An Economic Definition for Censorship Resistance - Censorship.wtf

Intro

Traditionally, censorship resistance meant that valid transactions eventually get added to the blockchain. But for some transactions like those from oracles or arbitrage traders, just eventual inclusion is not good enough - they need to get on chain quickly to be useful

Mallesh argues we need a new definition of censorship resistance : one that guarantees timely inclusion of transactions, not just eventual inclusion. This would allow new mechanisms like on-chain auctions. It could also help rollups and improve blockchain protocols overall.

Vitalik already talked about it in 2015, but Mallesh is advocating for the community to revisit it now, as timely transaction inclusion unlocks new capabilities.

A thought experiment

Let's take an example of an "European Option", a financial contract where an user agrees to pay the difference between a reference price (say $50) and the market price of an asset at a future date (block X), if the market price is higher

On block X, if the price is $60, the user owes the holder $10 (the difference between price at block X and reference price). The holder would be willing to pay up to $10 to get the transaction included on the blockchain to exercise the option. But the user also has incentive to pay up to $10 to censor the transaction and avoid paying out.

On the expiration date, there is an incentive for both parties to pay high fees to either execute or censor the transaction. This creates an implicit auction for block space where the transaction will end up going to whoever is willing to pay more in fees.

The dark side of PBS

The existing fee auction model enables censorship. By paying high fees, you can block valid transactions without others knowing

This is not just thoretical, as Special Mechanisms Group demonstrated the problem some weeks before the presentation : by buying a block that contained only their own promotional transaction, they could have silently censored others by including some but not all valid transactions

The key problems :

• Options and other time-sensitive DeFi transactions create incentives for participants to engage in blocking/censorship bidding wars. This extracts value rather than creating it.
• The existing fee auction model allows value extraction through silent censorship by omitting transactions without it being visible.

Economic definition of censorship resistance

Mallesh introduces the concept of a "public bulletin board" to abstractly model blockchain censorship resistance. This model has two operations

• Read : Always succeeds, no cost. Lets you read board contents.
• Write : Takes data and a tip "t". Succeeds and costs t, or fails and costs nothing

Censorship resistance is defined as a fee function - the cost for a censor to make a write fail. Higher fees indicate more resistance.

Some examples

• Single designated block : Censorship fee is around t. A censor can outbid the transaction tip to block it.
• EIP-1559 : Potentially worse resistance since base fee is burnt. Censor only needs to outbid t-b where b is base fee

The goal is to reach high censorship fees regardless of t, through better blockchain design, like multiple consecutive slots.

Better censorship resistance

Having multiple consecutive slots with different producers increases censorship fees.

A censor must pay off each producer to block a transaction, costing k*t for k slots at tip t. But this also increases read latency - you must wait for k blocks.

On-Chain Auctions

Low censorship resistance limits on-chain mechanisms like auctions. As an example, consider a second-price auction in 1 block with N+1 bidders :

• Bidders 1 to N are honest, submit bids b_i and tips t_i
• Bidder 0 is a censor. It waits for bids, offers the producer p to exclude some bids.
• Producer sees all bids/tips, and censor's offer p. It decides which transactions to include.
• Auction executes on included bids.

A censor can disrupt the auction by blocking bids. This exploits the low censorship resistance of a single block.

Warm up

Suppose a second-price auction with just 1 honest bidder and 1 censor bidder :

• The honest bidder bids their value v. Their tip t must be < v, otherwise they overpay even if they win.
• The censor sees t is less than v, so it will censor whenever its value w > t. It pays the producer slightly more than t to exclude the honest bidder's bid.
• Knowing this, the honest bidder chooses t to maximize profit, resulting in a formula relating t to v.

With N+1 bidders :

Honest bidders bid their value but tip low due to censorship risk. The censor often finds it profitable to exclude all other bids and win for free.

As a result, the auction revenue collapses - the censor gets the item cheaply. If multiple censors, the producer running the auction extracts most of the value.

Proposed solution : Multiple Concurrent Block Proposers

Mallesh proposes a solution to the blockchain censorship problem using multiple concurrent block producers rather than one monopolist producer.

Have k block producers who can all submit blocks concurrently. The blockchain contains the union of all blocks.

Tips are conditional : small tip t if included by multiple producers, large tip T if only included by one.

This creates a "Prisoner's Dilemma" for producers - including is a dominant strategy to get more tips.

Cost of inclusion is low (kt) but censorship resistance is high (kT) with the right t and T. Hence, a censor finds it too expensive to bribe all producers. Honest bidders can participate fairly.

Concluding thoughts

Benefits :

• Removes producer monopoly power over censorship.
• Lowers tipping requirements for inclusion.
• Enables more on-chain mechanisms like auctions resistant to censorship attacks.

But the community needs to think about which of these notions to adopt/prioritize/optimize for.