Can SPOs reorder transactions?

Staking pool operators (SPOs) produce blocks in the Cardano network. No one but them can control what transactions get into the blocks. This is a big responsibility but also an opportunity to abuse their position. Let's describe the basic principles of distributed networks and explain that the ability to reorder transactions is not a bug in the network, but a feature that can be exploited.

TLDR:

• The rules of the Cardano protocol are defined in the source code and anyone in the world can fork the code and change them.
• The ability to change protocol rules is not a bug of the network, but a feature of open-source distributed networks.
• Violation of fundamental rules is not possible, as other nodes would not accept it.
• 100% compliance would require centralization or closed source.
• If the majority is unable to enforce its demand, the network is not sufficiently decentralized.
• A decentralized network is able to maintain its basic properties regardless of the small number of participants who break the rules.

How the protocol rules can be changed?

In the context of this article, it is important to understand how network rules are defined and enforced.

Cardano is a network protocol. You can think of a protocol as a set of rules that allow nodes to communicate with each other across the Internet. The protocol rules can be found in the specification. The rules define all the important rules regarding block production, transaction distribution, validation, and many other things. Protocol rules also define how transactions are to be selected for a new block. The IOG team created a Cardano node, which is a piece of software, according to the specification. Pool operators install a Cardano node on their computer which allows them to communicate with others. If they meet the conditions, they can start producing new blocks.

Cardano is an open-source project. This means that the source code is freely available on GitHub. Anyone in the world can fork the source code and change some rules. Even a pool operator can do it. So if the SPO wants to, he can change the rules regarding the selection of transactions into a block.

The original rule regarding the selection of transactions into a block is defined on a first-come, first-served basis. Each Cardano node maintains its own mem-pool into which it inserts transactions that come from the network. When a node becomes a slot leader, it should, according to the original rules, take transactions from the mem-pool in the order in which they arrived and put them into a new block.

If the pool operator has any reason to change this rule, it can do so in its own version of the Cardano node source code. He then installs this version on his machine. With the change made, the operator can select transactions according to its own rules. For example, he may prefer transactions from a particular DEX or other Defi service. For this, the operator may get paid off-chain or may prefer transactions coming from its own Defi service.

Decentralisation vs. centralisation

It is important to note that the ability to change protocol rules is not a bug of the network, but a feature of open-source distributed networks. A decentralized network is composed of independent volunteers who have decided to run a Cardano pool (or node). No one has a list of them and can dictate how to do it. The rules are defined in the source code, which can be seen as a communication tool between the team and the operators.

Operators can only partially modify some rules. Mostly rules that cannot be 100% enforced. This also applies to the rules about the selection of transactions to be inserted into the block. The reason is simple. No one but the pool operator knows what transactions are available in the mem-pool of his node. Theoretically, this could be detected by monitoring the network communication of all nodes just to prove to operators that they have a transaction in the mem-pool that they are deliberately ignoring in favor of another that came later.

Operators cannot change important rules regarding block and transaction validation or monetary policy. Violation of fundamental rules is not possible, as other nodes would not accept it. This is why network consensus is important. All nodes supervise each other's compliance with the rules. If a fraudulent node inserts a non-valid transaction into a block, the new block would be rejected by all honest nodes.

All other blockchain networks work on the very same principle. Also, Bitcoin and Ethereum allow block producers to change some protocol rules and they can also choose transactions to the block as they want.

Ensuring 100% compliance would require centralization or a closed source. Centralized systems work in such a way that only one version of the client is deployed, so change is not possible in principle. If the source code were closed, operators would be forced to install a version that no one knows how really works. Block producers have the most power in blockchain networks. If the authorities wanted to enforce censorship of transactions, they would have to demand it from block producers. They would then have to filter transactions and deliberately ignore those that do not meet the conditions set by the authority.

Changing the rules of the protocol can be seen as an abuse of power if it is not in line with the expectations of the community. In a decentralized network, there is no authority to dictate what is and is not okay. The majority should decide. If the community is not satisfied with the behavior of the block producers, it should act. If the majority is unable to enforce its demand, the network is not sufficiently decentralized. Building a public, permissionless, distributed, byzantine and fault-tolerant system is the responsibility of all users. The majority must be able to set the rules, not the minority.

What is the best way to choose the transactions that will be in the block?

Cardano works on a first-come, first-served basis. One of the reasons is fairness. It's a similar principle to waiting in a long queue. You also wouldn't like it if someone came and stood in front of you. The functionality of some Defi services can be sensitive to the timely processing of transactions. Imagine you try to update your collateral to avoid getting a margin call and pool operators ignore your transaction because they want to prioritize others.

Unfortunately, even this system is not ideal. There may be cases where some transactions have priority and should be processed before those that can theoretically wait. For example, margin call transactions have higher priority than NFTs distributions. Usually, it is not a problem if the network is only 40% loaded. If the network load is 90% for a long time, there should be some kind of priority system.

Bitcoin and Ethereum use a fee market. Block producers choose transactions based on the size of the fee. This system allows users to pay more for earlier transaction processing, essentially allowing them to prioritize transactions. On the other hand, the principle of fairness and inclusiveness is violated. Decentralization should not just be for the rich. Moreover, in the case of Ethereum, the fee market enables the so-called MEV problem.

The selection of transactions into a block is a complex topic and is subject to debate. Block producers may abuse their position and disrespect expected behavior. They may prefer certain transactions out of their own selfish interests, or they may be forced to do so by authority. In both cases, it is important that the community is able to enforce its demands on block producers.

Decentralization has one big advantage. The network can tolerate a small number of participants who deliberately break the rules. If the majority of participants follow the rules, the network is able to maintain the desired properties, such as censorship resistance.

The SPO can choose to ignore all transactions that are directed to it from other nodes because it is bribed by the owner of the DEX to only process its transactions. If the SPO has only a 0.5% stake, network users will not even notice, since this SPO will only create, say, 100 blocks in an entire epoch (20 blocks per day). This would be a problem if the SPO had a larger stake, or the DEX owner bribed more SPOs.

It is important for the community that someone draws attention to these problems. Ideally, there should be a monitoring system that could highlight the inappropriate behavior of operators. However, there is a catch. A monitoring system could have a negative impact on privacy. It might be possible to analyze the blocks and point out cases where blocks from a particular SPO contain an unusually large number of transactions from a particular service. I'm not sure this is an ideal solution.

Hopefully, input endorsers will significantly help to solve this problem, as basically, all transactions that appear in the network will get into the block. The individual operators will have less effect on the content of the block since the block will essentially just be a reference to pre-created sub-blocks.

Conclusion

A decentralized network is composed of many participants who ideally should have equal status, but in practice, this is not the case. Not everyone can be a pool operator. SPOs have a stronger position than users and can exploit this. The Cardano network is not owned by SPOs, but by ADA holders. Every ADA holder has the ability to influence the quality of network decentralization and to some extent the behavior of pool operators. Honest behavior can be enforced in decentralized networks mainly through economic incentives. Each ADA holder should be concerned about the honest behavior of the pool to which he delegates coins.