Breaking free from thechains of blockchain
protocols
Yonatan Sompolinsky

joint work: Aviv Zohar, Yoad Lewenberg

The Hebrew University, Jerusalem
IsraelOur daydream for Bitcoin◉

long-term vision.
several orders of magnitude increase intransaction volume (many MB per sec)◉transactions confirmed quickly (~1 sec)
◉highly secureThis work◉a new family of blockchain protocols◉

makes use of ordinary Bitcoin blocks◉- orthogonal to “offchain” solutions
scalablePublic ledger underhigh throughput
C1GenesisblockE1

network’s
F1 longestchainD3E2

flow of time

D4E3

D1D2A

B1

C2C3

D5

Double-spending
attacker publishes blocks
after confirmation
tx reversedA

B1honesttx

doublespend

B2

B

D1

E1

F1

D3E2

flow of time

D4E3

D2C2C3

D5C4

D6E4

F2

G1

Censorshipto prevent confirmation,
attacker publishes empty blocks fast
B

D1

E1

F1

D3

E2

F2

D4E3

D2A

B1

C2C3

D5G1

Delayed-Acceptanceto prevent confirmation,
attacker helps weaker chains to survive
B

D1E1

F1

E1

D6E4

D3D6D6D4E3D2A

B1C2C3D5F1

Security thresholds underhigh throughput

doublespending

censorship

delayedacceptancelongestchain

GHOST

ideal50%

50%

50%

50%

50%

50%

50%

50%

50%

does an ideal protocol exist?

INSIGHT“chainless” protocols.

1. to avoid vulnerability, all blocks
participate in tx confirmation.

2. agreeing on the order of incomingtransactions is enough.

From chains to DAG◉

acknowledge all predecessors◉

ledger becomes block chain DAG◉

need to define new consistency rules◉

more complex, more powerfulAB1B2C1

D1
D2

Consistency via linear orderingobservation: a linear ordering of blocks in DAG
induces natural consistency

A

B1

C1

B2block DAG

D1
D2A

B2

B1

C1linearized block DAG

D2

D1

Consistency via linear ordering

a “good” order should be resilient to revision.
now implies◉◉

with high probability:
no cutting in line:

later

published earlier than implies

not easy to satisfy - naïve protocols are manipulable

New protocol
the order on a given DAG is decided by all blocks voting.
1. for each paira) blockthat knows(base case:b) block

vote between
votesorand(or both): compute vote recursively
for allthat knows neither

that it does not know)

nor : compute vote by majority ofblocks in ’s future

2. linearize pairwise votes via the “Schulze Method”◉

under no delays coincides with longest-chain/GHOST◉

provably correctevery new block runs protocol on its world-view

EGenesisFcase #1: E or F are in past(C)infer C’s vote via recursion

EGenesis

FCC

case #1: E or F are in past(C)infer C’s vote via recursion

E

GenesisF

case #2, E and F not in past(C)C votes according to majority in future (C)E

GenesisF?

case #2, E and F not in past(C)C votes according to majority in future (C)E

Genesis?
F

case #2, E and F not in past(C)C votes according to majority in future (C)E

Genesis?

F

case #2, E and F not in past(C)C votes according to majority in future (C)E

Genesis?
F

case #2, E and F not in past(C)C votes according to majority in future (C)Genesis?

FE

case #2, E and F not in past(C)C votes according to majority in future (C)EGenesis

F

How censorship fails

EGenesis

How censorship fails

EGenesis

How censorship fails

EGen-esis

How censorship fails

EGen-esis

How censorship fails

EGen-esis◉Linearization
pairwise ordering not enough - cycles may form:
A>B>C>A

we use the “Schulze Method” to finalize the linear◉◉ordering
counting confirmations - we provide a policy,
which is faster than longest-chain/GHOST

Back to the security thresholds

Doublespending

Censorship

DelayedacceptanceLongestchain

GHOSTNew
Protocol

50%

50%

50%

50%

50%

50%

50%

50%

50%*

* excluding a visible double-spending

we proveWe are working on…

◉

patch for mining fees - countering “delayed◉considering incentives, selfish mining

acceptance” attack- our protocol does not make things worse◉

SPV and compact proofs◉

algorithmic efficiency for miners and merchants◉Summarythe longest-chain rule cannot scale,but Bitcoin can◉chains are neat and compact, yet vulnerable◉

using DAGs allows utilization of the entire
mining power“Bitcoiners of the world, unite! You have nothing

to lose but your chains!“ (Karl Marx)Thank You