The Economic Limits of Permissionless Consensus

TL;DR

This paper investigates the economic security limits of permissionless consensus protocols, establishing fundamental impossibility results and presenting a protocol that achieves economic security under certain conditions.

Contribution

It introduces the EAAC property to formalize economic security and proves bounds showing when no protocol can be EAAC, along with a protocol that achieves EAAC under specific adversary thresholds.

Findings

No protocol can be EAAC if adversary controls at least half of resources in synchronous setting.

No protocol can be EAAC if adversary controls at least one-third in partially synchronous setting.

A proof-of-stake protocol achieves EAAC if adversary controls less than two-thirds in synchronous setting.

Abstract

The purpose of a consensus protocol is to keep a distributed network of nodes "in sync," even in the presence of an unpredictable communication network and adversarial behavior by some of the participating nodes. In the permissionless setting, these nodes may be operated by unknown players, with each player free to use multiple identifiers and to start or stop running the protocol at any time. Establishing that a permissionless consensus protocol is "secure" thus requires both a distributed computing argument (that the protocol guarantees consistency and liveness unless the fraction of adversarial participation is sufficiently large) and an economic argument (that carrying out an attack would be prohibitively expensive for an attacker). There is a mature toolbox for assembling arguments of the former type; the goal of this paper is to lay the foundations for arguments of the latter type. An ideal permissionless consensus protocol would, in addition to satisfying standard consistency and liveness guarantees, render consistency violations prohibitively expensive for the attacker without collateral damage to honest participants. We make this idea precise with our notion of the EAAC (expensive to attack in the absence of collapse) property, and prove the following results: 1. In the synchronous and dynamically available setting, with an adversary that controls at least one-half of the overall resources, no protocol can be EAAC. 2. In the partially synchronous and quasi-permissionless setting, with an adversary that controls at least one-third of the overall resources, no protocol can be EAAC. 3. In the synchronous and quasi-permissionless setting, there is a proof-of-stake protocol that, provided the adversary controls less than two-thirds of the overall stake, satisfies the EAAC property. All three results are optimal with respect to the size of the adversary.