Tendermint is among the most widely studied and deployed Byzantine fault-tolerant (BFT) consensus protocols, owing in part to its native leader-rotation mechanism that subsumes complex view changes. Like most partially-synchronous BFT protocols, Tendermint tolerates $f 5f$ setting that decides in two communication steps in the good case, while preserving Tendermint's leader-rotation structure. Fast Tendermint collapses Tendermint's prevote and precommit steps into a single voting step and merges the $locked$ and $valid$ state. We give proofs of agreement, validity, and termination, and a formal specification in Quint, a modern surface syntax for TLA+, used to model-check the protocol.
Jakub Kacper SzelÄ…g, Aydin Abadi, Mohammad Naseri
Decentralization as a concept in computer science has existed for over half a century. Despite its fundamental role across domains such as security, distributed computing, artificial intelligence, cloud infrastructures, and Internet of Things (IoT) architectures, there remains no universally accepted definition of decentralization applicable across computer communication systems. This has become increasingly problematic with the emergence of decentralized AI and machine learning paradigms, including collaborative training, distributed inference, blockchain-based, and agentic AI, where decentralization is often treated as a core design objective. Meanwhile, existing approaches frequently conflate decentralization with related notions such as distribution of trust or specific implementation paradigms. Such ambiguity creates inconsistencies in system analysis, limits comparability between works, and weakens the rigor of formal reasoning surrounding communication architectures and protocol design. In this work, we define this research gap as the Decentralization Problem. We analyze the formal-semantic, epistemological, and pragmatic foundations of decentralization and introduce a graph-based ontology defining it as both relational and subject-specific property of computer communication systems. The framework formally distinguishes decentralization from distribution and supports evaluation through two novel metrics: Void Tolerance and Imperviousness. We also provide a browser-based implementation that enables automated classification and metric computation of arbitrary systems. Instantiations to federated learning and blockchain architectures show consistent, comparable assessments where existing definitions produce incomplete or contradictory conclusions, providing a domain-independent foundation for analysing decentralization across heterogeneous systems.
Adnan Iftekhar, Chengliang Zheng, Xiaohui Cui, Mir Hassan
Blockchain can preserve supply-chain records, but ledger integrity alone does not show whether a participant should be trusted in a future risk-sensitive transaction. Existing reputation systems mainly address product evidence, global feedback aggregation, or review authenticity, while giving less attention to repeated bilateral inflation, identity multiplicity, and unfair decay for honest participants with sparse histories. We present \RC, a participant trust framework that uses blockchain as an evidence and provenance layer rather than as the source of trust. Governed interaction outcomes are converted into bounded evidence. Repeated interactions between the same pair are discounted, low counterparty diversity is penalized, governance-supplied identity confidence weights positive evidence, and scores decay toward a neutral prior according to verified interaction volume. Identity, contract, outcome, and update provenance remain on chain, while nonlinear reputation computation is performed off chain and checked on chain for admissibility. In controlled simulations with 30 seeded runs and matched interaction traces, the full model reduces mean collusive gain to 0.1443, compared with 0.3688 for naive mean evidence and 0.3585 for static decay. With ten identities under one controller, the reputation inflation ratio falls to 0.8723, while three comparison baselines remain above 1.08. On identical newcomer traces, volume-aware decay increases mean newcomer reputation from 0.6626 to 0.7589 and reduces the false low-trust rate from 0.3633 to 0.1683. Paired analysis confirms these improvements across runs. The results support a bounded reduction in reputation distortion, not attacker detection. Deployment evaluation and calibration with operational data are still required before production use.
High-performance Byzantine Fault Tolerant (BFT) blockchains are designed to achieve high throughput and low latency, yet their observed block time distributions often reveal complex behaviors arising from networking, pipelining, and deployment heterogeneity. In this paper, we diagnose HotStuff-based high-performance BFT consensus by modeling block times through a quorum-based multicast framework that links each block interval to quorum formation latency. We capture multimodal block time distributions using mixture models, where each component represents a distinct network condition characterized by effective transfer rate of block information. The proposed model is fitted to the bulk of mainnet block time data, while tail decay is analyzed separately to assess asymptotic behavior. Applying this methodology to Hyperliquid and Aptos mainnets, we find that Hyperliquid is well explained by a unimodal distribution, consistent with a relatively homogeneous validator deployment. In contrast, Aptos exhibits persistent multimodal structure and a pronounced shift following a consensus upgrade, reflecting heterogeneous deployments and diverse communication paths. These results demonstrate that mixture modeling of block time provides a practical and informative diagnostic tool for analyzing and monitoring high-performance BFT consensus.
Automated market makers exchange assets through liquidity pools whose quoted prices depend on their reserves, with constant product pools being the most common. When such pools reside on different blockchains or shards, a sequence of swaps cannot in general be executed atomically. Aanes et al. introduced lock-swaps and retroactive constant product liquidity pools to provide price guarantees for such a setting. A retroactive pool implicitly maintains a virtual pool for each possible execute/cancel resolution of its active locks. In the presence of active locks, serving a new swap request requires computing a safe quote; a quote with an output that does not exceed the minimum possible output, taken over all virtual pools. The quote being safe is a hard constraint ensuring the integrity of the pool. A soft constraint is to make the quote as close to the minimum possible output as possible. Aanes et al. gave a simple and efficient algorithm for computing the exact minimum when unresolved provides and reclaims of liquidity do not coexist, showed by an explicit example that the algorithm fails in general, and left the computational complexity of the general case open. In this paper, we show that unless P is equal to NP, there is no polynomial time algorithm that computes in the general case a safe quote with any fixed multiplicative approximation ratio (e.g., 50%) relative to the exact minimum. This seems like a severe obstacle for deployment of the lock-swap functionality. However, we also present two simple and practical algorithms for computing safe quotes that have input-dependent approximation ratios that are likely to be satisfactory in practice, thus circumventing that obstacle.
Decentralized manufacturing faces a pre-contractual impasse: a Provider cannot price a service accurately without inspecting the design file, yet the Consumer cannot share that file without exposing intellectual property. We introduce the Optimistic Verifiable Claim (OVC), a blockchain protocol that lets a Consumer publish a verifiable claim about a concealed design (such as the material it consumes) and a Provider price and bid on it without seeing the design. The claim is committed when the service is posted and stands unless the selected Provider challenges it; a challenge triggers a deterministic on-chain check that exposes any dishonesty, and the design is disclosed only to settle a dispute, never on the honest path. We implement four checks (authorized key access, delivery-channel integrity, syntactic conformance, and declared material consumption) in Solidity and measure them on a real 6.41 MB G-code file, the 3DBenchy, across Ethereum, Arbitrum, and opBNB. Every service incurs the cost of posting the encrypted design, with or without a dispute. For the 3DBenchy, the no-dispute outcome costs \$7,207 in up to 9 hours on Ethereum, \$288 in 3 min on Arbitrum, and \$2.87 in 2 min on opBNB, and a fully contested dispute costs \$49,660 in up to 57 hours on Ethereum, \$1,988 in 19 min on Arbitrum, and \$19.73 in 13 min on opBNB. Costs and times grow with size: for a 50 MB industrial design, an undisputed service reaches \$56,173 and up to 3 days on Ethereum against \$22.36 and 16 min on opBNB, and a fully contested dispute reaches \$488,440 over up to 18 days on Ethereum against \$195 and 1.6 hours on opBNB. Of the four, the material-consumption check is the costliest, its predicate being the most expensive to evaluate on-chain. OVC makes confidential, claim-based bidding economically feasible on Arbitrum and opBNB, but not on Ethereum at industrial scale.
Jemima Owusu-Tweneboah, Amani Altarawneh, Deepti Gupta, Maria Luisa Figueroa
Cybersecurity and privacy frameworks such as NIST SP~800--53, ISO/IEC~27001, GDPR, and HIPAA are widely used to guide organizational security posture and regulatory compliance. In practice, however, framework adoption is often assessed through point-in-time audits, self-attestations, and fragmented evidence reviews, providing limited assurance that controls are consistently implemented, independently validated, and sustained over time, particularly in environments that rely on third-party vendors. These limitations are amplified in multi-vendor ecosystems, such as healthcare remote patient monitoring (RPM), where compliance obligations span organizational boundaries and assessments are conducted by multiple independent assessors. This paper investigates how permissioned blockchain systems can support framework implementation maturity measurement rather than static compliance verification. We propose a blockchain-based Third-Party Risk Assessment (TPRA) framework that operationalizes assessment workflows, enforces multi-party governance, and preserves longitudinal assessment state using programmable smart contracts. Building on this framework, we introduce a set of evaluation metrics and a qualitative maturity model designed to assess whether compliance controls are verifiably implemented, governed, and sustained across repeated assessment cycles.
Yifeng Ye, Rongji Huang, Gerui Wang, Mingchao Wan · 7 authors
In blockchain systems, peer-to-peer (P2P) overlay networks play a crucial role in providing reliable, scalable and efficient message-delivery services to upper layers. However, the consensus layer and the underlying P2P network remain mutually opaque in existing blockchains, waiving the opportunity for further improvement. In contrast to other P2P applications, blockchain can naturally be abstracted as a state machine. We therefore leverage this abstraction to record network topologies and latencies in a trusted and coordinated manner. With this support, we propose three improvements to rotating-leader consensus protocols and their underlying P2P networks: (1) accelerating leader rotation; (2) introducing a reliable-broadcast paradigm that employs tree-based dissemination in the normal case and falls back to gossip only when necessary; and (3) constructing latency-aware dissemination trees. We integrate the above ideas into Tendermint and libp2p, and conduct empirical evaluation on Amazon EC2 platform using up to 300 nodes distributed across 10 regions. The results demonstrate that, compared with gossip-based dissemination over the same topology, our prototype improves peak throughput by up to $7.26\times$.
In Ethereum, transaction inclusion is rarely in question; what matters is the delay until inclusion. Currently, block builders could exercise censorship across consecutive blocks, threatening time-critical applications, such as on-chain auctions. To mitigate this risk, existing proposals such as FOCIL, scheduled for deployment in late 2026, assign a committee to list transactions for mandatory inclusion. However, no committee member is held accountable for the actual inclusion of the transactions: an adversary can bribe the entire committee to omit any transaction for less than 2 Euro per block under current conditions. We argue that accountability, i.e., requiring all exclusion decisions to be publicly disclosed and verifiably complete, with violations attributable to a specific party, substantially raises censorship costs. To this end, we propose Fair Forward Inclusion Lists (FairFIL) as an accountable censorship resistance mechanism for Ethereum. In FairFIL, every builder must publish all transactions the builder chooses to censor, subject to a protocol-anchored policy; a committee verifies the completeness and validity of this disclosure. The subsequent builder must include these transactions, forfeiting the full block reward upon any omission. Therefore, under FairFIL, extending censorship beyond a single slot requires an assembler to forfeit a full block reward. We show that compliance is rational for all participants within our behavior model. Our empirical evaluation on Ethereum mainnet indicates that multi-block censorship costs one order of magnitude more than under existing proposals, while leaving the builder's MEV extraction freedom largely intact. Initial measurements further suggest that the mempool consistency FairFIL requires is met in practice.
Aircraft maintenance records are critical to airworthiness and asset valuation, yet they are often fragmented across stakeholders, creating verification bottlenecks and information asymmetry that may suppress aircraft residual value. This paper proposes a blockchain-anchored decentralized application (dApp) based on a dual-layer architecture that combines InterPlanetary File System (IPFS)-based off-chain storage with on-chain anchoring of Content Identifiers (CIDs) and selected metadata. With respect to off-chain file size, the on-chain payload per record remains $\mathcal{O}(1)$, compared with $\mathcal{O}(n)$ for direct on-chain file storage. The architecture incorporates metadata and traceability controls informed by Federal Aviation Administration (FAA) electronic recordkeeping guidance. The main contribution is an economic framework that models the relationship between tamper-evident maintenance-record provenance, audit workflow duration, aircraft residual value, and operational cost. In a 7-kB experiment conducted on the BNB Smart Chain testnet, CID anchoring reduced gas consumption by 93.9\% compared with direct on-chain storage. Under explicitly stated scenario assumptions, the audit-cost model indicates potential savings of more than 90\%. These results support the technical feasibility of the prototype and illustrate its economic potential, while the estimated financial benefits remain to be validated using operational data.
To meet the throughput demands of modern blockchain systems, protocols for State Machine Replication (SMR) increasingly have many processors disseminate blocks of transactions in parallel, with consensus then establishing a total ordering on the blocks of all producers. Such designs face a choice as to when a block may enter the ordering. Certified approaches wait for a quorum to attest a block's availability, which is robust but adds message delays to every transaction. Uncertified approaches let proposals reference blocks immediately, which is fast but degrades rapidly when referenced data must be fetched on the critical path. Raptr, the state of the art, takes a middle course, finalising the longest prefix of the leader's proposal that a quorum holds, so that no processor ever blocks or fetches. The remaining weakness is sensitivity to order: if the data behind a single early batch is withheld, the proposal finalises little or nothing, so individual faulty producers can still deny the system its optimistic path. We present Multimmit, a protocol for $n \ge 5f+1$ processors combining a consensus layer requiring one round of voting per view with multi-chain data dissemination. Votes are cast relative to the leader's proposal, reporting per chain how far the voter can support it, and may themselves attest fresh blocks beyond it. A transaction block disseminated at time $t$ is ordered by $t+3δ$ in expectation and $t+2δ$ at best, measured from the block's dissemination rather than the leader's proposal. Degradation under faults is graceful: a faulty producer delays only its own chain's blocks, costing other chains at most a one-view wait for placement. No leader can both finalise its leader block and exclude a fresh, well-circulated block of an honest chain. Consensus traffic is tens of kilobytes per view, independent of transaction volume.
Christian Cachin, David Lehnherr, Juan Villacis, François-Xavier Wicht
Sender untraceability hides the account spent by a cryptocurrency transfer among a set of candidates, its masking set. What a transfer does to that set separates two designs: classical schemes retain the whole set and append a nullifier marking the spent account, so the ledger grows with every transfer; constant-state schemes instead consume and replace the entire set. We ask how this choice affects synchronization. We formalize the two designs as the linear and constant untraceable asset transfer objects (LUAT and CUAT) and locate them in the consensus hierarchy. In LUAT, transfers from distinct accounts commute. Its consensus number is 2, compared with 1 for standard asset transfer, independently of the masking-set size and of the untraceability notion, and LUAT is starvation-free. Partitioning the accounts into fixed masking sets lets exhausted sets be garbage-collected without increasing that number. In CUAT, a transfer consumes and replaces every account of its masking set, so two transfers whose sets intersect cannot both take effect. We formalize this with the conflict graph on masking sets, whose edges join sets sharing an account. Under weak untraceability, which protects a transaction in isolation, the consensus number is unbounded already for one-round protocols. Under strong untraceability, which protects against an observer of the complete history, untraceability holds on a history exactly when any two accounts sharing a masking set occur in the same number of the masking sets in it. This uniform incidence bounds the conflict graph, and matching constructions attain it, so the consensus number is determined exactly and grows quadratically in the masking-set size. Finally, CUAT is not starvation-free. The two objects therefore pay for the same privacy differently: LUAT in storage, CUAT in synchronization and fairness.
Bruno Ramos-Cruz, Javier Andreu-Perez, David Richerby, Luis MartÃnez
The operation of blockchain is governed by consensus algorithms (CA). Several consensus mechanisms require significant computational power, while others necessitate high amounts of stakes to select the participant to validate and verify the transactions in the block, leading to centralisation of power and participant exclusion. This paper proposes a novel methodology to address these issues in reputation-based consensus algorithms by studying the reputation behaviour of the validator using intuitionistic fuzzy sets (IFSs) and uninorm aggregation operations (UAOs). Our approach uses IFSs to express the "reputation" because the reputation values in a consensus algorithm eventually imply uncertainty, and IFSs facilitate the representation of a lack of precise knowledge about reputation. Moreover, this methodology utilises uninorm aggregation operations to monitor reputation over time and reinforces the importance of negative and positive reputation. Consequently, this solution allows validators to rectify past failures in subsequent verification processes and foster an equitable consensus algorithm design. The proposed framework maintains linear computational complexity and does not introduce additional communication overhead beyond the underlying consensus protocol. Supported by experimental results, our methodology demonstrates improved performance and evaluation, promising advancements in blockchain network fairness and inclusivity.