Decaying Vote Weight in Consensus: Three Fixes, Three New Attacks

A weighted consensus that decays validator vote weight to reward liveness looks clean until you realize each fix you apply to the protocol opens a new attack vector that the previous fix had sealed.

The Cascade: Drift, Halt, Eclipse

Start with a sensible goal: let voting weight track live participation. Decay the weight of stale validators. If you mix proof of work, staked capital, and earned contribution, you naturally decay the work and contribution portions while leaving staked capital untouched—capital is at risk regardless of activity. First attack: under any correlated quiet period, live weight drifts toward capital. A patient capital holder who walks away keeps full weight while active participants fade. The franchise collapses toward the one undecayed resource.

So you decay all three symmetrically. Now the effective mix holds steady under uniform staleness. You've closed the drift. But your finalization bar was a fraction of total base weight. With everyone decayed, the supporting weight you can actually gather falls below two thirds of that base bar even when every present validator agrees. The chain halts under low participation. The bar is measured against weight that no longer exists.

Shift the bar to measure against effective present weight instead. Now a unanimous set finalizes, halts are gone. Third attack: an attacker who can make honest validators appear absent—via eclipse or heartbeat censorship—shrinks the denominator. A minority that could never reach two thirds of the real set now reaches two thirds of the shrunken set and finalizes alone. The base-weight bar was eclipse-resistant precisely because attackers couldn't shrink it. You traded halt resistance for eclipse resistance without noticing.

The Hybrid That Holds

The fix that actually holds is a hybrid: take the basis as the larger of the present effective weight and an absolute quorum floor—a fixed fraction of the base weight. Below the floor the denominator cannot shrink, so an eclipse attacker cannot manufacture a supermajority out of a thin set. Above the floor the effective term governs, so real participation still finalizes and the halt stays closed.

The analysis states a falsifiable claim: under the hybrid basis with the floor set at a fixed fraction of base weight, no coalition holding less than that floor fraction of the honest set can finalize, regardless of how stale or eclipsed the rest appear. If anyone can exhibit a sub-floor finalization with the floor enforced, the hybrid is wrong.

Why This Matters Beyond the Chain

Each of the three fixes—decay weight, measure against present weight—is locally correct and publishable on its own. Each reintroduces a problem the previous step solved because liveness and eclipse resistance are both functions of the same quantity: the threshold denominator. You cannot tune one without moving the other.

The next time you see a weighted consensus proposal with decaying weights, check whether it pins a floor under the denominator. If it doesn't, the eclipse attack is already baked in.

Source: Three fixes, three new attacks: decaying vote weight in a weighted consensus
Domain: ethresear.ch