docs(blockchain): detect Blend network delivery failure and react to it

[madxor]

[RFC-PR] Blend Failure Detection and Reaction

Reviewer Orientation

Prerequisite context: read Motivation first. The Blend Protocol's message lifecycle, Proof of Quota, Proof of Selection, and the Cryptarchia occupied-slot machinery are assumed and unchanged; the changes are new sections and parameters in the Blend Protocol plus one sentence in Block Construction.

#	Priority	Document / Change	What to look for
1	Critical	Start here — Blend Protocol → Bypass Mode, Chain Starvation (details)	the bypass — broadcasting proposals unprotected — is opened by the chain-starvation signal only, never by local evidence; check the gating guards (ONLINE mode, broadcast-channel health) and that entry/exit cannot oscillate or fork the network
2	Critical	Start here — Blend Protocol → Reaction Ladder (details)	every retry must carry the identical proposal (identical block id) — a rebuilt proposal would equivocate; check the quota accounting: R_D = 2 newly fixed, ladder consumes 6 of Q_L = 9 operations
3	High	Blend Protocol → Progress Observation (details)	new detection primitive: a core sender follows its own message hop by hop via PoQ nullifiers; verify it is passive, reveals nothing the sender did not choose, and that the T_H derivation treats the dissemination delay d as network-dependent
4	High	Blend Protocol → Suspect Nodes, Delivery Deadline (details)	abuse resistance: suspicion is capped, epoch-reset, and never affects connections — check an adversary cannot herd senders onto its nodes or get honest nodes isolated
5	Medium	Blend Protocol → Detection, Network Health, Effective Network Size (details)	local health measurements drive only local repair; confirm none of them can trigger the bypass
6	Medium	Blend Protocol → Resilience of the Reaction Ladder (details)	check the delivery/anonymity formulas against the tables, the bypass-forcing thresholds, and whether the three residual risks are acceptable
7	Low	Block Construction → transaction maturity under bypass; Terminology and Fallback additions	skim — one-sentence maturity rule, two new terms, declared-vs-effective network size clarification

Status tracker

• 🚧 Raw (make sure that all below is completed)
  • Template applied
  • Authors filled in
  • Authors agree on the RFC content
• 📘 Draft (make sure that all below is completed)
  • All dependent specifications added (Notion backlinks checked)
  • Specifications to deprecate added, if applicable
  • Specifications to retire added, if applicable
  • Research Lead assigned, or Project Lead assigned if the Research Lead is an author
  • Relevant Research Domain Experts assigned (cannot be authors)
• ⚙️ Verified (make sure that all below is completed)
  • Researchers’ comments addressed
  • All logical changes documented
  • All Research reviewers approve the latest version
  • Engineering Lead assigned
  • Relevant Engineering Domain Experts assigned
• 🔀 Merged (make sure that all below is completed)
  • Engineers’ comments addressed
  • Every change added to the change log
  • All Engineering reviewers approve the latest version
  • Specification version numbers assigned
  • Implementation reviewed and merged
  • Branch updated to master and all conflicts resolved
  • PR merged

Change log

Revision	Description	Date
v1	Initial PR description	2026-08-21

Motivation

The Blend Protocol defines communication failure — a disseminated message that is never broadcast — but specifies no way to detect it and no reaction to it. Every block proposal travels through the Blend network, so adversarial or broken core nodes that stop the network from delivering stop the chain with it, and consensus does not repair this on its own: the leadership-lottery difficulty is recalibrated from slot occupancy only once per epoch, so proposals lost today are compensated days later. The only existing escape, the Fallback rule, is keyed to the declared network size from the SDP snapshot and cannot see a network that is large on paper but not delivering.

The chain must not halt. The network must detect that Blend is failing and route around it — within minutes, using only what each node can observe on its own — and return to it once it recovers.

Proposal

Add a Failure Detection and Reaction mechanism to the Blend Protocol, specified at all three tiers (Overview, Protocol, Details) plus an analysis section. No new message types, no coordination between nodes, and no consensus rule: every signal is locally observable, and the reaction changes only how a proposal is transported — never whether it is valid — so nodes that react differently still accept the same blocks and cannot fork over it.

• Detection: a core sender follows its own message hop by hop through the network (progress observation, per-step deadline T_H); an edge sender, which sees none of the network's traffic, waits for its proposal on the broadcasting channel (delivery deadline T_D); and every node watches for chain starvation — the one signal read identically by all nodes from the chain itself.
• Reaction: a lost proposal is retried through a ladder of progressively shorter blending paths (Λ = (3,2,1)) that avoids the nodes that failed, funded entirely by the leadership quota of the win that produced it; repeat offenders become suspect and are avoided in path construction.
• Bypass: while the chain is starving — and on no other evidence — nodes broadcast their proposals directly, unprotected, keeping all other protocol duties running, and return to the Blend network after a hold-down with staggered timing.

One supporting sentence in Block Construction preserves the transaction-maturity assumption when a proposal is broadcast during a bypass. Newly fixed parameters: R_D = 2, T_H, T_D = 15, S_min = 2, S_max = ⌊N/10⌋, W_S = 600, θ_S = 2, H_B = J_B = 300.

Discussion

Local evidence never opens the bypass

The load-bearing design decision. Everything a node measures about itself — peering degree, inbound traffic, effective network size, even its own proposals failing — can be forged by an adversary sitting on that node's connections, and a bypass triggered by forged local evidence is a deanonymization button: block a target's traffic until it unmasks itself. Chain starvation is the one trigger the adversary cannot produce for a single victim, because every synchronized node reads it from the same source. The deliberate consequence: a node isolated inside the Blend network stays censored rather than revealing itself — its blocks are lost, its privacy is not, and the condition is logged for its operator.

What the ladder trades

Each retry spends anonymity to buy delivery: shorter paths are harder to drop but need fewer adversarial nodes to be fully adversarial. The trade is quantified in the analysis; at 50 % faulty nodes the ladder lifts delivery from 12.5 % to 67.2 %, while worst-case unlinkability (all three attempts made, a third of the network adversarial) degrades from ~99 % to ~75 % — against 0 % for a proposal that is never delivered or is bypassed.

Parameter rationale

Each parameter is derived, not chosen, in its Details section: T_D = 15 from the message-traversal bound 9 + 5d (holds while d < 1.2 rounds); T_H = ⌈Δ_max + 2d⌉ with d derived from network diameter and per-hop cost, and explicitly to be measured rather than assumed; W_S = 600/θ_S = 2 from the binomial false-trigger rate (≈ 3.45·10⁻⁷ per window, one false bypass per ~55 years, detection within 10 minutes); R_D = 2 so that a single lottery win funds the 6-operation ladder with 3 operations spare — the spare is what makes path avoidance implementable, since avoiding a node means leaving the key that selects it unused.

Residual risks

Three, stated and accepted in the analysis: a consensus-layer eclipse can fake starvation for one node (intrinsic to distributed systems, not repairable from below); targeted censorship of an isolated anonymous sender persists by design (intrinsic to anonymous communication); and retry timing is correlated with the drop that caused it — a joint event requiring the adversary both on the randomly selected path and observing the sender, probability q_A·[1−(1−q_A)^Φ_CC] per failed attempt (≈ 3 % at q_A = 0.1, ≈ 23 % at 0.3), yielding a candidate-set sample rather than a link.

Compatibility

No wire-format, state, or consensus change. The mechanism adds local node behavior and parameters; a bypassed proposal is an ordinary valid block. R_D = 2 fixes a parameter the specification previously left open rather than changing a deployed value.

Details

Bypass, gated on chain starvation only

The chain is starving when at most θ_S = 2 of the trailing W_S = 600 slots are occupied — a slot counts if the node holds any valid block carrying it, on any branch — while the node is in ONLINE fork-choice mode and its broadcasting channel is otherwise healthy (peers at target, transactions still arriving). Expected occupancy is 20 slots at f = 1/30; the guards separate "Blend is not delivering" from "I am desynchronized or disconnected".

In bypass mode, own proposals are broadcast directly (linkable to their sender); relaying, processing, broadcasting for others, and cover generation continue unchanged — preserving the anonymity pool for nodes still inside and providing the traffic by which recovery is observed. Exit requires H_B = 300 rounds of continuously healthy connections and observed progress of the node's own generated messages, followed by a random stagger drawn from (0, J_B = 300) so the network cannot oscillate in lockstep; re-entries within an epoch double the hold-down up to 8·H_B. An edge node, which holds no core connections, exits on the chain condition alone.

The reaction ladder

On a detected loss the proposer re-encapsulates and re-releases the proposal:

Attempt	Released	Blending operations
1	on generation	3
2	on the failure of attempt 1	2
3	on the failure of attempt 2	1

Every attempt must carry the identical proposal and therefore the identical block identifier — rebuilding it would place two blocks in one slot under one Proof of Leadership, an equivocation. Each attempt uses keys no previous attempt used (fresh PoQ nullifiers, so the network relays it as a new message), avoids the nodes of failed attempts and suspect nodes as far as the available keys allow, and cancels one scheduled cover message so a core node's emission rate is unchanged. The ladder consumes 6 of the Q_L = β_D + β_D·R_D = 9 blending operations of the lottery win that produced the proposal (R_D = 2); quota of one win must not fund another proposal; the ladder must end by the end of the Transition Period following its keys' epoch. A core node exhausts it within 6·T_H = 24 rounds, an edge node within 3·T_D = 45 — inside one and a half expected block intervals.

Progress observation (core-sender detection)

The sender computed every encapsulation, so each intermediate form of its own message — and the PoQ nullifier in that form's public header — is known to it in advance. Since every message is relayed to every core node, the sender recognizes those forms in the traffic it already relays (a lookup in the existing duplicate-detection nullifier cache) and follows its message hop by hop, restarting a per-step deadline

T_H = ceil(Δ_max + 2d)        # = 4 rounds at minimal network size
d   ≈ D · (t_v + t_l + t_x)   # dissemination delay: hops × per-hop cost
D   ≈ log_{Φ_CC − 1}(N)       # distance across the core network

with t_v the header-verification time (10–20 ms; the forwarding path checks only nullifier and signature — PoQ verification runs on the concurrent processing path). d is a function of the deployment, so nodes should measure T_H as a high quantile of their own observed release-to-observation latencies, with the computed value as the default and T_D as the ceiling. A step that passes unobserved names the node that failed it — including the exit: last intermediate form seen, no broadcast, one culprit. Cover messages provide the same observation for free up to their last intermediate form, making every core node a continuous, cost-free monitor of network health; their exit hop is not probed, so exit censorship is caught by data messages alone. The observation is passive and reveals only what the sender chose itself.

Suspicion and the delivery deadline

T_D = 15 rounds (floor 12) is the end-to-end deadline: the traversal bound β_max·Δ_max + (β_max+2)·d = 11.5 at d = 0.5, plus margin. It is an edge node's only detection and a core node's backstop. On a failure, a core node records one failure against the exact node identified; an edge node against every node of the path. S_min = 2 failures make a node suspect — avoided in path construction but served normally in every other respect, since isolating a node an adversary silenced is what the adversary wants. At most S_max = ⌊N/10⌋ suspects; counters reset each epoch with the key pool. This also gives the relaying incentive of the Rewarding section its enforcement: a node that drops messages loses the senders that would have selected it.

Network health and the effective network size

Three locally-tracked conditions — the share of own messages observed progressing, the effective network size N_eff = N·(A_ok/A) estimated from the connection attempts maintenance already makes, and whether Φ_CC^Min healthy connections can be restored — drive only local repair (reconnect, keep emitting cover, log for the operator). None can trigger the bypass; the Fallback rule stays keyed to the declared SDP size that every node reads identically.

Analysis

New Resilience of the Reaction Ladder section evaluates the two suppression strategies — indiscriminate dropping (destroys cover traffic, visible to connectivity maintenance) and exit censorship (invisible to every traffic measurement, which is why detection is end-to-end) — giving delivery and anonymity-failure tables over q_F = q_A ∈ {0.1 … 0.7}, the expected quota cost (within the 6 reserved operations at every failure rate), and the bypass-forcing thresholds: suppressing > 90 % of proposals for ten minutes needs q_F ≥ 0.91 or q_A ≥ 0.97, past the 2/3 site-percolation threshold at Φ_CC = 4 — by the time nodes bypass, Blend has ceased to be a connected network, so the bypass is not usable as a deanonymization tool. Ends with the three residual risks.

Block Construction: transaction maturity under bypass

The Blend network's delay is what otherwise guarantees that referenced transactions have spread before validators check their mempools. A proposal broadcast during a bypass preserves the assumption by referencing only transactions that entered the proposer's mempool at least T_D earlier; a proposal built before the bypass began has already waited that long.

Terminology and Fallback

New terms broadcast failure (every message carrying a proposal fails) and bypassing (direct, unprotected broadcast); the Fallback section now states explicitly that its rule is keyed to the declared network size — identical for all nodes — and points to the new sections for failures the declared size cannot see.

Implementation

• Implement progress observation: track expected per-layer PoQ nullifiers for own generated messages against the relay duplicate cache; per-step T_H timer with a measured-quantile override of the computed default
• Implement delivery-deadline (T_D) detection: watch the broadcasting channel for the proposer's own block identifier (edge senders; core backstop)
• Implement the reaction ladder: re-encapsulation of the identical proposal with unused keys, failed-node and suspect avoidance in path construction, cover-message cancellation, quota accounting with R_D = 2, Transition-Period cutoff
• Implement suspect tracking: exact attribution (core) vs path-wide (edge), S_min threshold, S_max cap with lowest-counter eviction, epoch reset
• Implement the chain-starvation detector: rolling occupied-slot count over W_S with the ONLINE and broadcast-channel-health guards
• Implement bypass mode: direct broadcast path with the T_D transaction-maturity constraint, unchanged relaying/processing/cover duties, exit hold-down with progress condition, random stagger, doubling backoff, edge-node variant
• Implement N_eff estimation from maintenance connection attempts and operator-facing logging for all network-health conditions
• Add or extend tests / test vectors: ladder timing and quota accounting, retry non-equivocation (identical block id across attempts), starvation-detector false-positive and latency bounds, bypass enter/exit without oscillation
• Simulate delivery and bypass-forcing behavior over q_F/q_A to confirm the analysis tables
• Verify the implementation matches this specification

Affected Specifications

Specification	Status	Note
Blend Protocol	Modified	→ 1.2.0; new Failure Detection and Reaction sections at all three tiers, new parameters, new analysis section
Block Construction, Validation and Execution	Modified	→ 1.2.1; one sentence on transaction maturity under bypass
Message Encapsulation Mechanism	—	unchanged, flagged for attention: Progress Observation relies on its reconstructable-header and per-layer-nullifier properties — reviewers should confirm no change is needed there

🤖 Generated with Claude Code