Modeling Resources in Permissionless Longest-chain Total-order Broadcast

TL;DR

This paper introduces a formal framework to analyze how different resources like computation and stake influence the security and vulnerabilities of permissionless blockchain protocols, highlighting trade-offs and attack susceptibilities.

Contribution

It proposes a resource allocator abstraction to characterize resources and provides a framework for understanding security trade-offs in longest-chain protocols based on resource types.

Findings

Proof-of-Work is more resistant to long-range attacks.

Proof-of-Stake and Proof-of-Storage are more vulnerable to double-spending.

Security trade-offs depend on the underlying resource used in the protocol.

Abstract

Blockchain protocols implement total-order broadcast in a permissionless setting, where processes can freely join and leave. In such a setting, to safeguard against Sybil attacks, correct processes rely on cryptographic proofs tied to a particular type of resource to make them eligible to order transactions. For example, in the case of Proof-of-Work (PoW), this resource is computation, and the proof is a solution to a computationally hard puzzle. Conversely, in Proof-of-Stake (PoS), the resource corresponds to the number of coins that every process in the system owns, and a secure lottery selects a process for participation proportionally to its coin holdings. Although many resource-based blockchain protocols are formally proven secure in the literature, the existing security proofs fail to demonstrate why particular types of resources cause the blockchain protocols to be vulnerable to distinct classes of attacks. For instance, PoS systems are more vulnerable to long-range attacks, where an adversary corrupts past processes to re-write the history, than Proof-of-Work and Proof-of-Storage systems. Proof-of-Storage-based and Proof-of-Stake-based protocols are both more susceptible to private double-spending attacks than Proof-of-Work-based protocols; in this case, an adversary mines its chain in secret without sharing its blocks with the rest of the processes until the end of the attack. In this paper, we formally characterize the properties of resources through an abstraction called resource allocator and give a framework for understanding longest-chain consensus protocols based on different underlying resources. In addition, we use this resource allocator to demonstrate security trade-offs between various resources focusing on well-known attacks (e.g., the long-range attack and nothing-at-stake attacks).