arXiv subjects

Alejandro Ranchal-Pedrosa

Publications and source records attributed to Alejandro Ranchal-Pedrosa.

12 recordsLinked to original sources

arXiv2026

You've Got a BUD in Me: Authenticated Reads from Per-Block Write Logs

Blockchains usually pay for authenticated reads by maintaining a structure that spans the entire state. We show how validators can support historical membership and exclusion proofs by authenticating each block's writes instead. A Block Update Digest (BUD) commits a write log whose predecessor pointers link successive modifications of each key. A SuperBUD summarizes last writes over a window; an exponential hierarchy turns long unchanged intervals into short proofs. The digest count is logarithmic in the gap within the hierarchy's range, with one additional digest per top-level window beyond it. We prove soundness against adversarial provers and up to f Byzantine validators, and completeness for queries anchored by a post-deployment modification, assuming archive, attestation, and committee evidence is available. Across a 50x increase in state size, the measured base-BUD path rises by 1.24x, compared with 3.1x and 69.5x for in-memory and cache-bounded disk-backed Merkle Patricia tries. On the synthetic trace, two-digest read-layer payloads stay below 800 bytes, and warm hash-path verification takes at most 146 microseconds at p99.

cs.CR↗

arXiv2026

Hermes: Low Tail-Latency Via Prefix Consensus

Leader-based BFT protocols finalize through their leaders: a view whose leader is crashed or slow finalizes nothing, and the timeout that ends it admits no good setting. A conservative timeout turns every crashed leader into a long stall; an aggressive one voids the views of leaders that are merely slow. Either way the expired view is wasted, and this trade-off, not the good case, governs tail latency. Hermes makes expired views finalize. Hermes is a two-round rotating-leader protocol for $n=5f+1$ processes under partial synchrony built on prefix consensus: votes carry values ordered by a prefix relation, and quorums require comparability rather than equality. Every process broadcasts a justified proposal at view start and casts a single vote, for the leader's proposal upon delivery or for a fallback proposal at the timeout; there are no nullify votes. A timely honest leader finalizes its full proposal in $2δ$. Otherwise, any $n-f$ votes, which need not match, finalize the heaviest common prefix. We instantiate Hermes as a finality gadget over an available chain and over Autobahn-style multi-lane dissemination, where parent-relative delta tipcuts with explicit skips keep independent proposals comparable and sender-indexed erasure-coded amplification keeps complexity at $O(n^2\hat{m}+λn^3)$ bits and $O(n^2)$ messages per view, where $\hat{m}$ is the number of concurrent dissemination lanes in Autobahn and $λ$ the security parameter.

cs.DC↗

arXiv2026

Slack and Budget Breaking in Threshold Team Production

A threshold system completes a public task only after $κ$ verifiable shares are publicly committed. If the honest schedule creates $ \Nstar=κ+Δ$ share opportunities by deadline $t^\star$, then $Δ$ shares are slack such that a coalition delays completion if and only if it withholds at least $Δ+1$ shares. The incentive problem is therefore to price the cheapest sabotage set. Agents receive a direct fee $f$ per committed share. A delaying coalition may also obtain delay value at most $L$, and may earn additional fee revenue during recovery after the deadline. Let $R_1^+$ be a pathwise upper bound on the coalition's incremental fee revenue in a recovery slot that completes the task, including any same-slot overshoot. The principal can post a nonnegative completion bounty that depends only on committed shares, uses no deposits or punishments, and expires if completion is late. The optimal rule is uniform, as if completion occurs by $t^\star$, every admissible horizon share receives $B/\Nstar$, otherwise no bounty is paid. Full participation is ex-post strongly delay proof exactly when $ (Δ+1)f+\frac{Δ+1}{\Nstar}B \ge L+R_1^+ . $ Equivalently, the exact worst-case budget is $ B^\star = \frac{\Nstar}{Δ+1} \bigl(L+R_1^+-(Δ+1)f\bigr)^+ . $ The bound is tight for every nonnegative completion measurable bounty, among the $\Nstar$ horizon shares, some $Δ+1$ receive total bounty at most $(Δ+1)B/\Nstar$, and withholding precisely those shares delays completion. The result applies to threshold signatures, data availability certification, coded dissemination, and generic $k$-of-$n$ completion tasks. We also isolate a separate limit, no transfer rule based only on completed shares can remove a final slot race in which a coalition has already observed enough pre-completion shares to act.

cs.GT↗

arXiv2026

SNARE: A TRAP for Rational Players to Solve Byzantine Consensus in the 5f+1 Model

The TRAP protocol solves rational agreement by combining accountable consensus with a one-shot BFTCR finalization phase. We present SNARE (Scalable Nash Agreement via Reward and Exclusion), the adaptation of TRAP to $n=5f{+}1$, and prove $ε$-$(k,t)$-robustness for rational agreement tolerating coalitions up to ${\approx}73\%$ with deposits under $0.5\%$ of the gain. A central finding is that appending a single all-to-all broadcast round with the $4f{+}1$ threshold after predecisions yields $ε$-$(k,t)$-robustness for coalitions up to $3f$ (${\approx}60\%$) without any deposit: we need not model or know the utility function of deviating players, only that they participate in the protocol. These players can be \emph{deceitful} (arbitrary unknown utility), not just rational, and the finalization structure prevents disagreement regardless of their motivation. This observation is protocol-agnostic, applies to any $5f{+}1$ protocol at the cost of one message delay that runs concurrently with the next view, and does not require commit-reveal mechanisms. Above $60\%$, the full baiting mechanism with deposits under $0.5\%$ extends tolerance to ${\approx}73\%$. A second finding is that valid-candidacy, the property preventing reward front-running, holds unconditionally regardless of the quorum threshold, removing both the $n>2(k{+}t)$ and $n>\frac{3}{2}k{+}3t$ constraints from the original TRAP. This retroactively extends the $3f{+}1$ bound from $C<n/2$ to $C<5n/9$. The binding constraint in both models is the winner consensus operating on $2f$ residual players after excluding $3f{+}1$ detected equivocators. We explore avenues for relaxing this limit.

cs.GT↗

arXiv2026

A mechanism design overview of Sedna

Sedna is a coded multi-proposer consensus protocol in which a sender shards a transaction payload into rateless symbols and disseminates them across parallel proposer lanes, providing high throughput and ``until decode'' privacy. This paper studies a sharp incentive failure in such systems. A cartel of lane proposers can withhold the bundles addressed to its lanes, slowing the chain's symbol accumulation while privately pooling the missing symbols. Because finalized symbols become public, the cartel's multi-slot information lead is governed by a chain level delay event where the chain fails to accumulate the $κ$ bundles needed for decoding by the honest horizon $t^\star=\lceil κ/m\rceil$. We characterize the resulting delay probability with KL-type large deviation bounds and show a knife edge pathology when the slack $Δ=t^\star m-κ$ is zero such that withholding a single bundle suffices to push inclusion into the next slot with high probability. We propose \textsf{PIVOT-$K$}, a Sedna native pivotal bundle bounty that concentrates rewards on the $κ$ bundles that actually trigger decoding, and we derive explicit incentive compatibility conditions against partial and coalition deviations. We further show that an adaptive sender ``ratchet'' that excludes lanes whose tickets were not redeemed collapses multi-slot withholding into a first slot deficit when $t^\star\ge 2$, reducing the required bounty by orders of magnitude. We close by bounding irreducible within slot decode races and providing parameter guidance and numerical illustrations. Our results show that for realistic parameters Sedna can reduce MEV costs to 0.04\% of the transaction value.

cs.GT↗

arXiv2025

Sedna: Sharding transactions in multiple concurrent proposer blockchains

Modern blockchains increasingly adopt multi-proposer (MCP) consensus to remove single-leader bottlenecks and improve censorship resistance. However, MCP alone does not resolve how users should disseminate transactions to proposers. Today, users either naively replicate full transactions to many proposers, sacrificing goodput and exposing payloads to MEV, or target few proposers and accept weak censorship and latency guarantees. This yields a practical trilemma among censorship resistance, low latency, and reasonable cost (in fees or system goodput). We present Sedna, a user-facing protocol that replaces naive transaction replication with verifiable, rateless coding. Users privately deliver addressed symbol bundles to subsets of proposers; execution follows a deterministic order once enough symbols are finalized to decode. We prove Sedna guarantees liveness and \emph{until-decode privacy}, significantly reducing MEV exposure. Analytically, the protocol approaches the information-theoretic lower bound for bandwidth overhead, yielding a 2-3x efficiency improvement over naive replication. Sedna requires no consensus modifications, enabling incremental deployment.

cs.CR↗

arXiv2023

ZLB, a Blockchain Tolerating Colluding Majorities

The problem of Byzantine consensus has been key to designing secure distributed systems. However, it is particularly difficult, mainly due to the presence of Byzantine processes that act arbitrarily and the unknown message delays in general networks. Although it is well known that both safety and liveness are at risk as soon as n/3 Byzantine processes fail, very few works attempted to characterize precisely the faults that produce safety violations from the faults that produce termination violations. In this paper, we present a new lower bound on the solvability of the consensus problem by distinguishing deceitful faults violating safety and benign faults violating termination from the more general Byzantine faults, in what we call the Byzantine-deceitful-benign fault model. We show that one cannot solve consensus if $n \leq 3t + d + 2q$ with t, d, and q are Byzantine, deceitful, and benign processes. We show that this bound is tight by presenting the Basilic class of consensus protocols that solve consensus when $n > 3t + d + 2q$. These protocols differ in the number of processes from which they wait to receive messages before progressing. Then, we build upon the Basilic class in order to present Zero-Loss Blockchain (ZLB), the first blockchain that tolerates an adversary controlling more than half of the system, with up to less than a third of them Byzantine. ZLB is an open blockchain that combines recent theoretical advances in accountable Byzantine agreement to exclude undeniably faulty processes. Interestingly, ZLB does not need a known bound on the delay of messages but progressively reduces the portion of faulty processes below 13 , and reaches consensus. Geo-distributed experiments show that ZLB outperforms HotStuff and is almost as fast as the scalable Red Belly Blockchain that cannot tolerate n/3 faults.

cs.DC↗

arXiv2022

Basilic: Resilient Optimal Consensus Protocols With Benign and Deceitful Faults

The problem of Byzantine consensus has been key to designing secure distributed systems. However, it is particularly difficult, mainly due to the presence of Byzantine processes that act arbitrarily and the unknown message delays in general networks. Although it is well known that both safety and liveness are at risk as soon as $n/3$ Byzantine processes fail, very few works attempted to characterize precisely the faults that produce safety violations from the faults that produce termination violations. In this paper, we present a new lower bound on the solvability of the consensus problem by distinguishing deceitful faults violating safety and benign faults violating termination from the more general Byzantine faults, in what we call the Byzantine-deceitful-benign fault model. We show that one cannot solve consensus if $n\leq 3t+d+2q$ with $t$ Byzantine processes, $d$ deceitful processes, and $q$ benign processes. In addition, we show that this bound is tight by presenting the Basilic class of consensus protocols that solve consensus when $n > 3t+d+2q$. These protocols differ in the number of processes from which they wait to receive messages before progressing. Each of these protocols is thus better suited for some applications depending on the predominance of benign or deceitful faults. Finally, we study the fault tolerance of the Basilic class of consensus protocols in the context of blockchains that need to solve the weaker problem of eventual consensus. We demonstrate that Basilic solves this problem with only $n > 2t+d+q$, hence demonstrating how it can strengthen blockchain security.

cs.DC↗

arXiv2022

TRAP: The Bait of Rational Players to Solve Byzantine Consensus

It is impossible to solve the Byzantine consensus problem in an open network of $n$ participants if only $2n/3$ or less of them are correct. As blockchains need to solve consensus, one might think that blockchains need more than $2n/3$ correct participants. But it is yet unknown whether consensus can be solved when less than $2n/3$ participants are correct and $k$ participants are rational players, which misbehave if they can gain the loot. Trading correct participants for rational players may not seem helpful to solve consensus since rational players can misbehave whereas correct participants, by definition, cannot. In this paper, we show that consensus is actually solvable in this model, even with less than $2n/3$ correct participants. The key idea is a baiting strategy that lets rational players pretend to misbehave in joining a coalition but rewards them to betray this coalition before the loot gets stolen. We propose TRAP, a protocol that builds upon recent advances in the theory of accountability to solve consensus as soon as $n>\max\bigl(\frac{3}{2}k+3t,2(k+t)\bigr)$: by assuming that private keys cannot be forged, this protocol is an equilibrium where no coalition of $k$ rational players can coordinate to increase their expected utility regardless of the arbitrary behavior of up to $t$ Byzantine players. Finally, we show that a baiting strategy is necessary and sufficient to solve this, so-called rational agreement problem. First, we show that it is impossible to solve this rational agreement problem without implementing a baiting strategy. Second, the existence of TRAP demonstrates the sufficiency of the baiting strategy. Our TRAP protocol finds applications in blockchains to prevent players from disagreeing, that could otherwise lead to "double spending".

cs.DC↗

arXiv2021

Rational Agreement in the Presence of Crash Faults

Blockchain systems need to solve consensus despite the presence of rational users and failures. The notion of $(k,t)$-robustness has shown instrumental to list problems that cannot be solved if $k$ players are rational and $t$ players are Byzantine or act arbitrarily. What is less clear is whether one can solve such problems if the faults are benign. In this paper, we bridge the gap between games that are robust against Byzantine players and games that are robust against crash players. Our first result is an impossibility result: We show that no $(k,t)$-robust consensus protocol can solve consensus in the crash model if $k+2t\geq n$ unless there is a particular punishment strategy, called the $(k,t)$-baiting strategy. This reveals the need to introduce baiting as the act of rewarding a colluding node when betraying its coalition, to make blockchains more secure. Our second result is an equivalence relation between crash fault tolerant games and Byzantine fault tolerant games, which raises an interesting research question on the power of baiting to solve consensus. To this end, we show, on the one hand, that a $(k,t)$-robust consensus protocol becomes $(k+t,t)$-robust in the crash model. We show, on the other hand, that the existence of a $(k,t)$-robust consensus protocol in the crash model that does not make use of a baiting strategy implies the existence of a $(k-t,t)$-robust consensus protocol in the Byzantine model, with the help of cryptography.

cs.GT↗

arXiv2021

ZLB: A Blockchain to Tolerate Colluding Majorities

In the general setting, consensus cannot be solved if an adversary controls a third of the system. Yet, blockchain participants typically reach consensus "eventually" despite an adversary controlling a minority of the system. Exceeding this $\frac{1}{3}$ cap is made possible by tolerating transient disagreements, where distinct participants select distinct blocks for the same index, before eventually agreeing to select the same block. Until now, no blockchain could tolerate an attacker controlling a majority of the system. In this paper, we present Zero-Loss Blockchain (ZLB), the first blockchain that tolerates an adversary controlling more than half of the system. ZLB is an open blockchain that combines recent theoretical advances in accountable Byzantine agreement to exclude undeniably deceitful replicas. progressively reduces the portion of deceitful replicas below $\frac{1}{3}$, and reaches consensus. Geo-distributed experiments show that ZLB outperforms HotStuff and is almost as fast as the scalable Red Belly Blockchain that cannot tolerate $n/3$ faults.

cs.DC↗

arXiv2019

Platypus: a Partially Synchronous Offchain Protocol for Blockchains

Offchain protocols aim at bypassing the scalability and privacy limitations of classic blockchains by allowing a subset of participants to execute multiple transactions outside the blockchain. While existing solutions like payment networks and factories depend on a complex routing protocol, other solutions simply require participants to build a \emph{childchain}, a secondary blockchain where their transactions are privately executed. Unfortunately, all childchain solutions assume either synchrony or a trusted execution environment. In this paper, we present Platypus a childchain that requires neither synchrony nor a trusted execution environment. Relieving the need for a trusted execution environment allows Platypus to ensure privacy without trusting a central authority, like Intel, that manufactures dedicated hardware chipset, like SGX. Relieving the need for synchrony means that no attacker can steal coins by leveraging clock drifts or message delays to lure timelocks. In order to prove our algorithm correct, we formalize the chilchain problem as a Byzantine variant of the classic Atomic Commit problem, where closing a childchain is equivalent to committing the whole set of payments previously recorded on the childchain ``atomically'' on the main chain. Platypus is resilience optimal and we explain how to generalize it to crosschain payments.

cs.DC↗