1. Solida: A Blockchain Protocol Based on Reconfigurable Byzantine Consensus
Ling Ren
Joint work with Ittai Abraham, Dahlia Malkhi,
Kartik Nayak and Alexander Spiegelman
*Work done at VMware Research

2. Bitcoin Ordered blocks (of transactions)
A block must be hard to generate -- mining
To talk about cryptocurreny, we have to start with Bitcoin
Only the payer can initiate a tx
Refer to a previous tx in which he was the payee
The number one challenge: double spending
Alice pays Bob $1
& Dan $2
Dan pays Carol $50 ……
Carol pays Bob $50 ……
Bob pays Alice $10 ……
Double spending
Carol pays Carol’ $50 ……

3. Bitcoin Mining Mining: solve hard puzzles ffffffffca780f89 Random
function
ffffffffca780f89
> Threshold ?
nonce
By the time Carol finds this cheating block, the rest of the world has found more blocks on the main chain
Longest chain wins
Proof-of-Work (PoW)
Alice pays Bob $1
Alice pays Dan $2
Dan pays Carol $50 ……
Carol pays Bob $50
Bob pays Alice $10
PoW
PoW
PoW

4. Permissionless Consensus
Bitcoin: PoW + longest chain wins
Alice
Bob
Emily
Dave
Charlie
Participants reach consensus on tx history
Anyone can leave or join at any time
Newly minted coins
& tx fees

5. Permissionless Consensus
Bitcoin: PoW + longest chain wins
Alice
Bob
Emily
Dave
Charlie

6. Bitcoin Consensus is Slow
10min / block, > 60min latency
Byzantine consensus (e.g., PBFT) is instant
Member 1
(Leader)
Member 2
Member 3
Member 4
Pre-prepare
Prepare
Commit
n = 3f+1
PBFT Courtesy of J. NYU

7. PBFT for Blockchains? Reconfiguration Wedging
[Peercensus, Byzcoin, Hybrid Consensus]
Numerous challenges:
PBFT is permissioned
TXs concurrent to reconfiguration
“altruistic” vs. “rational” participants
Reconfiguration
Wedging
They tried to make it permisssionless, but we will see later, they didn’t succeed.
Hardly justifiable. E.g., mine Bitcoin voluntarily, no need for reward
What is Solidus

8. Reconfiguration
puzzle
puzzle
Committee F
PoW A B C D E
PoW G
PoW

9. Reconfigure PBFT The newcomer acts as an external leader Let me in PoW
Decision
Member 1
An elect phase like Paxos.
Leader is external. Use PoW as a ticket to get into the committee.
The 3 phases in the middle same as PBFT, but renamed.
A propagate phase for the world.
Member 2
PoW
Member 3
Decision
Member 4
Propose
Accept
Commit
Propagate

10. Reconfigure PBFT - Contention
Paxos-style leader election with ranks
Leader B
PoW
Leader A
Member 1
Leader -> rank
High ranked leader can interrupt low ranked ones.
What to use as ranks?
Paxos, a leader picks its own rank.
Here, A leader must not control its own rank.
PoW as rank.
Member 2
PoW
Member 3
Member 4
Propose
Accept
Commit

11. Reconfigure PBFT - Contention
PoW as rank
Leader B
Let me in!
PoW
Leader A
Member 1
PoW as rank.
B interrupts A.
Case 1: A has not done much, B proposes his own proposal
Yessir!
Member 2
PoW
Member 3
Member 4
Status
Propose
Accept
Commit

12. Reconfigure PBFT - Contention
PoW as rank
Let A in!
Leader B
PoW
Leader A
Member 1
PoW as rank.
B interrupts A.
Case 2: A has done a lot and cannot be reverted
Member 2
Help A finish!
PoW
Member 3
Member 4
Status
Propose
Accept
Commit

13. PoW Problem with PoW Ranks A Byzantine leader can stall Leader A
Member 1
PoW as rank.
B interrupts A.
Case 2: A has done a lot and cannot be reverted
Member 2
PoW
Member 3
Member 4
Elect
Propose
Accept
Commit

14. A Fix with Epochs rank = (lifespan, PoW) rank
Lifespan = # of PoWs seen so far
Leader A
Member 1
PoW as rank.
B interrupts A.
Case 2: A has done a lot and cannot be reverted
Member 2
rank
Member 3
Member 4
Elect
Propose
Accept
Commit

15. Safety follows from PBFT
Proof-of-Work gives sybil-proof
and eventually unique leader
Lifespan prevents stalling
A Fix with Epochs
rank = (epoch, PoW)
Each member maintains a local epoch
rank.epoch = median among 2f+1 replies
Leader A
Member 1
PoW as rank.
B interrupts A.
Case 2: A has done a lot and cannot be reverted
Member 2
rank
Member 3
Member 4
Get-epoch
Elect
Propose
Accept
Commit

16. Proof Sketch Goal: Adversary cannot get 1/3 seats
Sketch: Message delay for honest users  extra time to work on PoW for adversaries
Synchrony? Seriously?
Necessary for Bitcoin/PoW [PSS’16]
Why PBFT if the model is synchronous?
Actual speed vs. ½ fault tolerance

18. Summary Bitcoin: PoW  a PoW chain  permissionless consensus
Solida: PoW

19. Solidus  Solida