Public-mempool gas sponsorship needs escrow, a bond, or trust

Economics
1

Public-mempool gas sponsorship needs escrow, a bond, or trust

In one sentence: if you want a contract to pay gas for someone else’s transaction, and you want the public mempool to relay that transaction with no locked money and no off-chain trust, you cannot have all three. This article proves that, and shows that every workaround falls into one of three categories. That is why EIP-8141 reserves balance instead of leaving the choice to taste.

The problem, in plain terms

A sponsor wants to pay gas for a user. The public peer-to-peer network should pass that transaction along after a quick local check. The dream is “check it on-chain and forward it,” with no deposit and no trusted middleman.

The catch: before a transaction lands in a block, every node that forwards it must check it, and that check costs work. If the transaction never lands, that work is never paid for. So an attacker can flood the network with sponsored transactions that everyone checks and nobody pays for. That is a denial-of-service attack. The rest of this article makes that intuition exact.

Terms

  • Mempool (M): the public network of N nodes that gossip candidate transactions before a block includes them. Anyone can forward.
  • Sponsored transaction (s): names a payer P who owes the gas cost c(s) only if a block includes s. The sender is not P.
  • Admission rule (R): how a node decides, before inclusion, whether to accept and forward s.
  • Sybil identity: a fresh account an attacker makes for almost nothing.
  • Residual claimant: someone the protocol can take c(s) from, on-chain, without their consent, when the gas goes unpaid.
  • Seizable value: on-chain balance tied to an identity that the protocol can reach without consent.

The property we want: solvency without escrow (SwE)

Plain version: admit sponsored transactions with no locked money from the sponsor, and keep the attack from being cheap.

An admission rule R has SwE when both hold:

  • SwE(i), no locked or spent value. R admits s such that (a) no on-chain value tied to P can be taken without P’s consent, and (b) admission costs no non-refundable resource, on-chain or off-chain, per attempt.
  • SwE(ii), the attack is not cheap, at any network size. The total wasted validation work grows no faster than the attacker’s own cost, and the ratio does not grow as the network N grows.

The “at any network size” part matters. Drop it and a fixed network with rate limits can technically satisfy the plain version. See Why the N multiplier is unavoidable.

Assumptions

  • A1, free identities. A payer identity costs almost nothing to make and can hold zero seizable balance.
  • A2, you cannot pin the builder in advance. Before inclusion, the network cannot force the eventual block builder to promise to cover c(s). This is not assumed; it follows from A1, shown in Why you cannot pin the builder.
  • A3, checking costs something. Checking s costs each forwarding node w > 0, and that cost is lost if no block includes s. The exact size of w does not matter; the argument scales with how many unpaid transactions get admitted, not with w.

Core lemma: no one to bill

Plain version: if the sponsor put up nothing, then when the gas goes unpaid, there is nobody to take it from.

Lemma. Under A1, if R admits s with no seizable value tied to P, then on non-payment there is no one to bill.

Proof. You can only take value where it exists and is attributable. P has none (A1). The sender owes nothing here, by construction. The builder can be billed only for transactions it chose to include; a transaction that was never included was never chosen, so none of the builder’s value is reachable for it. Nobody else is named. So no one can be made to pay c(s), and the set of people to bill is empty. ∎

This is necessary but not the whole story. It only covers the “take money on-chain” path. An attack can still be made expensive a different way: by burning an off-chain resource (like proof-of-work) on every attempt. The theorem closes that second path separately.

The theorem

Plain version: no admission rule can give you all of SwE. Whatever it does, it lands in one of four cases, and every case fails.

Theorem. No public-mempool admission rule R satisfies SwE.

Proof. Suppose R satisfies SwE. By SwE(i)(a) and the lemma, there is no one to bill when gas goes unpaid. By SwE(i)(b), admission costs no non-refundable per-attempt resource. Now split on what R charges per attempt:

  1. R charges nothing. Each unpaid admitted s still costs w on every forwarding node (A3). Fresh identities name fresh empty payers, so duplicate suppression cannot merge them. Each distinct s reaches and is checked by all N nodes, so wasted work is W = N·w·k for k transactions. Sending k transactions costs the attacker about k off-chain, so the waste-to-cost ratio is about N: it does not shrink as k grows, and it grows with the network. That breaks SwE(ii).
  2. R charges an on-chain fee per attempt. If the sender pays, that is self-pay, not sponsorship. If P pays, P now spends or locks attributable on-chain value per attempt. That is an on-chain bond, and it breaks SwE(i).
  3. R requires the payer to hold seizable value at admission, whether or not it is ever taken. That is a held balance, and it breaks SwE(i)(a).
  4. R requires a non-refundable off-chain resource per attempt, such as proof-of-work. That is an off-chain toll, and it breaks SwE(i)(b).

There is no fifth case: R either charges something per attempt (cases 2, 3, 4) or it charges nothing (case 1). So no R satisfies SwE. ∎

Why the N multiplier is unavoidable

Case 1 is the heart of it, so here is why the three obvious defenses do not save it.

  • Deduplication drops repeats of the same transaction. The attacker sends different transactions, each with a fresh payer and a fresh hash, so every node still checks all k of them.
  • Rate limits and reputation punish a known identity. Identities are free (A1), so a banned one is replaced by a fresh, clean one.
  • A content filter would have to tell an eventually-unpaid transaction from an eventually-paid one before inclusion, which A2 says you cannot. A filter that guesses blindly drops honest sponsored transactions too, which is self-inflicted denial of service.

Reaching all N nodes is the whole point of a public mempool, and eclipse resistance is designed to guarantee it. So the per-transaction factor of N is built into public gossip. It is not a bug a client can patch.

The three categories

Plain version: every design that looks like it beats the theorem is secretly doing one of three things: making you pay per attempt, making you hold money, or trusting someone off-chain.

The anchor is capacity: let K(id) be how many mempool slots R gives an identity, and K₀ the capacity of a brand-new identity. A free baseline K₀ > 0 is not a bond: under A1 it leaks work proportional to the number of Sybil identities, which is case 1, not an escape.

  • Pay per attempt.
    • On-chain bond. Capacity above K₀ scales with non-refundable on-chain spend tied to the identity. Forms: locked stake, capacity earned by past paid inclusions, self-pay, and prepaid burn.
    • Off-chain toll. Capacity is bought with a non-refundable off-chain resource such as proof-of-work, per attempt.
  • Hold money. R requires a present, attributable on-chain balance whose size caps how many transactions get in, taken or not. Covers reserved balances (EIP-8141) and checked-but-drainable balances (EIP-8223).
  • Trust someone off-chain. A relayer signature, a preconfirmation, private orderflow, or an off-chain personhood check. The guarantee leaves the trustless public mempool.

The four-case split is exhaustive by construction. For the off-chain-trust category, Douceur’s rule supplies the personhood case: open-membership Sybil resistance needs either a scarce-resource test (pay per attempt) or a certifier (off-chain trust). The toll-versus-trust line is settled: an off-chain resource anyone can buy in bulk gives the attacker the same per-unit cost as an honest user, which is useless under A1; an off-chain resource that is scarce per person must be handed out by an off-chain issuer, which is off-chain trust.

A balance cannot be frozen into a snapshot

Plain version. You can prove “I am allowed to do X” against an old snapshot, because a lie there only hurts you. You cannot prove “I have money reserved” the same way, because a snapshot does not know how much of that money you already promised to other pending transactions.

Corollary (a held balance must be read live or bonded). A held balance cannot be replaced by a proof that the balance was reserved as of a recent committed state snapshot. A snapshot states a balance at a moment but not how much of that balance is already promised to other pending transactions. So one honest recent snapshot backs an unbounded number of admission proofs against a single balance, and this over-commitment stays unbounded for any finite choice of snapshot-refresh window, mempool-residency window, and withdrawal delay. Closing it reintroduces either a live per-payer ledger (a live balance read) or present locked value equal to the summed pending cost (a bond). The single-payer drain-during-maturation case does admit a bound (the withdrawal delay must be at least the snapshot-refresh window plus the residency window, plus a margin for the deepest reorg), but that is strictly weaker than a live read and does not touch the over-commitment case. This is why EIP-8141 keeps a live reservation ledger rather than a snapshot proof: authority can be committed to a snapshot because a false claim only hurts the claimant, but a balance cannot, because the amount already promised to others is not in the snapshot.

Where existing designs land

  • ERC-4337 and ERC-7562. Stake and reputation raise the cost of remaking a Sybil; the stake is never slashed. The free unstaked-paymaster tier is K₀ > 0 and leaks work of order N under Sybil pressure, while growth above it is an on-chain bond. This supports the theorem.
  • EIP-8141. Reservation accounting is a held balance: a node caps a payer’s admitted transactions by its present on-chain balance. This is node-side aggregate accounting, not an on-chain lock, so it bounds how many pending transactions one balance can back but does not keep an individual admitted transaction funded once the payer drains. Guaranteeing a specific admitted transaction survives a drain is a stronger, opt-in form of the same category, an on-chain lock. The theorem explains why the spec had to reserve at all.
  • EIP-8223. A static check (one registry read at 0x13, one signature recovery, one balance check) does not dodge A3, and its balance requirement is a held balance.
  • FOCIL (EIP-7805, EIP-8369). Forced inclusion sits after admission, propagation is signature-only and committee-capped, and force-inclusion is validity-conditional. A zero-value sponsor’s transaction is invalid and is not force-included, so FOCIL cannot invent a residual claimant.
  • Based preconfirmations. Binding a future proposer reduces to an on-chain bond (slashable collateral) plus off-chain trust (a signed commitment).

Why you cannot pin the builder

A2 follows from A1. The only two ways to make a permissionless party answerable for a future act are a signed promise and posted seizable collateral. Without either, the party can just decline later, which is exactly “cannot pin in advance.” Based preconfirmations show the pattern: bind the proposer no matter what and an attacker drains it for free, so the proposer needs a right to refuse, which brings back opacity; bind it only when it opts in, and that opt-in is a signed commitment (off-chain trust) backed by stake (an on-chain bond).

Contributions

  • The SwE property and the impossibility theorem, with the four-case split and the amplification statement (waste-to-cost ratio grows with N).
  • The core lemma stated as necessary but not sufficient, which admits the off-chain-toll path instead of hiding it.
  • The free-baseline-anchored classification, which keeps “bond” from meaning “any cost-gated capacity.”
  • Turning three previously-assumed claims (cannot pin the builder, FOCIL non-evasion, static-check non-evasion) into proved lemmas.

Related work

  • Buterin, alternative-mempool proposal (2021) introduced the validation-and-execution split and the pay-before-execution rule. This article shows why that guarantee cannot be free in the public tier.
  • Yaish, Qin, and others, Speculative DoS in Ethereum (IACR 2023/956) demonstrate ConditionalExhaust and MemPurge. This article states the invariant that makes the attack class unavoidable for stake-free, toll-free public sponsorship.
  • STAKESURE (arXiv 2401.05797) draws a compensation pool from slashed stake, which is a collectivized on-chain bond.
  • Douceur and Humanode PoBU establish the scarce-resource-or-certifier rule, which is why A1 cannot be dropped for free.

Open questions

  1. Attester compute under co-inclusion. The worst case is acknowledged by EIP-8369 but not pinned by a Standards-Track spec, so it waits on benchmarks, not argument.
  2. Spec maturity. EIP-8141, EIP-8223, EIP-8369, and EIP-7805 are at various proposal stages. Every spec constant here reflects the text as read on 2026-09-14.