arXiv CSopen access

Scarcity Is Not Enough: An Impossibility Result for Linear Sybil Cost Under Parallelizable Resources

1

Scarcity Is Not Enough: An Impossibility Result for Linear Sybil Cost Under Parallelizable Resources arXiv:2605.29651v1 [cs.CR] 28 May 2026

Homayoun Maleki, Nekane Sainz, Jon Legarda, and Igor Santos-Grueiro

✦

Abstract—Permissionless systems resist Sybil attacks by binding influence to scarce resources. We show that scarcity alone is insufficient: the structural properties of the resource determine whether influence can be concentrated at sublinear cost—whether through identity replication, delegation, or pooling. We model this through the adversarial cost C(s, T ): the minimum expenditure required to achieve influence proportional to s independent participation units over T windows. We prove that any resource satisfying divisibility, additivity of influence, temporal reusability, and identity transferability admits influence amortization: C(s, T ) = o(sT ), regardless of protocol design. This is an impossibility result—no protocol rule can enforce linear cost of influence concentration over a structurally parallelizable resource. We further prove that throughput-bounded, non-transferable, window-local resources enforce C(s, T ) = Ω(sT ): each additional unit of sustained influence incurs marginal cost ∆(s, T ) = Ω(T ), growing with the time horizon. The two resource classes are asymptotically separated. As a direct design consequence, any mechanism targeting linear cost of influence concentration must ground participation in a resource that violates at least one parallelizability property. Index Terms—Sybil resistance, influence concentration, parallelizable resources, throughput-bounded resources, adversarial cost scaling, structural impossibility, permissionless systems

1

I NTRODUCTION

Permissionless systems rest on a radical premise: that open participation, without gatekeepers or trusted authorities, can produce secure and fair collective outcomes. The mechanism that makes this possible—binding influence to the expenditure of a scarce resource—has been the cornerstone of distributed consensus since Nakamoto [1]. Yet deployment has revealed a persistent gap between this promise and reality. Bitcoin’s hash power is concentrated in a handful of mining pools [2]. Ethereum’s stake is dominated by a small number of liquid staking providers [3]. This paper identifies the structural reason why. • •

H. Maleki, N. Sainz, and J. Legarda are with DeustoTech, University of Deusto, Bilbao, Spain. E-mail: [email protected] I. Santos-Grueiro is with the International University of La Rioja (UNIR), Logroño, Spain.

1.1 Resource-Based Defenses and Their Shared Blind Spot The foundational obstacle in permissionless systems is the Sybil attack [4]: a single adversary generates many identities to amplify influence beyond any honest participant. The standard response is to make identity costly by tying participation to a scarce resource. Proof-of-Work binds influence to computational effort [1], [5]. Proof-of-Stake binds it to financial capital [6]. Graph-based defenses [7], [8] constrain identity placement via social structure. Identity-binding mechanisms [9], [10] restrict credential issuance to verified participants. Despite their diversity, these approaches share a common blind spot. The original insight behind resourceweighted participation—introduced by Proof-of-Work— was precise: binding influence to a scarce resource prevents cheap identity creation from amplifying adversarial power. Subsequent work has studied this principle extensively, asking whether an adversary’s aggregate resource share crosses a safety threshold. What has received far less attention is a different question: does the structure of that resource permit influence to be concentrated at sublinear cost? A resource that is divisible, transferable, and reusable allows a fixed base to be redistributed—through identity replication, delegation, or pooling—achieving disproportionate influence without proportional expenditure, even when aggregate resource share remains unchanged. This paper characterizes exactly which resource properties permit this concentration, and which ones prevent it. 1.2

Why Concentration Is Structurally Inevitable

The concentration patterns observed across deployed systems are not protocol failures. They are structural consequences of the resources those protocols are built on. In Bitcoin, mining pools aggregate hash power from thousands of participants into a small number of coordinated identities. Gencer et al. [2] document that the topfour pools routinely control over fifty percent of total hash power. The reason is structural: computational capacity is

2

divisible, transferable, and temporally reusable—properties that allow a fixed resource base to be aggregated, redistributed, and reused across arbitrarily many identities at vanishing marginal cost [11], [12]. Moreover, influence is additive: distributing r across k identities preserves total influence, P f (r ) = f (r), so redistribution incurs no penalty. i i Proof-of-Stake replaced computational effort with financial capital, eliminating PoW’s energy cost. But the structure of the underlying resource is identical in the relevant sense: capital is divisible, transferable, temporally reusable, and additive in influence. Delegation mechanisms allow a fixed capital base to be distributed across many validator identities, each carrying proportional influence [6], [13]. The outcome is familiar: as of 2023, Lido Finance alone controlled approximately thirty percent of all staked ETH [3]. The same structural argument applies to every resource that can be subdivided and reused across identities. The pattern is not a coincidence. When a resource satisfies all four properties, a fixed base can be aggregated and redistributed across arbitrarily many identities—amplifying network presence, proposal bandwidth, and committee weight without proportional expenditure. The concentration of power is not an externality. It is built into the resource. 1.3

The Missing Question

The observation above points to a question existing analyses do not answer: What structural properties of a security resource guarantee that no adversary can achieve s-unit influence over T windows at cost below Ω(sT )? We formalize this through C(s, T ): the minimum expenditure required to achieve influence proportional to s independent participation units over T consecutive windows— whether through identity replication, delegation, or pooling. Two regimes matter. If C(s, T ) = o(sT ), a fixed resource base suffices to achieve arbitrarily large influence— concentration is cheap regardless of protocol design. If C(s, T ) = Ω(sT ), each additional unit of sustained influence requires proportional expenditure— concentration is structurally infeasible. The answer, we show, is determined entirely by the structure of the underlying resource. No protocol rule can enforce C(s, T ) = Ω(sT ) when the resource itself is divisible, transferable, temporally reusable, and additive in influence. This is an impossibility result. It holds independently of consensus design, cryptographic assumptions, or network model. But impossibility alone is not enough. The second result of this paper is constructive: we identify a class of resources—throughput-bounded, non-transferable, and window-local—that provably enforces C(s, T ) = Ω(sT ). This resource class has not been formally characterized in prior work. Beyond its theoretical significance, this characterization is actionable: Any consensus protocol grounded in a throughput-bounded, non-transferable, and window-local resource inherits C(s, T ) = Ω(sT ) by construction, without additional protocol-level enforcement. Introducing this class, and proving its properties, is the central contribution of this paper.

1.4

This Paper

This paper draws a structural boundary in the design space of permissionless systems and introduces a resource class that sits on the right side of it. We prove that any resource satisfying four properties— divisibility, additivity of influence, temporal reusability, and identity transferability—admits influence amortization: C(s, T ) = o(sT ), regardless of protocol design. Computation, capital, storage, and delegated stake all fall into this class. No mechanism built on such a resource can enforce linear cost of influence concentration. We then introduce throughput-bounded resources: resources in which each participation unit requires an independent channel, the channel output is non-transferable, and allocation does not carry over across time windows. We prove that any such resource enforces C(s, T ) = Ω(sT ): each additional unit of sustained influence incurs marginal cost ∆(s, T ) = Ω(T ), growing with the time horizon. Concentration of influence is structurally infeasible by construction. Together, these two results establish a sharp asymptotic separation: parallelizable resources admit influence concentration at vanishing marginal cost; throughput-bounded resources structurally preclude it. The separation between these two classes yields a direct design rule—the Resource Substitution Principle: enforcing linear cost of influence concentration requires grounding participation in a resource that violates at least one parallelizability property. Protocol design cannot substitute for resource structure. 1.5

Contributions 1)

2)

3)

1.6

Impossibility under parallelizable resources (Theorem 5.4). Any mechanism whose weighting resource satisfies divisibility, additivity, temporal reusability, and identity transferability satisfies C(s, T ) = o(sT ), regardless of protocol design. Influence concentration is achievable at vanishing marginal cost. Linear cost of influence concentration under throughput-bounded resources (Theorem 6.2). We introduce the class of throughput-bounded, nontransferable, window-local resources and prove that any such resource enforces C(s, T ) = Ω(sT ), with marginal cost ∆(s, T ) = Ω(T ). Resource Substitution Principle (Theorem 7.2). Linear cost of influence concentration requires violating at least one parallelizability property. No protocol can enforce this boundary without a structural change in the underlying resource. Paper Organization

Section 2 reviews related work. Section 3 presents the system model. Section 4 develops the resource framework. Section 5 proves the impossibility result. Section 6 proves the linear lower bound. Section 7 establishes the structural separation, the Resource Substitution Principle, and hybrid system behavior. Section 8 classifies concrete resource types. Section 9 presents the evaluation. Section 10 discusses limitations. Section 11 concludes.

3

2

R ELATED W ORK

Prior work on Sybil resistance and permissionless systems addresses several distinct security questions. We survey the main research directions and identify the gap this paper fills. Table 1 summarizes the distinction.

These analyses model adversarial capability in terms of aggregate resource ownership and study equilibrium incentives or corruption costs. They do not study whether influence can be concentrated at sublinear cost through delegation or pooling—the question central to this paper.

2.1

2.4

Resource-Based Sybil Defenses

Douceur [4] established that in the absence of a trusted authority, identity replication in open systems cannot be prevented. Nakamoto [1] proposed binding participation to a scarce resource—computational effort—as a practical response to this impossibility. Formal analyses of Nakamoto-style consensus [5], [14]–[16] establish chaingrowth, common-prefix, and chain-quality guarantees expressed as thresholds on adversarial hash power. Proof-ofStake protocols—including Ouroboros [6], [17], [18], Snow White [19], and Algorand [20]—replace computational effort with financial capital and derive analogous guarantees as thresholds on adversarial stake. These protocols collectively instantiate the aggregate-threshold adversarial model formalized in foundational Byzantine fault-tolerance work [21], [22]; Algorand additionally employs verifiable random functions [23] for committee selection. These analyses consistently reason about aggregate adversarial resource ownership. Security guarantees take the form: if the adversary controls less than a threshold fraction of the total resource, the protocol is safe. They do not characterize whether a fixed resource base can be used to concentrate influence at sublinear marginal cost. The present paper addresses this question directly. 2.2

Empirical and Systems-Level Analyses

Empirical work documents the centralization patterns that resource-based mechanisms produce in practice. Gencer et al. [2] measure mining pool concentration in Bitcoin and Ethereum. Rosenfeld [11], [24] analyzes pooled mining reward systems and hash-rate-based double-spending dynamics. Bonneau et al. [12] and Narayanan et al. [25] survey the broader security and deployment landscape of Bitcoin. Gervais et al. [26], [27] quantify security-performance tradeoffs and decentralization properties of deployed proof-ofwork systems. Work on selfish mining [28] and doublespending [29] analyzes adversarial strategies under aggregate resource models. Network-layer studies [30] document how propagation dynamics interact with pool-driven resource concentration. These works describe the symptoms of structural resource properties—concentration, pooling, delegation— but do not formally characterize why such patterns are structurally inevitable under divisible, reusable resources. The present paper provides this characterization. 2.3

Economic Analyses of Consensus

Budish [31] and Budish et al. [32] analyze the economic limits of permissionless consensus, framing security in terms of the cost of mounting a majority attack. Carlsten et al. [33] study incentive stability in the absence of block rewards. Saleh [13] provides an equilibrium analysis of Proof-ofStake.

Graph-Based and Social-Structure Defenses

SybilGuard [7], SybilLimit [8], and SybilControl [34] bound adversarial influence by exploiting the observation that in social networks, the number of edges between honest and Sybil regions is small relative to internal connectivity. SybilInfer [35] applies probabilistic inference over trust graphs to identify adversarial clusters. Game-theoretic analyses [36] study equilibrium conditions under which honest participants can deter adversarial identity creation. These approaches address a different question: where Sybil identities can be placed within a social graph, rather than how the cost of adversarial influence scales over time. They provide no characterization of C(s, T ) as s or T grows, and their guarantees depend on graph-topology assumptions that may not hold in practice [37]. 2.5

Identity-Binding Mechanisms

Proof-of-Personhood [9] and pseudonym parties [10] bind credentials to real-world participants to enforce one-person– one-identity mappings. Reputation systems [38] offer a related but distinct approach: rather than binding participation to verified identity, they tie influence to accumulated behavioral history. These mechanisms address admission— restricting the creation of new identities—rather than the sustained cost of concentrating influence over time. Once admitted, influence may still be governed by a transferable, reusable resource. 2.6

Capability and Rate-Limiting Architectures

Hardware-rooted execution environments such as Intel SGX [39] enforce per-device participation limits that bind resource generation to specific hardware. Capability-based systems [40] and congestion-control mechanisms [41] impose per-actor throughput constraints in different deployment contexts. Bitcoin-NG [42] decouples block leadership from transaction throughput, instantiating a per-leader rate constraint as a protocol-level primitive. HoneyBadger BFT [43] makes explicit throughput bounds central to its communication complexity analysis. Alwen et al. [44] study sustained space and time complexity of sequential proof-ofwork constructions. These works impose per-actor throughput constraints but analyze them in the context of access control, network stability, or computational hardness—not the cost of influence concentration. They do not establish the structural separation between parallelizable and throughput-bounded resource classes that this paper proves. 2.7

Positioning

The common thread across prior work is a focus on aggregate adversarial capability: how much resource does an adversary control, and is it below a safety threshold? No prior

4

work asks whether a fixed aggregate resource can be used to concentrate influence at sublinear marginal cost—whether through identity replication, delegation, or pooling—nor establishes the structural conditions under which this is or is not possible. This paper provides that characterization. We identify the structural properties that determine whether adversarial cost scales as o(sT ) or Ω(sT ), establish an impossibility result for parallelizable resources, introduce the throughputbounded resource class and prove its linear cost guarantee, and derive a design principle for systems requiring linear cost of influence concentration.

3

S YSTEM M ODEL

We model an open and permissionless system in which identity creation is inexpensive and no admission authority exists. Influence is regulated by a security-weighting resource R. Our objective is to characterize how structural properties of R determine whether influence can be concentrated at sublinear cost—whether through identity replication, delegation, or pooling. Table 2 summarizes the core notation. 3.1

Identities and Participation

In permissionless systems, an identity is a cryptographic key pair that authorizes participation. A single real-world entity may control arbitrarily many key pairs, and therefore arbitrarily many identities, at negligible cost [4]. Influence concentration may therefore arise either through identity replication—controlling many key pairs each with unit weight—or through resource aggregation—controlling few key pairs but delegating or pooling sufficient resource to achieve equivalent aggregate influence. The model captures both mechanisms uniformly. Let U denote the universe of potential participants. At each time window t, the system contains a set of active identities Vt ⊆ U . An adversary A is identity-unbounded: it may create, retire, and coordinate an arbitrary number of identities at negligible syntactic cost. Let St ⊆ Vt denote the set of identities controlled by A at window t, with |St | = st . No a priori bound is placed on st .

where f : R≥0 → R≥0 is the protocol’s resource-to-influence function. No structural assumptions are placed on f at this stage; these will be derived from properties of R in Section 4. The total adversarial influence at window t is X Wv (t). (2) WA (t) = v∈St

Definition 3.1 (Activation Threshold). There exists a constant rmin > 0 such that an identity is active in window t only if rv (t) ≥ rmin . Remark 3.1 (Structural interpretation of rmin ). rmin is a structural property of the resource deployment, not a free protocol parameter. In Proof-of-Work, it corresponds to the minimum computational contribution required to produce a valid share within a window—a constraint of the hardware and difficulty setting. In device-bound execution, it is the minimum attestation output a device must generate to register as active. A protocol setting rmin = 0 admits zero-resource identities, which produce zero influence (f (0) = 0) and contribute nothing to WA (t); this is a degenerate case outside the model scope. For deployments where rmin is design-dependent, Theorem 6.2 gives a lower bound parameterized by the deployment’s participation floor: C(s, T ) ≥ s · T · rmin holds for any fixed rmin > 0 and is non-vacuous whenever a positive participation threshold is enforced. The activation threshold establishes a per-identity, perwindow resource floor that is unavoidable regardless of resource structure. The structural results of this paper concern costs beyond this floor: whether a resource imposes an additional T -scaling cost per unit of sustained influence, or whether temporal reusability eliminates it. 3.4

Adversarial Model

The adversary A is computationally unbounded but constrained by the structural properties of R. Specifically, A may: • • •

3.2

Time Model •

instantiate, retire, and coordinate an arbitrary number of identities; allocate and reallocate resource across identities when the resource structure permits; reuse resource across time windows when temporal reuse is allowed; aggregate influence through delegation or pooling when the resource structure permits.

Time proceeds in discrete windows t = 1, 2, . . . A window represents the minimal interval over which resource allocation and influence are refreshed—for example, a block interval or governance epoch. We evaluate security over a finite horizon of T windows. An identity is sustained if it remains active throughout all windows t = 1, . . . , T .

This model subsumes the aggregate-resource adversaries used in blockchain consensus analyses [5], [6] while remaining protocol-agnostic. The adversary’s only binding constraint is the structural properties of R, formalized in Section 4.

3.3

3.5

Resource and Influence

Let R denote the security-weighting resource. For each identity v ∈ Vt and window t, let rv (t) ∈ R≥0 denote the resource allocated to v . Influence is determined by a mapping
Wv (t) = f rv (t) , (1)

Adversarial Cost

Definition 3.2 (Adversarial Cost Function). Let RA (t) = P r (t) denote the total resource expenditure of A at window v v∈St t, and let Wunit = f (rmin ) denote the influence of an identity operating at the activation threshold. C(s, T ) denotes the minimum total resource expenditure required to achieve influence

5

TABLE 1 Positioning of This Work Relative to Prior Literature

Research Line

Representative Works

Primary Security Question

Influence Concentration Cost?

Sybil attack literature

[4], [7], [8], [35]

Can adversaries create multiple identities, and how can identity creation be restricted or detected?

No

Blockchain consensus security

[5], [6], [14], [20]–[22]

Under what aggregate adversarial resource ownership do safety and liveness properties fail?

No

Economic analyses of consensus

[29], [31], [32]

What equilibrium incentives and corruption costs arise in resourceweighted consensus?

No

Graph-based defenses

[7], [8], [35]

Can Sybil proliferation be constrained via social-network structure?

No

Identity-binding mechanisms

[9], [10]

How can systems enforce oneperson–one-identity mappings?

No

Capability / rate-limiting architectures

[39]–[41]

Can per-actor throughput limits be enforced at the system level?

No

This paper

—

How do structural properties of security resources determine whether influence can be concentrated at sublinear cost?

Yes

proportional to s independent participation units over T consecutive windows—whether through sustaining s active identities, delegating to s validators, pooling toward equivalent aggregate weight, or any combination thereof: ( T ) X WA (t) ≥ s · Wunit C(s, T ) = inf RA (t) . (3) ∀ t ∈ {1, . . . , T } t=1 This definition captures influence concentration in full generality: the adversary may achieve influence proportional to s units through any combination of identity replication, resource delegation, or pooling, whichever minimizes total expenditure. To expose the structure of costs, we decompose C(s, T ) as C(s, T ) = Cstock (s) + Cflow (s, T ) + h(s, T ), (4) where Cstock (s) is the one-time acquisition cost of resources that persist across all T windows without renewal (e.g., staked capital, hardware); Cflow (s, T ) is the cumulative perwindow expenditure for resources that must be renewed each window (e.g., energy, device attestations); and h(s, T ) is the coordination overhead of managing s participation units over T windows. The structural separation of Sections 5–6 concerns the scaling of Cflow (s, T ): parallelizable resources admit Cflow (s, T ) = 0 once stock is acquired, whereas throughputbounded resources enforce Cflow (s, T ) = Ω(sT ). Assumption 3.3 (Amortized Coordination). The coordination overhead satisfies h(s, T ) = o(sT ). This assumption captures the empirically observed behavior of pooling and delegation infrastructure: mining pools, validator delegation services, and cloud-managed multi-account orchestration each allow an operator to manage many participation units with overhead scaling as

O(s + T ) rather than O(sT ) [11]–[13]. Assumption 3.3 is an environmental condition on coordination infrastructure, not a property of R; the two are independent. Theorem 5.4 holds even when h(s, T ) = 0, and Theorem 6.2 holds regardless of how small h(s, T ) is. Remark 3.2 (Boundary case: h(s, T ) = Ω(sT )). Assumption 3.3 characterizes the adversarially favorable regime in which coordination is cheap. If h(s, T ) = Ω(sT )— for example, because managing s independent identities requires Ω(sT ) communication or operational effort—then C(s, T ) ≥ h(s, T ) = Ω(sT ) holds immediately, independently of resource structure. In this case the adversary already faces linear cost from coordination alone. Theorem 5.4 therefore establishes the worst case for the defender: even when coordination overhead is asymptotically free, a parallelizable resource admits C(s, T ) = o(sT ). When coordination is not free, the adversary’s position is no better. 3.6

Scaling Regimes

Two asymptotic regimes characterize the adversarial cost function. Definition 3.4 (Scaling Regimes). A mechanism exhibits sublinear scaling if C(s, T ) = o(sT ), and linear scaling if C(s, T ) = Ω(sT ). Under sublinear scaling, the marginal cost of each additional unit of sustained influence does not grow with the time horizon: ∆(s, T ) = o(T ), where ∆(s, T ) = C(s, T ) − C(s − 1, T ). A fixed resource base suffices to achieve arbitrarily large influence—concentration is cheap regardless of protocol design. Under linear scaling, each additional unit of sustained influence incurs cost at least Ω(T ), growing with the time horizon. Achieving influence proportional to s units over

6

TABLE 2 Core Notation Symbol

Meaning

v t T s rv (t) RA (t) Wv (t) Wunit f (·) St C(s, T ) ∆(s, T ) rmin τ h(s, T )

Identity (key pair / participant instance) Time window index Time horizon (number of windows) Number of independent participation units Resource allocated to identity v at window t P Total adversarial resource at window t: v∈St rv (t) Influence of identity v at window t Baseline influence: f (rmin ) Resource-to-influence mapping Set of adversarial identities at window t Min. cost to achieve s-unit influence over T windows Marginal cost: C(s, T ) − C(s − 1, T ) Activation threshold Per-channel throughput bound Coordination overhead

T windows costs at least Ω(sT ) regardless of how the adversary distributes its resource. The central question of this paper is: which regime does a given resource R induce? Section 4 provides the structural answer.

Remark 4.1 (Scope of Additivity). Definition 4.2 is a property of the mechanism’s influence function f , not of the resource in isolation. It characterizes mechanisms in which influence aggregates proportionally with resource allocation. This class includes Proof-of-Work (block-production probability proportional to hash power), linear Proof-of-Stake (voting weight proportional to staked capital), and most deployed committee-weight and reputation-score protocols. Mechanisms deliberately designed to penalize √ concentration— such as quadratic voting, where f (r) = r—do not satisfy Definition 4.2 and fall outside the scope of Theorem 5.4. The theorem applies precisely to the broad class of deployed mechanisms where influence scales with aggregate resource share. Definition 4.3 (Temporal Reusability). R is temporally reusable if an allocation obtained in window t may be applied in window t + 1 without renewed identity-bound expenditure. Definition 4.4 (Identity Transferability). R is identitytransferable if an allocation rv (t) assigned to identity v may be reassigned to any other identity v ′ without proportional cost. Definition 4.5 (Throughput-Bounded Resource). R is throughput-bounded if each identity v is associated with a dedicated participation channel Cv satisfying all three of the following conditions: 1)

4

R ESOURCE F RAMEWORK

We develop an axiomatic framework for security-weighting resources. Rather than analyzing specific protocols, we characterize resources by their structural properties—the constraints they impose on division, aggregation, reuse, and transfer across identities and time. These properties, not protocol design, determine whether influence concentration is achievable at sublinear cost. 4.1

Resource as a Structural Object

A security-weighting resource R is a quantity that can be allocated across identities, evolves across time windows, and determines influence through the mapping f of Section 3. The analysis is agnostic to the semantic nature of R— whether it is computation, capital, storage, or participation time. What matters are the structural properties governing how R behaves under partition, aggregation, temporal reuse, and identity transfer.

2) 3)

The three conditions of Definition 4.5 jointly imply that each active identity requires an independent participation channel whose capacity cannot be shared, pooled, or carried forward across identities or time. Scaling the number of active identities therefore requires provisioning additional independent channels. Note that τ and rmin are independent parameters: rmin is the minimum resource required for an identity to be active, while τ bounds the maximum. For the system to admit active identities, we require 0 < rmin ≤ τ . The linear lower bound of Theorem 6.2 holds for any such configuration and is tightest when rmin = τ . 4.3

4.2

Structural Properties

Definition 4.1 (Divisibility). R is divisible if for any allocation r ≥ 0 and integer k ≥ 1, there exist r1 , . . . , rk ≥ 0 with Pk i=1 ri = r , and the adversary may distribute ri to identity i without additional structural cost. Definition 4.2 (Additivity of Influence). A mechanism induces additive influence if   X X
f rv (t) = f  rv (t) . (5) v∈St

v∈St

Total influence depends only on aggregate allocation, not on how it is partitioned across identities.

Per-channel rate limit. There exists τ > 0 such that rv (t) ≤ τ for all v and t. Non-transferability. The allocation rv (t) cannot be simultaneously credited to any other identity v ′ ̸= v . Window-locality. Allocation in window t does not carry over to window t + 1; sustained participation requires renewed expenditure in every window.

Resource Classes

Definition 4.6 (Parallelizable Resource). R is parallelizable if it satisfies Definitions 4.1, 4.3, and 4.4 (divisibility, temporal reusability, and identity transferability), and the induced mechanism satisfies Definition 4.2 (additivity of influence). Definition 4.7 (Throughput-Bounded Non-Parallelizable Resource). R is a throughput-bounded non-parallelizable resource if it satisfies Definition 4.5. The following proposition shows that parallelizable resources render influence invariant to identity partitioning— the formal basis of influence amortization. Proposition 4.8 (Identity Partition Invariance).PIf R is parallelizable, then for any aggregate allocation r = v∈St rv (t),

7

total adversarial influence satisfies WA (t) = f (r), independently of how r is partitioned across identities.

Lemma 5.3 (Marginal Cost Collapse). Let R be parallelizable. Under Assumption 3.3,

Proof. By divisibility, r may P P be partitioned arbitrarily. By additivity, v f (rv ) = f ( v rv ) = f (r). By identity transferability, any reallocation of r across identities leaves WA (t) unchanged. By temporal reusability, r acquired in window t persists without renewal. Hence WA (t) = f (r) depends only on aggregate ownership.

C(s, T ) → 0 as s, T → ∞, sT

4.4

Resource Taxonomy

Table 3 classifies representative resource types by the structural properties they satisfy. Proof-of-Work is decomposed into its capacity component (mining hardware: parallelizable stock) and its operational component (energy: windowlocal flow). The theorems of this paper apply to each component separately; the full economic cost of PoW mining involves both.

(7)

and the marginal cost satisfies ∆(s, T ) = O(1) = o(T ). Proof. By the activation threshold (Definition 3.1), sustaining influence proportional to s units requires aggregate allocation at least r ≥ s · rmin . For a parallelizable resource, the adversary acquires this aggregate once: by Lemma 5.2, the allocation r = s · rmin suffices for all T windows without renewed expenditure. By Lemma 5.1, r is then partitioned across s identities without loss of total influence. Hence the total adversarial cost satisfies

C(s, T ) ≤ s · rmin + h(s, T ).

(8)

Under Assumption 3.3, h(s, T ) = o(sT ), so

5

I MPOSSIBILITY U NDER PARALLELIZABLE R E C(s, T ) rmin h(s, T ) ≤ + → 0 sT T sT

SOURCES

We prove that no protocol grounded in a parallelizable resource can enforce linear cost of influence concentration. The result is independent of protocol design, cryptographic assumptions, and network model: it follows from the structural properties of the resource alone. 5.1

Marginal Influence Cost

∆(s, T ) = C(s, T ) − C(s − 1, T ).

which is o(T ).

5.3

Main Result

Theorem 5.4 (Impossibility of Linear Influence Cost). Let R be a parallelizable resource. Under Assumption 3.3, any mechanism grounded in R satisfies

C(s, T ) = o(sT ),

Supporting Lemmas

Lemma 5.1 (Identity Partition Invariance). Let R be divisible and let the induced mechanism be additive in influence. For any aggregate allocation r ≥ 0 and any integer s ≥ 1, the adversary can distribute r across s identities such that s s X X f (rv ) = f (r) and rv = r. v=1

(10)

(6)

A resource admits influence amortization if ∆(s, T ) = o(T ): the marginal cost does not grow with the time horizon. We show that every parallelizable resource satisfies this condition, and in fact satisfies the stronger bound ∆(s, T ) = O(1). 5.2

as s, T → ∞, since the first term vanishes as T → ∞ and the second by assumption. For the marginal cost,

∆(s, T ) = C(s, T ) − C(s − 1, T )   ≤ rmin + h(s, T ) − h(s − 1, T ) = O(1),

The marginal cost of achieving one additional unit of sustained influence is

(9)

(11)

regardless of protocol design. In particular, ∆(s, T ) = O(1) = o(T ): the marginal cost of influence concentration does not grow with the time horizon. Proof. Follows directly from Lemma 5.3.

v=1

In particular, total adversarial influence is invariant to identity partitioning. Proof. By into r1 ,P . . . , rs ≥ Pdivisibility, r may be partitioned P 0 with v rv = r. By additivity, v f (rv ) = f ( v rv ) = f (r). Lemma 5.2 (Cross-Window Reuse). If R is temporally reusable, an allocation r obtained in window t may be applied in all subsequent windows t + 1, . . . , T without additional expenditure. Proof. Immediate from Definition 4.3.

Theorem 5.4 is an impossibility result in the following sense: no choice of protocol rules, consensus mechanism, or cryptographic construction can enforce C(s, T ) = Ω(sT ) when the underlying resource is parallelizable. The barrier is structural, not algorithmic. Any adversary with access to a parallelizable resource of aggregate size s · rmin can sustain s-unit influence over an arbitrarily long horizon T at cost growing only as O(s)—independent of T . Note that Assumption 3.3 is used only to bound the coordination term h(s, T ). The core conclusion—that Cflow (s, T ) = 0 for a parallelizable resource—holds even when h(s, T ) = 0: temporal reusability alone eliminates perwindow renewal cost once the stock is acquired.

8

TABLE 3 Structural Taxonomy of Security Resources. PoW is decomposed into its capacity component (hardware: parallelizable) and operational component (energy: non-reusable flow). Theorems 5.4 and 6.2 apply to each component separately. The Add. column indicates whether the mechanism grounded in each resource class induces additive influence in the sense of Definition 4.2. Resource

Div.

Add.

Reuse

Transfer

Notes

Scaling

PoW: hardware (capacity)

✓

✓

✓

✓

Parallelizable stock; mining pools instantiate amortization

o(sT )

PoW: energy (operational)

✓

✓

×

✓

Window-local flow; must be renewed each block interval

Linear in T †

Financial stake (PoS)

✓

✓

✓

✓

Parallelizable stock; delegation markets instantiate amortization

o(sT )

Social-graph trust

Partial

Partial

Partial

Partial

Guarantees depend on graph topology; no explicit C(s, T ) bound

Model-dependent

Device-bound execution

×

×

×

×

Each device constitutes one independent channel per window

Ω(sT )

Human real-time participation

×

×

×

×

Cognitive and temporal throughput limits bound channel capacity

Ω(sT )

Rate-limited participation‡

×

×

×

×

Qualifies only when bound to non-transferable execution channels

Ω(sT )

†

Energy is non-reusable (window-local) but transferable across identities; it falls outside the

parallelizable class of Theorem 5.4, which applies only to the hardware component. ‡ Account-level rate limits without channel binding are bypassable through identity replication.

6 L INEAR L OWER B OUND U NDER T HROUGHPUTB OUNDED R ESOURCES We prove the complementary result: throughput-bounded, non-transferable, window-local resources structurally enforce C(s, T ) = Ω(sT ). In contrast to parallelizable resources, where influence can be amortized across identities and time, throughput-bounded resources require independent participation capacity per identity per window. Scaling the number of active identities therefore requires proportionally increasing recurring expenditure. 6.1

6.2

Main Result

Theorem 6.2 (Linear Lower Bound). Let R be throughputbounded, non-transferable, and window-local. Then there exists c > 0 such that

C(s, T ) ≥ c · sT,

(15)

and in particular C(s, T ) = Ω(sT ). The marginal cost satisfies ∆(s, T ) ≥ rmin · T = Ω(T ). Proof. Set c = rmin . From Lemma 6.1, ∆(s, T ) ≥ rmin · T for all s ≥ 1. Summing over s participation units:

Supporting Lemma

Lemma 6.1 (Positive Marginal Cost). Let R be throughputbounded, non-transferable, and window-local. Then for all s ≥ 1 and T ≥ 1, ∆(s, T ) ≥ rmin · T. (12) Proof. To sustain influence proportional to s units over T windows, each of the s participation units requires rv (t) ≥ rmin in every window t (Definition 3.1). By nontransferability (condition 2 of Definition 4.5), the allocation for one identity cannot be credited to another, so sustaining s units requires total expenditure at least s·rmin per window. By window-locality (condition 3), this expenditure must be renewed in every window; it cannot carry forward from window t to t + 1. Therefore,

C(s, T ) ≥

T X

s · rmin = s · T · rmin .

(13)

t=1

Similarly, C(s − 1, T ) ≤ (s − 1) · T · rmin in the best case, so

∆(s, T ) = C(s, T ) − C(s − 1, T ) ≥ s · T · rmin − (s − 1) · T · rmin = rmin · T. (14)

C(s, T ) =

s X i=1

∆(i, T ) ≥

s X

rmin · T = s · T · rmin = c · sT.

i=1

(16)

Hence C(s, T ) = Ω(sT ) and ∆(s, T ) = Ω(T ). The bound C(s, T ) ≥ s · T · rmin is tight: setting rv (t) = rmin for all v and t achieves C(s, T ) = s · T · rmin exactly, so the lower bound matches the minimum achievable cost. Theorem 6.2 holds independently of Assumption 3.3: the linear lower bound follows from the structural properties of R alone, regardless of how small h(s, T ) is. Contrast with Theorem 5.4. The separation between the two resource classes is sharpest at the level of marginal cost: Parallelizable: ∆(s, T ) = O(1), Throughput-bounded: ∆(s, T ) = Ω(T ).

(17)

Under parallelizable resources, each additional unit of sustained influence becomes asymptotically free as the time horizon grows. Under throughput-bounded resources, each additional unit costs at least rmin · T —growing linearly with the horizon.

9

7

S TRUCTURAL S EPARATION AND D ESIGN C ON -

SEQUENCES

Theorems 5.4 and 6.2 establish bounds on C(s, T ) for each resource class separately. We now combine them into a single separation result and derive its design consequences. 7.1

Structural Separation

Theorem 7.1 (Structural Separation). Let R be a securityweighting resource. 1) 2)

If R is parallelizable, then C(s, T ) = o(sT ). If R is throughput-bounded, non-transferable, and window-local, then C(s, T ) = Ω(sT ).

The two resource classes induce asymptotically disjoint scaling regimes: no resource can simultaneously satisfy both. Proof. Part (1) is Theorem 5.4. Part (2) is Theorem 6.2. Since o(sT ) and Ω(sT ) are asymptotically disjoint, no mechanism can exhibit both regimes. 7.2

Resource Substitution Principle

Theorem 7.1 yields a direct design constraint. Theorem 7.2 (Resource Substitution Principle). Any mechanism targeting C(s, T ) = Ω(sT ) must ground participation in a resource that violates at least one of the following properties: divisibility, additivity of influence, temporal reusability, identity transferability. Proof. Suppose for contradiction that the underlying resource satisfies all four properties. Then it is parallelizable (Definition 4.6), and Theorem 5.4 gives C(s, T ) = o(sT ), contradicting the assumption that C(s, T ) = Ω(sT ). Corollary 7.3. Protocol rules alone cannot enforce C(s, T ) = Ω(sT ) when the underlying resource is parallelizable. Linear cost of influence concentration requires a structural change in the resource, not a redesign of the protocol. The Resource Substitution Principle is the central design consequence of this work: the boundary between amortizable and non-amortizable influence regimes is a property of the resource class, not of protocol design. 7.3

renewal. The adversary must renew every k windows, incurring ⌈T /k⌉ renewal events, so   T . (19) C(s, T ) = Ω s · k This interpolates between linear scaling at k = 1 (windowlocal) and sublinear scaling as k → T (full temporal reuse). Characterizing intermediate regimes in full generality remains an open problem; we return to it in Section 10. 7.4

Hybrid Systems

Real-world systems often combine resource classes. A governance protocol, for example, may allocate voting influence proportionally to financial stake (a parallelizable resource) while constraining proposal submission through per-identity rate limits (a throughput-bounded resource). The following lemma shows that the linear lower bound is preserved whenever a throughput-bounded component is present. Lemma 7.4 (Hybrid Scaling). Let R = (Rp , Rt ) where Rp is parallelizable and Rt is throughput-bounded, non-transferable, and window-local. If adversarial cost decomposes additively as

C(s, T ) = Cp (s, T ) + Ct (s, T ),

(20)

then C(s, T ) = Ω(sT ). Proof. By Theorem 5.4, Cp (s, T ) = o(sT ). By Theorem 6.2, Ct (s, T ) ≥ c · sT for some c > 0. For sufficiently large s, C(s, T ) ≥ Ct (s, T ) ≥ c · sT , giving C(s, T ) = Ω(sT ). Lemma 7.4 has a practical implication: a system designer can enforce linear influence cost by introducing any throughput-bounded participation component, even alongside parallelizable influence mechanisms. The throughputbounded component dominates asymptotically under additive decomposition.

8

I NSTANTIATIONS AND C LASSIFICATION

The structural taxonomy of Table 3 classifies representative resource types by the properties of Definitions 4.1–4.5. This section provides the formal classification argument for peractor throughput channels and walks through the principal instantiations.

Intermediate Regimes

Theorems 5.4 and 6.2 characterize the two extremal resource classes. Real-world mechanisms may satisfy structural properties only partially, yielding scaling behavior that interpolates between the two regimes. Partial transferability. Suppose at most a fraction α ∈ [0, 1] of the aggregate allocation can be reassigned across identities, while the remaining fraction (1 − α) is identity-bound. Then the adversary can amortize only the transferable portion, yielding
C(s, T ) = Ω (1 − α) · sT . (18) The bound tightens as α → 0 (full throughputboundedness) and weakens as α → 1 (full parallelizability). Bounded temporal reuse. Suppose resource allocation persists for at most k consecutive windows before requiring

8.1

Per-Actor Throughput Channels

Several mechanisms naturally ground participation in peractor execution channels: device-bound attestation environments, human interaction tasks, and rate-limited participation protocols with non-transferable channel binding. We formalize the structural classification of this resource class. Definition 8.1 (Per-Actor Throughput Channel). A participation channel Cu associated with actor u is a per-actor throughput channel if there exists τ > 0 such that for every window t, the resource output attributable to u satisfies ratet (Cu ) ≤ τ . Resource allocation for any identity v backed by channel Cu satisfies rv (t) ≤ ratet (Cu ). Theorem 8.2 (Per-Actor Channel Classification). Let R be a resource derived from per-actor throughput channels. Then R

10

satisfies: (1) throughput boundedness, (2) non-transferability, and (3) window-locality. Consequently R belongs to the throughputbounded non-parallelizable class (Definition 4.7), and C(s, T ) = Ω(sT ) by Theorem 6.2. Proof. (1) Throughput boundedness follows from the perchannel rate limit τ of Definition 8.1. (2) Non-transferability holds because resource generation is bound to the actor controlling Cu ; the output of Cu cannot be simultaneously credited to an identity controlled by a different actor. (3) Window-locality holds because each window requires fresh channel output; ratet (Cu ) does not carry over to window t + 1. All three conditions of Definition 4.5 are satisfied. 8.2

Instantiation Walkthrough

Proof-of-Work (hardware component). Mining hardware is divisible, transferable across mining pools, and temporally reusable. Influence is additive: aggregate hash power determines block-production probability independently of identity partitioning. Mining pools empirically instantiate this amortization: the top-four pools routinely control over fifty percent of total hash power [2], [11], consistent with C(s, T ) = o(sT ). Proof-of-Stake (financial capital). Financial capital satisfies the same four properties as PoW hardware: divisible, additive, temporally reusable, and identity-transferable. Delegation mechanisms allow a fixed capital base to be distributed across many validator identities, each carrying proportional influence [6], [13]. As of 2023, Lido Finance alone controlled approximately thirty percent of all staked ETH [3], instantiating the same amortization pattern. Device-bound execution. Trusted execution environments [39] bind activity to specific hardware. Each device constitutes one per-actor throughput channel whose output is non-transferable and must be renewed each window; a single device cannot simultaneously attest for multiple identities. By Theorem 8.2, C(s, T ) = Ω(sT ). Human real-time participation. Human cognition imposes intrinsic per-window throughput limits that cannot be increased by additional computational infrastructure. Sustaining s active identities requires s independent human participants, each constituting one channel; C(s, T ) = Ω(sT ) by Theorem 8.2. Rate-limited network participation. Account-level rate limits qualify as throughput-bounded only when structurally bound to non-transferable execution channels. Limits attached to syntactic identifiers alone are bypassable through identity replication and do not satisfy Definition 4.5. Effective enforcement requires binding rate constraints to independent, non-aggregable participation channels such as device-attested proposal submission. 8.3

Governance Illustration

Consider a governance protocol in which voting influence is proportional to delegated stake—as in DAO-style governance [45]—while proposal submission is subject to a peridentity participation constraint. Without throughput-binding. If submission limits are enforced only at the account level (syntactic identity), an adversary controlling stake r∗ may split it across s accounts

Fig. 1. Total adversarial cost C(s, T ) (left) and normalised ratio C(s, T )/sT (right) vs. s, with T = 100 and rmin = 1.0. The parallelizable ratio decays monotonically toward zero (Theorem 5.4); the throughput-bounded ratio remains fixed at rmin (Theorem 6.2).

while preserving total voting weight. Each account gains independent proposal bandwidth, committee presence, and rate-limited interaction capacity. The adversary achieves sunit influence at cost C(s, T ) = o(sT ) via Theorem 5.4, since the underlying resource (stake) is parallelizable. With throughput-binding. If proposal submission is additionally bound to non-transferable participation channels— for example, device-attested submissions or identity-bound participation windows—then the participation component constitutes a throughput-bounded resource Rt . By Lemma 7.4, the hybrid system enforces C(s, T ) = Ω(sT ): the throughput-bounded component dominates asymptotically, regardless of how parallelizable the influence mechanism is. This illustrates the practical import of Corollary 7.3: the designer need not replace the parallelizable influence mechanism. Introducing any throughput-bounded participation component is sufficient to enforce linear cost of influence concentration.

9

E VALUATION

Note. All figures and tables in this section are direct visualizations of the closed-form cost expressions of Theorems 5.4 and 6.2. They are not empirical measurements of deployed systems. Their purpose is to make the asymptotic separation concrete across representative parameter ranges. We use the following closed-form expressions:

Cpar (s, T ) = s · rmin + h(s, T ), Cbnd (s, T ) = s · T · rmin ,

h(s, T ) = s + T,

(21) (22)

with rmin = 1.0 unless stated otherwise. 9.1

Cost Scaling Analysis

Figure 1 plots total adversarial cost and the normalised ratio C(s, T )/sT against sustained influence units s, for T = 100. Figure 2 fixes s = 10 and varies the time horizon T for three values of rmin . Throughput-bounded cost grows strictly linearly in T for all parameter values; parallelizable cost remains sublinear relative to sT . 9.2

Non-Amplification Under Identity Replication

Figure 3 isolates the effect of identity replication under a throughput-bounded resource. The honest population is fixed at n = 200 validators. An adversary controls m

11

TABLE 4 Crossover s∗ for representative (T, rmin ) values, computed from (23). Above s∗ , throughput-bounded cost exceeds the parallelizable baseline.

Fig. 2. Total cost (left) and normalised cost C(s, T )/sT (right) vs. time horizon T , with s = 10 and rmin ∈ {0.5, 1.0, 2.0}. All throughputbounded curves grow linearly in T ; the parallelizable normalised ratio decays toward zero, confirming Cpar (s, T ) = o(sT ).

T

rmin = 0.5

rmin = 1.0

rmin = 2.0

10 25 50 100 200

2.9 2.3 2.1 2.1 2.0

1.2 1.1 1.0 1.0 1.0

0.6 0.5 0.5 0.5 0.5

rmin remains bounded away from zero for all s and T (Theorem 6.2); and (3) adversarial influence under throughputbounded resources scales with channel capacity m, not with identity count s, confirming that identity replication without proportional channel capacity yields no influence gain. 9.4

Fig. 3. Adversarial influence share vs. channel capacity m, for s ∈ {400, 700, 1000} and nhonest = 200. All three curves overlap exactly: influence share equals m/(m + n), independent of s. Identity replication without additional channel capacity yields no influence gain, consistent with Theorem 6.2.

independent participation channels and s target identities, with s ∈ {400, 700, 1000}—all strictly larger than the plot range of m. Adversarial influence share is WA /Wtot = min(m, s)/(min(m, s) + n). Since s > m throughout, min(m, s) = m for all plotted values, and all three curves are identical. Influence share is therefore determined entirely by channel capacity m, not by identity count s: multiplying the number of adversarial identities by a factor of 2.5 (from s = 400 to s = 1000) yields zero influence gain. This directly validates the nonamplification consequence of Theorem 6.2. 9.3

Parameter Sensitivity

Table 4 reports the crossover s∗ —the value of s at which Cbnd (s, T ) = Cpar (s, T )—for representative (T, rmin ) combinations: T , T · rmin > rmin + 1. (23) s∗ = T · rmin − rmin − 1 For all tested values, s∗ is small and decreases as T grows: by T = 25, any adversary sustaining more than two or three influence units faces higher cost under throughput-bounded resources than under parallelizable ones. The evaluation confirms three properties predicted by the theory: (1) the parallelizable normalised cost Cpar (s, T )/sT → 0 as s, T → ∞ (Theorem 5.4); (2) the throughput-bounded normalised cost Cbnd (s, T )/sT =

Empirical Calibration

The closed-form expressions of Sections 9.1–9.3 illustrate the asymptotic regimes using unit parameters. We now calibrate the model against two deployed systems whose concentration behavior is documented in the cited literature, using parameters drawn directly from those sources. The purpose is to show that the framework produces non-trivial, quantitatively grounded predictions about observable participation patterns. Ethereum proof-of-stake: The Ethereum protocol requires each validator to commit a minimum stake of rmin = 32 ETH [6], making this the natural activation threshold. As of 2023, Lido Finance operated approximately s ≈ 300,000 validators, representing roughly thirty percent of all staked ETH [3]. Time is measured in epochs; one Ethereum epoch comprises 32 slots and lasts approximately 6.4 minutes. Figure 4 applies the cost model to these parameters. Under the current parallelizable mechanism (financial capital), the adversarial cost is

Cpar (300,000, T ) ≈ 9.6 × 106 ETH, independent of T : a one-time stock acquisition suffices regardless of the participation horizon. Under a hypothetical throughput-bounded mechanism with the same rmin , the cost grows as Cbnd (300,000, T ) = 32 × 300,000 × T ETH, reaching 9.6 × 109 ETH at T = 1,000 epochs (approximately 4.4 days)—a quantity exceeding the total circulating ETH supply by approximately two orders of magnitude (total supply ≈ 1.2 × 108 ETH as of December 2023 [3]). The normalised ratio Cpar /sT → 0 while Cbnd /sT = rmin = 32 remains constant, consistent with Theorems 5.4 and 6.2 respectively. Bitcoin proof-of-work: Gencer et al. [2] report that the top-four Bitcoin mining pools collectively controlled over fifty percent of total hash power, with individual shares of approximately 16.5%, 15.5%, 12.0%, and 11.5%, respectively. We represent each pool’s effective identity count proportional to its share of a normalised network of N = 10,000 units. Figure 5(a) plots Cpar (s, T )/sT for four operator tiers spanning small pools (s = 50) to the top-pool tier (s =

12

Fig. 4. Ethereum PoS calibration using parameters from Rated Network [3]. rmin = 32 ETH; s = 300,000 (Lido tier) and s = 100 (small operator). Left: total adversarial cost vs. time horizon T (epochs); parallelizable cost is T -independent (Theorem 5.4), throughput-bounded cost scales as Ω(sT ) (Theorem 6.2). Right: normalised ratio C(s, T )/sT ; parallelizable decays to zero while throughput-bounded remains fixed at rmin .

1,650). For all tiers, the ratio decays toward zero as T grows, confirming the Cpar (s, T ) = o(sT ) prediction of Theorem 5.4. Figure 5(b) displays the marginal cost separation: ∆par (s, T ) = O(1) versus ∆bnd (s, T ) = Ω(T ), illustrating the structural gap of Theorem 7.1. The calibration confirms that the asymptotic separation of Theorems 5.4 and 6.2 is not merely a theoretical asymptote: at the scale of deployed systems and realistic participation horizons, the cost gap between parallelizable and throughput-bounded mechanisms is quantitatively decisive. For the Lido-scale case, the crossover occurs within the first few epochs; for Bitcoin pool tiers, within the first few hundred block intervals.

10

L IMITATIONS AND O PEN P ROBLEMS

The structural separation established in this paper characterizes adversarial cost scaling under explicit modeling assumptions. Several limitations and open directions remain. 10.1

Enforcement of Throughput Constraints

The framework assumes a per-identity throughput bound τ and activation threshold rmin that hold structurally. Practical mechanisms approximate non-transferability and windowlocality via device attestation and session serialization, but no deployment enforces them perfectly; advances in automation may effectively increase τ . The formal guarantees hold given the structural properties of Definitions 4.6 and 4.5; deployment-level fidelity is outside the scope of the present framework. 10.2

Non-Additive Hybrid Compositions

Lemma 7.4 establishes that a throughput-bounded component preserves the linear lower bound under additive cost decomposition. Non-additive compositions—where the two resource classes interact in ways that are not captured by

C(s, T ) = Cp (s, T ) + Ct (s, T )—remain outside the present scope. For example, a system might require a minimum threshold of both parallelizable and throughput-bounded resources to be active, creating a non-additive coupling. Whether the linear lower bound is preserved under such compositions is an open problem.

10.3

Economic Coordination and Identity Markets

The model abstracts away economic coordination dynamics. In practice, delegation markets, identity outsourcing, and secondary markets for rate-limited credentials may alter the effective cost structure; characterizing equilibrium behavior under adaptive incentives and strategic outsourcing remains outside the present scope.

10.4

Window Granularity and Temporal Modeling

The model partitions time into discrete windows of fixed duration. Smaller windows increase renewal frequency under throughput-bounded resources; larger windows may weaken window-local constraints. A window-independent formulation expressing the separation in terms of wall-clock time remains an open direction.

10.5

Scope of the Framework

The framework is structural and protocol-agnostic: it characterizes the resource-level preconditions that any mechanism must satisfy, and does not replace deploymentspecific security analyses, probabilistic consensus proofs, or economic equilibrium models. Characterizing intermediate scaling regimes—where structural properties are only partially satisfied—in full generality remains an open theoretical problem.

13

Fig. 5. Bitcoin PoW calibration using pool share data from Gencer et al. [2]. Left: normalised cost Cpar (s, T )/sT for four operator tiers; all decay toward zero (Theorem 5.4), with larger pools converging faster. Right: marginal cost ∆(s, T ) under each resource class; the structural gap between O(1) and Ω(T ) regimes across the full time horizon (Theorem 7.1).

11

C ONCLUSION

R EFERENCES [1]

Binding influence to a scarce resource prevents cheap identity creation from amplifying adversarial power— but scarcity alone is insufficient. The structural properties of the resource determine whether influence can be concentrated at sublinear cost, regardless of how the protocol is designed. We proved that any resource satisfying divisibility, additivity of influence, temporal reusability, and identity transferability admits influence amortization: C(s, T ) = o(sT ), with marginal cost ∆(s, T ) = O(1) that does not grow with the time horizon (Theorem 5.4). This is an impossibility result: no protocol rule can enforce linear cost of influence concentration over a structurally parallelizable resource. We further proved that throughput-bounded, non-transferable, window-local resources enforce C(s, T ) = Ω(sT ), with marginal cost ∆(s, T ) = Ω(T ) growing with the time horizon (Theorem 6.2). Theorems 5.4 and 6.2 together establish a sharp asymptotic separation between the two resource classes (Theorem 7.1). The Resource Substitution Principle (Theorem 7.2) translates this separation into a design rule: enforcing linear cost of influence concentration requires grounding participation in a resource that violates at least one parallelizability property. Protocol design cannot substitute for resource structure. Any mechanism grounded in a throughputbounded, non-transferable, and window-local resource inherits C(s, T ) = Ω(sT ) by construction—without additional protocol-level enforcement. Future directions include the formal characterization of intermediate scaling regimes under partial violations of parallelizability, equilibrium analysis under adaptive incentives and identity markets, and the design of practical mechanisms that enforce throughput-boundedness while preserving permissionlessness and accessibility.

S. Nakamoto, “Bitcoin: A peer-to-peer electronic cash system,” https://bitcoin.org/bitcoin.pdf, 2008. [2] A. E. Gencer, S. Basu, I. Eyal, R. van Renesse, and E. G. Sirer, “Decentralization in Bitcoin and Ethereum networks,” in Proceedings of the 22nd International Conference on Financial Cryptography and Data Security (FC), ser. LNCS, vol. 10957. Springer, 2018, pp. 439–457. [3] Rated Network, “Ethereum staking market share and validator distribution,” Rated Network Analytics, 2023, available at https: //www.rated.network/. Accessed: December 2023. [4] J. R. Douceur, “The Sybil attack,” in Proceedings of the 1st International Workshop on Peer-to-Peer Systems (IPTPS), ser. LNCS, vol. 2429. Springer, 2002, pp. 251–260. [5] J. A. Garay, A. Kiayias, and N. Leonardos, “The bitcoin backbone protocol: Analysis and applications,” in Advances in Cryptology – EUROCRYPT 2015, ser. LNCS, vol. 9057. Springer, 2015, pp. 281– 310. [6] A. Kiayias, A. Russell, B. David, and R. Oliynykov, “Ouroboros: A provably secure proof-of-stake blockchain protocol,” in Advances in Cryptology – CRYPTO 2017, ser. LNCS, vol. 10401. Springer, 2017, pp. 357–388. [7] H. Yu, M. Kaminsky, P. B. Gibbons, and A. Flaxman, “SybilGuard: Defending against Sybil attacks via social networks,” in Proceedings of the ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications. ACM, 2006, pp. 267–278. [8] H. Yu, C. Shi, M. Kaminsky, P. B. Gibbons, and F. Xiao, “SybilLimit: A near-optimal social network defense against Sybil attacks,” in Proceedings of the IEEE Symposium on Security and Privacy (S&P). IEEE, 2008, pp. 3–17. [9] M. Borge, E. Kokoris-Kogias, P. Jovanovic, L. Gasser, N. Gailly, and B. Ford, “Proof-of-personhood: Redemocratizing permissionless cryptocurrencies,” in Proceedings of the IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 2017, pp. 23–26. [10] B. Ford, “Pseudonym pairs: Scalable and accountable proof of personhood,” in Proceedings of the Workshop on Decentralized Finance and Security (DeFi Security), 2020. [11] M. Rosenfeld, “Analysis of Bitcoin pooled mining reward systems,” arXiv preprint arXiv:1112.4980, 2011. [12] J. Bonneau, A. Miller, J. Clark, A. Narayanan, J. A. Kroll, and E. W. Felten, “SoK: Research perspectives and challenges for Bitcoin and cryptocurrencies,” in Proceedings of the IEEE Symposium on Security and Privacy (S&P). IEEE, 2015, pp. 104–121. [13] F. Saleh, “Blockchain without waste: Proof-of-stake,” The Review of Financial Studies, vol. 34, no. 3, pp. 1156–1190, 2021.

14

[14] L. Ren, “Analysis of Nakamoto consensus,” in Cryptology ePrint Archive, Report 2019/943, 2019, available at https://eprint.iacr.org/ 2019/943. [15] R. Pass and E. Shi, “Hybrid consensus: Efficient consensus in the permission-less model,” in Proceedings of the 31st International Symposium on Distributed Computing (DISC). Schloss Dagstuhl, 2017, pp. 39:1–39:19. [16] ——, “FruitChains: A fair blockchain,” in Proceedings of the ACM Symposium on Principles of Distributed Computing (PODC). ACM, 2017, pp. 315–324. [17] A. Kiayias, A. Russell et al., “Ouroboros Praos: An adaptivelysecure, semi-synchronous proof-of-stake protocol,” in Advances in Cryptology – EUROCRYPT 2018, ser. LNCS, vol. 10821. Springer, 2018, pp. 66–98. [18] A. Kiayias et al., “Ouroboros Genesis: Composable proof-of-stake blockchains with dynamic availability,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2018, pp. 913–930. [19] R. Pass and E. Shi, “The sleepy model of consensus,” in Advances in Cryptology – ASIACRYPT 2017, ser. LNCS, vol. 10625. Springer, 2017, pp. 380–409. [20] Y. Gilad, R. Hemo, S. Micali, G. Vlachos, and N. Zeldovich, “Algorand: Scaling Byzantine agreements for cryptocurrencies,” in Proceedings of the 26th ACM Symposium on Operating Systems Principles (SOSP). ACM, 2017, pp. 51–68. [21] L. Lamport, R. Shostak, and M. Pease, “The Byzantine generals problem,” ACM Transactions on Programming Languages and Systems, vol. 4, no. 3, pp. 382–401, 1982. [22] M. Castro and B. Liskov, “Practical Byzantine fault tolerance,” in Proceedings of the 3rd Symposium on Operating Systems Design and Implementation (OSDI). USENIX Association, 1999, pp. 173–186. [23] S. Micali, M. Rabin, and S. Vadhan, “Verifiable random functions,” in Proceedings of the 40th Annual IEEE Symposium on Foundations of Computer Science (FOCS). IEEE, 1999, pp. 120–130. [24] M. Rosenfeld, “Analysis of hash rate-based double spending,” arXiv preprint arXiv:1402.2009, 2014, available at https://arxiv. org/abs/1402.2009. [25] A. Narayanan, J. Bonneau, E. Felten, A. Miller, and S. Goldfeder, Bitcoin and Cryptocurrency Technologies. Princeton University Press, 2016. [26] A. Gervais, G. O. Karame, K. Wüst, V. Glykantzis, H. Ritzdorf, and S. Capkun, “On the security and performance of proof of work blockchains,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2016, pp. 3–16. [27] A. Gervais, G. O. Karame, V. Capkun, and S. Capkun, “Is Bitcoin a decentralized currency?” vol. 12, no. 3, 2014, pp. 54–60. [28] I. Eyal and E. G. Sirer, “Majority is not enough: Bitcoin mining is vulnerable,” in Proceedings of the 18th International Conference on Financial Cryptography and Data Security (FC), ser. LNCS, vol. 8437. Springer, 2014, pp. 436–454. [29] J. A. Kroll, I. C. Davey, and E. W. Felten, “The economics of Bitcoin mining, or Bitcoin in the presence of adversaries,” in Proceedings of the Workshop on the Economics of Information Security (WEIS), 2013. [30] T. Neudecker and H. Hartenstein, “Network layer aspects of permissionless blockchains,” vol. 21, no. 1, 2019, pp. 838–857. [31] E. Budish, “The economic limits of Bitcoin and the blockchain,” National Bureau of Economic Research, Working Paper 24717, 2018. [32] E. Budish, A. Lewis-Pye, and T. Roughgarden, “The economic limits of permissionless consensus: Currency, payments, smart contracts,” in Proceedings of the ACM Conference on Economics and Computation (EC). ACM, 2024. [33] M. Carlsten, H. Kalodner, S. M. Weinberg, and A. Narayanan, “On the instability of Bitcoin without the block reward,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2016, pp. 154–167. [34] J. Li, D. Feng et al., “SybilControl: Practical Sybil defense with computational puzzles,” in Proceedings of the 7th ACM Conference on Data and Application Security and Privacy (CODASPY). ACM, 2017. [35] G. Danezis and P. Mittal, “SybilInfer: Detecting Sybil nodes using social networks,” in Proceedings of the Network and Distributed System Security Symposium (NDSS). Internet Society, 2009. [36] D. Laszka, B. Johnson, and J. Grossklags, “A game-theoretic analysis of defense strategies against Sybil attacks,” in Proceedings of

the International Conference on Autonomous Agents and Multi-Agent Systems (AAMAS). IFAAMAS, 2020. [37] P. Wang, Y. Du et al., “Attacking graph-based Sybil detection schemes,” in Proceedings of the Annual Computer Security Applications Conference (ACSAC). ACM, 2019. [38] P. Resnick, R. Zeckhauser, E. Friedman, and K. Kuwabara, “Reputation systems,” Communications of the ACM, vol. 43, no. 12, pp. 45–48, 2000. [39] V. Costan and S. Devadas, “Intel SGX explained,” Cryptology ePrint Archive, Report 2016/086, 2016, available at https://eprint. iacr.org/2016/086. [40] H. M. Levy, Capability-Based Computer Systems. Digital Press, 1984. [41] V. Jacobson, “Congestion avoidance and control,” ACM SIGCOMM Computer Communication Review, vol. 18, no. 4, pp. 314– 329, 1988. [42] I. Eyal, A. E. Gencer, E. G. Sirer, and R. van Renesse, “Bitcoin-NG: A scalable blockchain protocol,” in Proceedings of the 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, 2016, pp. 45–59. [43] A. Miller, Y. Xia, K. Croman, E. Shi, and D. Song, “The Honey Badger of BFT protocols,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2016, pp. 31–42. [44] J. Alwen, J. Blocki, and K. Pietrzak, “Sustained space and idling time complexity of cryptographic proofs of sequential work,” in Proceedings of the 11th Innovations in Theoretical Computer Science Conference (ITCS). Schloss Dagstuhl, 2020. [45] V. Buterin, “DAOs, DACs, DAs and more: An incomplete terminology guide,” Ethereum Foundation Blog, 2014, https://blog. ethereum.org/2014/05/06/daos-dacs-das-and-more.