Validators in permissionless, large-scale blockchains, such as Ethereum, are typically payoff-maximizing, rational actors. Ethereum relies on in-protocol incentives, like rewards for correct and timely votes, to induce honest behavior and secure the blockchain. However, external incentives, such as the block proposer’s opportunity to capture maximal extractable value (MEV), may tempt validators to deviate from honest protocol participation.We show a series of commitment attacks on LMD GHOST, a core part of Ethereum’s consensus mechanism. We demonstrate how a single adversarial block proposer can orchestrate long-range chain reorganizations by manipulating Ethereum’s reward system for timely votes. These attacks disrupt the intended balance of power between proposers and voters: by leveraging credible threats, the adversarial proposer can coerce voters from previous slots into supporting blocks that conflict with the honest chain, enabling a chain reorganization.In response, we introduce a novel reward mechanism that restores the voters’ role as a check against proposer power. Our proposed mitigation is fairer and more decentralized – not only in the context of these attacks – but also practical for implementation in Ethereum.

In 1985, Dolev and Reischuk proved a fundamental communication lower bounds on protocols achieving fault tolerant synchronous broadcast and consensus: any deterministic protocol solving those tasks (even against omission faults) requires at least a quadratic number of messages to be sent by nonfaulty parties. In contrast, many blockchain systems achieve consensus with seemingly linear communication per instance against Byzantine faults. We explore this dissonance in three main ways. First, we extend the Dolev-Reischuk family of lower bounds and prove a new lower bound for Crusader Broadcast protocols. Our lower bound for crusader broadcast requires non-trivial extensions and a much stronger Byzantine adversary with the ability to simulate honest parties. Secondly, we extend our lower bounds to all-but-m Crusader Broadcast, in which up to m parties are allowed to output a different value. Finally, we discuss the ways in which these lower bounds relate to the security of blockchain systems. We show how Eclipse-style attacks in such systems can be viewed as specific instances of the attacks used in our lower bound for Crusader Broadcast. This connection suggests a more systematic way of analyzing and reasoning about Eclipse-style attacks through the lens of the Dolev-Reischuk family of attacks.

This paper presents a study of the Poof-of-Stake (PoW) Ethereum consensus protocol, following the recent switch from Proof-of-Work (PoS) to Proof-of-Stake within Merge upgrade. The new protocol has resulted in reduced energy consumption and a shift in economic incentives, but it has also introduced new threat sources such as chain reorganizations and balancing attacks. Using a simple and flexible agent-based model, this study employs a time-continuous simulation algorithm to analyze the evolution of the blocktree and assess the impact of initial conditions on consensus quality. The model simulates validator node behavior and the information propagation throughout the peer-to-peer network of validators to analyze the resulting blockchain structure. Key variables in the model include the topology of the peer-to-peer network and average block and attestation latencies. Metrics to evaluate consensus quality are established, and means to observe the model's responsiveness to changes in parameters are provided. The simulations reveal a phase transition in which the system switches from a consensus state to a non-consensus state, with a theoretical justification presented for this observation.