What is the Nakamoto coefficient of Cardano?

The Nakamoto coefficient was first formally described in 2017 by former Coinbase CTO Balaji Srinivasan. The Nakamoto coefficient measures decentralization and represents the minimum number of actors required to disrupt the blockchain's network. A high Nakamoto coefficient means that a blockchain is more decentralized. When this measurement was created, Proof-of-Work networks dominated the world, so Balaji did not focus on Proof-of-Stake networks. We don't mind, because the principles are the same. Balaji described more categories that can be measured. For example, hash rate distribution across countries, number of nodes, number of clients, the number of nodes, or even development. In this paper, we will only consider attacks that can break the network consensus.

TLDR

• It is not necessary to attack all nodes in the network if the goal is to break the network consensus.
• Internal attacks are dangerous. For example, the CEO of Binance wanted the Bitcoin pool operators to reverse a transaction.
• The attack strategy varies depending on the specific damage the attacker wants to achieve.
• The Minimum Attack Vector (MAV) is a similar figure that corresponds to the Nakamoto coefficient focused on mining.
• Some people don't see the difference between the number of user nodes and the number of block producers.
• The Edinburgh Decentralization Index (EDI) is an index developed by the University of Edinburgh to measure the level of decentralization of cryptocurrencies.
• Decentralization may be an unattainable goal because control can be bought with money.

How many people does it take to break the network?

Each blockchain network is composed of nodes that humans operate. It is possible to attack either the nodes or the people. Attacking nodes can cause them to shut down, prevent them from participating in the network consensus, or control them for the benefit of the attacker. Attacking people can force behavior that would be detrimental to the network. Hackers can be expected to attack nodes while regulators and politicians can attack people. We have described external attacks. Internal attacks are also a threat to the blockchain.

The internal attack is based on the collaboration of people who are actively involved in maintaining the network. A group of people may agree among themselves to damage the network. Internal attacks are less likely, but cannot be ruled out. There may be situations where collaboration can pay off. For example, during the big Binance hack in 2019, the CEO of the exchange tried to pressure the pool operators to “undo the hack” by making a reorg of the Bitcoin blockchain. The undoing was essentially prevented only by time. When the CEO asked for collaboration, it was relatively late to throw away many of the blocks already mined. The miners weren't opposed to the reorg initially, so if CZ had been faster, it could have happened.

In a blockchain network, nodes do not have equal status. Usually, only a subset of nodes participates in the network consensus. Participants in a network consensus volunteer to participate through ownership of a particular resource. In the case of PoW networks, this is the hash rate, in PoS networks it is coins. This fact makes the attacker's job easier, as fewer nodes or participants make it easier to perform the intended attack.

The nodes that produce blocks are the most important for network consensus. Another important group is the entities that delegate the resource to members of the block producer group. In the case of Cardano and Bitcoin, the group of delegates chooses among a group of pools to which they delegate the resource. Ethereum requires each block producer to have 32 ETH. However, the concept of pools has also emerged organically. The concept of delegating responsibility for block production works in this PoS network as well.

Note that attacking the full nodes of ordinary users makes little sense from the attacker's point of view since he gains almost nothing by doing so. User nodes basically just accept valid blocks but have no effect on the ongoing consensus regarding the content of blocks, transaction censorship, choice of chains in case of forks, etc.

The miners providing the hash rate do not need to run their own node in the same way as ADA stakers. Only the nodes of the block producers are important to the attacker. It is not necessary to attack all nodes in the network if the goal is to break the network consensus. Some people mistakenly believe that only the number of nodes in the network is important, but this is not the case for consensus attacks.

An attacker may want to slow down block production, sway the consensus in his favor, attempt a double-spend attack, split the network into two (or more parts) where each maintains a different version of the blockchain, etc. The attacker's goal may be essentially just a show of force and proof that the network can be attacked. The goal of the attack may be to lose the reputation of the network.

The attack strategy varies depending on the specific damage the attacker wants to achieve. It is possible to attack the blockchain at the network level. For example, it is possible to try to prevent the distribution of blocks. It is possible to attack nodes directly. For example, if a Bitcoin pool distributes work among miners and the attacker manages to shut down a node, the block will not be produced by that pool even after the PoW task is solved. The block can thus produce an attacker node.

An attacker may attempt to control the source. This means that they will either buy enough of the resource to attack the network on the open market or try to steal the resource from its current holders. Coins of PoS networks can be stolen on exchanges or directly from their holders who do not have them well protected, for example in HW wallets such as Trezor and Ledger. ADA holders who stake coins on centralized exchanges threaten Cardano. If a hacker manages to steal coins from an exchange he can get a part of the resource that helps him to attack the consensus.

In the case of hash rate, the same type of attack is possible. The attacker can invest in ASIC miners and energy or can cut off large mining halls from the Internet during the attack, effectively preventing the block from creation. A smarter attack may involve exploiting a third party's hash rate to its advantage. The attack can either target the network (let the miners solve the attacker's task) or the mining hall operator (either regulatorily or by extortion).

Minimum Attack Vector

The Minimum Attack Vector (MAV) looks at how many entities having some control over the network would be required for a 51% attack. In other words, MAV specifies how many independent parties have to collude in secret to have that 51% control. The higher this number is, the better it is.

Note that the attacker is not trying to gain control of the network by trying to obtain 51% of the resource by, for example, buying on the open market. We mean achievement the gaining supremacy by having more resources than honest players.

From the perspective of an internal attack, this is the number of parties that cooperate with each other in the attack. From the perspective of an external attack, someone would have to convince, overtake control of infrastructure, or coerce this number of parties to commit the attack.

MAV is a similar figure that corresponds to the Nakamoto coefficient focused on mining. Regarding the decentralization of mining, Balaji watches the number of entities that directly receive rewards from the protocol, i.e. the pools.

In the Cardano network, we have to look at the number of entities that would have to work together to have control of 51% of the ADA coins after adding up the individual stakes. Note that this is not the number of pools, as one entity can control multiple pools. It is the stake that the entity holds that is important, not the number of pools that produce blocks. This is a definite advantage, because if the operator runs the pools smartly, and each is on a different infrastructure, it may be more difficult for an external attack to compromise all of the operator's pools simultaneously.

The current MAV of the Cardano network is 22. Some sources say 24. The MAV for Bitcoin and Ethereum is 3. In the case of Ethereum, it can be 5 if we decompose the Lido depositors.

It is important to note that MAV may not have as much meaning as people usually think. For a quick attack, such as a double-spend or reorganization of the blockchain in a case similar to the Binance hack, MAV makes sense. Delegates usually don't have enough time to react to an attack in short while. They have little chance to delegate the resource elsewhere in order to weaken rogue pools. In the case of longer-lasting problems, for example, if pools censor transactions, the power is in the hands of the delegates. They can delegate the resource (coins or hash rate) to pools that behave as they expect, which may not be the pools that censor transactions.

The pool size is composed of delegated resources. If we want to examine decentralization in more detail, we should be interested in the number of delegates. Especially the large delegates, i.e., those holding large numbers of coins in PoS networks or running large mining halls in PoW networks. Resource owners can run their own pool, but there are whales that delegate the resource.

High decentralization solves “nearly” everything

The best network defense against most attacks is a high level of decentralization. Consider a situation where Alice decides to cheat. She changes the protocol rules on her node and starts, for example, censoring transactions or preferring transactions of a particular exchange while ignoring other transactions in her mem-pool. What happens? If Alice has a small share of the resource (a small stake), almost nothing significant happens. If Bob, Carol, Dave, and others follow the original rules of the protocol, the rules preferred by the majority will be enforced.

This is why the MAV must be as high as possible. If the agreement between Alice, Bob, and Carol was enough to censor transactions, the decentralization of the network would be very low. If this trio had, say, a 60% share of the resource (stake), they could ignore the blocks produced by the minority in some networks, essentially forcing censorship. The more participants that would have to agree to such unwanted behavior, the less likely it is to happen.

Would it be fair if Alice, Bob, and Carol could do something (censorship of transactions) that most users don't want? If they have 60% control over the production of blocks, this trio is the majority. They have a consensual right to decide the rules since they control the majority of the resource. What they don't have is the consent of users, but they don't have to worry about that in principle unless they don't mind some would leave the network.

The design of Cardano is well thought out, as the pool operators, in our example Alice, Bob and Carol, will probably never own enough ADA coins to control the network consensus. It is important that users have control over the work of the pool operators from the position of holding the resource. If they are dissatisfied with the work of the pool operators, they can delegate the ADA coins elsewhere. This is exactly the same principle as introduced by Bitcoin, except that BTC holders are mostly not miners. Bitcoin tends to centralize as only a few dozen mining halls control more than half the hash rate. Decentralization of the resource should also ideally be as high as possible. This may be an unattainable goal, as control can be bought with money.

The miners want higher rewards from mining and it is smart to squeeze out the competition. But in doing so, they gradually gain dominant power over the network consensus. Cardano has a similar problem, as ADA coins can also be bought with money, and the more coins you have, the higher the reward. There is some advantage in that a large number of other people want to own the coins, and each ADA holder essentially decentralizes the network. In other words, Cardano is a more inclusive network in terms of being able to participate in decentralization and be rewarded. Even staking may not be the final solution to achieve the best possible decentralization.

Note that whoever controls a large portion of the resource may not have a full node of his own at all. If he has his own node, his node will have a much stronger position in the network than the nodes of the other participants.

Conclusion

Unfortunately, the cryptocurrency industry does not measure decentralization well. Many laymen don't realize how diverse the range of attacks is and the importance of details. Some people see no difference between the number of user nodes with the number of block producers or underestimate the capabilities of pools for short-term attacks.

The Edinburgh Decentralization Index (EDI) is an index developed by the University of Edinburgh to measure the level of decentralization of cryptocurrencies such as Bitcoin and Ethereum. From this index, it is possible to have a practical and objective measurement of how decentralized a project is. Once these two biggest projects are measured we will see how well Cardano and others are doing. It is important to have an independent analysis with a well-developed measurement methodology. The team is still working on the index, so no results are available yet.