A contribution to the critique of blockchain censorship

A contribution to the critique of blockchain censorship Ruichao Jiang1 , Michelle Yeo2,3 , and Long Wen1

arXiv:2608.15640v1 [cs.CR] 16 Aug 2026

1

Derivation Technology Ltd, Hong Kong, China {ruichao.jiang,long.wen}@derivation.info 2 Aarhus University, Aarhus, Denmark mxyeo@cs.au.dk 3 Nanyang Technological University

Abstract. We study the blockchain censorship attack introduced in [21], which shows that joining the attack is a dominant strategy. We show that, by introducing certain detectability threshold, joining the attack can lead to strictly less reward for whales, which are defined to be a small number of validators that hold significantly more voting power than the rest (henceforth known as minnows). This leads to a change of the equilibrium: With whales unwilling to participate in the attack, it is difficult for minnows alone to launch the attack. We also perform Monte Carlo simulation to show the existence of reduction for whales’ reward in Ethereum and Solana. Keywords: Blockchains · Censorship resilience · Attacks.

1

Introduction

Blockchain censorship is a growing topic of interest and has been studied extensively on both the transaction-level (see [1,2,5,7,14]), and the consensus-level (see [6,15]). Recent work of Yeo and Zhang [21] analyzes rational censorship attacks in a blockchain model where validators arrive in random order and coordinate their attack intention via only a single message through a shared “blackboard” (i.e., the blockchain). They show that under some assumptions on attacking coalition size and order of validators joining the attack, both attacking the blockchain as well as joining the censorship attack gives validators larger profits (formally, the attack is a subgame perfect equilibrium in the underlying game induced by the attack). In so doing, they show how strategic interactions between validators can negatively impact the liveness of the underlying blockchain. The attack presented in [21] lies on four key assumptions. Firstly, all players are rational, which means that as long as excluding some other validator can result in larger expected profits shared among the non-excluded validators, the non-excluded validators have an incentive to do so. Secondly, the attacking coalition needs to have sufficient cumulative voting power, in order to prevent the excluded validators from taking over and excluding the attacking coalition. Thirdly, the “no big player” assumption, which states that there is no player

2

Ruichao Jiang, Michelle Yeo, and Long Wen

that controls too large amount of voting power such that the player has to be included in all attacking coalitions. Lastly, the attack also assumes the existence of a detectability threshold, which is an exclusion threshold η such that excluding more than η users will lead to the attack being detected and hence a larger cost (represented by the drop in the price of the underlying cryptocurrency) for the attacking validators relative to their gain in profits from the attack. In this work, we reexamine the attack of [21] from a complementary angle. In particular, we note that under a specific and realistic distribution of voting power, there are parameter regimes over the attacking coalition size and total number of validators such that not all validators are guaranteed profits in expectation. In more detail, we model voting power as distributed between two types of validators: whales and minnows. Whale validators control noticeably larger voting power compared to minnows (see Section 3 for more details), and it is these whale validators that suffer a loss in expected profits in joining the attack compared to not under certain parameter regimes. Consequently, this implies parameter regimes under which the original attack in [21] might not succeed, due to the whales’ reluctance to join the attack (and insufficient cumulative voting power from the minnows). We stress that our work does not contradict the result in [21]. Rather, our analysis relies on a subtle insight: although the model proposed by [21] imposes a detectability cost, their analysis assumes that detection is “in-built” into the attack and thus the attack either stops before being detected or remains undetected. This effectively guarantees only profits for the users who are in the attacking coalition. In our work, we allow for cases where the attack can be detected, and hence the detectability cost can actually be imposed. 1.1

Our contributions

Our contributions can be summarised as follows: – (Model.) We examine the original censorship attack proposed by [21] under a realistic distribution of validator voting power, where validators are split into whales (nodes that control significantly larger voting powers) and minnows (nodes that control uniformly small voting powers). – (Analysis.) We analyse parameter regimes whereby whale nodes gain a lower expected profit compared to their expected profit under the honest strategy, due to the detection cost. – (Numerical experiments.) We validate our theoretical bounds with Monte Carlo simulations using real-world stake distribution data from Ethereum and Solana. 1.2

Related work

Blockchain censorship attacks. Blockchain censorship is a topic of growing interest, especially in the light of recent top-down censorship mandated by governments to target malicious individuals and organisations (see e.g., [10,18,19]). On

A contribution to the critique of blockchain censorship

3

the research front, blockchain censorship has mainly been studied in the context of miner extractable value (MEV) prevention (see, e.g., [1,2,5,7,14]). A comprehensive survey of blockchain censorship can be found in [20]. The work which is most related to ours is the censorship attack presented by [21]. Their attack is based on the simple observation that excluding some number of validators (i.e., ignoring their messages and blocks) would only benefit the non-excluded validators in that they will achieve a larger proportional share of block rewards. Additionally, [21] also assumes that too large an attack might be detectable and thus detrimental to the blockchain system. They model this by imposing a detection cost (i.e., a fixed cost representing the drop of the underlying cryptocurrency price) if too many validators are excluded. From these observations, they then show that (1) every validator has an incentive to propose forming a coalition that excludes some amount of validators, and (2) assuming validators join the coalition in a randomised order, every validator has an incentive to join the attacking coalition. Our work takes the attack of [21] as a starting point, but analyses the attack given a specific distribution of voting powers among validator nodes: validators are classified into whales and minnows with whales holding on to much more power compared to minnows. Our work shows that under this specific distribution of power, the detection cost might actually deter whales from joining the attack, which adds nuance to the original attack by [21]. Detectability. The threat of attack detectability and its use in disincentivising attacks was first introduced by [3] with their notion of a covert adversary: an adversary that wants to minimise attack detection. Follow up work in the blockchain setting also examined detectability costs in the context of selfish mining (see [4]), cryptographic self-selection (see [8]), and blockchain censorship (see [21]). Notably, the work of [21] did not examine the impact of the detectability cost on their proposed attack. Our work goes one important step further with the detectability cost proposed by [21]: we argue that assuming the cost is prohibitively large, there are attack settings where whales might not want to join the attack, which provides security against the “costless” censorship attacks as outlined in [21]. Empirical analyses of stake distribution. Our work is also related to works that empirically analyse the distribution of power among validators in blockchains. [11] measure the impact of switching over from proof of work to proof of stake (PoS) in the decentralisation of Ethereum, and show that PoS Ethereum displays a huge concentration of power among a small number of validators. This property is also observed in [16], as well as a broader blockchain power centralisation literature review performed by [17]. Altogether, this validates our model and study of the censorship attack using whales and minnows, as well as reinforces the results of our empirical analysis. 1.3

Organisation

We present notation and our model in Section 2. In Section 3, we define our whale and minnow model and analyse the censorship attack under this specific

4

Ruichao Jiang, Michelle Yeo, and Long Wen

whale and minnow power distribution. We then present our main theorem ( Theorem 1) in Section 4, which shows precise conditions in which whale nodes would achieve a reduced profit from joining the attack compared to acting honestly. We supplement and justify our theoretical bounds with Monte Carlo simulations on real-world Ethereum and Solana data in Section 5, and finally discuss open problems in Section 6.

2

Background and notation

Notation. We use [n] to denote the set {1, . . . , n}. Given a set S, we use 1{S} to denote the indicator function of S. For two functions f and g, we follow the convention in probability theory to use f ∨ g to denote the pointwise maximum of two, i.e. (f ∨ g)(x) = max{f (x), g(x)}. If g happens to be a number, it means a constant function.

2.1

Glossary

For readability, we present a glossary of common notation used throughout this work. t: The requisite power threshold necessary to launch the censorship attack, which is described in Section 2.2. k: The attacking coalition size, i.e., number of parties. W (resp. M ): Set of whale (resp. minnow) validator nodes. α: Voting power of each whale. w: Number of whales. Sk : Total voting power of an attacking coalition of size k (Definition 2). K(t, k): The actual number of participant when both the voting power and coalition size requirements are met. Nk : Number of whales in an attacking coalition of size k (Definition 5). N0 : Minimum number of whales in a successful attack of coalition size k (Definition 6). Φ(k, t): Expected whale’s gain for the whales that joined a successful attack (Definition 7). Φ(k, t): An upper bound on Φ(k, t) (Proposition 1). m: Upper bound on N0 , the minimum number of whales in a successful attacking coalition. F: The feasible set of m. Note that N0 and m are just numbers but Sk , K(t, k) and Nk are random variables, whose sample space is the set of permutations. As such, they are functions of the arrival order π (Definition 1). We suppress this explicit dependence.

A contribution to the critique of blockchain censorship

2.2

5

Model

Blockchain, system and threat model. We assume there are n validators, indexed from 1 to n. We assume an underlying blockchain system S that is maintained by the aforementioned [n] validators. Each validator xi has some amount of voting power vi that determines the probability that they Pncreate the next block. Wlog, we normalise all voting powers to sum to 1, i.e., i=1 vi = 1. Each time a block is appended to the blockchain, the block reward is paid in full to the validator that proposed the block. Finally, we assume the underlying blockchain defines a protocol that validators should follow, henceforth known as the honest strategy. We assume time proceeds in discrete time steps where at each time step a block is added to the blockchain. For simplicity purposes, we also assume that changes in the state of the blockchain and financial system as a result of user actions at some time step will be immediately reflected in the next time step, i.e., the consequences of user actions do not incur any time lag. We assume all validators are rational, i.e., each validator strives to maximise their utility. Moreover, we assume that each validator has the same utility function, which is to maximise their long-run average block reward. Cost model. We assume the same cost model as in [21]. Namely, there is some cost if the censorship attack is detected. Attack detectability is determined by the size of the attacking coalition, i.e., the attack is detectable if the attacking coalition size exceeds some detectability threshold 1 − η, and undetectable otherwise. We assume the cost of detection is considerably larger than the expected rewards of launching the attack, thus validations halt the attack whenever the attacking coalition size exceeds the threshold (more details in the attack model below.). Attack model We summarise the attack model of [21]. In the attack model of [21], the attack is initiated by posting a message to a smart contract on the blockchain signifying the intent to form an attacking coalition to censor messages from other users. Anyone can initiate this smart contract and thus the arrival order is uniform (We leave out the possibility that the validators can re-order the arrival order, which corresponds to a form of MEV). Following this initial message, the authors show if there is no requirement on the coalition size, the best response will be to always join the attack: If you don’t join, you are sure to be censored. In our work, we model the uniformly random process in which validators join the attack by the following. Definition 1 (Arrival order). An arrival order is a permutation from the set of validators to the set of arrival orders π : {1, . . . , n} → {1, . . . , n}. −1

Note that π (i) means the index of the validator that arrives in the i-th position. We therefore assume that we sample π from a uniform distribution over all n! permutations. We also introduce the notion of k-sum, which tracks the total voting power accumulated by the first k attacking validators.

6

Ruichao Jiang, Michelle Yeo, and Long Wen

Definition 2 (k-sum). After k arrivals, the voting power that attackers have accumulated is k X Sk (π) := vπ−1 (i) . i=1

The dependence on π can be omitted if no confusion is caused, especially when the subscript k itself depends on the randomness of π. We now consider the stopping times of the random validator arrival process. Recall that in [21], the random validator arrival process successfully halts when either one of the following conditions hold: (1) the total accumulated power of the validators that join the attack (in the order specified by the random arrival process) first exceeds the power threshold t, or (2) the attacking coalition size remains under the detectability threshold 1 − η, and hence the attackers remain undetected. We formally define these two conditions in Definitions 3 and 4 below. Definition 3 (Power-only stopping time). Kp (t) := min{j ≥ 1 | Sj (π) ≥ t}. Definition 4 (Stopping time with coalition size requirement). Let k ≤ n be the size of coalition of attackers. The stopping time with coalition size requirement is defined as follows. K(t, k) :=Kp (t) ∨ k = min{j ≥ k | Sj (π) ≥ t}. in this Remark 1. The detectability parameter η in [21] corresponds to n−k n article.

3

Whales and minnows

In this section, we study a particular distribution of voting power of practical interest. We suppose there are only two types of validator nodes: whales W with voting power α and minnows M with voting power ε. Whales correspond to validators with large voting powers, and minnows correspond to validators with significantly smaller voting powers (compared to the whales). The number of whales is w and the number of minnows is n − w. We assume that the number of whales is far less than that of minnows and the voting powers of whales are far greater than those of minnows, i.e., w = O(1), α = O(n). ε Note that α/ε = O(n) is where the model is interesting. Suppose for example
that α/ε = Θ(n2 ). Then the collective voting power of minnows are O n1 =

A contribution to the critique of blockchain censorship

7

o(1): The minnows collectively hold near 0 voting power in the large n limit. Then being fair or unfair ceases to be a question. We first note that in the absence of any attack, i.e., all validators act according to the honest strategy, the total expected utility for the whales is αw, which we henceforth call the whale fair play value. Definition 5 (Attacking whales). Define the number of whales appearing in the first k arrivals as follows. Nk := {1 ≤ i ≤ k | π −1 (i) ∈ W } Note that Nk ∼ Hypergeometric(n, w, k), which comes from the assumption of the uniformly random arrival order of the validators (see Definition 1). Hence, the expected number of whales in the first k arrivals is E[Nk ] = And the variance is Var[Nk ] =

kw . n

kw(n − k)(n − w) . n2 (n − 1)

Using the number of whales appearing in the first k arrivals Nk , we can now decompose the k-sum into two parts: the first part comprises of the total voting power held by the whales in Nk , and the second part comprises of the total voting power held by the remaining minnows. Sk (Nk ) = αNk + ε(k − Nk ).

(1)

Rearranging Equation (1), we get that the following two events are identical.    t − kε {Sk ≥ t} = Nk ≥ . α−ε Importantly, the above equation effectively equates the success of the attack (i.e., {Sk ≥ t} mo to the number of whales appearing in the first k n on the l LHS) t−kε on the RHS). arrivals (i.e., Nk ≥ α−ε Definition 6. Define the minimum number of whales in first k arrivals so that Sk ≥ t as follows.    t − kε N0 := max 0, . α−ε We now define the whale’s gain as the expectation of the fraction of attacking whales’ voting power over the attackers’ voting power. This corresponds to the expected potential gain in block rewards for the whales that successfully join the attack, assuming block rewards are split proportionately to power. To motivate this definition we price the whales as a species, i.e., we track the reward of the w whales collectively. Under the honest strategy each block reward is split in proportion to voting power, so every validator earns its own

8

Ruichao Jiang, Michelle Yeo, and Long Wen

share in the long run and the whales earn their fair play value αw. Under a successful attack only the coalition receives and divides the reward, so S1K acts as a multiplier on each member’s power. The coalition formed at K holds NK whales of power α each, while the remaining w − NK whales are censored and earn nothing; fixing the arrival order, the strong law of large numbers shows that the whales’ long-run average reward converges almost surely to the random K variable αN SK , whose mean we take as the whale’s gain. Note that a successful attack need not be a success for the whales as a species: those inside the coalition profit, but any whales left outside lose everything—a loss already reflected in the numerator αNK . Definition 7 (Whale’s gain). 

αNK Φ(k, t) := E SK



It follows from the law of total probability that     αNKp αNk 1{Sk < t} Φ(k, t) = E 1 {Sk ≥ t} + E Sk SKp := Φ1 (k, t) + Φ2 (k, t). The following two lemmas decompose and bound each component of the whale’s gain. Lemma 1 computes the whale’s gain in the case where the attack succeeds. Lemma 2 upper bounds the whale’s gain in the case of a failed attack. Lemma 1. Φ1 (k, t) =

w X

P(Nk = j)

j=N0

αj . αj + ε(k − j)

Proof. This follows from     αNk αNk E 1 {Sk ≥ t} = E 1{Nk ≥ N0 } . Sk αNk + ε(k − Nk ) ⊔ ⊓ Lemma 2. Φ2 (k, t) ≤ P(Nk < N0 )

αN0 . t

Proof. On Sk < t, the power-only stopping time is in effect. Hence, Kp ≥ k + 1 and SKp −1 < t ≤ SKp < t + α.

A contribution to the critique of blockchain censorship

9

It follows that (α − ε)NKp = SKp − εKp < t + α − ε(k + 1),
where the first line is a rearrangement of SKp = αNKp + ε Kp − NKp . Dividing by α − ε, NK p <

t − kε + 1 ≤ N0 + 1 =⇒ NKp ≤ N0 . α−ε

Hence,  Φ2 ≤ E

 αN0 N0 α 1{Sk < t} = P(Nk < N0 ) . t t ⊔ ⊓

We search for an upper bound of the whale’s gain Φ independent of the number of attackers k. First, let m ∈ N be an upper bound on N0 uniform in k. That is, m ≥ N0 , where N0 can depend on k, but m does not depend on k. We first show an upper bound of Φ using the hypergeometric distribution in Proposition 1 below. Proposition 1. For m ≥ N0 , Φ(k, t) <

w X

P(Nk = j)

j=m

αm αj := Φ(k, t). + P(Nk < m) αj + ε(k − j) t

We call the RHS of the above the hypergeometric upper bound of the whale’s gain. Proof. By Definition 6, for all integers j ∈ [N0 , m], we have Sk (j) > t. Hence, m−1

m−1 X

P(Nk = j)

X αm αj < P(Nk = j) αj + ε(k − j) t j=N0

j=N0

= P(N0 ≤ Nk < m)

αm . t

By Lemmas 1 and 2, Φ(k, t) ≤

w X

P(Nk = j)

j=N0

 =

m−1 X

j=N0

<

w X j=m

+

w X

αj αN0 + P(Nk < N0 ) αj + ε(k − j) t

  P(Nk = j)

j=m

P(Nk = j)

αN0 αj + P(Nk < N0 ) αj + ε(k − j) t

αj αm + P(Nk < m) . αj + ε(k − j) t ⊔ ⊓

10

Ruichao Jiang, Michelle Yeo, and Long Wen

Proposition 1 requires m > N0 , which is equivalent to the following condition on k   t − αm km := m + ≤ k. (2) ε We define the following auxiliary quantity Λ(m) :=

m−1 X j=0

w j



with the convention Λ(0) = 0. Lemma 3. For w ≤ k < n and m < w + 1,  P(Nk < m) ≤ Λ(m)

n−k n−w

w−m+1 .

Proof. For 0 ≤ j ≤ w   j−1 w−j−1 w Y k−i Y n−k−i j i=0 n − i i=0 n − j − i   w−j−1 Y w n−k < j n − j − (w − j) i=0   w−j w n−k = j n−w w−m+1   w n−k . < n−w j

P(Nk = j) =

⊔ ⊓

Summing over j, the result is proved.

We now have the requisite ingredients to derive an upper bound of the upper bound of the whale’s gain Φ, which is independent of the attacking coalition size k. Recall that the whale fair play value is the expected return of the whales when all validators follow the honest strategy. In the following proposition, we show that for k within a certain interval, the upper bounded whale’s gain Φ is upper bounded by the whale fair play value αw. This immediately implies, assuming the upper bound on the whale’s gain is tight enough, the existence of attacking coalition size parameter regions whereby whales might not join the attack, as they get a larger expected reward in the case where everyone behaves honestly. Proposition 2 (Uniform bound of Φ). Φ(k, t) < αw for all k satisfying the following inequality α(α − ε)εk 2 w(n − k)(n − w) αm Λ ≥ 2 n (n − 1) t



n−k n−w

w−m+1 .

(3)

A contribution to the critique of blockchain censorship

11

Proof. Define g(j, k) :=

αj . αj + ε(k − j)

Then, −2α(α − ε)εk ∂2g = ≤ −2α(α − ε)εk. 2 ∂j [αj + ε(k − j)]3 Hence, g(j, k) is 2α(α − ε)εk-strongly concave in j. By Jensen’s inequality for strongly concave functions, 2α(α − ε)εk Var[Nk ] 2 α(α − ε)εk 2 w(n − k)(n − w) = n2 (n − 1) := f (k).

g(E[Nk ], k) − E[g(Nk , k)] ≥

On the other hand, E[g(Nk , k)] =

w X

P(Nk = j)g(j, k),

j=0

g(E[Nk ], k) =

αE[Nk ] αw = = αw. αE[Nk ] + ε(k − E[Nk ]) αw + ε(n − w)

Then, for m ≥ 1, Φ(k, t) = E[g(Nk , k)] +

m−1 X

P(Nk = j)

h αm

j=0

≤ αw − f (k) +

m−1 X

P(Nk = j)

t

h αm t

j=0

i − g(j, k) i − g(j, k)

:= αw − f (k) + ∆(k). Hence, f (k) > ∆(k) =⇒ Φ(k, t) < αw. By Lemma 3 m−1 X

αm αm ∆(k) < P(Nk = j) < Λ t t j=0



n−k n−w

w−m+1 . ⊓ ⊔

Hence, Equation (3) is a sufficient condition for f (k) > ∆(k). We now extract from Equation (3) an explicit condition on k.

Lemma 4. For m < w, the following equation in k has a unique root k̂ ∈ [0, n). α(α − ε)εk 2 w(n − k)(n − w) αm Λ = 2 n (n − 1) t



n−k n−w

w−m+1 .

12

Ruichao Jiang, Michelle Yeo, and Long Wen

Proof. If m = 0, k = 0 is the unique solution. Suppose that m ≥ 1. Define f (k) :=

Ck 2 − 1, (n − k)w−m

where C :=

(α − ε)ε(n − w)w−m+2 wt (αn − 1)(1 − αw)(n − w)w−m wt = . 2 mΛn (n − 1) mΛn2 (n − 1)

Then any root of the original equation is a root of f (k) = 0 and vice versa. Since f (0) = −1 and limk→n− f (k) = +∞, there exists a root in (0, n). Since m < w, f is increasing in k. Hence, the root is also unique.

⊔ ⊓

By the monotonicity of f (k), the condition in Proposition 2 is equivalent to k̂ ≤ k < n.

4

Analysis of the validity range

In the previous section, we showed in Proposition 2 an upper bound on the upper bounded whale’s gain. In this section, we determine the conditions under which a reduction on whales’ profit is guaranteed, i.e., we show an upper bound on the actual whale’s gain. Indeed, our main theorem in this section Theorem 1 shows that there is certain parameters such that the whale gain under the attack is actually smaller than in the setting where there is no attack, implying that in such a whale-minnow model the rational censorship attack of [21] might not always be successful. In order to determine the parameter settings whereby the attack is not guaranteed to be successful, we first pin down the range of m. To do so, we summarise the conditions that m must satisfy. 1. m ≥ N0 (k) from Proposition 1; 2. m < w + 1 from Lemma 3; 3. m < w from Lemma 4. l m   (t−αm)(n−w) From condition 1, we have k ≥ m + t−αm = m + . Since the ε 1−αw upper bound of k has to be strictly smaller than n, this gives us the following lower bound on m: m+

(t − αm)(n − w) t(n − w) − (1 − αw)(n − 1) ≤ n − 1 ⇐⇒ m ≥ . 1 − αw αn − 1

Together with condition 3, we obtain the feasible set F for m as follows:   t(n − w) − (1 − αw)(n − 1) F := N ∩ ,w − 1 . αn − 1 We now show that the feasible set of m is non-trivial.

(4)

A contribution to the critique of blockchain censorship

13

Proposition 3. F is not empty. Proof. First, t(n − w) − (1 − αw)(n − 1) t − (1 − αw) ≤ . αn − 1 α Then, t − (1 − αw) ≤ w − 1 ⇐⇒ α ≤ 1 − t, α which is the original assumption on α.

⊔ ⊓

Proposition 3 implies that we can always choose an m s.t. km ≤ n − 1. It remains to show that we can choose k̂(m, n) ≤ n − 1. Since k̂ is the unique solution of f (k) = 0 and f is increasing in k, k̂ ≤ n − 1 ⇐⇒ f (n − 1) ≥ 0 ⇐⇒ C(m, n)(n − 1)2 ≥ 1. Let G(m, n) := C(m, n)(n − 1)2 =

(αn − 1)(1 − αw)(n − w)w−m (n − 1)wt . mΛ(m)n2

Lemma 5. G(m, n) is decreasing in m for m ∈ F and increasing in n for n ≥ w + 1. Proof. Since n − w ≥ 1 and w − m ≥ 1, higher m leads to lower exponent. Also, mΛ(m) in the denominator increases in m. Hence, G decreases in m. For monotonicity in n, take the logarithmic derivative. 1 ∂G α w−m 1 2 = + + − G ∂n αn − 1 n−w n−1 n 1 2 1 + − > n−w n−1 n 2 2 ≥ − > 0. n−1 n ⊔ ⊓ By Lemma 5, a sufficient condition for k̂ ≤ n − 1 is G(w − 1, n) ≥ 1 for all n. Finally, we obtain our main result. Recall that Proposition 2 gives an upper bound for Φ(k, t), which is itself an upper bound on the whale’s gain. Our main theorem presents an upper bound for the whale’s gain Φ(k, t) itself.

14

Ruichao Jiang, Michelle Yeo, and Long Wen

Theorem 1. There exists n0 (α, w, t) s.t. for all n ≥ n0 , there exists m ∈ F(n, α, w, t) s.t. Φ(k, t) < αw for all max{km , k̂(m, n), w} ≤ k < n. Proof. It remains to determine n0 so that k̂(m, n) < n. Since G is increasing in n, n0 can be chosen as the smallest integer n s.t. G(w − 1, n) ≥ 1, i.e.

(αn − 1)(1 − αw)(n − w)(n − 1)wt ≥ 1. (w − 1)(2w − w − 1)n2

Since (αn − 1)(n − w)(n − 1) > αn3 − (αw + α + 1)n2 , it suffices to require [αn − (αw + α + 1)](1 − αw)wt ≥ 1, (w − 1)(2w − w − 1) i.e.

(w − 1)(2w − w − 1) 1 + . α α(1 − αw)wt l m w −w−1) Hence, we can choose n0 (α, w, t) = w + 1 + α1 + (w−1)(2 . α(1−αw)wt n≥w+1+

5

⊔ ⊓

Numerical experiments

In this section, we choose the threshold t = 12 and estimate Φ using Monte-Carlo for two of the larger and more widely-used proof-of-stake networks: Ethereum and Solana (Table 1). Ethereum [13] Solana [12] 1 Lido 22.3% Galaxy 3.23% 2 Binance 8.3% Helius 3.22% 3 ether.fi 5.2% Coinbase 02 3.03% 4 Coinbase 4.5% Figment 2.57% 5 Kraken 3.8% Ledger by Figment 2.44% 6 Figment 3.7% P2P.org 1.98% 7 Blockdaemon 2.7% Everstake 1.67% 8 Everstake 1.8% Binance staking 1.55% 9 Kiln 1.7% G9x1...j6TY (anon) 1.43% 10 Upbit 1.3% H74q...UAst (anon) 1.39% Table 1. Top 10 stake shares in Ethereum and Solana.

A contribution to the critique of blockchain censorship

15

Datasets. We took data pertaining to the number of validators as well as their amounts of stakes from [9]. We note that although the number of validators in Ethereum is around ∼ 1M, each validator has the same amount of stake of 32ETH. Thus we use the stake share percentages (as presented in Table 1) to group the validators into whales with each whale controlling some number of validators corresponding the the stake share percentages above. This gives us a total of 10040 validators in Ethereum. We repeat the same process with Solana to get 1397 validators. Empirical estimation of stake distribution and whale count. To check whether our model of whales and minnows is realistic and reflected in real-life blockchain systems, we tried to fit three parametric families of distributions that are mainly used to model data with very large and small values: exponential, power law, and stretched exponential function4 to both the Ethereum and Solana stake distribution datasets. The goodness of fit result is presented in Table 2 and depicted in Figure 1. From this, we also obtain a natural choice for the whale count w parameter for Ethereum and Solana. Both exponential and stretched exponential distributions have a “characteristic length” λ, which is a natural candidate for the whale count. R2 (Ethereum) R2 (Solana) Exponential 0.971 0.947 Power law 0.927 0.892 Stretched exponential 0.994 0.984 Table 2. The goodness of fit (R2 ) for three parametric distribution families. The power law distribution has the worst fit out of the 3 families. The stretched exponential is a better fit compared to the exponential distribution. The reason is that in both Ethereum and Solana there is a noticeable amount of users that control large amount of stake (i.e., the whales), so the distribution of stake drops significantly after accounting for these whales. However, minnows in the tail region have roughly the same amount of stake, so the distribution drops very slowly in this region. A pure exponential distribution cannot capture this mismatch.

Empirical estimation of whale’s gain. Next, for each chain, we performed two experiments to empirically estimate the whale’s gain depending on the number of attackers k: first, using the real whales’ voting power (from real world data collected from [13,12]). Second, assuming all the whales have the same voting power. We depict our results in Figure 2. We note that all 4 curves exhibit 3 regimes: a relatively flat phase at a small attacking coalition size k, where the attack is favorable to whales; a transition phase where the attack is becoming detrimental to whales; a final upward phase that touches the whale fair play 4

x β

The density of the stretched exponential function is f (x) ∝ e−( λ ) .

16

Ruichao Jiang, Michelle Yeo, and Long Wen

Fig. 1. Fitting the stretched exponential distribution to Ethereum real world data in the plot on the left, and Solana in the plot on the right. The green dashed line: w = ⌈λ⌉ is chosen as the whale count for each dataset.

value. We stress that the final upward phase ending at the whale fair play value is not a coincidence: when k = n, every participant must be included in the attack for the attack being undetected. However, including all validators in the attack effectively nullifies the impact of the attack, rendering it to be exactly the case of where there is no attack, and every validator follows the honest strategy.

Fig. 2. Φ(k, t = 1/2) vs. attack coalition size k. The plot on the left (resp. right) depicts the result for Ethereum (resp. Solana). The blue curve shows the estimation using real world whale stake numbers, and the orange curve shows the estimation using assuming all whales have the same stake. The red curve depicts the baseline whale fair play value.

Verifying the validator lower bound. We now verify if Theorem 1 applies to the setting where we assume all whales have the same voting power. Recall that The-

A contribution to the critique of blockchain censorship

17

orem 1 gives a condition on the size of the validators to have a meaningful whale and minnow separation:   1 (w − 1)(2w − w − 1) n ≥ n0 = w + 1 + + . α α(1 − αw)wt For Ethereum, n0 = 19 ≪ n = 10040; for Solana, n0 = 224137 ≫ n = 1397. So Theorem 1 applies to Ethereum but says nothing about Solana. However, Monte Carlo simulation for Solana did show a reduction of whales’ profit after k > 425. This is because our theoretical bound of n0 = O(2w ) is very loose. Both Table 1 and Figure 1 show that Ethereum is more controlled by a few whales than Solana, which amounts to a lower number of whales w. Attacking coalition size requirement. Lastly, we study the requirement on coalition size max{km , k̂(m, n), w} in Ethereum given by Theorem 1. The feasible set for m is F(n, α, w, t) = {0, 1}. Since m is a free parameter, we are free to choose it to minimize k ∗ . The result is n o k ∗ := min max w, km , k̂(m, n) = 7232, m∈F n n oo ∗ m := arg min max w, km , k̂(m, n) = 0. m∈F

Since k ∗ < n, the result is not vacuous. However, k ∗ > kexp = 5781 found by the Monte Carlo simulation, so the theoretical requirement is conservative.

6

Discussion and implications

We studied the censorship attack introduced in [21], where blockchain consensus participants can collude to exclude some other participants from earning any reward. We showed that in case that a finite amount of voting power is controlled by some handful amount of whales and the rest of voting power is uniformly distributed among a large number of minnows, if the detectability of this attack increase above certain threshold k ∗ , the attack will become detrimental to the whales (Theorem 1). This will deter the whales from joining the attack in the first place. Without whales, it becomes difficult for minnows themselves to gather enough voting power to launch the attack. Theorem 1 provides a conservative (way too large) estimate of the required amount of participants and the detectability level. We performed Monte Carlo simulation in Section 5 to show that this reduction in whales’ reward phenomenon occurs even when the condition of Theorem 1 is not met in Solana. Our work initiates several interesting open questions and important directions of future work, which we highlight below.

18

Ruichao Jiang, Michelle Yeo, and Long Wen

Power centralisation. The threat of censorship is typically associated with centralisation of power. Perhaps somewhat counterintuitively, our work shows that the presence of whales might prevent censorship attacks under certain parameter regimes, and in particular with high detection costs and detection thresholds. In contrast, the setting where there are no whales and only minnows is susceptible to the original censorship attack proposed by [21]. This suggests that some degree of power centralisation can prevent certain types of censorship attacks, and it would be interesting to explore and analyse such censorship attacks under different voting power distributions. Non-uniformly random arrival order. Recall that a key assumption underlying both the original attack and our model is the uniformly-random validator arrival order. Another important and orthogonal direction of research is to consider the impact of a non-uniformly random arrival order on the attack success. In particular, the realistic setting where whales can influence the arrival order (whether through bribery or selection) and put themselves first in the attack. Such a non-uniformly random arrival process could influence both the success and detectability of the attack, and is an interesting direction of future research.

References 1. Abraham, I., Pinkas, B., Yanai, A.: Blinder-scalable, robust anonymous committed broadcast. In: ACM Conference on Computer and Communications Security (CCS 2020). pp. 1233–1252. ACM (2020). https://doi.org/10.1145/3372297.3417261 2. Alpos, O., Amores-Sesar, I., Cachin, C., Yeo, M.: Eating sandwiches: Modular and lightweight elimination of transaction reordering attacks. In: Bessani, A., Défago, X., Nakamura, J., Wada, K., Yamauchi, Y. (eds.) International Conference on Principles of Distributed Systems (OPODIS 2023). LIPIcs, vol. 286, pp. 12:1– 12:22. Schloss Dagstuhl - Leibniz-Zentrum für Informatik (2024). https://doi. org/10.4230/LIPIcs.OPODIS.2023.12 3. Aumann, Y., Lindell, Y.: Security against covert adversaries: Efficient protocols for realistic adversaries. In: Vadhan, S. (ed.) Theory of Cryptography (TCC 2007). Lecture Notes in Computer Science, vol. 23, pp. 281–343 (2010). https://doi. org/10.1007/978-3-540-70936-7_8 4. Bahrani, M., Weinberg, S.: Undetectable selfish mining. In: ACM Conference on Economics and Computation (EC 2024). p. 1017–1044. EC ’24, ACM (2024). https://doi.org/10.1145/3670865.3673485 5. Baum, C., David, B., Frederiksen, T.: P2DEX: privacy-preserving decentralized cryptocurrency exchange. In: Sako, K., Tippenhauer, N. (eds.) Applied Cryptography and Network Security. (ACNS 2021). Lecture Notes in Computer Science, vol. 12726, pp. 163–194. Springer (2021). https://doi.org/10.1007/ 978-3-030-78372-3_7 6. Bonneau, J.: Why buy when you can rent? - bribery attacks on bitcoin-style consensus. In: Clark, J., Meiklejohn, S., Ryan, P., Wallach, D., Brenner, M., Rohloff, K. (eds.) Financial Cryptography and Data Security. (FC 2016). Lecture Notes in Computer Science, vol. 9604, pp. 19–26. Springer (2016). https: //doi.org/10.1007/978-3-662-53357-4_2

A contribution to the critique of blockchain censorship

19

7. Cachin, C., Kursawe, K., Petzold, F., Shoup, V.: Secure and efficient asynchronous broadcast protocols. In: Kilian, J. (ed.) Advances in Cryptology (CRYPTO 2001). Lecture Notes in Computer Science, vol. 2139, pp. 524–541. Springer (2001). https: //doi.org/10.1007/3-540-44647-8_31 8. Cai, L., Liu, J., Weinberg, S., Zhou, C.: Profitable manipulations of cryptographic self-selection are statistically detectable. In: Böhme, R., Kiffer, L. (eds.) Advances in Financial Technologies (AFT 2024). pp. 30:1–30:23. LIPIcs, Schloss Dagstuhl Leibniz-Zentrum für Informatik (2024). https://doi.org/10.4230/LIPIcs.AFT. 2024.30 9. Dune: Dune onchain data platform (2025), https://dune.com/home 10. of the Treasury’s Office of Foreign Assets Control., U.D.: Sanctions compliance guidance for the virtual currency industry. (2021), https://ofac.treasury.gov/ media/913571/download?inline 11. Grandjean, D., Heimbach, L., Wattenhofer, R.: Ethereum proof-of-stake consensus layer: Participation and decentralization. In: Budurushi, J., Kulyk, O., Allen, S., Diamandis, T., Klages-Mundt, A., Bracciali, A., Goodell, G., Matsuo, S. (eds.) Financial Cryptography and Data Security (FC 2024) International Workshops. Lecture Notes in Computer Science, vol. 14746, pp. 253–280. Springer (2025). https://doi.org/10.1007/978-3-031-69231-4_17 12. Helius: Solana decentralization: Facts and figures (2025), https://www.helius. dev/blog/solana-decentralization-facts-and-figures 13. Hildobby: Ethereum eth staking (2026), https://dune.com/hildobby/ eth2-staking 14. Kostiainen, K., Gnap, S., Karame, G.: Censorship resilient and confidential collateralized second layer payments. IACR Cryptol. ePrint Arch. (2022), https: //eprint.iacr.org/2022/1520 15. McCorry, P., Hicks, A., Meiklejohn, S.: Smart contracts for bribing miners. In: Zohar, A., Eyal, I., Teague, V., Clark, J., Bracciali, A., Pintore, F., Sala, M. (eds.) Financial Cryptography and Data Security: FC 2018 International Workshops. Lecture Notes in Computer Science, vol. 10958, pp. 3–18. Springer (2018). https: //doi.org/10.1007/978-3-662-58820-8_1 16. Nir, C., Yaish, A., Yacouel, S., Malkhi, D., Cong, W.: Quantifying inequality in blockchain networks (2025). https://doi.org/10.2139/ssrn.5540258 17. Sai, A., Buckley, J., Fitzgerald, B., Le Gear, A.: Taxonomy of centralization in public blockchain systems: A systematic literature review. Information Processing & Management 58(4), 102584 (2021). https://doi.org/10.1016/j.ipm.2021. 102584 18. of the Treasury, U.D.: U.s. treasury issues firstever sanctions on a virtual currency mixer, targets dprk cyber threats. (2022), https://home.treasury.gov/ news/press-releases/jy0768 19. of the Treasury, U.D.: U.s. treasury sanctions notorious virtual currency mixer tornado cash. (2022), https://home.treasury.gov/news/press-releases/jy0916 20. Wahrstätter, A., Ernstberger, J., Yaish, A., Zhou, L., Qin, K., Tsuchiya, T., Steinhorst, S., Svetinovic, D., Christin, N., Barczentewicz, M., Gervais, A.: Blockchain censorship. In: ACM Web Conference 2024. pp. 1632–1643. ACM (2024). https: //doi.org/10.1145/3589334.3645431 21. Yeo, M., Zhang, H.: Rational censorship attack: Breaking blockchain with a blackboard. In: International Conference on Mathematical Research for Blockchain Economy (MARBLE ’25). Lecture Notes in Operations Research, Springer (2025). https://doi.org/10.1007/978-3-032-13377-9_2

20

Ruichao Jiang, Michelle Yeo, and Long Wen

A

Omitted proofs

A.1

Proof of Proposition 2

Proposition 2 (Uniform bound of Φ). Φ(k, t) < αw for all k satisfying the following inequality  w−m+1 α(α − ε)εk 2 w(n − k)(n − w) αm n−k . (3) ≥ Λ n2 (n − 1) t n−w Proof. Define g(j, k) :=

αj . αj + ε(k − j)

Then, ∂2g −2α(α − ε)εk = ≤ −2α(α − ε)εk. 2 ∂j [αj + ε(k − j)]3 Hence, g(j, k) is 2α(α − ε)εk-strongly concave in j. By Jensen’s inequality for strongly concave functions, 2α(α − ε)εk Var[Nk ] 2 α(α − ε)εk 2 w(n − k)(n − w) = n2 (n − 1) := f (k).

g(E[Nk ], k) − E[g(Nk , k)] ≥

On the other hand, E[g(Nk , k)] =

w X

P(Nk = j)g(j, k),

j=0

g(E[Nk ], k) =

αE[Nk ] αw = = αw. αE[Nk ] + ε(k − E[Nk ]) αw + ε(n − w)

Then, for m ≥ 1, Φ(k, t) = E[g(Nk , k)] +

m−1 X

P(Nk = j)

j=0

≤ αw − f (k) +

m−1 X

P(Nk = j)

j=0

h αm

i − g(j, k)

t

h αm t

i − g(j, k)

:= αw − f (k) + ∆(k). Hence, f (k) > ∆(k) =⇒ Φ(k, t) < αw. By Lemma 3 ∆(k) <

m−1 X j=0

P(Nk = j)

αm αm < Λ t t



n−k n−w

w−m+1

Hence, Equation (3) is a sufficient condition for f (k) > ∆(k).

. ⊓ ⊔

Related documents

• A contribution to the critique of blockchain censorship#616790
• A contribution to the critique of blockchain censorship#616290
• Blockchains and the General Data Protection Regulation#29987
• SilentLedger: Privacy-Preserving Auditing for Blockchains with Complete Non-Interactivity#1062793
• Blockchain and the Tracing of Illicit Financial Flows: On-Chain Analysis, Off-Chain Attribution, and Asset Recovery#121615