The Golden Snitch: A Byzantine Fault Tolerant Protocol with Activity

Abstract

The increasing popularity of blockchain-based cryptocurrencies has revitalized the search for efficient Byzantine fault-tolerant (BFT) protocols. Many existing BFT protocols can achieve good performance in fault-free cases but suffer severe performance degradation when faults occur. This is also a problem with DiemBFT. To mitigate performance attacks in DiemBFT, we present an improved BFT protocol with optimal liveness called the Golden Snitch. The core idea is to introduce unbiased randomness in leader selection and improve the voting mechanism to protect honest leaders from being dragged down by the previous leader. The performance of the Golden Snitch is evaluated through experiments, turning out it outperforms DiemBFT in the presence of faults.

A Analysis of Correctness

The correctness of BFT protocols is usually defined by two properties: safety and liveness. This section surveys that the Snitch can guarantee safety and liveness under some reasonable assumptions mentioned previously.

1.1 A.1 Safety

The safety of the Snitch is proved to be provided regardless of the network status.

Definition 1

(safety). The protocol provides safety if it satisfies agreement and validity simultaneously.

Lemma 1

(validity). Any block containing invalid data can not be confirmed.

Proof

Because a valid CC can be formed only with $n-f=2f+1$ votes for it, there must be a correct replica who voted it. In other words, Malicious replicas cannot generate a certificate without the cooperation of a correct node. As a correct replica, it is impossible to send a positive vote for a block with invalid data. Trivially ensures that only valid blocks can be confirmed.

Lemma 2

(agreement). In BFT model, for round r, the replica $P_i$ maintains a block $B_r$ with its confirmation certificate $CC_r$. If there exits any other replica $P_j$ that maintains a block $B_r'$ with its confirmation certificate $CC_r'$ in the same round, it must be $B_r=B_r'$ and $CC_r=CC_r'$.

Proof

We prove Lemma 2 by contradiction. It is assumed that there exists a round r, where two conflicting blocks $B_r$ and $B_r'$ are both confirmed, each by a correct replica. As defined before, $2f+1$ positive votes would be required to form a CC. Hence, $CC_r$ and $CC_r'$ need $2(2f+1)=n+f+1$ votes simultaneously. It implies that at least $f+1$ replicas vote twice with the original setting of n. It then goes against the assumption that at most f malicious replicas exist. Consequently, there is at most one valid block in a round.

Theorem 1

(safety). Two conflicting blocks can not be committed according to the commit rule.

Proof

It is assumed that there are three certified blocks chained in consecutive rounds, as shown in the example in Fig. 1(a):

$$\begin{aligned} B_r \leftarrow CC_r \leftarrow B_{r+1} \leftarrow CC_{r+1} \leftarrow B_{r+2} \leftarrow CC_{r+2}. \end{aligned}$$

Here, $n-f$ votes were cast for $CC_2$ to commit $B_r$, out of which at least $f+1$ were from correct replicas. These correct replicas that contributed to the generation of $CC_2$ remember r as their locked round $r_l$, and would not vote for block B if it is not a descendant of block $B_r$, according to the vote rules. Hence, if there exist another three certified blocks chained in consecutive rounds as:

$$\begin{aligned} B_r' \leftarrow CC_r' \leftarrow B_{r+1}' \leftarrow CC_{r+1}' \leftarrow B_{r+2}' \leftarrow CC_{r+2}'. \end{aligned}$$

Then $B_r'$ must be a descendant of $B_r$.

1.2 A.2 Liveness

Liveness can be provided after GST. Next, we set the timer for $\varDelta$ to denote the maximum round duration and use $\delta$ to denote the network delay.

Definition 2

(Liveness). Whenever the network becomes synchronous, the algorithm provides liveness as to commits will be produced in a timely manner.

Lemma 3

(Round Sync). For two consecutive rounds, round $r-1$ is led by a correct leader and round r is a timeout round. If a correct replica first switches to a new maximum round $r+1$ at time t, then others will move to round $r+1$ at time $t+2\delta$.

Proof

It is assumed that leader $l_{r-1}$ published $B_{r-1}$ at time $t'$. Replicas can be divided into three parts and discussed as follows:

• Replica A receives $B_{r-1}$ at time $t'$:A moves to round r and and starts the timer at time $t'$. Then the timer expired at time $t'+\varDelta$.

• Replica B receives $B_{r-1}$ at time $t'+\delta$: Similarly, B sends starts its timer at time $t'+\delta$ and then broadcasts a timeout message at time $t'+\delta +\varDelta$.

• Replica C receives $B_{r-1}$ at time $t'+\delta$: C starts its timer at time $t'+\delta$. While replica C received more than $f+1$ timeout messages leading to its broadcast for timeout message before the timer expired.

In consequence, replicas broadcast respective timeout messages before time $t'+\delta +\varDelta$. Then replicas complete the recovery within $\delta$. Finally, we came to the conclusion that replicas would be synchronized to the same round within $2\delta$.

Lemma 4

In the situation of all leaders in three consecutive rounds, $l_r, \dots , l_{r+3}$ are correct, $B_r$ can be committed within $4*2\delta$ after it is proposed.

Proof

According to the commit rule, three consecutive confirmation certificates are required to commit a block. For these rounds that generate certificates, each round duration is at most $2\delta$. Taking round synchronization into consideration, no more than $3*2\delta +2\delta$ is required to commit a block.

Lemma 5

Malicious nodes cannot impede progress infinitely.

Proof

The recover threshold is $f+1$, ensuring that malicious nodes can not reveal others’ secrets without at least one correct replica. It is inevitable that a malicious leader can block the process temporarily by means of no response or publishing an invalid block. While these behaviors cannot affect the next-round leader at all. Thanks to the punishment, in the worst case, the process will be made after $f+1$ rounds.

Theorem 2

(Liveness). The request issued by a correct client eventually completes.

Proof

By Lemma 3, it can be concluded that all replicas enter the same round in time. Besides, owing to Lemma 4 combined with Lemma 5, transaction finality is guaranteed when a succession of three consecutive leaders behave correctly one after another. Hence, correct clients will receive replies to their requests eventually. It means liveness is guaranteed.