[Paper Review] Blockchain Consensus Protocols in the Wild

Christian Cachin, Marko Vukolić|arXiv (Cornell University)|Jul 6, 2017

Blockchain Technology Applications and SecurityComputer Science41 references257 citations

TL;DR

The paper surveys consensus protocols used in permissioned blockchains, advocates formal security models and public reviews, and compares resilience across platforms.

ABSTRACT

A blockchain is a distributed ledger for recording transactions, maintained by many nodes without central authority through a distributed cryptographic protocol. All nodes validate the information to be appended to the blockchain, and a consensus protocol ensures that the nodes agree on a unique order in which entries are appended. Consensus protocols for tolerating Byzantine faults have received renewed attention because they also address blockchain systems. This work discusses the process of assessing and gaining confidence in the resilience of a consensus protocols exposed to faults and adversarial nodes. We advocate to follow the established practice in cryptography and computer security, relying on public reviews, detailed models, and formal proofs; the designers of several practical systems appear to be unaware of this. Moreover, we review the consensus protocols in some prominent permissioned blockchain platforms with respect to their fault models and resilience against attacks. The protocol comparison covers Hyperledger Fabric, Tendermint, Symbiont, R3~Corda, Iroha, Kadena, Chain, Quorum, MultiChain, Sawtooth Lake, Ripple, Stellar, and IOTA.

Motivation & Objective

• Advocate a rigorous, cryptography-style approach to evaluating consensus protocols with formal models and public review.
• Survey consensus mechanisms used in permissioned blockchains and contrast their fault models and resilience.
• Highlight the risks of ad-hoc protocol design and the need for standard validation practices.
• Provide a platform-by-platform comparison of resilience and security properties in real-world implementations.

Proposed method

• Discuss the need for formal security models, trust assumptions, and open validation in blockchain protocols.
• Review state-machine replication as the basis for blockchain consensus and its two key properties: safety and liveness under eventual synchrony.
• Compare crash-tolerant (Paxos/VSR) and Byzantine (PBFT) consensus families and their applicability to permissioned blockchains.
• Analyze a concrete flawed protocol (Tangaroa) to illustrate common design pitfalls and the importance of proper BRB/BCB primitives.

Experimental results

Research questions

• RQ1 What consensus models and fault assumptions underpin current permissioned blockchain protocols?
• RQ2 How do prominent permissioned blockchain platforms differ in resilience to crashes vs. Byzantine faults?
• RQ3 What formal methods and validation practices are employed or lacking in industry implementations?
• RQ4 What are representative strengths and weaknesses of Paxos/VSR-based versus PBFT-based approaches in practice?
• RQ5 What lessons can be drawn from identified pitfalls (e.g., Tangaroa) for future protocol design?

Key findings

• Consensus protocols in permissioned blockchains require clearly stated trust assumptions and formal reasoning to be considered trustworthy.
• There is a broad gap between cryptographic practice and industry deployment in blockchain protocol design, with many implementations lacking formal validation.
• Paxos/VSR and PBFT families underpin most crash-tolerant and Byzantine fault-tolerant protocols, respectively, with well-understood progress through views and leader election.
• PBFT/BFT-SMaRt provide robust Byzantine fault tolerance with demonstrated performance in LAN/WAN settings, whereas ad-hoc extensions (e.g., Tangaroa) can fail safety or liveness.
• Some platforms separate ordering from transaction validation to improve scalability and flexibility (e.g., Hyperledger Fabric V1 with Kafka-based ordering).
• Fewer implementations achieve rigorous live and safe Byzantine consensus in practice, underscoring the value of formal proofs and public review.