Quantifying Liveness and Safety of Avalanche's Snowball

TL;DR

This paper experimentally analyzes the resilience of Avalanche's Snowball protocol, showing how adversaries can delay liveness and break safety under certain conditions, highlighting its similarities to Byzantine broadcast protocols.

Contribution

It provides the first quantitative analysis of Snowball's resilience, demonstrating the thresholds for liveness and safety breaches through simulation.

Findings

Adversaries controlling about 5.2% stake can delay liveness in 2000-node network.

Less than 3% stake can attack liveness when given additional network state information.

Safety can be broken exponentially faster than liveness, depending on adversary stake and network size.

Abstract

This work examines the resilience properties of the Snowball and Avalanche protocols that underlie the popular Avalanche blockchain. We experimentally quantify the resilience of Snowball using a simulation implemented in Rust, where the adversary strategically rebalances the network to delay termination. We show that in a network of $n$ nodes of equal stake, the adversary is able to break liveness when controlling $\Omega(\sqrt{n})$ nodes. Specifically, for $n = 2000$, a simple adversary controlling $5.2\%$ of stake can successfully attack liveness. When the adversary is given additional information about the state of the network (without any communication or other advantages), the stake needed for a successful attack is as little as $2.8\%$. We show that the adversary can break safety in time exponentially dependent on their stake, and inversely linearly related to the size of the network, e.g. in 265 rounds in expectation when the adversary controls $25\%$ of a network of 3000. We conclude that Snowball and Avalanche are akin to Byzantine reliable broadcast protocols as opposed to consensus.