arxiv: 2605.05559 · v1 · submitted 2026-05-07 · 💻 cs.GT · cs.CR

Recognition: unknown

Adversarial procurement in blockchains

Maryam Bahrani, Michael Neuder, S. Matthew Weinberg

Pith reviewed 2026-05-08 04:36 UTC · model grok-4.3

classification 💻 cs.GT cs.CR

keywords adversarial procurementblockchainsmechanism designliveness faultsslashingvalidity proofsincentivesSNARKs

0 comments

The pith

The optimal protocol for procuring expensive tasks in adversarial blockchains incurs loss that scales logarithmically with liveness fault cost times the adversarial network fraction.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper models the problem of getting nodes to perform costly computations like generating validity proofs in a blockchain where some fraction may be adversarial. The protocol must pay suppliers enough to encourage correct behavior while minimizing the expected cost if the task fails to complete, known as a liveness fault. Analysis reveals that the best such mechanism achieves a total loss that increases only logarithmically in the fault cost, amplified by the adversarial share. This leads to simple structures for the optimal payments and assignments, including using one randomly chosen primary performer backed by a committee.

Core claim

We formalize adversarial procurement as a mechanism design problem balancing liveness fault costs with incentive payments. We show that the loss of the optimal protocol scales logarithmically in the cost of a liveness fault, scaled up by the adversarial fraction of the network. Further, the optimal equilibria designate a single random node as the primary worker and a committee as a fallback. We also characterize the asymptotic regimes where having negative payments is especially helpful.

What carries the argument

A mechanism design model that selects payments and task assignments to rational but possibly adversarial nodes, trading off procurement costs against the risk-weighted cost of liveness failures.

Load-bearing premise

The analysis assumes a fixed and known fraction of adversarial nodes who act as rational economic agents responding to the designed payments and possible slashing.

What would settle it

A simulation or real-world deployment where the observed total loss deviates from the predicted logarithmic scaling when the liveness fault cost is increased while keeping the adversarial fraction fixed.

Figures

Figures reproduced from arXiv: 2605.05559 by Maryam Bahrani, Michael Neuder, S. Matthew Weinberg.

**Figure 3.1.** Figure 3.1: A 3−dimensional example of the transition dynamics of the solution to (PROG3) at h = 1, n = 3 and C = 2 (lower surface) and C = 5 (higher surface). The colorbars denote the value of g at [s1, s2, s3], and the circle and square markers indicate the minimizers over the intersection of the surface and the polytope. Example 3.5 (h = 2, n = 5). As we increase the value of C, the minimizer s ∗ of g takes multi… view at source ↗

**Figure 3.2.** Figure 3.2: This plot shows Ct (on log scale) as a function of the continuous honest ratio τ = h/n ∈ (0, 1) when h, n → ∞ as calculated in Lem. 3.10 (solid line). The dashed lines denote the corresponding values with stake B = 10 (Section 3.4) as calculated in Cor. A.3. Remark 3.5 (Ct reduces to root finding on high-degree polynomials). Notice that to find Ct , for each candidate C we need to solve for the roots of … view at source ↗

**Figure 3.3.** Figure 3.3: The optimal protocol loss as a function of view at source ↗

read the original abstract

An emerging blockchain protocol design pattern leverages the asymmetry between the computational effort in performing versus verifying tasks. For example, cryptographic validity proofs (e.g., SNARKS) require the prover to expend significant effort demonstrating the correctness of their claim, while the verifiers benefit from extremely easy validation. The operationalization of this paradigm requires efficiently soliciting the performance of expensive tasks in pseudonymous, adversarial environments. We formalize this as a mechanism design question. The protocol balances the economic cost of a liveness fault, where the work is not completed, with the payments required to incentivize specific behavior from candidate suppliers. We show that the loss of the optimal protocol scales logarithmically in the cost of a liveness fault, scaled up by the adversarial fraction of the network. Further, we find that the optimal equilibria have an intuitive structure, allowing us to provide concrete advice to practitioners. Specifically, in many regimes, the optimum designates a single, random node as the primary worker and a committee as a fallback, which is reminiscent of leader-based consensus mechanisms. We also characterize the asymptotic regimes where having negative payments (i.e., slashing in blockchain parlance) is especially helpful.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper sets up a mechanism-design model for procuring expensive verifiable work in adversarial blockchains and derives a clean O(α log C) loss bound plus an intuitive single-worker-plus-committee equilibrium.

read the letter

The core contribution is a formal treatment of how to pay for hard-to-do but easy-to-check tasks like SNARK proofs when some fraction of nodes may be adversarial. They balance the economic cost of a liveness failure against the payments needed to elicit the work, and they show the minimax loss of the optimal mechanism grows only logarithmically in that failure cost, scaled by the adversarial fraction α. The equilibrium they characterize often reduces to designating one random primary worker with a committee fallback, which matches structures already used in practice. They also identify regimes where slashing (negative payments) helps a lot. That scaling result and the structural advice are the parts that stand out as new relative to earlier incentive analyses in the blockchain literature. The model itself is straightforward and the derivation appears internally consistent with no obvious gaps or post-hoc fitting. The assumptions are stated clearly: fixed known α and rational economic actors. Those are standard for this style of work, though they limit direct applicability to pseudonymous settings where behavior can be less predictable. The paper does not claim empirical validation, so the practical recommendations remain theoretical guidance rather than tested prescriptions. Readers working on incentive layers for proof-based protocols or mechanism design in distributed systems will find the logarithmic bound and equilibrium structure useful. It is not a broad survey or empirical study, but the focused model and result give it a clear audience. The work is grounded enough and the claim sharp enough to merit referee time even if revisions are needed on exposition or comparison to prior mechanism-design results.

Referee Report

2 major / 3 minor

Summary. The paper formalizes the procurement of computationally expensive tasks (e.g., generating SNARK proofs) in pseudonymous, adversarial blockchain environments as a mechanism-design problem. The protocol must trade off the economic cost C of a liveness fault against the payments needed to elicit correct behavior from rational suppliers, a fraction α of whom are adversarial. The central claims are that the minimax loss of the optimal procurement mechanism scales as O(α log C) and that the optimal equilibria have a simple structure: a single randomly chosen primary worker with a committee fallback. The paper further characterizes the regimes in which negative payments (slashing) are beneficial.

Significance. If the derivations are correct, the logarithmic scaling result supplies a clean, falsifiable prediction for the loss incurred by any procurement protocol and supplies concrete design guidance (leader-plus-committee structure, selective use of slashing). The model is parameter-light once α is fixed, and the equilibrium characterization is intuitive and reminiscent of existing leader-based consensus protocols. These features would make the work a useful reference for both theorists and protocol designers.

major comments (2)

[Theorem 1 / §4] The O(α log C) scaling is the load-bearing claim. The manuscript should state explicitly in the main theorem (presumably §4 or §5) the precise assumptions on the distribution of costs, the information structure, and the solution concept (e.g., dominant-strategy vs. Bayesian Nash) under which the bound is proved; without that list it is impossible to judge whether the log dependence survives modest relaxations of the model.
[§5] The equilibrium characterization (single random primary + committee fallback) is presented as “optimal in many regimes.” The paper should identify the precise regime boundaries (e.g., ranges of C/α) in which this structure is exactly optimal versus approximately optimal, and should supply the corresponding welfare gap.

minor comments (3)

[§2] Notation for the loss function L(·) and the payment vector p is introduced late; a compact table of symbols in §2 would improve readability.
[Introduction] The abstract states the scaling result without a proof sketch; the introduction should contain a one-paragraph high-level derivation outline so that readers can follow the logic before the technical sections.
[Figures 3–5] Several figures compare the optimal mechanism to simple baselines; axis labels and legend entries should be enlarged for print readability.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the careful reading, the positive evaluation, and the recommendation for minor revision. The comments identify useful opportunities to strengthen the clarity of our main results. We address each major comment below.

read point-by-point responses

Referee: [Theorem 1 / §4] The O(α log C) scaling is the load-bearing claim. The manuscript should state explicitly in the main theorem (presumably §4 or §5) the precise assumptions on the distribution of costs, the information structure, and the solution concept (e.g., dominant-strategy vs. Bayesian Nash) under which the bound is proved; without that list it is impossible to judge whether the log dependence survives modest relaxations of the model.

Authors: We agree that the assumptions should be stated explicitly within the theorem statement itself. Theorem 1 is proved under i.i.d. costs drawn from a known distribution with bounded support, private information about individual costs, and Bayesian Nash equilibrium as the solution concept. The O(α log C) bound is derived via a minimax argument that relies on these conditions. We will revise the statement of Theorem 1 to include an explicit enumerated list of these assumptions (and any auxiliary technical conditions) immediately preceding the bound. This change will also facilitate discussion of robustness. revision: yes
Referee: [§5] The equilibrium characterization (single random primary + committee fallback) is presented as “optimal in many regimes.” The paper should identify the precise regime boundaries (e.g., ranges of C/α) in which this structure is exactly optimal versus approximately optimal, and should supply the corresponding welfare gap.

Authors: The single-random-primary-plus-committee structure is exactly optimal when C/α exceeds a threshold determined by the upper bound on individual costs and the adversarial fraction α; below this threshold the structure remains approximately optimal with a welfare gap bounded by a constant multiple of α. We will expand §5 to state the exact boundary condition in closed form, distinguish the exact-optimality regime from the approximate-optimality regime, and report the associated welfare-gap bounds (which remain O(α log C) in the approximate case). The required calculations follow directly from the existing equilibrium analysis and will be added to the main text. revision: yes

Circularity Check

0 steps flagged

No significant circularity; derivation self-contained in mechanism-design model

full rationale

The paper formalizes adversarial procurement as a mechanism-design problem balancing liveness-fault cost C against payments to rational suppliers under fixed adversarial fraction α. The claimed O(α log C) loss scaling for the optimal protocol is obtained by minimizing the worst-case loss over feasible mechanisms (including the single-primary-plus-committee structure), without any reduction to fitted data, self-definitional parameters, or load-bearing self-citations. The equilibrium characterization follows directly from the incentive-compatibility constraints stated in the model; no step equates the target result to its own inputs by construction. External validity concerns (pseudonymity) are separate from internal soundness.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 0 invented entities

The central claim rests on standard mechanism-design assumptions about rational agents and a fixed adversarial fraction; no new entities are postulated and no parameters appear to be fitted to data.

free parameters (1)

adversarial fraction
Scales the loss bound; treated as an exogenous model parameter rather than fitted.

axioms (1)

domain assumption Participants are rational and respond to economic incentives including payments and slashing
Invoked to justify the equilibrium analysis in the procurement setting.

pith-pipeline@v0.9.0 · 5500 in / 1186 out tokens · 37760 ms · 2026-05-08T04:36:42.996868+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

46 extracted references · 16 canonical work pages

[1]

Mohsen Ahmadvand, Rok Pajniˇ c, and Ching-Lun Chiu. 2026. push0: Scalable and Fault-Tolerant Orchestration for Zero-Knowledge Proof Generation.arXiv preprint arXiv:2602.16338(2026)

work page arXiv 2026
[2]

David Ribeiro Alves, Vishnu Patankar, Matheus Pereira, Jamie Stephens, Nima Vaziri, and Sreeram Kannan. 2026. EigenAI: Deterministic Inference, Verifiable Results.arXiv preprint arXiv:2602.00182(2026)

work page arXiv 2026
[3]

2023.We are announcing Axiom, the ZK coprocessor for Ethereum.https://x.com/ axiom_xyz/status/1620104714322051073

Axiom. 2023.We are announcing Axiom, the ZK coprocessor for Ethereum.https://x.com/ axiom_xyz/status/1620104714322051073

work page arXiv 2023
[4]

Moshe Babaioff, Robert Kleinberg, and Christos H Papadimitriou. 2007. Congestion games with malicious players. InProceedings of the 8th ACM conference on Electronic commerce. 103–112

2007
[5]

Maryam Bahrani and Naveen Durvasula. 2024. Resonance: Transaction fees for heterogeneous computation.arXiv preprint arXiv:2411.11789(2024)

work page arXiv 2024
[6]

2026.High Proposer Payment Alert!https://x.com/mevproposerbot/ status/2024852422460321829

MEV-Boost Bot. 2026.High Proposer Payment Alert!https://x.com/mevproposerbot/ status/2024852422460321829

work page arXiv 2026
[7]

2025.Announcing Pico Prism, the state-of-the-art zkVM for Ethereum real-time prov- ing.https://x.com/brevis_zk/status/1978430670390133237

Brevis. 2025.Announcing Pico Prism, the state-of-the-art zkVM for Ethereum real-time prov- ing.https://x.com/brevis_zk/status/1978430670390133237

work page arXiv 2025
[8]

2025.Brevis ProverNet Whitepaper.https://brevis.network/whitepaper/ provernet.pdf

Brevis. 2025.Brevis ProverNet Whitepaper.https://brevis.network/whitepaper/ provernet.pdf

2025
[9]

Ethan Buchman, Jae Kwon, and Zarko Milosevic. 2018. The latest gossip on BFT consensus. arXiv preprint arXiv:1807.04938(2018)

work page arXiv 2018
[10]

2021.Endgame.https://vitalik.eth.limo/general/2021/12/06/ endgame.html

Vitalik Buterin. 2021.Endgame.https://vitalik.eth.limo/general/2021/12/06/ endgame.html

2021
[11]

2026.Potential ZK-EVM Rollout Tweet.https://x.com/VitalikButerin/ status/2007559523528233041

Vitalik Buterin. 2026.Potential ZK-EVM Rollout Tweet.https://x.com/VitalikButerin/ status/2007559523528233041

work page arXiv 2026
[12]

Vitalik Buterin and Virgil Griffith. 2017. Casper the friendly finality gadget.arXiv preprint arXiv:1710.09437(2017)

work page arXiv 2017
[13]

Vitalik Buterin, Diego Hernandez, Thor Kamphefner, Khiem Pham, Zhi Qiao, Danny Ryan, Juhyeok Sin, Ying Wang, and Yan X Zhang. 2020. Combining ghost and casper.arXiv preprint arXiv:2003.03052(2020). 23

work page arXiv 2020
[14]

Vincent Conitzer and Makoto Yokoo. 2010. Using mechanism design to prevent false-name manipulations.AI magazine31, 4 (2010), 65–78

2010
[15]

Philip Daian, Steven Goldfeder, Tyler Kell, Yunqi Li, Xueyuan Zhao, Iddo Bentov, Lorenz Breidenbach, and Ari Juels. 2020. Flash boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability. In2020 IEEE Symposium on Security and Privacy (SP). IEEE, 910–927

2020
[16]

Soubhik Deb, Robert Raynor, and Sreeram Kannan. 2024. Stakesure: Proof of stake mecha- nisms with strong cryptoeconomic safety.arXiv preprint arXiv:2401.05797(2024)

work page arXiv 2024
[17]

2006.Handbook of procurement

Nicola Dimitri, Gustavo Piga, and Giancarlo Spagnolo. 2006.Handbook of procurement. Cam- bridge University Press

2006
[18]

2026.Spin up your own Ethereum node.https://ethereum.org/developers/ docs/nodes-and-clients/run-a-node/

Ethereum.org. 2026.Spin up your own Ethereum node.https://ethereum.org/developers/ docs/nodes-and-clients/run-a-node/

2026
[19]

2026.Provers – Ethproofs.https://ethproofs.org/provers

Ethproofs. 2026.Provers – Ethproofs.https://ethproofs.org/provers

2026
[20]

2024.Introducing BuilderNet.https://collective.flashbots.net/t/ introducing-buildernet/4173

Flashbots. 2024.Introducing BuilderNet.https://collective.flashbots.net/t/ introducing-buildernet/4173

2024
[21]

2026.Phase 0 – The Beacon Chain.https://github.com/ethereum/ consensus-specs/blob/master/specs/phase0/beacon-chain.md

Ethereum Foundation. 2026.Phase 0 – The Beacon Chain.https://github.com/ethereum/ consensus-specs/blob/master/specs/phase0/beacon-chain.md

2026
[22]

Pranav Garimidi, Michael Neuder, and Tim Roughgarden. 2025. Tullock Contests in the Wild: Applications in Blockchains.ACM SIGecom Exchanges23, 1 (July 2025), 24–34

2025
[23]

Pranav Garimidi, Michael Neuder, and Tim Roughgarden. 2026. Beyond Winner-Take-All Procurement Auctions.arXiv preprint arXiv:2603.27779(2026)

work page arXiv 2026
[24]

2025.Shipping an L1 zkEVM #1: Realtime Proving.https://blog.ethereum

Sophia Gold. 2025.Shipping an L1 zkEVM #1: Realtime Proving.https://blog.ethereum. org/2025/07/10/realtime-proving

2025
[25]

Jens Groth. 2016. On the size of pairing-based non-interactive arguments. InAnnual in- ternational conference on the theory and applications of cryptographic techniques. Springer, 305–326

2016
[26]

Lioba Heimbach, Lucianna Kiffer, Christof Ferreira Torres, and Roger Wattenhofer. 2023. Ethereum’s proposer-builder separation: Promises and realities. InProceedings of the 2023 ACM on Internet Measurement Conference. 406–420

2023
[27]

2026.Infura – Web3 Development Platform.https://www.infura.io/

Infura. 2026.Infura – Web3 Development Platform.https://www.infura.io/

2026
[28]

George Karakostas and Anastasios Viglas. 2003. Equilibria for networks with malicious users. InInternational Symposium on Algorithms and Computation. Springer, 696–704

2003
[29]

2023.=nil; Proof Market.https://nil.foundation/blog/post/ proof-market

Mikhail Komarov. 2023.=nil; Proof Market.https://nil.foundation/blog/post/ proof-market

2023
[30]

2025.EigenCloud Whitepaper.https://docs.eigencloud.xyz/assets/files/ EigenCloud_Whitepaper-127a6743029d2c4858e7633196c47ea4.pdf 24

Eigen Labs. 2025.EigenCloud Whitepaper.https://docs.eigencloud.xyz/assets/files/ EigenCloud_Whitepaper-127a6743029d2c4858e7633196c47ea4.pdf 24

2025
[31]

2025.SP1 Hypercube announcement thread.https://x.com/SuccinctLabs/ status/1925306484281553262

Succinct Labs. 2025.SP1 Hypercube announcement thread.https://x.com/SuccinctLabs/ status/1925306484281553262

work page arXiv 2025
[32]

Andrew Lewis-Pye, Joachim Neu, Tim Roughgarden, and Luca Zanolini. 2025. Accountable liveness. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communi- cations Security. 3431–3445

2025
[33]

Andrew Lewis-Pye and Tim Roughgarden. 2023. Permissionless consensus.arXiv preprint arXiv:2304.14701(2023)

work page arXiv 2023
[34]

2024.Unbundling staking: Towards rainbow staking.https://ethresear

Barnab´ e Monnot. 2024.Unbundling staking: Towards rainbow staking.https://ethresear. ch/t/unbundling-staking-towards-rainbow-staking/18683

2024
[35]

Thomas Moscibroda, Stefan Schmid, and Roger Wattenhofer. 2006. When Selfish Meets Evil: Byzantine Players in a Virus Inoculation Game. In25th Annual Symposium on Principles of Distributed Computing (PODC). Denver, Colorado, USA

2006
[36]

Minghao Pan, Bruno Mazorra, Christoph Schlegel, and Akaki Mamageishvili. 2024. On sybil- proof mechanisms.arXiv preprint arXiv:2407.14485(2024)

work page arXiv 2024
[37]

2025.Web3 Pi: Your Ethereum Node on Raspberry Pi.https://www.web3pi.io/

Web3 Pi. 2025.Web3 Pi: Your Ethereum Node on Raspberry Pi.https://www.web3pi.io/

2025
[38]

Aaron Roth. 2008. The price of malice in linear congestion games. InInternational Workshop on Internet and Network Economics. Springer, 118–125

2008
[39]

2024.Succinct network: Prove the world’s software.https://resources.cryptocompare.com/asset-management/20420/ 1754473565450.pdf

Uma Roy, John Guibas, M Pai, K Kulkarni, and Dan Robinson. 2024.Succinct network: Prove the world’s software.https://resources.cryptocompare.com/asset-management/20420/ 1754473565450.pdf

2024
[40]

2026.Blocks Are Dead

Toni Wahrst¨ atter. 2026.Blocks Are Dead. Long Live Blobs.https://ethresear.ch/t/ blocks-are-dead-long-live-blobs/24611

2026
[41]

2026.MEV-Boost Dashboard.https://mevboost.pics/

Toni Wahrst¨ atter. 2026.MEV-Boost Dashboard.https://mevboost.pics/

2026
[42]

Wenhao Wang, Lulu Zhou, Aviv Yaish, Fan Zhang, Ben Fisch, and Benjamin Livshits. 2025. Prooφ: A ZKP Market Mechanism. InInternational Conference on Financial Cryptography and Data Security. Springer, 180–196

2025
[43]

Makoto Yokoo, Yuko Sakurai, and Shigeo Matsubara. 2004. The effect of false-name bids in combinatorial auctions: New fraud in Internet auctions.Games and Economic Behavior46, 1 (2004), 174–188

2004
[44]

2025.Boundless Whitepaper.https://read.boundless.network/

RISC Zero. 2025.Boundless Whitepaper.https://read.boundless.network/

2025
[45]

ZKsync. 2025.Airbender enters the Ethproofs leaderboard as the fastest zkVM.https: //x.com/zksync/status/1983243385147146291 25 A Section 3 Appendices A.1 Expanded form of(PROG1) It is helpful to consider the protocol objective (PROG1) as a two-layer optimization. Once the equilibrium vectorsis set, then the minimal protocol loss (encoded as payments made...

work page arXiv 2025
[46]

+ε ′a−1 ≥ C+a 1 +ε ′ = C+a 1 + 1+a C+a = (C+a) 2 C+ 2a+ 1

Plugging in the designated valueε ′ = 1+a C+a to (9), we get C= C+a 1 +ε ′ +. . .+ε ′a−1 ≥ C+a 1 +ε ′ = C+a 1 + 1+a C+a = (C+a) 2 C+ 2a+ 1 . The inequality is true for allC > a 2. Now observe that the RHS of (9) is strictly decreasing inε, and we confirmed that evaluating it atε ′ resulted in a value that was less thanC. The optimal symmetric equilibrium ...