receives two blocks that contain conflicting transactions $e_{i},e^{\prime}_{i}\in\mathcal{E}_{i}$, it attests to the fact that it observed the conflict. It then computes the scores of the conflicting transactions. If any validator had attested to a transaction before attesting to the conflict, their attestation toward the first transaction is included in the score, including $V$ if it attested. If $V$’s observed score for the block containing $e_{i}$ is $FTM$ or greater, without seeing an $FTM$-observed set, $V$ joins the side consensus protocol with altered initial conditions. For example, if we use Algorithm 22, $V$ would join the protocol with a phase $-1$ lock on $e_{i}$. See the Appendix for a summary of Algorithm 22. There may be other consensus algorithms that admit suitably altered initial conditions.

If $V$ does not see a score of $FTM$ or greater for either $e_{i}$ or $e^{\prime}_{i}$, it joins the side consensus protocol with standard initial conditions. If $V$ sees an $FTM$-observed set, it does not join the side consensus protocol, but rather continues to produce blocks attesting to the fact that it observed such a set. This gives us two cooperatively overlapping decision criteria: the first is observing an $FTM$-observed set, and the second is receiving the decision of the side consensus algorithm. For pseudocode, see Algorithm 3.

Lemma 5.1**.**

If an $FTM$-observed set exists, then Algorithm 22 can only decide on the value attested by the $FTM$-observed set.

The proof is a straightforward alteration of Lemma 3.5 from “Consensus in the Presence of Partial Synchrony.” [4], because at least $NFM$ correct processors start with a lock on $e_{i}$ at phase $-1$. This means that if a validator receives evidence of an $FTM$-observed set, they can stop the side protocol, as the outcome is a foregone conclusion.

It is straightforward to see that if no such observed set exists, then the correct processors join the side protocol within $\Delta$, and so the side protocol has a delay of at most $2\Delta$, and will therefore converge.

5.2 Completely removing the side consensus algorithm

We can now build in a consensus algorithm natively into Casanova-conflict-exclude, and dispense with a side algorithm. We call this Casanova.

We assume that validators produce a new block every time unit $\delta$. A round is defined as a fixed number of blocks. Round 1 for a validator begins two blocks after the block that begins round 0. Each round $r\geq 1$ begins $r+1$ blocks after the block that began round $r-1$ (that is, round $r$ starts $\frac{r(r+3)}{2}$ blocks after round [math]). Validators can have locks on a value which is internal state not externally visible. Locks on a value have an associated round. Once a validator has a lock on a value, it may release it only to take a lock with a later associated round. This may be for the same or a different value.

The state before a conflict is encountered is treated as round $-1$. Upon encountering conflicting transactions $e_{i}$ and $e^{\prime}_{i}$, round [math] for the conflict domain $\mathcal{E}_{i}$ begins. If a validator has observed $e_{i}$ with a score of $FTM$ or greater, it has a round $-1$ lock on $e_{i}$. If a validator observes some transaction $e_{i}$ with a score of $FTM$ or greater in any round $r$, it takes a lock on $e_{i}$, with the associated round $r$. If it has a lock from a previous round $p<r$, it releases the earlier lock and takes the later lock.

The validators must vote at the beginning of each round $r$ according to the following rules:

If the validator has a lock on $e_{i}$ from a previous round $p<r$, the validator attests to their vote for $e_{i}$ at the beginning of round $r$, and the DAG includes their attestation that they did see a score of $FTM$ or greater in some previous round. 2. 2.

Otherwise, the validator records a vote for transaction $e^{\prime}_{i}\in\mathcal{E}_{i}$ with the lowest hash seen so far. (Any other deterministic ordering would work as well)

To bound the number of possibilities from a particular exclusion set $\mathcal{E}_{i}$, each validator may attest to at most 1 transaction from $\mathcal{E}_{i}$. Conflicts may arise due to different validators attesting to different transactions before seeing blocks containing conflicting transactions. This bounds the number of transactions that will be considered from any given $\mathcal{E}_{i}$ to $N-f+f(N-f)$.

If, for any $r$, a validator sees a round-$r$ $FTM$-observed set for a transaction $e_{i}$, the validator decides on $e_{i}$, and attests to that fact. The validator no longer counts rounds, but can continue with the attestation. Other validators will eventually also see the same decision criteria. For pseudocode, see Algorithm 4.

5.3 Formal Decision Criteria

We define $decide_{i}$ as follows for Casanova. $decide_{i}(D)=e_{i}$ if $e_{i}\in\mathcal{E}_{i}$ and $D$ contains an $FTM$-observed set having voted for $e_{i}$ in some round $r$. If an $FTM$-observed set exists in more than one round, we take the value chosen in the earliest round. Otherwise $decide_{i}(D)=\{e\in D|index(e)=i\}$. Assuming we have $f$ or fewer Byzantine validators, this is well defined because the existence of two or more $FTM$-observed sets for different transactions $e_{i}\neq e^{\prime}_{i}$ would require at least $f+1$ equivocations.

5.4 Proof of Safety for Casanova

Assume some validator $V$ with DAG $D$ s.t. $e_{i}=decide_{i}(D)\in\mathcal{E}_{i}$, and let $r$ be the round associated with the decision. Then $V$ observed an $FTM$-observed set. Of the $FTM$-observed set, at least an $NFM$ must be locked on $e_{i}$. In order to unlock from $e_{i}$, they must observe a transaction $e^{\prime}_{i}\in\mathcal{E}_{i}$ in round $r^{\prime}>r$ with score $FTM$ or greater. But because at least $NFM$ are locked on $e_{i}$, the greatest possible score that could be seen is $FTM-1$. This precludes the formation of an $FTM$-observed set on $e^{\prime}_{i}\neq e_{i}$, therefore no two correct processors can decide on different values under the assumed fault bounds. There is some earliest round $r_{min}$ where any validator decides. The above shows that if any correct validator decides a round $r>r_{min}$, they will make the same decision. $\square$

5.5 Proof of Liveness for Casanova

We will prove liveness for some particular $\mathcal{E}_{i}\subset\mathbb{E}$; specifically, at least one representative $e_{i}\in\mathcal{E}_{i}$ has been observed by at least one correct validator. Assume a validator $V$ with DAG $D$ s.t. $decide_{i}(D)\in\mathcal{P}(\mathcal{E}_{i})decide_{i}(D)\neq\varnothing.$ Assume that round $r$ is longer than $2\Delta$. Then before the start of round $r+1$, there is at most one locked transaction: during the round, all validators receive evidence of locks from all correct validators. If two or more locks exist, the correct validators will release all but one of them, the lock with the highest round. If such a lock exists, then every correct validator has received evidence for it. Then the blocks that start round $r+1$ will be received in enough time for an $FTM$-observed set to form during the round. If a lock does not exist at the start of round $r+1$, a lock will occur within $N-f+f(N-f)$ additional rounds, because of the bound on the number of possible conflicts that may be accepted. $\square$

6 Conclusion

Casanova is an attestation-based Byzantine fault tolerant algorithm for ongoing consensus on a causally linked DAG of transactions. It is optimized for the case where the majority of transactions never see conflicts. It requires that transaction conflicts partition the set of possible transactions, a requirement that can be met in a ledger, but is not met e.g. in Bitcoin[1]. A programmable blockchain using this consensus algorithm would need to carefully match the programming model to this requirement. Overall we expect that the requirements can be met in a variety of useful applications, and that the algorithm will scale very well.

We encourage researchers to extend these ideas to optimize other kinds of consensus protocols. We warmly welcome efforts to implement Casanova and measure its performance.

7 Acknowledgment

Some of our initial ideas were inspired by Vlad Zamfir and his colleagues’ work on Casper [5]. The integrated consensus protocol borrows heavily from Tendermint [6] and Algorithm 22 from DLS[4].