[Paper Review] Enhancing Accountability and Trust in Distributed Ledgers

Maurice Herlihy, Mark Moir|arXiv (Cornell University)|Jun 23, 2016

Blockchain Technology Applications and Security14 references19 citations

TL;DR

This paper proposes design principles and mechanisms to enhance accountability and fairness in permissioned distributed ledgers by minimizing non-deterministic choices and enabling after-the-fact detection of manipulation. It introduces deterministic ordering rules, auditable logs, and accountability triggers in Tendermint-based systems to make fairness violations more detectable and enforceable through real-world penalties.

ABSTRACT

Permisionless decentralized ledgers ("blockchains") such as the one underlying the cryptocurrency Bitcoin allow anonymous participants to maintain the ledger, while avoiding control or "censorship" by any single entity. In contrast, permissioned decentralized ledgers exploit real-world trust and accountability, allowing only explicitly authorized parties to maintain the ledger. Permissioned ledgers support more flexible governance and a wider choice of consensus mechanisms. Both kinds of decentralized ledgers may be susceptible to manipulation by participants who favor some transactions over others. The real-world accountability underlying permissioned ledgers provides an opportunity to impose fairness constraints that can be enforced by penalizing violators after-the- fact. To date, however, this opportunity has not been fully exploited, unnecessarily leaving participants latitude to manipulate outcomes undetectably. This paper draws attention to this issue, and proposes design principles to make such manipulation more difficult, as well as specific mechanisms to make it easier to detect when violations occur.

Motivation & Objective

• To address the lack of enforceable fairness guarantees in distributed ledgers, especially in permissioned systems where real-world accountability is possible.
• To reduce opportunities for participants to manipulate transaction ordering or inclusion without detection.
• To design lightweight, off-path mechanisms that allow auditors to detect long-term statistical anomalies indicative of systematic violations.
• To integrate accountability into the ledger’s design without compromising performance for honest participants.
• To demonstrate applicability through modifications to the open-source Tendermint ledger system.

Proposed method

• Replace non-deterministic choices with deterministic rules wherever possible to reduce manipulation vectors.
• Log all non-avoidable non-deterministic choices in a cryptographically authenticated, auditable manner to enable post-hoc analysis.
• Use cryptographic signatures and hash chains to ensure logs cannot be tampered with, preserving integrity for auditing.
• Decouple accountability mechanisms from the critical path to avoid performance penalties on normal operation.
• Introduce mechanisms like OWAC (Ordered Write-Ahead Commit) to enforce consistent ordering of transactions across validators.
• Enable detection of violations through statistical analysis of logs, even when individual events are indistinguishable from normal non-determinism.

Experimental results

Research questions

• RQ1 How can fairness violations in permissioned ledgers be detected after the fact when real-time enforcement is not feasible?
• RQ2 What design principles minimize the number of non-deterministic choices that could be exploited for manipulation?
• RQ3 How can accountability be enforced in a way that does not degrade performance for honest participants?
• RQ4 What mechanisms allow auditors to detect systematic manipulation patterns without requiring real-time intervention?
• RQ5 In what ways can existing ledger systems like Tendermint be extended to support verifiable fairness and accountability?

Key findings

• The proposed design principles significantly reduce the number of non-deterministic choices, thereby shrinking the attack surface for manipulation.
• Auditable, cryptographically authenticated logs enable detection of suspicious long-term trends indicative of repeated fairness violations.
• The OWAC protocol and related mechanisms ensure that validators cannot control transaction ordering within blocks, even if they manipulate peer communication order.
• Accountability mechanisms are kept off the critical path, preserving performance for normal operations while still enabling post-hoc detection.
• The approach enables real-world enforcement of penalties—such as fines or expulsion—by providing verifiable evidence of misconduct.
• The framework is generalizable and has been successfully adapted to the Tendermint ledger system, demonstrating practical feasibility.