A Fast Confirmation Rule
for the Ethereum Protocol
Aditya Asgaonkar
Offchain Labs
Francesco D’Amato
Ethereum Foundation
Roberto Saltini
Ethereum Foundation
Luca Zanolini
Ethereum Foundation
Chenyi Zhang
University of Canterbury
What is a Confirmation Rule?
Canonical Chain
Block Confirmation
B
v1’s�canonical
v2’s�canonical
v3’s�canonical
B
v2’s�canonical
v3’s�canonical
✔
B
v2’s�canonical
v3’s�canonical
✘
v1’s�canonical
v1’s�canonical
✔
Why do we need a Fast Confirmation Rule?
Finalization is a (slow) Confirmation Rule
Dangerous Solution to Speed Up Confirmation
Fast Confirmation Rule’s Objectives
Our target
Safety Property: A confirmed block never conflicts with the canonical chain of any honest validators
Quick Recap of Gasper, the Ethereum’s Consensus Protocol
Gasper Consensus Protocol
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain by FFG-Casper
B4
Available Chains by LMD-GHOST
Gasper
0
LMD-GHOST Protocol
LMD-GHOST Protocol
LMD-GHOST Protocol
LMD-GHOST Fork-Choice function
LMD-GHOST Fork-Choice function
LMD-GHOST Fork-Choice function
V1
V1
LMD-GHOST Fork-Choice function
V1
V1
A Fast Confirmation Rule Algorithm
for LMD-GHOST
Assumptions
V1
V2
Assumptions
V1
V2
s1
s2
s3
s4
s5
s6
s7
😈 ≤ β * total_stake
😇 ≥ (1-β) * total_stake
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
Assume that this block is canonical
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
Assume that this block is canonical
β = 0.2
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
Assume that this block is canonical
β = 0.2
W = 100
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
S(B11) > W * (½+β)
Assume that this block is canonical
W = 100
β = 0.2
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
S(B11) > W * (½+β)
S(B11) > 100 * 0.7
S(B11) > 70
S(B11) = 71
Assume that this block is canonical
W = 100
β = 0.2
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
S(B11) > W * (½+β)
S(B11) > 100 * 0.7
S(B11) > 70
S(B11) = 71
Assume that this block is canonical
W = 100
β = 0.2
B12
S(B12) < W * ½
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
S(B11) > W * (½+β)
S(B11) > 100 * 0.7
S(B11) > 70
S(B11) = 71
Assume that this block is canonical
W = 100
β = 0.2
B12
S(B12) < W * ½
S(B12) < 100 * 0.5
S(B12) < 50
S(B12) = 49
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
S(B11) > W * (½+β)�
S(B11) = 71-20=51
Assume that this block is canonical
W = 100
β = 0.2
B12
S(B12) < W * ½
S(B12) < 100 * 0.5
S(B12) < 50
S(B12) = 49
β equivocates
A Confirmation Rule for Ethereum is about LMD-GHOST weight, not chain depth.
B10
B11
S(B11) > W * (½+β)�
S(B11) = 71-20=51
Assume that this block is canonical
W = 100
β = 0.2
B12
S(B12) < W * ½
S(B12) < 100 * 0.5
S(B12) < 50
S(B12) = 49
β equivocates
🏆
What about when we move to the next slot?
B10
B11
S(B11) = 51
Assume that this block is canonical
β = 0.2
B12
What about when we move to the next slot?
B10
B11
S(B11) = 51+80 = 131
Assume that this block is canonical
W = 200
β = 0.2
B12
B13
S(B13) = 80
What about when we move to the next slot?
B10
B11
S(B11) = 51+80 = 131
Assume that this block is canonical
W = 200
β = 0.2
B12
B13
S(B13) = 80
What about when we move to the next slot?
B10
B11
S(B11) = 51+80 = 131
Assume that this block is canonical
W = 200
β = 0.2
B12
B13
S(B13) = 80
What about when we move to the next slot?
B10
B11
S(B11) = 51+80 = 131
Assume that this block is canonical
W = 200
β = 0.2
B12
B13
S(B13) = 80
What about when we move to the next slot?
B10
B11
S(B11) = 51+80 = 131
Assume that this block is canonical
W = 200
β = 0.2
B12
B13
S(B13) = 80
Is B11 still going to be canonical for ever?
What about when we move to the next slot?
B10
B11
S(B11) = 51+80 = 131
Assume that this block is canonical
W = 200
β = 0.2
B12
B13
S(B13) = 80
Is B11 still going to be canonical for ever?
Yes. It is.�But to prove it we need to do something clever!
Let us assume we know who is honest
B10
B11
Assume that this block is canonical
W = 100
β = 0.2
Let us assume we know who is honest
B10
B11
H(B11)
Assume that this block is canonical
W = 100
β = 0.2
J = 80
Stake of the honest validators supporting B11
Stake of the honest validators in the committee
Let us assume we know who is honest
B10
B11
H(B11) > W * ½
Assume that this block is canonical
W = 100
β = 0.2
J = 80
Stake of the honest validators in the committee
Let us assume we know who is honest
B10
B11
H(B11) > W * ½
Assume that this block is canonical
W = 100
β = 0.2
J = 80
Stake of the honest validators in the committee
Never equivocate
Let us assume we know who is honest
B10
B11
H(B11) > W * ½
H(B11) > J * ½ * / (1-β)
Assume that this block is canonical
W = 100
β = 0.2
J = 80
Stake of the honest validators in the committee
Let us assume we know who is honest
B10
B11
H(B11) > W * ½
H(B11) > J * ½ * / (1-β)
Assume that this block is canonical
W = 100
β = 0.2
J = 80
Stake of the honest validators in the committee
Implies
J ≥ (1-β) * W
Let us assume we know who is honest
B10
B11
H(B11) > W * ½
H(B11) > J * ½ / (1-β)
H(B11) > 80 * 0.5 /0.8 = 50
H(B11) > 50
H(B11) = 51
Assume that this block is canonical
W = 100
β = 0.2
J = 80
Stake of the honest validators in the committee
Implies
Let us assume we know who is honest
B10
B11
H(B11) > W * ½
H(B11) > J * ½ / (1-β)
H(B11) > 80 * 0.5 * 1/0.8
H(B11) > 50
H(B11) = 51
Assume that this block is canonical
W = 100
β = 0.2
J = 80
Stake of the honest validators in the committee
Implies
P(B11) := H(B11)/J = 51/80
Let us assume we know who is honest
B10
B11
H(B11) > W * ½
H(B11) > J * ½ / (1-β)
H(B11) > 80 * 0.5 * 1/0.8
H(B11) > 50
H(B11) = 51
Assume that this block is canonical
W = 100
β = 0.2
J = 80
Stake of the honest validators in the committee
Implies
P(B11) := H(B11)/J = 51/80 ⪆ 0.63 > ½ / (1-β) = 0.625
What happens at the next slot?
B10
B11
H(B11) = 51
Assume that this block is canonical
W = 200
β = 0.2
J = 160
B13
What happens at the next slot?
B10
B11
H(B11) = 51 + 80 = 131
Assume that this block is canonical
W = 200
β = 0.2
J = 160
B13
H(B13) = 80
What happens at the next slot?
B10
B11
H(B11) = 51 + 80 = 131
Assume that this block is canonical
W = 200
β = 0.2
J = 160
P(B11) = H(B11)/J = 131/160 ⪆ 0.81
B13
H(B13) = 80
What happens at the next slot?
B10
B11
H(B11) = 51 + 80 = 131
Assume that this block is canonical
W = 200
β = 0.2
J = 160
P(B11) = H(B11)/J = 131/160 ⪆ 0.81 > ½ / (1-β) = 0.625
B13
H(B13) = 80
🎉
What happens at the next slot?
B10
B11
H(B11) = 51 + 80 = 131
Assume that this block is canonical
W = 200
β = 0.2
J = 160
P(B11) = H(B11)/J = 131/160 ⪆ 0.81 > ½ / (1-β) = 0.625
B13
H(B13) = 80
🎉
H(B11) > W * ½
What happens if the next slot is in a new epoch?
B10
B11
H(B11) = 51
Assume that this block is canonical
β = 0.2
J = 80
What happens if the next slot is in a new epoch?
B10
B11
H(B11) = 51
Assume that this block is canonical
β = 0.2
J = 80+X
B13
New epoch
X new honest nodes are added to the committee of block B13
What happens if the next slot is in a new epoch?
B10
B11
H(B11) ≥ 51 + X
Assume that this block is canonical
β = 0.2
J = 80+X
B13
H(B13) = 80
New epoch
X new honest stake is added to the committee of block B13.�
At least the X new honest stake is added to the support of B11
What happens if the next slot is in a new epoch?
B10
B11
H(B11) ≥ 51 + X
Assume that this block is canonical
β = 0.2
J = 80+X
B13
H(B13) = 80
New epoch
X new honest nodes are added to the committee of block B13
P(B11) = H(B11)/J ≥ (51 + X) / (80 + X)
What happens if the next slot is in a new epoch?
B10
B11
H(B11) ≥ 51 + X
Assume that this block is canonical
β = 0.2
J = 80+X
B13
H(B13) = 80
New epoch
X new honest nodes are added to the committee of block B13
Add X to both numerator and denominator
P(B11) = H(B11)/J ≥ (51 + X) / (80 + X)
What happens if the next slot is in a new epoch?
B10
B11
H(B11) ≥ 51 + X
Assume that this block is canonical
β = 0.2
J = 80+X
B13
H(B13) = 80
New epoch
X new honest nodes are added to the committee of block B13
Add X to both numerator and denominator
P(B11) = H(B11)/J ≥ (51 + X) / (80 + X) ≥ 51 / 80
What happens if the next slot is in a new epoch?
B10
B11
H(B11) ≥ 51 + X
Assume that this block is canonical
β = 0.2
J = 80+X
B13
H(B13) = 80
New epoch
X new honest nodes are added to the committee of block B13
Add X to both numerator and denominator
P(B11) = H(B11)/J ≥ (51 + X) / (80 + X) ≥ 51 / 80 ⪆ 0.63 > ½ / (1-β) = 0.625
🎉
What happens if the next slot is in a new epoch?
B10
B11
H(B11) = 51 + X
Assume that this block is canonical
β = 0.2
J = 80+X
P(B11) = H(B11)/J = (51 + X) / (80 + X) ≥ 51 / 80 > ½ * (1/(1-β)) = 0.625
B13
H(B13) = 80
New epoch
X new honest nodes are added to the committee of block B13
Honest Support for B11= J
How do we measure P(B11)
How do we measure P(B11)
S(B11) / W > ½ + β
P(B11) = H(B11) / J > ½ / (1-β)
Implies
How do we measure P(B11)
S(B11) / W > ½ + β
H(B11) / J > ½ * 1/(1-β)
Implies
What about B10 and the other blocks?
B10
B11
B9
F
Latest Finalized Block
What about B10 and the other blocks?
B10
B11
B9
👍
Q(B11) > ½+β?
F
Latest Finalized Block
What about B10 and the other blocks?
B10
B11
B9
👍
Q(B10) > ½+β?
👍
Q(B11) > ½+β?
F
Latest Finalized Block
What about B10 and the other blocks?
B10
B11
B9
👍
Q(B9) > ½+β?
👍
Q(B10) > ½+β?
👍
Q(B11) > ½+β?
F
Latest Finalized Block
A Fast Confirmation Rule for�LMD + FFG = Gasper
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
Latest Justified
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
Latest Justified
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
justified(B9) = justified checkpoint according to the FFG votes in the chain of B9
Latest Justified
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
Latest Justified
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG Votes are included in blocks
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
Latest Justified
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
Latest Justified
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
Latest Justified
FFG-Casper and LMD-GHOST
3
1
B0
B1
B2
B5
B6
B8
B7
B9
Finalized Chain
by
FFG-Casper
FFG Votes
0
B4
Available Chains
by
LMD-GHOST
2
B5
Latest Justified
Confirmation Rule:�
Final rule
B is not filtered out in the current epoch
Final rule
B is not filtered out in the current epoch
B is not filtered out in any future epoch
Final rule
Minimum stake that FFG votes for checkpoint(B) up until the current slot
Final rule
Minimum stake that FFG votes for checkpoint(B) up until the current slot
Minimum stake that FFG votes for checkpoint(B) from next slot till the end of the epoch
Final rule
Minimum stake that FFG votes for checkpoint(B) up until the current slot
Minimum required FFG stake to justify checkpoint(B)
Minimum stake that FFG votes for checkpoint(B) from next slot till the end of the epoch
There is more to Safety: Monotonicity
What we mean by Monotonicity
at s0, Q(B) = S(B)/W > ½ + β → Confirmed(B) = True
at s10, Q(B) = S(B)/W < ½ + β → Confirmed(B) = False
Some time after..
🤔
Is B at risk of being re-orged out?
⏳
What we mean by Monotonicity
Naive Solutions
Users query for confirmation only once and then remember the result
What if there is an actual network partition?��Wouldn’t it be better for users to have a way to detect that a block is actually not safe anymore?
First Challenge - The indicator Q is NOT monotonic
The indicator Q is not monotonic.
Solution for the current epoch
Trade off:
This require moving the assumption on network synchrony to the beginning of the current epoch.
Solution for the previous and current epoch:
Trade off:
This require moving the assumption on network synchrony to the beginning of the previous epoch.
What happens when the next epoch ends?
B
C(B)
B’
B is confirmed
B is “forced” to be confirmed until here
B is confirmed only if one if its descendant is confirmed, e.g. B’
e
e + 1
e + 2
What happens when the next epoch ends?
B
C(B)
C
B is confirmed
There exists a checkpoint descendant of B that is confirmed
if B is confirmed in epoch e, then by the end of epoch e+1, there exists a checkpoint C such that
epoch e
epoch e+1
e
e + 1
e + 2
What happens when the next epoch ends?
B
C(B)
C
B is confirmed
There exists a checkpoint descendant of B that is confirmed
if B is confirmed in epoch e, then by the end of epoch e+1, there exists a checkpoint C such that
epoch e
epoch e+1
Ratio of honest validators that have attested for C
A Final Note
The previous assumption is required because it is very hard to access FFG votes older than 2 epochs.
Otherwise, we could just check for any past epoch that it is impossible to justify any checkpoint conflicting with B
Initial Experimental Results
Initial Experimental Results by
Setup
Blog post here!
Initial Experimental Results by
Setup
Results
Initial Experimental Results by
Setup
Results
Initial Experimental Results by
Setup
Results
If implemented directly into a beacon node,�
we expect ≅ 12 sec�
Thank You!
If you are interested in implementing this Fast Confirmation Rule, please get in touch!�� @robsaltini��