Fact Check: DARPA Funded Report on Blockchain Centralization

On June 21, 2022, a DARPA-funded report on blockchain centralization was released by Trail of Bits, a security research firm. 

In this analysis, we will examine and fact check some of the claims in the report. We will focus primarily on Bitcoin, as that is the only blockchain that has demonstrated true resilience to attack in real world conditions. We will also contrast the academic findings in the paper with real world tests of these theories. 

There is constant research into attacks in Bitcoin space, and much of it is interesting, relevant, and worth considering. As Bitcoin’s fundamental purpose is resistance to state-level attack, the premise of new attack vectors is exciting and worthy of discussion. With the system transmitting more than a trillion dollars of value yearly, it is also constantly subject to real world conditions for attack as one of the biggest financial honeypots in the world.

We concur with the report that most blockchains are centralized to varying degrees, ranging from “decentralization theater” to being fully centralized without any pretense of decentralization. Unfortunately, we find many significant problems with the paper’s analysis of Bitcoin. Below we will address most of the major claims in the report. 

Every widely used blockchain has a privileged set of entities that can modify the semantics of the blockchain to potentially change past transactions […] There are currently four active contributors with access to modify the Bitcoin Core codebase, the compromise of any of whom would allow for arbitrary modification of the codebase.

The code chosen by the users was run by many nodes, despite that the change was not implemented by the “four active contributors” claimed by the authors. Even if we focus on the most popular Bitcoin client, bitcoin-core, the claim that four people control the source code is also FALSE. A more in depth look at how changes happen in Bitcoin is available here.

Many other blockchains employ a forced-upgrade mechanism such as Ethereum’s difficulty bombs. In those cases, we find the claim to be largely TRUE because nodes are forced to upgrade in order to remain operational.

The number of entities sufficient to disrupt a blockchain is relatively low: four for Bitcoin, two for Ethereum, and less than a dozen for most PoS networks.

We find the claim MOSTLY TRUE for other blockchains, especially those running staking systems, as most of the stake is typically sitting at large centralized exchanges or datacenters, is in the hands of founders and insiders who granted themselves large token distributions, and can be used to compromise vote-based systems.

For a blockchain to be optimally distributed, there must be a so-called Sybil cost. There is currently no known way to implement Sybil costs in a permissionless blockchain like Bitcoin. 

Sybil attacks cannot trick a Bitcoin node into accepting a false copy of the blockchain. The node needs only a *single* connection to an honest node to be resilient to this attack due to the consensus of Bitcoin being based on the heaviest/greatest proof of work chain being the true copy. It does not matter if attackers take over 99.9% of the network. 

There is a strong sybil cost in Bitcoin as far as mining goes: producing valid blocks requires burning real world energy. A malicious miner would have to consume significant real world energy to produce (still valid) blocks to starve the chain of transactions. A miner producing invalid blocks simply burns energy and loses money.

A dense, possibly non-scale-free, subnetwork of Bitcoin nodes appears to be largely responsible for reaching consensus and communicating with miners.

Consensus from this perspective is maintained at the edges (i.e. on each node that receives coins). It does not matter what happens in the middle. More on this topic is covered in the article Bitcoin Miners Beware: Invalid Blocks Need Not Apply. 

The authors imply that attacking the network layer can allow the attacker to tamper with data transmission, but censorship (omission of data) is the only feasible attack. If a node finds that its transactions are not being included in the blockchain, it can trivially connect to other nodes that are honest/functioning. Any attacks that attempt to starve the network of data transmission must control vast areas of the Internet, and last forever to be effective. 

The standard protocol for coordination within blockchain mining pools, Stratum, is unencrypted and, effectively, unauthenticated.

The paper also fails to mention that work on Stratum v2 is quite advanced and includes a solution to many of these problems including encryption, authentication, and pushing more decisions about block composition to the end miners rather than trusting the pool to select and order transactions. 

When nodes have an out-of-date or incorrect view of the network, this lowers the percentage of the hashrate necessary to execute a standard 51% attack

Bitcoin traffic is unencrypted—any third party on the network route between nodes (e.g., ISPs, Wi-Fi access point operators, or governments) can observe and choose to drop any messages they wish.

The Bitcoin Core client has a hard-coded delay of two minutes before it gossips new verified blocks to a peer. 

Over the past year, a malicious actor (widely believed to be from Russia) used a Sybil attack to gain control of up to 40% of Tor exit nodes. The attacker used the nodes to rewrite Bitcoin traffic.

The claim that Bitcoin traffic can be rewritten is impossible based on the design of digital signatures. Bitcoin transactions are digitally signed with ECDSA signatures. It is not possible to “rewrite Bitcoin traffic” without making transaction signatures invalid, and thus unacceptable to the receiving nodes. It is impossible to tamper with blocks without making them invalid.

The two countries with the highest percentage of non-Tor nodes, the United States and Germany, have the highest aggregate consensus influence in Bitcoin.

21% of Bitcoin nodes are running an old version of the Bitcoin Core client that is known to be vulnerable.

As a thought experiment, if we spin up a million nodes in a cloud datacenter running an old version of the software, nothing at all about the health of the network would change. However, using the methodology in the paper, the authors would conclude that 99.9+% of the network is centralized in a single datacenter and vulnerable to being crashed. Bitcoin network topology analysis is thus largely an academic exercise with few real world implications. Companies in the Bitcoin space regularly spin up large numbers of nodes for experimentation.

The majority of Bitcoin nodes have significant incentives to behave dishonestly.

The Bitcoin system, which transfers over $1 Trillion dollars annually offers a significant honeypot for successful attacks. There are few systems of this financial magnitude, and all of them are attacked constantly, including Bitcoin. If an attack was possible, it would be tried, which we are not seeing today. Again, it is important to remember that censorship attacks are trivially defeated by transmitting a signed transaction to only a single honest mining node, no matter how many nodes the attacker controls, and this could literally be done on a handwritten piece of paper if necessary.

In this report, we identified several scenarios in which blockchain immutability is called into question not by exploiting cryptographic vulnerabilities but instead by subverting the properties of a blockchain’s implementation, networking, or consensus protocol.

At face value, the paper elaborates on many already explored attack vectors in Bitcoin, some of which Bitcoin was literally invented to solve (sybil attacks), but fails to give context to the attacks and their achievability and consequences in the real world.

In particular, “eclipse attacks” and “sybil attacks” which force a node to make connections to malicious nodes are not effective against Bitcoin. The node requires a single connection to another honest node to see the true blockchain. 

Even if fully eclipsed, the node will not accept invalid transactions because it enforces the rules of Bitcoin consensus using its local software. The most damaging types of attack here might be a double spending attack, in which the attacker tries to exchange Bitcoin for some other currency and get away with it, as well as censorship attacks. 

In practice, double spending is attempted on centralized exchanges and is very difficult to impossible to get away with in real life — especially on Bitcoin where it is easy to run a full node. In order for such an attack to be practical, you’re going to need to control enough of the internet to trick an exchange to connect to only malicious nodes, and that you’re going to sustain this long enough for nobody to notice and to steal funds without leaving an identifying trail in the traditional banking system.

The authors claim that Bitcoin could be attacked at the network layer to achieve censorship. Again, the authors have failed to demonstrate this in real world conditions, and have failed to mention that a connection to a single honest node with connectivity to the honest partition of the network defeats the attack.

Finally, the authors fail to clarify the significance of a 51% attack. Such an attack does not allow the attacker to create coins from thin air, spend coins that aren’t theirs, steal user funds, or really do anything of value other than censor transactions or starve the chain of blocks. Additionally, such an attack must be maintained literally forever and is very expensive to even launch, let alone sustain, because as soon as the remaining honest miners of the world have a majority hashpower, they can continue producing normal blocks. 

Any attack that wasn’t able to last forever would ultimately restore functionality to Bitcoin, thus only proving its strength. Rewriting the history of the blockchain is an even more daunting and unachievable goal due to the exponential energy costs required to do so, and to do so in perpetuity against an honest group of miners. A further exposition of 51% attacks is available here: Is Bitcoin mining centralization a threat? 

We conclude that the DARPA funded paper on blockchain centralization by Sultanik et al. contains many false or misleading claims and cannot be treated seriously.