Breaking Cycles for Scalable Fair Ordering in Blockchain Systems

arXiv:2609.00837v1 [cs.DC] 1 Sep 2026

Breaking Cycles for Scalable Fair Ordering in Blockchain Systems Jinchun He

Wangjie Qiu

Yizhong Liu

Beihang University hejinchun@buaa.edu.cn

Beihang University wangjieqiu@buaa.edu.cn

Beihang University liuyizhong@buaa.edu.cn

Shengda Zhuo

Kwok-Yan Lam

Jinan University zhuosd96@gmail.com

Nanyang Technological University kwokyan.lam@ntu.edu.sg

ABSTRACT

1

In blockchain systems, transaction order directly determines financial outcomes: unfair ordering enables front-running and sandwich attacks that have extracted over $686M from Ethereum users. Current fair-ordering protocols aggregate pairwise receive-order evidence from replicas. Under contention or adversarial manipulation, however, Condorcet cycles force them into global strongly connected component (SCC) condensation, causing delays, coarse batches, and scaling failures. We present FlashOrder, a deterministic fair-ordering engine that localizes cyclic ambiguity before it propagates across the batch. FlashOrder embeds pairwise preferences into one-dimensional canonical positions, clusters nearby transactions with a partition hypergraph, and performs hierarchical inter- and intra-cluster serialization, replacing batch-wide SCC condensation with localized sorting and aggregation. Evaluated against Themis (CCS ’23) and Rashnu (VLDB ’24) on a libhotstuff-based prototype, FlashOrder achieves up to 10.5× higher throughput than Themis and 4.8× higher than Rashnu, with the latency gap widening as network scales. In controlled adversarial simulation, it reduces maximum rank displacement by 88.7%, and under Condorcet attacks it sustains 12.0× and 9.7× higher throughput than Themis and Rashnu on average. These results show that localizing cyclic ambiguity yields stronger fairness at substantially higher throughput.

Replicated transactional systems rely on consensus protocols to ensure that all replicas execute transactions in the same deterministic order [44]. Blockchain systems and distributed databases share this design space as replicated transactional systems [39], where Byzantine Fault-Tolerant (BFT) protocols guarantee safety and liveness [9, 50] despite adversarial participants. However, while existing BFT protocols [6, 29] ensure ordering consistency, they fall short in guaranteeing fairness: a malicious leader can still manipulate transaction sequencing to censor, reorder, or prioritize transactions without violating consensus correctness [13, 23, 45]. This problem is particularly critical in decentralized finance (DeFi), where transaction order directly determines economic outcomes. Adversarial ordering manipulation, commonly known as maximal extractable value (MEV), has extracted more than $686M on Ethereum alone [13, 26, 36]. More broadly, whenever multiple transactions compete for limited shared resources, ordering itself determines fairness. Consequently, recent systems have introduced order fairness guarantees [23, 45]: if sufficiently many honest replicas observe transaction 𝑡𝑖 before 𝑡 𝑗 , the committed order should preserve this precedence relation. Existing order fairness systems rely on global dependencygraph resolution. Several technical approaches have been proposed to prevent ordering manipulation. Timestamp-based schemes such as Pompe [51] and Wendy [25] assign each transaction a representative timestamp and sort by temporal ordering, but remain vulnerable to clock manipulation and do not tolerate Byzantine timestamp injection. Trusted-execution-environment (TEE) designs [43] enforce ordering through hardware isolation, trading stronger guarantees for reliance on secure hardware assumptions. Cryptographic approaches such as proof-carrying fair ordering [37] provide verifiable fairness guarantees at the cost of additional computational overhead. A more widely adopted family of solutions—and the focus of this paper—builds on pairwise receive-order evidence: each replica records its local transaction receive order, and the protocol aggregates these pairwise precedence relations into a dependency graph to derive a globally fair sequence. This evidence model is natural for Byzantine settings because it does not require synchronized clocks, trusted hardware, or strong cryptographic assumptions. Within this pairwise-evidence family, a sequence of systems has progressively refined how the dependency graph is constructed and integrated with consensus. Themis [22] first implemented practical order-fairness: each replica records its local transaction receive order, the protocol aggregates these pairwise precedence relations

KEYWORDS blockchain, Byzantine consensus, transaction sequencing, order fairness PVLDB Reference Format: Jinchun He, Wangjie Qiu, Yizhong Liu, Shengda Zhuo, and Kwok-Yan Lam. Breaking Cycles for Scalable Fair Ordering in Blockchain Systems. PVLDB, 14(1): XXX-XXX, 2026. doi:XX.XX/XXX.XX PVLDB Artifact Availability: The source code, data, and/or other artifacts have been made available at https://github.com/kingstenzzz/FlashOrder-paper.

This work is licensed under the Creative Commons BY-NC-ND 4.0 International License. Visit https://creativecommons.org/licenses/by-nc-nd/4.0/ to view a copy of this license. For any use beyond those covered by this license, obtain permission by emailing info@vldb.org. Copyright is held by the owner/author(s). Publication rights licensed to the VLDB Endowment. Proceedings of the VLDB Endowment, Vol. 14, No. 1 ISSN 2150-8097. doi:XX.XX/XXX.XX

INTRODUCTION

Table 1: Comparison with representative fair-ordering protocols. Protocol

Fairness

Graph Scope

Cycle Resol.

SCC-Dep.

Condorcet Handling

Wendy [25] Aequitas [23] Themis [22] Rashnu [32]

timed-relative-fairness 𝛾-batch-order-fairness 𝛾-batch-order-fairness 𝛾-batch-order-fairness

— Full batch Full batch Pruned (data-dep.)

Timestamp comparison Global SCC condensation Global SCC + batch unspooling Pruned SCC condensation

No Yes Yes Yes

Timing-sensitive Global collapse Global collapse Pruned collapse

FlashOrder

𝛾-batch-order-fairness

Partition clusters

Local clustering + sorting

No

Localized degradation

Graph Scope: the scope of the dependency structure used for ordering. Cycle Resol.: how cyclic pairwise ambiguity is resolved. SCC-Dep.: whether the protocol depends on SCC condensation. Condorcet Handling: qualitative behavior under Condorcet-style cyclic attacks.

into a directed dependency graph, resolves cyclic ambiguity through strongly connected component (SCC) condensation, and produces a linear sequence via topological sorting. Rashnu [32] observes that not all transaction pairs require ordering constraints—only datadependent transactions accessing shared state need fair ordering— and therefore constructs dependency edges only for conflicting transactions to reduce graph volume. Global SCC resolution limits fair-ordering scalability. Despite these refinements in graph construction, all of these systems share the same SCC-based cycle-resolution paradigm—first construct a global dependency graph, then resolve cycles through SCC condensation—and are therefore subject to the same bottleneck. Under high contention, network jitter, or adversarial Condorcet attacks, pairwise majority relations become densely cyclic. Once such cyclic ambiguity propagates across the batch, SCC condensation moves onto the critical path, producing coarse-grained batching, unstable latency, and poor scalability. This bottleneck is acute in the operating regimes that matter most for modern blockchain systems. High-frequency DeFi workloads generate many near-simultaneous transactions whose pairwise precedence is weakly separated; adversaries can further amplify this ambiguity by selectively inducing conflicting local observations. In these settings, SCC-based resolution causes confirmation delay (cyclic transactions wait for the full SCC), coarse batches (a small ambiguous region collapses a much larger batch), and poor scalability (global cycle resolution becomes the critical path as replicas and transactions grow). Recent bounded-unfairness results sharpen this concern by showing that minimizing order distortion inside such cyclic regions is NP-hard and admits no constant-factor polynomial-time approximation [24]. The central weakness of SCC-based fair ordering is thus structural, not merely an implementation artifact. This observation motivates a different design question: rather than accelerating global cycle resolution, can we structure the ordering pipeline so that cyclic ambiguity never reaches the scale at which such resolution becomes expensive? Our approach. We present FlashOrder, a deterministic fair-ordering engine that answers this question with a localization-based design. The engine operates through a three-stage pipeline: (1) robust canonical embedding of thresholded pairwise evidence into a onedimensional ordering signal, (2) adaptive clustering of nearby ambiguous transactions as a partition hypergraph, and (3) hierarchical inter- and intra-cluster serialization. FlashOrder does not redefine

fairness and does not redesign the consensus substrate; instead, it rewrites the ordering engine itself so that dense pairwise evidence is processed through localized sorting and aggregation rather than batch-wide SCC condensation. Contributions: This paper makes the following contributions. • We identify global SCC-based cycle resolution as the main execution bottleneck in prior graph-based fair-ordering protocols. Our analysis shows that, under contention and Condorcetstyle cyclic ambiguity, the practical cost of fair ordering is dominated not by pairwise evidence aggregation itself, but by the global procedure required to resolve cyclic precedence relations; recent bounded-unfairness results further indicate that optimizing order distortion inside such cyclic regions is structurally intractable in general [24]. • We propose FlashOrder, a deterministic fair-ordering engine that localizes cyclic ambiguity before it spreads across the batch. FlashOrder combines thresholded canonical embedding, adaptive clustering over a partition hypergraph, and hierarchical serialization to transform dense pairwise evidence into a localized ordering structure, replacing global SCC condensation with deterministic local sorting and aggregation. • We show that this localized execution path simultaneously improves fairness and performance across complementary evaluation settings. We implement FlashOrder on top of libhotstuff and evaluate it against HotStuff [50], Themis [22], and Rashnu [32] under varying network scales, contention levels, fairness settings, and adversarial ordering-manipulation scenarios. At 𝑛 = 9, FlashOrder achieves 30,680 txs/s, a 10.5× improvement over Themis and 4.8× over Rashnu. As the network scales to 𝑛 = 101, the gap further widens: FlashOrder maintains 180 ms latency while Themis reaches 779 ms and Rashnu reaches 401 ms, because FlashOrder keeps the ordering path localized whereas Themis and Rashnu incur increasingly expensive global graph processing. In controlled adversarial simulation at 𝛾 = 0.8, FlashOrder reduces maximum rank displacement from 301 (Themis) and 287 (Rashnu) to 34 positions. Under 50 ms WAN Condorcet attacks at 𝛾 = 0.6, FlashOrder sustains 12.0× higher throughput than Themis and 9.7× higher than Rashnu on average. Together, these results suggest that FlashOrder lowers the practical cost of fair ordering while improving fairness quality under explicit cluster-order conditions. 2

Pre-generate Attack Transactions

2 BACKGROUND 2.1 Fair Ordering Preliminaries

C1 T0

Replicated transactional systems rely on consensus protocols to ensure that all honest replicas execute transactions in the same deterministic order [44]. Byzantine Fault-Tolerant (BFT) protocols guarantee safety and liveness [9, 50] but do not inherently ensure order fairness: a malicious leader can still manipulate transaction sequencing without violating consensus correctness [13, 23]. This has motivated order fairness as an additional property: if sufficiently many honest replicas observe transaction 𝑡𝑥𝑖 before 𝑡𝑥 𝑗 , the committed order should preserve this precedence [23, 45]. Why receive-order evidence? Several approaches have been proposed to realize order fairness. Timestamp-based schemes such as Pompe [51] and Wendy [25] assign each transaction a representative timestamp, but remain vulnerable to clock manipulation and Byzantine timestamp injection. Propagation-time estimation cannot be captured precisely because the network is asynchronous and transactions may be arbitrarily delayed. As a result, the most widely adopted family of fair-ordering protocols—including Aequitas [23], Themis [22], and Rashnu [32]—builds on pairwise receive-order evidence: each replica records the order in which it receives transactions, and the protocol aggregates these local observation sequences to derive a globally fair ordering. This model is natural for Byzantine settings because it requires neither synchronized clocks nor trusted hardware. Condorcet paradox. Even when every individual replica’s local observation sequence is transitive, the aggregated pairwise majority preferences can form cycles, a phenomenon known as the Condorcet paradox from social choice theory [15]. Consider three replicas observing three transactions: • Replica 1: 𝑡𝑥 1 ≺ 𝑡𝑥 2 ≺ 𝑡𝑥 3 • Replica 2: 𝑡𝑥 2 ≺ 𝑡𝑥 3 ≺ 𝑡𝑥 1 • Replica 3: 𝑡𝑥 3 ≺ 𝑡𝑥 1 ≺ 𝑡𝑥 2 A majority (2 of 3) observe 𝑡𝑥 1 before 𝑡𝑥 2 , a majority observe 𝑡𝑥 2 before 𝑡𝑥 3 , and a majority observe 𝑡𝑥 3 before 𝑡𝑥 1 —forming an intransitive cycle 𝑡𝑥 1 → 𝑡𝑥 2 → 𝑡𝑥 3 → 𝑡𝑥 1 . No linear order can respect all three majority preferences simultaneously, making strict pairwise fairness impossible in general. To address this impossibility, 𝛾-batch-order-fairness [23] relaxes the requirement: transactions involved in a Condorcet cycle are delivered in the same batch, with no ordering guarantee within the batch. A deterministic tie-breaking rule (e.g., lexicographic ordering by transaction identifier) is then applied within each batch to produce a total order. Section 3.2 provides the formal definition.

T2

T1

T2

Voting Forms a Condorcet Cycle T0

R1 T0, T1, T2... T1

R2

C2

T2

Condorcet Cycle

T1, T2, T0...

(T0>T1, T1>T2, T2>T0)

T0

R3

…

T2, T0, T1...

C3 T2

T0

T1

R5 R5

T0

T1

T2

T1

T2

T0

Ordering Conflict

… Consensus Blocked

Figure 1: Condorcet attack: conflicting client sequences induce cyclic preferences, forcing SCC-based protocols to collapse the entire batch.

in four stages: (1) geographically distributed clients inject transactions with conflicting preference sequences; (2) these conflicting sequences induce local order disagreements across replicas; (3) the aggregated pairwise preferences form an intransitive voting cycle (Condorcet paradox); and (4) the SCC-based protocol must collapse all transactions into a single indivisible batch, leading to severe latency degradation or unresponsive ordering. Recent work has attempted to address this bottleneck at the communication layer (CFTO [33]) or the definition layer (Age-Aware Fairness [41]). However, these refinements remain dependent on constructing dense pairwise dependency graphs and executing expensive SCC condensation. Excessively large batches in these systems can worsen frontrunning risks within the batch [34], weakening the fairness objective they intend to improve. The root cause of this fragility is that SCC-based methods allow cyclic dependencies to propagate globally before attempting resolution. In contrast, FlashOrder localizes cyclic conflicts into small, bounded regions before they chain across the entire transaction set, reducing the cost of cycle resolution from traversing a dense 𝑂 (𝑚 2 ) graph to sorting within and across a small number of compact clusters.

3

SYSTEM MODEL AND PROBLEM SETUP

This section provides the system model of FlashOrder. We first specify the BFT system and adversarial model, then state the threshold pairwise fairness objective adopted from prior work.

3.1 2.2

T1

Submit to All Replicas

From Fairness to Bottleneck

System Model and Threat Model

We consider a standard partially synchronous BFT network model inherited from classical Byzantine Fault Tolerant consensus protocols [6, 9, 18, 21, 29, 38, 50]. The system consists of 𝑛 known replicas, of which at most 𝑓 may exhibit arbitrary (Byzantine) behavior at any given time. Byzantine replicas may deviate from the protocol arbitrarily, including sending conflicting messages to different subsets of honest replicas, omitting messages, or colluding to manipulate the transaction ordering. The network follows the partial synchrony model: message delivery delays are bounded by some unknown Δ after an unknown Global Stabilization Time (GST), but there is no bound before GST.

State-of-the-art fair ordering protocols (e.g., Themis [22]) enforce 𝛾batch-order-fairness by constructing a pairwise dependency graph 𝐺, where directed edges represent honest-majority preferences, and then executing Tarjan’s algorithm to collapse strongly connected components (SCCs) into indivisible batches. While theoretically sound, this graph-centric topology exhibits significant practical fragility under contention. Under high-contention workloads or targeted Condorcet attacks [45], adversarial nodes deliberately broadcast conflicting transaction sequences. As illustrated in Fig. 1, the attack proceeds 3

4𝑓

This is consistent with the underlying consensus protocol (HotStuff) and with prior fair-ordering baselines (Themis, Rashnu). Each replica maintains a local observation sequence O𝑖 representing the order in which it receives transactions from clients. The observation sequences may differ due to network latency, message reordering, or adversarial manipulation by Byzantine nodes. We assume standard cryptographic primitives: digital signatures for message authentication, collision-resistant hash functions for message commitment, and a public-key infrastructure (PKI) for key distribution. The adversary is computationally bounded and cannot break these cryptographic assumptions or compromise honest replica identities. Threat Model. Following prior work on order-fairness [22, 45], we consider Byzantine replicas that coordinate to maximize ordering disruption by sending conflicting transaction sequences to different honest replicas. This can induce Condorcet-style cyclic pairwise majorities in the aggregated preference graph [15]. Such cyclic regions are the critical stress case for SCC-based fair-ordering engines because they prevent direct linearization of robust pairwise preferences and force cycle resolution onto the critical path. Traditional BFT consensus requires 𝑛 > 3𝑓 to guarantee safety and liveness [9, 50]. However, order-fairness introduces additional constraints because the protocol must distinguish honest-majority orderings from adversarial noise. Following Themis [22] and Aequitas [23], FlashOrder uses a stricter threshold.

The tighter threshold 𝑛 > 2𝛾 −1 replaces the standard 𝑛 > 3𝑓 because order-fairness requires distinguishing the honest-majority signal from Byzantine noise. For typical configurations (e.g., 𝛾 = 0.8, 𝑓 = 15), this requires 𝑛 > 100, hence our experimental focus on 𝑛 = 101.

3.2

𝑃𝑖 𝑗 = |{𝑘 ∈ [𝑛] : 𝑡𝑥𝑖 ≺ O𝑘 𝑡𝑥 𝑗 }|,

4𝑓 , 2𝛾 − 1

Definition 3.3. (𝛾-Batch-Order-Fairness) [22, 23]. A transaction ordering protocol is 𝛾-batch-order-fair if, given a partition of T into ordered batches B1, B2, . . . , B𝑘 , for any pair 𝑡𝑥𝑖 , 𝑡𝑥 𝑗 ∈ T : if 𝑃𝑖 𝑗 > 𝜏 then 𝛽 (𝑡𝑥𝑖 ) ≤ 𝛽 (𝑡𝑥 𝑗 ),

(4)

where 𝛽 (𝑡𝑥) denotes the batch index containing 𝑡𝑥, and the consensus threshold 𝜏 is: j k 𝜏 = max(1, 𝑛(1 − 𝛾) + 𝑓 + 1). (5)

(1) Intuitively, 𝛾-batch-order-fairness requires that robust pairs be correctly ordered across batches, but makes no pairwise guarantee within each batch. This definition, adopted from Aequitas [23] and used by Themis [22], reflects the practical limit of what pairwiseevidence protocols can guarantee: when Condorcet cycles exist (i.e., 𝑃12 > 𝜏, 𝑃 23 > 𝜏, 𝑃 31 > 𝜏 simultaneously), no linear order can satisfy all robust pairs, making strict pairwise 𝛾-fairness unattainable in general. Under the threshold convention used here, 𝜏 = max(1, ⌊𝑛(1 − 𝛾)⌋ + 𝑓 + 1) is the evidence-admission threshold for declaring a pair robust. Thus smaller 𝛾 values raise 𝜏 and admit only stronger pairwise receive-order evidence, making settings close to the feasibility lower bound the strictest operating regime. Conversely, 𝛾 = 1 yields the lowest admission threshold (𝜏 = 𝑓 + 1) and is therefore the most permissive setting. The key challenge, therefore, is not how to redefine fairness, but how to realize these thresholded pairwise constraints without placing global cycle condensation on the critical path.

2𝑓

where 𝛾 ∈ ( 21 + 𝑛 , 1] is the order-fairness parameter. Proof. With 𝑛 replicas and 𝑓 Byzantine, the protocol relies on a quorum of 𝑛 − 𝑓 replicas. Among this quorum, at most 𝑓 may be malicious and 𝑓 may be honest but slow. Thus, the fairness argument must reserve enough margin above a simple majority to absorb both Byzantine evidence and delayed honest evidence. Writing this feasibility slack as (2𝛾 − 1)𝑛, order-fairness requires the slack to dominate the 4𝑓 uncertainty budget, i.e., (2𝛾 −1)𝑛 > 4𝑓 . Rearranging yields 𝑛 > 4𝑓 /(2𝛾 − 1). Under this convention, smaller 𝛾 leaves less slack above the feasibility boundary, and therefore corresponds to a stricter admissible operating regime. □ Lemma 3.2. 𝛾 Parameter Bounds. The order-fairness parameter 𝛾 is constrained to satisfy: 1 2𝑓 + < 𝛾 ≤ 1. 2 𝑛

(3)

which counts the number of replicas observing 𝑡𝑥𝑖 before 𝑡𝑥 𝑗 . The preference matrix 𝑃 = [𝑃𝑖 𝑗 ] 𝑖,𝑗 ∈ [𝑚] captures all pairwise receiveorder information.

Lemma 3.1. BFT Feasibility Threshold for Order-Fairness. Given 𝑛 replicas with at most 𝑓 Byzantine, the fairness threshold requires the following sufficient feasibility condition: 𝑛>

Thresholded Pairwise Fairness Objective

Let T = {𝑡𝑥 1, 𝑡𝑥 2, . . . , 𝑡𝑥𝑚 } denote a batch of 𝑚 transactions submitted to the BFT system. Each replica 𝑘 ∈ {1, . . . , 𝑛} maintains an observation sequence O𝑘 defining a total order over T . We denote by 𝑡𝑥𝑖 ≺ O𝑘 𝑡𝑥 𝑗 the event that transaction 𝑡𝑥𝑖 precedes 𝑡𝑥 𝑗 in replica 𝑘’s observation sequence. For any pair (𝑡𝑥𝑖 , 𝑡𝑥 𝑗 ) ∈ T × T , define the preference count:

(2)

4

Proof. The lower bound ensures that the honest supermajority exceeds the adversarial majority: 𝛾 > 1/2 + 2𝑓 /𝑛 derives from 𝑛 > 4𝑓 /(2𝛾 − 1). Under the threshold convention used in this paper, 𝛾 should be read as a feasibility/slack parameter rather than as a direct agreement fraction: values closer to the lower bound impose a stricter evidence-admission threshold and require larger deployments, while 𝛾 = 1 is the most permissive admissible setting. □

THE FLASHORDER ENGINE

FlashOrder is a cluster-based fair ordering engine designed as a plug-and-play, deterministic state machine for BFT consensus protocols. As illustrated in Fig. 2, the core pipeline comprises three phases: robust canonical embedding (RCE), adaptive hypergraph modeling (AHM), and hierarchical order resolution (HOR), which collectively replace global SCC condensation with localized sorting and aggregation. 4

n Replicas Robust Canonical Embedding

2 Adaptive Hypergraph Modeling

Resolution

Global Ord𝑒𝑟 ℒ

Canonical Projection

Adaptive Clustering

Inter-Cluster Sort

𝑡1

1 …

Preference Matrix P

𝑡𝑥𝑗

𝑡𝑥𝑗

𝐶𝑃 𝑠𝑘 − 𝐶𝑃 𝑠𝑘−1 < 𝛿

𝐶𝑃 𝑡𝑥𝑖 = {𝑡𝑥𝑗 ∈ 𝒯 ∖ {𝑡𝑥𝑖 } 𝑃𝑗𝑖 > 𝜏}

Linear Sorting

Quotient Graph Projection 𝐻𝑏

Sort by 𝐶𝑃 𝑡𝑥𝑖

𝑡2

Build cluster

𝑡𝑥𝑖

𝐻𝑎

𝑊𝑎𝑏 > 𝜆 ∙ 𝑊𝑏𝑎

Intra-Cluster Refinement 𝐻𝑎

…

...

…

…

Local Observation Order [O1 , … 𝑂𝑛 ]

3 Hierarchical Order

𝑡𝑚

𝑆𝑜𝑢𝑟𝑐𝑒 𝑡𝑥 = ෍ 𝑃𝑖𝑗 − 𝑃𝑗𝑖

Add edge

Figure 2: FlashOrder workflow

4.1

System Architecture and Processing Pipeline

this convention, decreasing 𝛾 raises 𝜏 and therefore makes the robust-pair admission rule stricter. Instead of inserting transactions into a directed graph to find edges, the engine calculates a Canonical Position (CP) for every transaction via a sequential scan:

Each replica maintains a local observation sequence and gossips it through the peer-to-peer layer. Once the leader collects a threshold quorum of these sequences, the consensus layer forwards the aggregated data to the fair ordering engine. The underlying BFT layer safely replicates the raw observation sequences, while FlashOrder operates as an independent deterministic state machine atop the agreed-upon data. Unlike prior decoupled systems (e.g., Themis) that still incur 𝑂 (𝑚 2 ) global graph condensation, FlashOrder restructures the computational payload so that honest replicas derive the same global ordering under the same certified input. The internal workflow of the finalize() engine processes transactions through three hierarchical phases, as formally defined in Algorithm 1. Each phase explicitly transforms transaction states to progressively resolve ordering dependencies. To make this replay property precise, FlashOrder applies fixed deterministic tiebreaking rules at every ordering stage: whenever canonical positions or intra-cluster scores are equal, transactions are ordered lexicographically by a unique transaction identifier, and whenever the quotient graph admits multiple valid topological orders, clusters are serialized by a deterministic cluster key.

4.2

𝐶𝑃 (𝑡𝑥𝑖 ) = |{𝑡𝑥 𝑗 ∈ T \ {𝑡𝑥𝑖 } | 𝑃 𝑗𝑖 > 𝜏 }|

(6)

This Step 1: Canonical Projection requires only sequential scans over the preference matrix, yielding a deterministic rank proxy that counts how many other transactions robustly precede it. Once the CP array is populated, the deterministic state machine executes Step 2: Linear Sorting which sorts the transaction batch in ascending order of their CP values, using the transaction identifier as a canonical secondary key whenever CP values are equal, thereby yielding the linear baseline sequence S. This canonical embedding compresses the 𝑂 (𝑚 2 ) global dependency graph into a single linear array. By projecting the data in this manner, FlashOrder localizes any underlying cyclic conflicts (Condorcet paradoxes) to adjacent indices within this 1D array. This locality enables bounded conflict resolution in subsequent phases, without global graph condensation.

4.3

Phase 2: Adaptive Hypergraph Modeling

Transactions with proximate canonical coordinates in S represent ordering ambiguities that frequently manifest as Condorcet cycles under contention. Instead of instantiating a dense 𝑂 (𝑚 2 ) dependency graph where every transaction is a node (the primary cause of computational saturation in prior works), FlashOrder applies a Structural Compression technique through adaptive geometric clustering (Algorithm 1, Phase 2), which produces a partition hypergraph (T , H ): the transaction set T is partitioned into disjoint clusters H = {𝐻 1, 𝐻 2, . . . , 𝐻𝑘 }, where each 𝐻𝑎 ⊆ T , |𝐻𝑎 | ≥ 1, and Ð𝑘 𝑎=1 𝐻𝑎 = T with 𝐻𝑎 ∩𝐻𝑏 = ∅ for 𝑎 ≠ 𝑏. We use the term partition hypergraph only for this disjoint cluster family; the subsequent inter-cluster dependency structure is an ordinary quotient graph.

Phase 1: Robust Canonical Embedding

The primary objective of the first phase is to rapidly condense the raw, aggregated observation sequences into a robust 1D baseline array without allocating any expensive graph data structures (Algorithm 1, Phase 1). The input to this phase is the dense preference matrix 𝑃, where each entry 𝑃𝑖 𝑗 records the number of replicas that observed 𝑡𝑥𝑖 arriving before 𝑡𝑥 𝑗 . To filter out Byzantine manipulations and network jitter, the system uses a threshold 𝜏 = max(1, ⌊𝑛(1 − 𝛾)⌋ + 𝑓 + 1), where 𝑛 is the total number of nodes and 𝑓 represents the upper bound of Byzantine faults. With 5

Algorithm 1. Main Workflow of FlashOrder Input : Transaction batch T ; agreed observations {O1, . . . , O𝑛 }; protocol params 𝛾, 𝑓 , 𝑛; system params Φ, 𝜆, E[𝑑𝑒𝑙𝑎𝑦], Δ𝑡𝑔𝑒𝑛 // Each transaction carries a unique deterministic identifier 𝑖𝑑 (𝑡𝑥) Output : Global ordering L

This reduces the topological state space from 𝑚 transactions to 𝑘 macro-nodes (𝑘 ≪ 𝑚). To achieve this, the engine first executes Step 1: Adaptive Clustering. Iterating through the sorted sequence S, adjacent transactions are grouped into a cluster 𝐻 when their coordinate difference remains within threshold 𝛿. As defined in Algorithm 1, we set 𝛿 =Φ·

// Phase 1: Robust Canonical Embedding 𝜏 ← max(1, ⌊𝑛 · (1 − 𝛾)⌋ + 𝑓 + 1) 𝑃𝑖 𝑗 ← |{𝑣𝑘 | 𝑡𝑥𝑖 ≺ O𝑘 𝑡𝑥 𝑗 }| for each 𝑡𝑥𝑖 ∈ T do 𝐶𝑃 (𝑡𝑥𝑖 ) ← |{𝑡𝑥 𝑗 ∈ T \ {𝑡𝑥𝑖 } | 𝑃 𝑗𝑖 > 𝜏 }|

(7)

where Φ is the fairness relaxation parameter (default 0.15), and E[𝑑𝑒𝑙𝑎𝑦], Δ𝑡𝑔𝑒𝑛 denote empirical network latency and transaction generation interval, respectively. This formulation keeps clustering sensitivity explicit and tunable through measurable system parameters. By confining cyclic dependencies within clusters, FlashOrder prevents these conflicts from growing into global SCCs. Following consolidation, the system proceeds with Step 2: Quotient Graph Projection. A directed graph G𝐻𝐺 = (H, E) is constructed as the quotient graph projection of the partition hypergraph, where nodes correspond to clusters 𝐻𝑎 ∈ H and directed edges encode inter-cluster preference dominance. A directed edge 𝐻𝑎 → 𝐻𝑏 is established when aggregate preference weight 𝑊𝑎𝑏 = Í Í 𝑡𝑥𝑖 ∈𝐻𝑎 𝑡𝑥 𝑗 ∈𝐻𝑏 𝑃𝑖 𝑗 exceeds reverse flow 𝑊𝑏𝑎 by a specified mar-

S = ⟨𝑠 1, . . . , 𝑠𝑚 ⟩ ← sort T by (𝐶𝑃 asc., 𝑖𝑑 (𝑡𝑥) asc.) // Phase 2: Adaptive Hypergraph Modeling 𝛿 ←Φ·

E[𝑑𝑒𝑙𝑎𝑦] , Δ𝑡𝑔𝑒𝑛

E[𝑑𝑒𝑙𝑎𝑦 ] Δ𝑡𝑔𝑒𝑛

// Adaptive Geometric Clustering H ← ∅; 𝐻𝑡𝑒𝑚𝑝 ← {𝑠 1 } for 𝑘 ← 2 to 𝑚 do if 𝐶𝑃 (𝑠𝑘 ) − 𝐶𝑃 (𝑠𝑘 −1 ) < 𝛿 then 𝐻𝑡𝑒𝑚𝑝 ← 𝐻𝑡𝑒𝑚𝑝 ∪ {𝑠𝑘 }

𝛾𝑛−𝑓

gin. Formally, the margin 𝜆 must satisfy 1 < 𝜆 < (1−𝛾 )𝑛+𝑓 so that inter-cluster edges are established only when the aggregate honestmajority signal reliably exceeds adversarial noise under the BFT threshold. In practice, 𝜆 is a system parameter selected inside this feasible interval; lower-𝛾 regimes narrow the admissible interval and therefore require a smaller margin. In the rare case where macro-cycles persist in G𝐻𝐺 under extreme adversarial topologies, the engine detects nontrivial SCCs and deterministically merges each selected component into a single super-cluster, yielding an acyclic quotient graph. Each final cluster 𝐻 is then assigned a deterministic key 𝑘𝑒𝑦 (𝐻 ) = min𝑡𝑥 ∈𝐻 𝑖𝑑 (𝑡𝑥). Derivation of the 𝜆 bound. The 𝜆 parameter controls when intercluster dominance is reliably detectable. We derive both bounds from 𝛾-fairness requirements. Lower bound (𝜆 > 1): To establish a meaningful edge 𝐻𝑎 → 𝐻𝑏 , we require clear dominance:

else H ← H ∪ {𝐻𝑡𝑒𝑚𝑝 }; 𝐻𝑡𝑒𝑚𝑝 ← {𝑠𝑘 } H ← H ∪ {𝐻𝑡𝑒𝑚𝑝 } // Quotient Graph Projection G𝐻𝐺 ← (H, E); E ← ∅ for each (𝐻𝑎 , 𝐻𝑏 ) ∈ H × H, 𝑎 ≠ 𝑏 do Í Í 𝑊𝑎𝑏 ← 𝑡𝑥𝑖 ∈𝐻𝑎 𝑡𝑥 𝑗 ∈𝐻𝑏 𝑃𝑖 𝑗 if 𝑊𝑎𝑏 > 𝜆 · 𝑊𝑏𝑎 then Add edge 𝐻𝑎 → 𝐻𝑏 to E while nontrivial SCC 𝐶 exists in G𝐻𝐺 , selected by deterministic cluster key do Ð 𝐻𝑚𝑒𝑟𝑔𝑒 ← 𝐻 ∈𝐶 𝐻 Replace vertices in 𝐶 with 𝐻𝑚𝑒𝑟𝑔𝑒 in G𝐻𝐺 Update edges E for 𝐻𝑚𝑒𝑟𝑔𝑒

𝑊𝑎𝑏 > 𝜆 · 𝑊𝑏𝑎

H𝑓 𝑖𝑛𝑎𝑙 ← 𝑉 (G𝐻𝐺 ) for each 𝐻 ∈ H𝑓 𝑖𝑛𝑎𝑙 do 𝑘𝑒𝑦 (𝐻 ) ← min𝑡𝑥 ∈𝐻 𝑖𝑑 (𝑡𝑥)

(8)

If 𝜆 ≤ 1, the condition 𝑊𝑎𝑏 > 𝜆 · 𝑊𝑏𝑎 would not guarantee 𝑊𝑎𝑏 > 𝑊𝑏𝑎 , allowing edges where reverse preference is equally strong. Thus, 𝜆 > 1 ensures inter-cluster edges require unambiguous forward dominance. Upper bound derivation. Under the same feasibility parameter 𝛾, the inter-cluster margin must account for the honest signal that can support the forward direction and the residual reverse evidence that may arise from disagreement, delay, or Byzantine behavior. Lower 𝛾 values correspond to a stricter operating regime: the pairwise threshold 𝜏 is higher, and the admissible margin interval for 𝜆 becomes narrower. The honest signal strength contributing to 𝑊𝑎𝑏 is bounded by:

// Phase 3: Hierarchical Order Resolution H𝑠𝑜𝑟𝑡𝑒𝑑 ← LexicographicTopologicalSort(G𝐻𝐺 , 𝑘𝑒𝑦) L ← ⟨⟩ for each 𝐻 ∈ H𝑠𝑜𝑟𝑡𝑒𝑑 do for each 𝑡𝑥𝑖 ∈ 𝐻 do Í 𝑆𝑐𝑜𝑟𝑒𝑖 ← 𝑡𝑥 𝑗 ∈𝐻,𝑗≠𝑖 (𝑃𝑖 𝑗 − 𝑃 𝑗𝑖 ) L𝐻 ← sort 𝐻 by (𝑆𝑐𝑜𝑟𝑒 desc., 𝐶𝑃 asc., 𝑖𝑑 (𝑡𝑥) asc.) L.append(L𝐻 ) return L

𝑆 honest ≈ 𝛾 (𝑛 − 𝑓 ) ≈ 𝛾𝑛 − 𝑓

(9)

The adversarial noise or conflicting evidence that could contribute to 𝑊𝑏𝑎 comes from: (i) the (1 −𝛾) fraction of honest nodes disagreeing, and (ii) all 𝑓 Byzantine nodes potentially providing reverse 6

global ordering L. These deterministic tie-breaking rules are invoked only when the ordering evidence is exactly tied, and therefore do not reverse any inter-cluster precedence established by the quotient graph. Within each cluster, the net-preference score provides a deterministic refinement for transactions whose robust precedence relations are mutually contradictory or too weakly separated; its fairness quality is evaluated empirically rather than asserted as an unconditional guarantee inside arbitrary cyclic regions.

signals: 𝑁 adversarial ≈ (1 − 𝛾)(𝑛 − 𝑓 ) + 𝑓 ≈ (1 − 𝛾)𝑛 + 𝑓

(10)

For the edge condition 𝑊𝑎𝑏 > 𝜆 · 𝑊𝑏𝑎 to reliably detect honest consensus over adversarial noise, we require: 𝜆 · 𝑁 adversarial < 𝑆 honest 𝜆 · ((1 − 𝛾)𝑛 + 𝑓 ) < 𝛾𝑛 − 𝑓 𝛾𝑛 − 𝑓 (1 − 𝛾)𝑛 + 𝑓

𝜆<

(11)

4.5

Complexity Analysis

𝛾𝑛−𝑓

Feasibility condition: For this bound to exceed 1 (i.e., (1−𝛾 )𝑛+𝑓 > 1), we require:

At the level of pairwise evidence aggregation, any receive-order fairness protocol operating on a pairwise preference matrix must process Θ(𝑚 2 ) relations in the worst case, where 𝑚 is the batch size. This is because there are 𝑚(𝑚−1)/2 transaction pairs, and the protocol must collect and process evidence for each pair to determine the relative ordering under the fairness constraint. FlashOrder therefore remains quadratic in the worst case with respect to the input information, while reducing the practical cost of cycle resolution through localized serialization. However, the empirical speedup over SCC-based protocols (e.g., Themis) stems from restructuring the systems-level overhead and data access patterns. Traditional protocols resolve cycles by constructing dense, pointer-based directed graphs and executing Tarjan’s SCC condensation. Under adversarial loads, these graphs become highly cyclic, causing high computational cost, unpredictable branch penalties, and deep recursion stacks. In contrast, FlashOrder isolates the Ω(𝑚 2 ) pairwise relation processing purely to sequential, efficient array arithmetic (Phase 1 and 2). It reduces the practical cost of the core topological cycleresolution engine by replacing expensive, graph traversal with localized canonical sorting and clustering. By replacing combinatorial graph topology with linear 1D sorting, FlashOrder avoids the large constant factors that dominate traditional 𝑂 (𝑚 2 ) fair ordering.

𝛾𝑛 − 𝑓 > (1 − 𝛾)𝑛 + 𝑓 𝛾𝑛 − 𝑓 − 𝑛 + 𝛾𝑛 > 𝑓 (2𝛾 − 1)𝑛 > 2𝑓 𝑛>

2𝑓 2𝛾 − 1

(12) 4𝑓

Under the standard BFT threshold condition 𝑛 > 2𝛾 −1 , this is always satisfied, guaranteeing the upper bound exceeds the lower bound. In the main deployment configurations we use 𝜆 = 1.2 as a conservative engineering margin; in stricter low-𝛾 regimes, the admissible interval narrows and 𝜆 must be selected within the corresponding bound.

4.4

Phase 3: Hierarchical Order Resolution

The final phase of the FlashOrder pipeline deterministically flattens the dimensionally reduced data structures into a total ordering L through a two-tier serialization process (Algorithm 1, Phase 3). The prior phase absorbs dense, transaction-level Condorcet cycles into a compact macro-hypergraph (G𝐻𝐺 ), so this final serialization avoids the deep recursion stacks and overhead of global graph traversals. First, the engine performs Step 1: Inter-Cluster Topological Sort. Because the prior phase has already absorbed any remaining macrocycles through SCC merging, the quotient graph G𝐻𝐺 is guaranteed to be acyclic at this point. FlashOrder executes a lexicographic topological traversal over the macro-nodes (clusters), establishing a coarse-grained precedence among the aggregated transaction groups (H𝑠𝑜𝑟𝑡𝑒𝑑 ). Among all currently eligible zero in-degree clusters, the engine always selects the one with the smallest deterministic key 𝑘𝑒𝑦 (𝐻 ) = min𝑡𝑥 ∈𝐻 𝑖𝑑 (𝑡𝑥). Next, the engine executes Step 2: Intra-Cluster Refinement to resolve the exact transaction sequence within each individual cluster. For a given cluster 𝐻 , FlashOrder computes a Net-Preference Score for every internal transaction 𝑡𝑥𝑖 : ∑︁ 𝑆𝑐𝑜𝑟𝑒 (𝑡𝑥𝑖 ) = (𝑃𝑖 𝑗 − 𝑃 𝑗𝑖 ) (13)

5

CORRECTNESS ARGUMENTS

This section presents the correctness arguments for FlashOrder. We establish three formal properties: deterministic replayability as an unconditional guarantee, conditional cluster-order fairness under explicit separation conditions, and acyclic exactness in wellseparated regimes. A pair (𝑡𝑥𝑖 , 𝑡𝑥 𝑗 ) is considered robust if the observed precedence count satisfies 𝑃𝑖 𝑗 > 𝜏, where 𝜏 = max(1, ⌊𝑛(1 −𝛾)⌋ + 𝑓 + 1). Let H ∗ denote the final cluster family after quotient-graph SCC merging, and let 𝛽 (𝑡𝑥) be the position of the final cluster containing 𝑡𝑥 in the lexicographic topological order. Proposition 5.1. (Deterministic Replayability). For fixed parameters and the same certified observation input {O1, . . . , O𝑛 }, all honest replicas running Algorithm 1 output the same total order L.

𝑡𝑥 𝑗 ∈𝐻,𝑗≠𝑖

This score sums the net preference for each transaction within the cluster. Because |𝐻 | is small (bounded and typically orders of magnitude below the batch size 𝑚), this local scoring adds negligible cost. The transactions within the cluster are sorted in descending order of their net scores; if multiple transactions obtain the same score, ties are resolved first by ascending canonical position and then by ascending transaction identifier. Finally, the deterministic state machine concatenates these locally sorted segments to produce the

Proof. The preference matrix 𝑃 is a pure function of the certified observation sequences. Canonical positions are computed from 𝑃 using a fixed threshold and are sorted with a deterministic identifier tie-breaker. Geometric clustering scans the sorted sequence deterministically. Quotient edges are computed from aggregate weights and a fixed margin, and nontrivial SCCs are merged using 7

a deterministic cluster key. The final topological traversal and intracluster score sorting also use fixed tie-breaking rules. Hence every step is a deterministic function of the same input and parameters, so all honest replicas reproduce the same L. □

Ethernet). We use the SmallBank benchmark with extreme Zipfian skew (SB_SKEW=0.99) and high interaction probability (SB_PROB=0.95), producing dense write-write conflicts that mirror real-world MEV arbitrage topologies. For fairness-quality evaluation (Section 6.5), we use algorithm-level simulation to evaluate larger network sizes and controlled adversarial sweeps beyond CloudLab scale.

Proposition 5.2. (Conditional Cluster-Order Fairness). Assume 4𝑓 𝑛 > 2𝛾 −1 . For every robust pair (𝑡𝑥𝑖 , 𝑡𝑥 𝑗 ) with 𝑃𝑖 𝑗 > 𝜏, suppose the final clusters 𝐻𝑖∗, 𝐻 𝑗∗ ∈ H ∗ satisfy one of the following conditions: (i) 𝐻𝑖∗ = 𝐻 𝑗∗ , or (ii) the final quotient graph contains a directed path from 𝐻𝑖∗ to 𝐻 𝑗∗ . Then FlashOrder satisfies the batch-level relation 𝛽 (𝑡𝑥𝑖 ) ≤ 𝛽 (𝑡𝑥 𝑗 ) for that pair. If the condition holds for every robust pair, FlashOrder satisfies the corresponding cluster-level batch-order property.

6.2

Evaluation Questions

• § 6.3: Can FlashOrder deliver high throughput and low latency in an end-to-end BFT prototype? • § 6.4: Does FlashOrder remain stable under stricter robust-pair admission? • § 6.5: Does FlashOrder preserve strong fairness quality under the same thresholded pairwise objective? • § 6.6: Does FlashOrder remain robust under adversarial orderingmanipulation attacks?

6.3

Throughput (KTPS)

Proposition 5.3. (Acyclic Exactness under Separation). If (a) the robust preference graph is acyclic, (b) the CP ordering is a valid topological order of that robust graph, (c) the clustering threshold 𝛿 does not merge any pair separated by a robust edge, and (d) the initial quotient graph (before SCC merging) is acyclic, then FlashOrder outputs a linear order satisfying every robust pair. Proof. Condition (c) ensures every robust edge connects distinct clusters. Condition (d) ensures no SCC merging occurs, so the initial cluster assignment is the final one. By (a) and (b), the robust edges form a partial order consistent with the CP ordering; combined with (c), each robust edge maps to a directed inter-cluster edge in the quotient graph whose direction is consistent with the robust preference. Since the quotient graph is acyclic (d), the lexicographic topological sort returns a linear extension that preserves all quotient-graph edges and therefore all robust edges. Intra-cluster sorting cannot reverse any robust edge because, by (c), no robust pair shares a cluster. Hence every robust pair appears in the output order in the required direction. □

70 60 50 40 30 20 10 0

End-to-End Performance in Deployment Themis Rashnu

913 21

HotStuff FlashOrder

41 61 81 Number of Replicas

101

Confirmation Latency (ms)

Proof. If 𝐻𝑖∗ = 𝐻 𝑗∗ , both transactions are in the same final cluster, so 𝛽 (𝑡𝑥𝑖 ) = 𝛽 (𝑡𝑥 𝑗 ). Otherwise, by assumption the final quotient graph contains a path from 𝐻𝑖∗ to 𝐻 𝑗∗ . The SCC-merge step leaves the quotient graph acyclic, and any topological ordering of an acyclic graph places the source of a directed path before its sink. Therefore 𝛽 (𝑡𝑥𝑖 ) < 𝛽 (𝑡𝑥 𝑗 ). Applying the same argument to every robust pair gives the cluster-level batch-order property. □

800 600

Themis Rashnu HotStuff FlashOrder Avg Latency P95 Latency

400 200 0

913 21

41 61 81 Number of Replicas

101

Figure 3: End-to-end throughput and latency under varying network scale (𝑛 = 9 to 101). 6.3.1 Scaling with Replica Count. We evaluate whether FlashOrder preserves end-to-end practicality as the deployment scale grows. We vary the network size from 𝑛 = 9 to 𝑛 = 101 replicas and compare FlashOrder with the HotStuff baseline as well as the two state-of-the-art fair-ordering protocols, Themis and Rashnu. The results in Fig. 3 show that FlashOrder maintains stable performance as the network grows, with a much smaller throughput gap to the non-fairness baseline than either Themis or Rashnu. Scalability analysis. As shown in Fig. 3, the vanilla HotStuff baseline establishes the upper bound for performance because it does not enforce fair ordering. At 𝑛 = 9, HotStuff achieves a peak throughput of 66,853 txs/s with an average latency of 14.9 ms (p95: 18.1 ms). FlashOrder follows closely, achieving 30,680 txs/s with an average latency of 32.6 ms (p95: 33.8 ms). In this small-scale setting, FlashOrder achieves a 10.5× throughput speedup over Themis (2,920 txs/s) and a 4.8× improvement over Rashnu (6,330 txs/s). As the network expands to 101 nodes, overall throughput naturally declines due to increased communication overhead in the BFT consensus. Even so, FlashOrder sustains 5,696 txs/s compared to the 7,372 txs/s of the baseline, translating to a throughput retention of 77.2% at peak node count, while its average latency reaches 180.0 ms (p95: 213.0 ms, compared to the baseline’s 136.4 ms / 154.4 ms). In contrast, Themis and Rashnu drop to 1,299 txs/s and 2,504 txs/s, respectively, with Themis’s latency spiking to 779.0 ms (p95: 924.2 ms) and Rashnu reaching 401.1 ms (p95: 457.0 ms).

FlashOrder also supports replayable order verification [30]: the leader attaches the 𝑛 − 𝑓 signed observation sequences as a certificate alongside L, and each honest replica replays the same certified input through its local engine. Any mismatch leads to rejection by the consensus layer.

6 EVALUATION 6.1 Experimental Setup We implement FlashOrder on top of the open-source libhotstuff codebase [50] and compare it with HotStuff (no fairness), Themis [22], and Rashnu [32]. We select Themis and Rashnu as baselines because they are the only open-source, HotStuff-integrated fair-ordering engines sharing the same pairwise-evidence model, enabling applesto-apples comparison. Deployment experiments run on CloudLab [16] c6525-25g baremetal machines (16-core AMD EPYC 7302P, 128 GB RAM, 25 Gbps 8

HotStuff HotStuff

214 213 20 212 211 15 210 29 10 287 2 5 265 2 0 100 200 400 600 800 24 Block Size

Latency (ms)

Latency (ms) Throughput (KTPS)

Throughput (KTPS)

214 213 40 212 211 30 210 29 20 287 2 10 265 2 0 100 200 400 600 800 24 Block Size

Rashnu Rashnu

FlashOrder FlashOrder

214 213 212 211 3 210 29 2 287 2 1 265 2 0 100 200 400 600 800 24 Block Size 4

Latency (ms)

Themis Themis

Throughput (KTPS)

Latency Throughput

Figure 4: Throughput and latency under varying batch sizes (𝑛 = 21): (a) Normal load, (b) Heavy contention load, (c) Geodistributed setting with 50 ms inter-node latency. These results show that FlashOrder retains most of the practical efficiency of HotStuff while scaling much better than SCCbased fair-ordering engines. The gap widens with replica count: FlashOrder keeps the ordering path localized, while Themis and Rashnu pay for global graph processing as cyclic ambiguity grows.

contention, batch size, and WAN delay make global SCC-style cycle resolution most expensive. Instead of allowing ambiguity to expand into a batch-wide graph bottleneck, FlashOrder confines it to localized clustering and serialization.

6.3.2 Performance under Challenging Operating Conditions. We test whether FlashOrder’s advantage persists precisely in the regimes that amplify cyclic ambiguity on the critical path. We evaluate the protocols under three scenarios with 𝑛 = 21 replicas, varying the block size from 100 to 800: (a) normal load in LAN, (b) heavy contention load in LAN (𝑆𝐵_𝑆𝐾𝐸𝑊 =0.99, 𝑆𝐵_𝑃𝑅𝑂𝐵=0.95), and (c) geodistributed deployment with 50 ms inter-node latency. As shown in Fig. 4, FlashOrder’s advantage over Themis widens as contention and latency increase. Normal load. Under normal load (Fig. 4a), FlashOrder closely tracks the HotStuff baseline, achieving 31.37 KTPS at block size 400 (93% of baseline) with latency of 58.7 ms, compared to the baseline’s 54.8 ms. Themis already exhibits significant degradation: at block size 800, Themis drops to 0.31 KTPS with latency spiking to 6,905 ms. Heavy contention. Under heavy contention (Fig. 4b), Themis’s throughput degrades sharply: at block size 800, its throughput drops to 0.24 KTPS with latency reaching 7, 636 ms. FlashOrder maintains 13.60 KTPS at block size 400 and achieves 166.6 ms latency at block size 800, delivering over 56× higher throughput than Themis in this extreme stress test. Geodistributed WAN. In a geo-distributed setting with 50 ms latency (Fig. 4c), the updated results show a clear separation at larger block sizes. At block size 800, FlashOrder reaches 2,373 TPS with average latency 1,650 ms (p95: 3,608 ms), while Themis drops to 480 TPS with 7,880 ms latency (p95: 11,667 ms) and Rashnu reaches 1,053 TPS with 3,915 ms latency (p95: 4,883 ms). In this geo-distributed scenario, FlashOrder achieves 4.94× and 2.25× throughput gains over Themis and Rashnu, respectively. Compared with the HotStuff baseline at block size 800 (3,189 TPS, 1,311 ms), FlashOrder retains 74.4% throughput with only 1.26× latency overhead. Taken together, these deployment results support the central systems claim of the paper: FlashOrder’s advantage is largest when

6.4

Sensitivity to Order-Fairness Parameter

We evaluate whether FlashOrder remains stable as lower 𝛾 values impose stricter robust-pair admission in the thresholded pairwise precedence structure. We test FlashOrder, Themis, and Rashnu under identical network settings while progressively scaling 𝛾 down from 1.0 to 0.6. Under the threshold 𝜏 = ⌊𝑛(1 −𝛾)⌋ + 𝑓 + 1, lowering 𝛾 raises the evidence threshold required to declare a precedence relation robust. This stricter regime reduces tolerance for weak receive-order evidence and makes the ordering engine more sensitive to the remaining high-confidence cyclic structure produced by contention and Condorcet-style manipulation. As depicted in Fig. 5, the performance of Themis degrades sharply as 𝛾 decreases: its throughput drops from 3.0 × 103 txs/s to 2.4 × 103 txs/s, while its latency spikes non-linearly from 334.3 ms to over 411.4 ms. Although Rashnu reduces the sorting volume by constructing graphs only for data-dependent transactions, it still relies on graph traversal and cycle elimination when the stricter threshold leaves hard high-confidence cycles in the dependency structure. Consequently, Rashnu incurs approximately a 35% latency penalty (reaching 205.8 ms) under severe topological stress. In contrast, FlashOrder shows strong performance stability. Even under the stricter robust-pair admission regime induced by 𝛾 = 0.6, FlashOrder maintains a burst throughput of over 21.6 × 103 txs/s, with its end-to-end latency remaining within 31.4–37.3 ms. This result indicates that the localized execution path remains stable even when the protocol admits only stronger pairwise evidence: rather than paying for larger global cycle-resolution routines, FlashOrder continues to resolve the remaining ambiguity within bounded clusters. 9

Fraction of transaction pairs reversed

Wendy, f=7 Wendy, f=15

6.5

Rashnu, f=7 Rashnu, f=15

0.3 0.2 0.1 0.0 5

Distance(tx, tx')

50

100

Figure 7: Adversarial fairness metrics Figure 6: Ordering resilience and defen- (𝑓 =2): RPS (right axis) and MaxDisp (left sive stability under direct manipulation. axis). Table 2: Fairness metrics under adversarial simulation (𝑓 =2, 30 inducing transactions, 20 trials).

Fairness Quality under Thresholded Pairwise Constraints

We evaluate whether FlashOrder preserves strong fairness quality under the same thresholded pairwise objective used by prior work. We report two complementary metrics: the robust-pair satisfaction rate (RPS), which measures how often robust precedence constraints are respected, and maximum rank displacement (MaxDisp), which captures worst-case output distortion. Together, these metrics let us evaluate both constraint satisfaction and the bounded-unfairness style quantity that captures how much positional distortion an adversary can force [24]. 6.5.1 Robust-Pair Satisfaction Rate. Beyond throughput and latency, we directly quantify fairness quality using two complementary metrics. The first is the Robust-Pair Satisfaction Rate (RPS), which measures the fraction of strongly agreed-upon transaction pairs correctly ordered in the protocol output. Formally, a pair (𝑡𝑥𝑖 , 𝑡𝑥 𝑗 ) is called robust if 𝑃𝑖 𝑗 > 𝜏, where 𝜏 = max(1, ⌊𝑛(1 − 𝛾)⌋ + 𝑓 + 1) is the consensus threshold. Given a protocol output 𝜎 ∗ , the robust-pair satisfaction rate is defined as: RPS =

FlashOrder, f=7 FlashOrder, f=15

0.4

1

Figure 5: Throughput and latency under varying order-fairness parameter 𝛾.

Themis, f=7 Themis, f=15

𝛾

RPS↑

MaxDisp↓

Cov.

Cov.𝑐

MaxGrp↓

Themis Rashnu FlashOrder

0.80 0.80 0.80

0.813 0.790 0.873

301 287 34

0.212 0.462 0.815

0.212 0.816 0.812

339 4 54

Themis Rashnu FlashOrder

0.51 0.51 0.51

0.915 0.853 0.996

300 291 10

0.894 0.507 0.910

0.895 0.915 0.908

59 2 70

Themis Rashnu FlashOrder

1.00 1.00 1.00

0.672 0.675 0.704

301 288 87

0.185 0.385 0.590

0.186 0.676 0.588

339 5 136

Cov.: quotient-/condensation-path coverage of all robust pairs. Cov.𝑐 : coverage restricted to conflicting pairs. MaxGrp: largest cluster/SCC size.

MaxDisp advantage. MaxDisp reveals the most striking advantage of FlashOrder. At 𝛾 = 0.8, FlashOrder’s worst-case displacement is 34 positions (8.5% of the 400-transaction batch), compared to 301 (75.3%) for Themis and 287 for Rashnu, an 88.7% reduction (i.e. (301−34)/301) in the attacker’s maximum exploitable displacement, or equivalently an 8.9× reduction. At 𝛾 = 0.51 with 𝑛 = 401, this advantage grows to 30× (10 vs 300 positions). This is the same qualitative notion of positional distortion targeted by boundedunfairness formulations [24]; FlashOrder improves it not by searching for an optimal order inside a global SCC, but by preventing ambiguity from expanding into such a region in the first place. Structural decomposition. To understand why FlashOrder achieves these gains, Table 2 decomposes each protocol’s robustpair handling into two structural mechanisms: (1) absorbed—robust pairs that land in the same cluster or SCC, where ordering information is effectively lost; and (2) covered (Cov.)—robust pairs whose clusters/SCCs differ but the quotient or condensation DAG preserves a one-way path, indicating genuine structural preservation. The MaxGrp column reports the size of the largest cluster (FlashOrder) or SCC (Themis/Rashnu). At 𝛾 = 0.8, Themis collapses 339 out of 400 transactions (85%) into a single SCC (MaxGrp= 339), so its Cov. is only 0.212—most robust pairs are absorbed rather than genuinely preserved. FlashOrder’s largest cluster contains only 54

∧ 𝜎 ∗ (𝑖) < 𝜎 ∗ ( 𝑗)}|

|{(𝑖, 𝑗) : 𝑃𝑖 𝑗 > 𝜏 , |{(𝑖, 𝑗) : 𝑃𝑖 𝑗 > 𝜏 }| with RPS := 1 if denominator is 0.

Protocol

(14)

We simulate an adversarial setting with 𝑓 = 2 Byzantine nodes and 30 inducing transactions, reporting results at 𝛾 = 0.8 (recommended operating point) and 𝛾 = 0.51 (strictest BFT-admissible setting, requiring 𝑛 > 400). RPS advantage. As shown in Table 2, FlashOrder achieves the highest RPS across all configurations. At the recommended 𝛾 = 0.8, FlashOrder’s RPS of 0.873 represents a 7.4% relative improvement over Themis (0.813) and a 10.5% improvement over Rashnu (0.790). At the strict 𝛾 = 0.51 setting with 𝑛 = 401 nodes, FlashOrder attains near-perfect robust-pair satisfaction with RPS = 0.996, while Themis and Rashnu remain at 0.915 and 0.853. Maximum Rank Displacement. The second fairness metric is Maximum Rank Displacement (MaxDisp), the worst-case positional shift between the protocol output and ground-truth ordering. In our simulation, the ground-truth reference order is the ascending send-time order used to generate the attack scenario. Whereas RPS measures aggregate fairness compliance, MaxDisp captures the worst-case attack surface available to an adversary. 10

transactions (13.5%), yet achieves Cov.= 0.815 through quotientpath coverage. Rashnu keeps SCCs tiny (max 4) by restricting edge construction to conflicting pairs, but leaves 54% of all robust pairs structurally uncovered (Cov.= 0.462); its conflict-restricted coverage Cov.𝑐 = 0.816 slightly exceeds FlashOrder’s 0.812 (0.4% difference, within statistical noise), which is expected: Rashnu exclusively optimizes for conflicting pairs while FlashOrder’s hypergraph construction must simultaneously resolve non-conflicting robust pairs. FlashOrder achieves this near-parity on conflict pairs while extending structural coverage to all robust pairs (Cov.= 0.815 vs. Rashnu’s 0.462). Under the strict 𝛾 = 0.51 setting, Themis’s SCC collapse becomes far less severe (MaxGrp drops to 59) and its Cov. improves to 0.894, confirming that stricter robust-pair admission naturally limits SCC size; however, FlashOrder still leads with Cov.= 0.910 and near-perfect RPS= 0.996. At 𝛾 = 1.0, all protocols see RPS decline (0.67–0.70), but structural differences persist: Themis again collapses to MaxGrp= 339 with Cov.= 0.185, while FlashOrder maintains Cov.= 0.590 (3.2× higher) and MaxDisp= 87 (3.5× lower than Themis’s 301), confirming that the quotient-path advantage holds across all parameter regimes. Scalability effect. Moving from the recommended setting (𝛾 = 0.8) to the stricter BFT-admissible setting (𝛾 = 0.51, 𝑛 = 401), FlashOrder’s fairness lead further amplifies: RPS increases from 0.873 to 0.996, while MaxDisp decreases from 34 to 10. Conversely, Themis’s MaxDisp remains at approximately 300 regardless of network scale. This suggests that FlashOrder not only avoids the execution bottleneck of SCC-based ordering, but also converts stricter robust-pair admission and larger-scale evidence aggregation into better fairness quality. Fig. 7 illustrates how these metrics vary continuously across different 𝛾 values.

6.6

displayed using the corresponding vote-margin labels. As shown in Fig. 6, at the most “fragile” point of 𝐷𝑖𝑠𝑡 = 1, FlashOrder limits successfully flipped pairs to 49 in standard scenarios and 63 under peak adversarial load. This protection is maintained while achieving a 23.15× speedup in execution time over Themis, reducing latency from 13.015 s to 0.562 s. By utilizing a structural cluster graph to avoid the cycle explosion associated with 𝑂 (𝑚 2 ) binary dependency graphs, FlashOrder helps prevent computational saturation during active attacks.

Avg. Throughput (TPS)

Themis ( =0.6) Themis ( =1.0)

Rashnu ( =0.6) Rashnu ( =1.0)

FlashOrder ( =0.6) FlashOrder ( =1.0)

Ordering Failed

1500 1000 500 0

3

10 attack cycle length (tx)

20

3

10 attack cycle length (tx)

20

Latency (ms)

2000 1000 0

Robustness under Condorcet Attacks

Attack setting. We further evaluate adversarial service robustness under explicit ordering-manipulation attacks in both simulation and real prototype deployment. For the simulation-side attack study, we configure a 101-node network with 𝑓 = 15 Byzantine nodes and 𝛾 = 0.8. This satisfies the 4𝑓 60 BFT threshold 𝑛 > 2𝛾 −1 = 0.6 = 100, placing FlashOrder within the threshold range considered by our fairness analysis. The Byzantine nodes systematically broadcast conflicting inverted transaction sequences to distinct subsets of honest nodes, increasing the length and density of dependency cycles. For the deployment-side attack study, we use a geo-distributed setting with 50 ms inter-node latency and inject explicit Condorcet cycles by splitting malicious clients into three groups that submit contradictory local orders (A>B, B>C, C>A) while background SmallBank traffic continues. We sweep attack cycle length {3, 10, 20} and report two representative fairness endpoints, 𝛾 ∈ {0.6, 1.0}. Ordering resilience. According to the distance metric

Figure 8: Condorcet attack robustness in WAN (50 ms): average throughput (top) and client latency (bottom) versus attack cycle length for 𝛾 ∈ {0.6, 1.0}. Throughput under attack. Figure 8 reports the 50 ms WAN results for the two representative endpoints used in the paper, 𝛾 ∈ {0.6, 1.0}, corresponding to a conservative threshold and the maximally permissive threshold, respectively. At 𝛾 = 0.6, FlashOrder sustains 742/1155/1467 TPS for cycle lengths 3/10/20, whereas Themis reaches 87/100/93 TPS and Rashnu reaches 106/104/136 TPS. Averaged across cycle lengths, FlashOrder achieves 1121 TPS, i.e., 12.0× higher than Themis and 9.7× higher than Rashnu under adversarial Condorcet attacks. At 𝛾 = 1.0, FlashOrder reaches 1202/1228/1813 TPS versus Themis 186/113/120 and Rashnu 172/513/113, corresponding to average gains of 10.1× over Themis and 5.3× over Rashnu. Latency and failure modes. Latency trends are consistent with the throughput advantage. FlashOrder keeps client latency in a lower band than Themis and Rashnu in almost all settings: 867–1292 ms at 𝛾 = 0.6 and 790–814 ms at 𝛾 = 1.0, compared with Themis at 1389–1600 ms (𝛾 = 0.6) / 1002–1082 ms (𝛾 = 1.0) and Rashnu at 1139–1963 ms (𝛾 = 0.6) / 784–995 ms (𝛾 = 1.0). The only notable outlier is FlashOrder at (𝛾 = 0.6, cycle = 3), where latency rises to 1292 ms, yet throughput still remains far above

𝐷𝑖𝑠𝑡 (𝑡𝑥𝑖 , 𝑡𝑥 𝑗 ) = #{𝑟 : 𝑡𝑥𝑖 ≺ O𝑟 𝑡𝑥 𝑗 } − #{𝑟 : 𝑡𝑥 𝑗 ≺ O𝑟 𝑡𝑥𝑖 } , which measures the receive-order vote margin between the two relative orders, the protocol’s ability to preserve the relative ordering of honest transactions is highlighted by the sharp decline in reversal rates as distance increases. In the simulation, transaction pairs are bucketed by the equivalent minority-count representation and 11

both baselines. We also observe explicit ordering failures in the same 50 ms sweep: at (𝛾 = 1.0, cycle = 20), Themis abandons fair ordering once the Condorcet attack breaks its tournament-graph assumption, while Rashnu triggers fallback after over-pruning the graph rather than completing its intended ordering procedure. Taken together, the attack experiments show that FlashOrder degrades more gracefully than SCC-based baselines along both performance and fairness dimensions. Under direct ordering manipulation, FlashOrder both preserves more robust precedence relations and bounds worst-case displacement more tightly, while still sustaining much higher service capacity than Themis and Rashnu.

approaches are complementary: they improve dissemination and proposal, while FlashOrder rewrites the ordering engine that serializes accumulated pairwise evidence into a final order. Layer 2 sequencers. Most L2 rollups employ centralized sequencers, creating MEV opportunities [1]. Mitigations include auctionbased priority (Timeboost [28]) and decentralized sequencer networks (Espresso [4], Astria). FlashOrder is orthogonal: it targets the algorithmic cost of converting replicated evidence into a deterministic fair order, regardless of who controls sequencing.

8 7

RELATED WORK

LIMITATIONS

FlashOrder uses the same thresholded pairwise evidence model as 𝛾-batch-order-fair protocols, but its quotient graph aggregates evidence at the cluster level. Therefore, an unconditional statement that every robust pair is preserved across clusters would require an additional separation condition: the pair’s signal must either induce the correct quotient edge or be absorbed into the same final cluster. The correctness arguments in Section 5 make this condition explicit, keeping the correctness claim aligned with the algorithmic object FlashOrder actually constructs, while separating it from the empirical quality metrics reported in Section 6.5. In particular, FlashOrder does not claim unconditional 𝛾-batchorder-fairness for arbitrary cyclic regions. Intra-cluster Net-Preference Score is a deterministic refinement for ambiguous or cyclic regions; it does not claim to satisfy all robust pairs inside arbitrary Condorcet cycles, which is precisely the hard case identified by bounded-unfairness analyses [24]. Its role is to provide a reproducible total order whose fairness quality is measured empirically through robust-pair satisfaction and rank displacement.

The proliferation of MEV in DeFi [13, 26, 35, 36] has motivated substantial research on order-fairness [11, 27]. We organize this literature into three layers. Fairness definitions. Aequitas [23] formalized batch orderfairness through pairwise receive-order constraints, later adopted by Themis. Wendy [25] and Pompe [51] explored timestamp-style fairness with weaker guarantees. Quick Order Fairness [7] studies efficiency boundaries, DCN [12] uses decentralized clocks, and bounded unfairness [24] shows that minimizing order distortion inside cyclic regions is NP-hard. UC Transaction Serialization [11] elevates fairness into composable cryptographic abstractions. FlashOrder does not redefine fairness; it provides a deterministic execution path for the 𝛾-batch-order-fairness regime. Ordering engines. The dominant systems line keeps pairwise evidence but realizes it through graph-based aggregation. Themis [22] made this approach practical through deferred ordering and batch unspooling, while Rashnu [32] reduces graph size by focusing on data-dependent transactions. Phalanx [46] performs ordered Byzantine consensus through graph-style dependency processing. These systems share the same SCC-based execution path. Subsequent work tries to improve this pipeline: CFTO [33] reduces communication overhead; Age-Aware Fairness [41] controls tail delay; Dikaios [47] prunes dependency graphs; EquiBFT [8] uses weighted voting; TEE-based approaches [43] rely on stronger trust assumptions. Auncel [10] also targets the SCC bottleneck, but solves it through weight-based linearization (𝑊 = 1 − 𝑘 𝑑 ) that commits all transactions in a single consensus round, yielding a total order without explicit cycle resolution. FlashOrder takes a different execution-level approach: it restructures ordering so that ambiguity remains localized through adaptive clustering before a batch-wide SCC can form, and uses hierarchical serialization rather than a single global pass. Its intra-cluster Net-Preference Score is related to aggregate preference rules in social choice theory [5], used as a deterministic local refinement rather than an optimal solution to cyclic aggregation. Protocol architectures. SpeedyFair [30] decouples ordering from consensus, a philosophy FlashOrder also adopts. Narwhal/Tusk [14], Bullshark [42], Shoal++ [2], Mysticeti [3], Sailfish [40], Autobahn [19], and Jolteon/Ditto [17] improve DAG-based BFT throughput but do not solve fair ordering. FairDAG [20], DAG of DAGs [31], and Fides [48] integrate fair ordering into the DAG-based proposer layer, while Travelers [49] reduces communication complexity for fair ordering through probabilistic techniques. These

9

CONCLUSION

FlashOrder is a deterministic fair-ordering engine that addresses the ordering-engine bottleneck of global SCC condensation in BFT transaction sequencing. By projecting pairwise preferences into a one-dimensional canonical embedding and localizing cyclic ambiguity through adaptive clustering and hierarchical serialization, FlashOrder shifts the critical path from batch-wide graph traversal to localized sorting and aggregation. Across prototype deployment and controlled simulation, FlashOrder achieves up to 10.5× higher throughput than Themis and 4.8× higher than Rashnu, with 77.2% throughput retention relative to the non-fairness baseline at 𝑛=101. Under Condorcet attacks in a 50 ms WAN, FlashOrder sustains 12.0× and 9.7× higher throughput than Themis and Rashnu on average, while reducing ordering latency from 13.0 s to 0.56 s over Themis. At 𝛾=0.8, FlashOrder reduces maximum rank displacement from 301 and 287 to 34 positions (an 88.7% reduction) and achieves an RPS of 0.873, improving to near-perfect RPS of 0.996 and MaxDisp of 10 at the stricter 𝛾=0.51 setting. FlashOrder shows that fair ordering can be made more practical and replay-verifiable by restructuring the ordering engine itself, without changing the pairwise evidence model or redesigning the consensus substrate. Future work will integrate this localized ordering path with DAG-based consensus architectures, connect it more tightly to composable fairness frameworks, and extend it to broader shared-sequencing settings. 12

REFERENCES

Consensus with Asynchronous Fallback. In Financial Cryptography and Data Security – 26th International Conference, FC 2022, Grenada, May 2-6, 2022 (Lecture Notes in Computer Science). Springer, 296–315. https://doi.org/10.1007/978-3031-18283-9_14 [18] Yossi Gilad, Rotem Hemo, Silvio Micali, Georgios Vlachos, and Nickolai Zeldovich. 2017. Algorand: Scaling Byzantine Agreements for Cryptocurrencies. In Proceedings of the 26th Symposium on Operating Systems Principles, SOSP 2017, Shanghai, China, October 28-31, 2017. ACM, 51–68. https://doi.org/10.1145/3132747.3132757 [19] Neil Giridharan, Florian Suri-Payer, Ittai Abraham, Lorenzo Alvisi, and Natacha Crooks. 2024. Autobahn: Seamless High Speed BFT. In Proceedings of the ACM SIGOPS 30th Symposium on Operating Systems Principles, SOSP 2024. ACM, 1–23. [20] Dakai Kang, Junchao Chen, Tien Tuan Anh Dinh, and Mohammad Sadoghi. 2025. FairDAG: Consensus Fairness over Multi-Proposer Causal Design. Proc. VLDB Endow. 19, 2 (2025), 265–278. https://doi.org/10.14778/3773749.3773763 [21] Idit Keidar, Eleftherios Kokoris-Kogias, Oded Naor, and Alexander Spiegelman. 2021. All You Need is DAG. In Proceedings of the 2021 ACM Symposium on Principles of Distributed Computing, PODC 2021, Virtual Event, Italy, July 26-30, 2021. ACM, 165–175. https://doi.org/10.1145/3465084.3467905 [22] Mahimna Kelkar, Soubhik Deb, Sishan Long, Ari Juels, and Sreeram Kannan. 2023. Themis: Fast, Strong Order-Fairness in Byzantine Consensus. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen, Denmark, November 26-30, 2023. ACM, 475–489. https: //doi.org/10.1145/3576915.3616658 [23] Mahimna Kelkar, Fan Zhang, Steven Goldfeder, and Ari Juels. 2020. OrderFairness for Byzantine Consensus. In Advances in Cryptology – CRYPTO 2020: 40th Annual International Cryptology Conference, CRYPTO 2020, Santa Barbara, CA, USA, August 17-21, 2020, Proceedings, Part III (Lecture Notes in Computer Science), Vol. 12172. Springer International Publishing, 451–480. https://doi.org/ 10.1007/978-3-030-56877-1_16 [24] Aggelos Kiayias, Nikos Leonardos, and Yu Shen. 2024. Ordering transactions with bounded unfairness: Definitions, complexity and constructions. In Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 34–63. [25] Klaus Kursawe. 2020. Wendy, the Good Little Fairness Widget: Achieving Order Fairness for Blockchains. In Proceedings of the 2nd ACM Conference on Advances in Financial Technologies, AFT 2020, New York, NY, USA, October 21-23, 2020. ACM, 25–36. https://doi.org/10.1145/3419614.3423263 [26] Zihao Li, Jianfeng Li, Zheyuan He, Xiapu Luo, Ting Wang, Xiaoze Ni, Wenwu Yang, Xi Chen, and Ting Chen. 2023. Demystifying DeFi MEV Activities in Flashbots Bundle. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen, Denmark, November 26-30, 2023. ACM, 165–179. https://doi.org/10.1145/3576915.3616590 [27] Zhuolun Li and Evangelos Pournaras. 2024. SoK: Consensus for Fair Message Ordering. CoRR abs/2411.09981 (2024). https://doi.org/10.48550/arXiv.2411.09981 arXiv:2411.09981 [28] Akaki Mamageishvili, Mahimna Kelkar, Jan Christoph Schlegel, and Edward W. Felten. 2023. Buying Time: Latency Racing vs. Bidding for Transaction Ordering. In 5th Conference on Advances in Financial Technologies, AFT 2023, Princeton, NJ, USA, October 23-25, 2023 (Leibniz International Proceedings in Informatics (LIPIcs)), Vol. 282. Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 23:1–23:22. https://doi.org/10.4230/LIPIcs.AFT.2023.23 [29] Andrew Miller, Yu Xia, Kyle Croman, Elaine Shi, and Dawn Song. 2016. The HoneyBadger of BFT Protocols. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS 2016, Vienna, Austria, October 24-28, 2016. ACM, 31–42. https://doi.org/10.1145/2976749.2978399 [30] Ke Mu, Bo Yin, Alia Asheralieva, and Xuetao Wei. 2024. Separation is Good: A Faster Order-Fairness Byzantine Consensus. In 31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024. The Internet Society. [31] Heena Nagda, Sidharth Sankhe, Sakshi Sinha, Keon Attarha, Mohammad Javad Amiri, and Boon Thau Loo. 2025. DAG of DAGs: Order-Fairness Made Practical. Proc. ACM Manag. Data 3, 6 (2025), 1–27. https://doi.org/10.1145/3769777 [32] Heena Nagda, Shubhendra Pal Singhal, Mohammad Javad Amiri, and Boon Thau Loo. 2024. Rashnu: Data-Dependent Order-Fairness. Proc. VLDB Endow. 17, 9 (2024), 2335–2348. https://doi.org/10.14778/3665844.3665861 [33] Mohammad Nassar, Ori Rottenstreich, and Ariel Orda. 2024. CFTO: Communication-Aware Fairness in Blockchain Transaction Ordering. IEEE Trans. Netw. Serv. Manag. 21, 1 (2024), 490–506. https://doi.org/10.1109/TNSM. 2023.3298201 [34] Eunchan Park, Taeung Yoon, Hocheol Nam, Deepak Maram, and Min Suk Kang. 2025. On Frontrunning Risks in Batch-Order Fair Systems for Blockchains. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 2025, Taipei, Taiwan, October 13-17, 2025. ACM, 918–932. https: //doi.org/10.1145/3719027.3744879 [35] Kaihua Qin, Liyi Zhou, and Arthur Gervais. 2022. Quantifying Blockchain Extractable Value: How dark is the forest?. In 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022. IEEE, 198–214. https://doi.org/10.1109/SP46214.2022.9833734

[1] Zeinab Alipanahloo, Abdelhakim Senhaji Hafid, and Kaiwen Zhang. 2024. Maximum Extractable Value (MEV) Mitigation Approaches in Ethereum and Layer2 Chains: A Comprehensive Survey. IEEE Access 12 (2024), 185212–185231. https://doi.org/10.1109/ACCESS.2024.3514375 [2] Balaji Arun, Zekun Li, Florian Suri-Payer, Sourav Das, and Alexander Spiegelman. 2025. Shoal++: High Throughput DAG BFT Can Be Fast and Robust!. In 22nd USENIX Symposium on Networked Systems Design and Implementation, NSDI 2025, Philadelphia, PA, USA, April 28-30, 2025. USENIX Association, 813–826. [3] Kushal Babel, Andrey Chursin, George Danezis, Anastasios Kichidis, Lefteris Kokoris-Kogias, Arun Koshy, Alberto Sonnino, and Mingwei Tian. 2025. Mysticeti: Reaching the Latency Limits with Uncertified DAGs. In Proceedings of the 2025 Network and Distributed System Security Symposium, NDSS 2025, San Diego, CA, USA, February 24-28, 2025. The Internet Society. https: //doi.org/10.14722/ndss.2025.240929 [4] Jeb Bearer, Benedikt Bünz, Philippe Camacho, Binyi Chen, Ellie Davidson, Ben Fisch, Brendon Fish, Gus Gutoski, Fernando Krell, Chengyu Lin, Dahlia Malkhi, Kartik Nayak, Keyao Shen, Alex Xiong, Nathan Yospe, and Sishan Long. 2024. The Espresso Sequencing Network: HotShot Consensus, Tiramisu Data-Availability, and Builder-Exchange. Cryptology ePrint Archive, Paper 2024/1189. https: //eprint.iacr.org/2024/1189 [5] Felix Brandt, Vincent Conitzer, Ulle Endriss, Jérôme Lang, and Ariel D. Procaccia. 2016. Handbook of Computational Social Choice. Cambridge University Press. [6] Ethan Buchman, Jae Kwon, and Zarko Milosevic. 2018. The Latest Gossip on BFT Consensus. CoRR abs/1807.04938 (2018). arXiv:1807.04938 [7] Christian Cachin, Jovana Micic, Nathalie Steinhauer, and Luca Zanolini. 2022. Quick Order Fairness. In Financial Cryptography and Data Security – 26th International Conference, FC 2022, Grenada, May 2-6, 2022, Revised Selected Papers (Lecture Notes in Computer Science). Springer, 316–333. https://doi.org/10.1007/978-3031-18283-9_15 [8] Siwei Cai, Lei Fan, Shengyun Liu, and Hong-Sheng Zhou. 2025. EquiBFT: A Framework for Achieving Fairness in BFT Consensus. In 45th IEEE International Conference on Distributed Computing Systems, ICDCS 2025, Glasgow, United Kingdom, July 21-23, 2025. IEEE, 341–351. https://doi.org/10.1109/ICDCS63083.2025. 00041 [9] Miguel Castro and Barbara Liskov. 1999. Practical Byzantine Fault Tolerance. In Proceedings of the 3rd Symposium on Operating Systems Design and Implementation, OSDI 1999, New Orleans, Louisiana, USA, February 22-25, 1999. USENIX Association, 173–186. [10] Wuhui Chen, Yikai Feng, Jianting Zhang, Zhongteng Cai, Hong-Ning Dai, and Zibin Zheng. 2024. Auncel: Fair Byzantine Consensus Protocol with High Performance. In IEEE INFOCOM 2024 - IEEE Conference on Computer Communications, Vancouver, BC, Canada, May 20-23, 2024. IEEE, 1251–1260. https://doi.org/10.1109/INFOCOM52122.2024.10621379 [11] Michele Ciampi, Aggelos Kiayias, and Yu Shen. 2024. Universal Composable Transaction Serialization with Order Fairness. In Advances in Cryptology – CRYPTO 2024: 44th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 18-22, 2024, Proceedings, Part I (Lecture Notes in Computer Science), Vol. 14921. Springer Nature Switzerland, 147–180. https: //doi.org/10.1007/978-3-031-68379-4_5 [12] Andrei Constantinescu, Diana Ghinea, Lioba Heimbach, Zilin Wang, and Roger Wattenhofer. 2024. A Fair and Resilient Decentralized Clock Network for Transaction Ordering. In 27th International Conference on Principles of Distributed Systems, OPODIS 2023, Tokyo, Japan, December 6-8, 2023 (Leibniz International Proceedings in Informatics (LIPIcs)), Vol. 286. Schloss Dagstuhl – Leibniz-Zentrum für Informatik, 8:1–8:20. https://doi.org/10.4230/LIPIcs.OPODIS.2023.8 [13] Philip Daian, Steven Goldfeder, Tyler Kell, Yunqi Li, Xueyuan Zhao, Iddo Bentov, Lorenz Breidenbach, and Ari Juels. 2020. Flash Boys 2.0: Frontrunning in Decentralized Exchanges, Miner Extractable Value, and Consensus Instability. In 2020 IEEE Symposium on Security and Privacy, SP 2020, San Francisco, CA, USA, May 18-21, 2020. IEEE, 910–927. https://doi.org/10.1109/SP40000.2020.00040 [14] George Danezis, Lefteris Kokoris-Kogias, Alberto Sonnino, and Alexander Spiegelman. 2022. Narwhal and Tusk: a DAG-based mempool and efficient BFT consensus. In EuroSys ’22: Seventeenth European Conference on Computer Systems, Rennes, France, April 5 - 8, 2022. ACM, 34–50. https://doi.org/10.1145/ 3492321.3519594 [15] Marquis de Condorcet. 1785. Essai sur l’application de l’analyse à la probabilité des décisions rendues à la pluralité des voix. Imprimerie Royale, Paris. [16] Dmitry Duplyakin, Robert Ricci, Aleksander Maricq, Gary Wong, Jonathon Duerig, Eric Eide, Leigh Stoller, Mike Hibler, David Johnson, Kirk Webb, Aditya Akella, Kuang-Ching Wang, Glenn Ricart, Larry Landweber, Chip Elliott, Michael Zink, Emmanuel Cecchet, Snigdhaswin Kar, and Prabodh Mishra. 2019. The Design and Operation of CloudLab. In Proceedings of the 2019 USENIX Annual Technical Conference, USENIX ATC 2019, Renton, WA, USA, July 10-12, 2019. USENIX Association, 1–14. [17] Rati Gelashvili, Lefteris Kokoris-Kogias, Alberto Sonnino, Alexander Spiegelman, and Zhuolun Xiang. 2022. Jolteon and Ditto: Network-Adaptive Efficient 13

[36] Kaihua Qin, Liyi Zhou, Benjamin Livshits, and Arthur Gervais. 2021. Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit. In Financial Cryptography and Data Security – 25th International Conference, FC 2021, Virtual Event, March 1-5, 2021 (Lecture Notes in Computer Science). Springer, 3–32. [37] Pengkun Ren, Hai Dong, Nasrin Sohrabi, Zahir Tari, and Pengcheng Zhang. 2025. Proof-Carrying Fair Ordering: Asymmetric Verification for BFT via Incremental Graphs. CoRR abs/2510.14186 (2025). arXiv:2510.14186 [38] Team Rocket, Maofan Yin, Kevin Sekniqi, Robbert van Renesse, and Emin Gün Sirer. 2020. Scalable and Probabilistic Leaderless BFT Consensus through Metastability. CoRR abs/1906.08936 (2020). arXiv:1906.08936 [39] Pingcheng Ruan, Tien Tuan Anh Dinh, Dumitrel Loghin, Meihui Zhang, Gang Chen, Qian Lin, and Beng Chin Ooi. 2021. Blockchains vs. Distributed Databases: Dichotomy and Fusion. In Proc. ACM SIGMOD/{PODS} Conf. 1504–1517. https: //doi.org/10.1145/3448016.3452789 [40] Nibesh Shrestha, Ruchit Shrothrium, Aniket Kate, and Kartik Nayak. 2025. Sailfish: Towards Improving the Latency of DAG-based BFT. In 46th IEEE Symposium on Security and Privacy, SP 2025. IEEE. https://doi.org/10.1109/SP61157.2025. 00021 [41] Yaakov Sokolik, Mohammad Nassar, and Ori Rottenstreich. 2025. Age-Aware Fairness in Blockchain Transaction Ordering for Reducing Tail Latency. IEEE/ACM Transactions on Networking 33, 2 (2025), 807–822. https://doi.org/10.1109/TNET. 2024.3503758 [42] Alexander Spiegelman, Neil Giridharan, Alberto Sonnino, and Lefteris KokorisKogias. 2022. Bullshark: DAG BFT Protocols Made Practical. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, Los Angeles, CA, USA, November 7-11, 2022. ACM, 2705–2718. https: //doi.org/10.1145/3548606.3559361 [43] Chrysoula Stathakopoulou, Signe Rüsch, Marcus Brandenburger, and Marko Vukolić. 2021. Adding Fairness to Order: Preventing Front-Running Attacks in BFT Protocols Using TEEs. In 40th IEEE International Symposium on Reliable Distributed Systems, SRDS 2021. IEEE, 34–45. https://doi.org/10.1109/SRDS53918.

2021.00013 [44] Alexander Thomson and Daniel J. Abadi. 2010. The Case for Determinism in Database Systems. Proc. VLDB Endow. 3, 1-2 (2010), 70–80. https://doi.org/10. 14778/1920841.1920855 [45] Mohammad Amin Vafadar and Majid Khabbazian. 2023. Condorcet Attack Against Fair Transaction Ordering. In 5th Conference on Advances in Financial Technologies, AFT 2023, Princeton, NJ, USA, October 23-25, 2023 (LIPIcs). Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 15:1–15:21. https://doi.org/10.4230/ LIPIcs.AFT.2023.15 [46] Guangren Wang, Liang Cai, Fangyu Gai, and Jianyu Niu. 2022. Phalanx: A Practical Byzantine Ordered Consensus Protocol. CoRR abs/2209.08512 (2022). arXiv:2209.08512 [47] Yang Wang, Xiaofei Xing, Guojun Wang, Yuheng Zhang, and Peiqiang Li. 2025. Dikaios: Position-anchored group ordering with reputation for fair and efficient Byzantine consensus. Comput. Networks 269 (2025), 111423. https://doi.org/10. 1016/j.comnet.2025.111423 [48] Shaokang Xie, Dakai Kang, Hanzheng Lyu, Jianyu Niu, and Mohammad Sadoghi. 2025. Fides: Scalable Censorship-Resistant DAG Consensus via Trusted Components. CoRR abs/2501.01062 (2025). arXiv:2501.01062 [49] Bowen Xue and Sreeram Kannan. 2024. Travelers: A scalable fair ordering BFT system. arXiv preprint arXiv:2401.02030 (2024). [50] Maofan Yin, Dahlia Malkhi, Michael K. Reiter, Guy Golan-Gueta, and Ittai Abraham. 2019. HotStuff: BFT Consensus with Linearity and Responsiveness. In Proceedings of the 2019 ACM Symposium on Principles of Distributed Computing, PODC 2019, Toronto, ON, Canada, July 29 - August 2, 2019. ACM, 347–356. https://doi.org/10.1145/3293611.3331591 [51] Yunhao Zhang, Srinath T. V. Setty, Qi Chen, Lidong Zhou, and Lorenzo Alvisi. 2020. Byzantine Ordered Consensus without Byzantine Oligarchy. In 14th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2020, Virtual Event, November 4-6, 2020. USENIX Association, 633–649.

14

Related documents

• Ricœur’s Intersection and the Harmonisation of Law and Algorithms#1178399
• Fundamentals of domination in graphs#1179875
• Blockchain security enhancement: an approach towards hybrid consensus algorithms and machine learning techniques#133957
• The 11/6 supremum of the Wang-Sitters rounding scheme for graph balancing#998384
• Reconciling blockchain technology and data protection laws: regulatory challenges, technical solutions, and practical pathways#461654