A balancing attack on Gasper, the current candidate for Eth2's beacon chain

Great work!
I also encountered this issue when I was working on the liveness of Casper. (There was a discussion in the Eth2 Telegram channel. Also, the “last-minute delivery” attack appears in another context: see the section splitting attack in the post of the bouncing attack.)

At that time, I conceived one possible solution. Basically, we modify which attestations (votes) are counted in the fork-choice rule (e.g., GHOST, LMD GHOST, FMD GHOST). Specifically, to calculate the score of block B,

  • For attestors (validators who make attestations), only the attestations that are included in a descendant block of B are counted.
  • For block proposers, all the attestations observed are counted (the same as before).

In the figures below, we assume a vanilla GHOST, but we can apply the same technique for LMD/FMD GHOST.

With this modification, the attacker cannot “sway” honest attestors by releasing attestations. Let us assume that the block proposer of the current slot is honest, and the attacker does not publish any saved block. The honest attestors in this slot receive the newly proposed block before they make an attestation (by the synchrony assumption). They calculate the score of blocks based on the same set of attestations, i.e., the attestations included in the proposed block or the blocks they received by the previous slot. Therefore, they vote for the same block.

Ties of blocks are broken in favor of the number of attestations that vote for them but are not included in any block yet. Let us assume a case where there is an honest slot, and the next slot is adversarial (i.e., the attacker is selected as the block proposer). Here, the attacker can ignore the honest block and attestations from the previous slot and make a fork. The score of the newly proposed attacker’s block and the honest block from the previous slot is zero, making a tie. However, the honest block voted by the honest attestations from the previous slot wins by the tie-breaking rule and gains the current slot’s honest attestations. If the block proposer of the next slot is honest, these attestations are included in a block.

This also shows that honest attestations in an adversarial slot can increase the main chain’s score later unless an attacker’s chain takes over the main chain.

2 Likes