FedChain: Secure Proof-of-Stake-based Framework for Federated- Systems

Cong T. Nguyen, Dinh Thai Hoang, Diep N. Nguyen, Yong Xiao, Hoang-Anh Pham, Eryk Dutkiewicz and Nguyen Huynh Tuong Abstract—In this paper, we propose FedChain, a novel framework for federated-blockchain systems, to enable effective transferring of tokens between different blockchain networks. Particularly, we first introduce a federated-blockchain system together with a cross-chain transfer protocol to facilitate the secure and decentralized transfer of tokens between chains. We then develop a novel PoS-based consensus mechanism for FedChain, which can satisfy strict security requirements, prevent various blockchain-specific attacks, and achieve a more desirable performance compared to those of other existing consensus mechanisms. Moreover, a Stackelberg game model is developed to examine and address the problem of centralization in the FedChain system. Furthermore, the game model can enhance the security and performance of FedChain. By analyzing interactions between the stakeholders and chain operators, we can prove the uniqueness of the Stackelberg equilibrium and find the exact formula for this equilibrium. These results are especially important for the stakeholders to determine their best investment strategies and for the chain operators to design the optimal policy to maximize their benefits and security protection for FedChain. Simulations results then clearly show that the FedChain framework can help stakeholders to maximize their profits and the chain operators to design appropriate parameters to enhance FedChain’s security and performance.

Index Terms—Blockchain, Proof-of-Stake, cross-chain transfer, sidechain, multiple-blockchain, and Stackelberg game. !

1 INTRODUCTION Despite its popularity and potential, blockchain has 1.1 Motivation been facing various challenges. The rapid development of blockchain and the massive popularity of Over the last few years, the development of the blockchain have lead to the creation of a plethora of blockchain net- technology has attracted massive attention. A blockchain works. For example, the number of cryptocurrency net- is an append-only of transactions shared among works has increased nearly four times in just one year the participants in a peer-to-peer network. With the help (from 2000 in 2019 to 7400 by the time this of consensus mechanisms, once a transaction enters the article is written, i.e., December 2020 [3]). These blockchain blockchain, it cannot be changed without the consensus networks are currently employing diverse consensus mech- of the majority of the network. Beside data immutability, anisms, which results in severe fragmentation since these the consensus mechanism also plays a key role in ensuring networks cannot communicate with each other. However, that such a decentralized network can reach the consensus there are many blockchain-based applications where the without a central authority, thereby avoiding the single- ability to transfer assets between different is point-of-failure. Moreover, advanced cryptography tech- essential, such as coalition loyalty programs and retail pay- niques such as digital signatures and asymmetric keys [1], ment. For example, in coalition loyalty programs, users need [7] enable blockchain users to create easily verifiable but to exchange their loyalty points among different programs, impossible to forge proofs of authentication for assets (i.e., which are stored on different blockchains in the forms of blockchain tokens) while enhancing the anonymity and arXiv:2101.12428v1 [cs.GT] 29 Jan 2021 blockchain tokens. Similarly, in retail payment, vendors privacy of users. As a result, blockchain can enable trusted might only accept a certain type of tokens, and thus the transactions among network participants even in an open users need to exchange their tokens to another type. How- and decentralized environment. With such outstanding ben- ever, for single blockchain networks, users who want to ex- efits, blockchain has been implemented as the backbone change tokens have to rely on trusted centralized exchange of numerous applications in many areas such as finance, platforms, e.g., Binance [4] and [5], which is against healthcare, and Internet-of-Things (IoT) [1], [7]. the decentralized nature of blockchain and poses serious se- curity threats. Particularly, there have been many attacks on • Cong T. Nguyen, Hoang-Anh Pham, and Nguyen Huynh Tuong are with these exchanges, resulting in a cumulative loss of more than the Ho Chi Minh City University of Technology, VNU-HCM, Vietnam. E-mail: {ntcong.sdh19, anhpham}@hcmut.edu.vn. $1 billion [6] over the last few years. Moreover, the trade-off • Diep N. Nguyen, Dinh Thai Hoang, and Eryk Dutkiewicz are between performance and security in consensus mechanism with the School of Electrical and Data Engineering, University designs usually leads to high delay and low processing of Technology Sydney, Australia. E-mail: {diep.nguyen, hoang.dinh, throughput. For example, needs 1 hour to confirm a eryk.dutkiewicz}@uts.edu.au. • Yong Xiao is with the School of Electronic Information and Communica- transaction and can only process less than 7 transactions per tions, Huazhong University of Science and Technology, Wuhan, China. second [7], which hinders blockchain applicability in many E-mail: [email protected] scenarios. Thus, this necessitates an effective framework that not only allows the interoperability among blockchains networks, but also guarantees the security and performance Although RSK is more decentralized, i.e., the federation in of each individual network. RSK is determined by public voting, RSK is still limited by To address these problems, the sidechain technology [8] the huge energy consumption of the PoW mechanism. has been developed to enable the formation of the federated- blockchain system, which consists of multiple blockchains Different from the PoW mechanism, the PoS mechanism to allow the users to transfer assets to any blockchain enables the blockchain participants to reach the consensus within. The core mechanism of the sidechain technology by proving tokens ownership. As a result, the PoS mecha- that enables the exchanging of tokens between different nism is much more energy-efficient and can achieve higher chains is the two-way peg mechanism. Specifically, when transaction processing speed compared to those of the PoW a user wants to transfer its assets from one chain to an- mechanism [1], [2], [7]. Due to those advantages, recent other chain, the user first creates a transaction to lock its research works in the area of the sidechain technology assets on the originating chain. Then, a group of validators, have shifted towards the PoS mechanism. In [14], a cross- selected by the two-way peg mechanism, will verify and chain transfer protocol is developed for cross-chain transfers confirm this transaction, and create a corresponding amount between a primary blockchain (main chain) and a secondary of assets on the destination chain. Typically, the two-way chain (sidechain). To validate the cross-chain transactions, peg mechanism can ensure that the cross-chain transfers the protocol relies on a set of certifiers who are chosen are secure and cannot be reverted, i.e., avoid cross-chain by the main chain. A major advantage of the proposed double-spending attacks [8]. However, the development of protocol is the independence between the side chain and the sidechain technology is still in a nascent stage, and main chain in terms of security and operations. However, it does not fully satisfy the security nor the performance the security of this protocol is not analyzed. In [15], the requirements of federated-blockchain systems. Particularly, authors propose a sidechain system, in which both the the ability to transfer assets between multiple chains may sidechain and the main chain employ a PoS mechanism, i.e., lead to centralization to a single chain, e.g., mining power Ouroboros. Unlike the previous works, this work focuses centralization in Proof-of-Work (PoW) and stakes central- more on the security aspects of the sidechain technology, ization in Proof-of-Stake (PoS). This poses a security threat providing formal definitions and robust security analyses. to the other chains in the same federation. Moreover, most Moreover, the proposed system ensures the independence in current sidechain applications still employ the PoW mech- terms of security between the blockchains within. However, anism which requires huge energy consumption and has the risk of centralization is not addressed. Similar to [14], the very low processing capabilities [1], [2]. Therefore, a secure authors in [16] also introduces a cross-chain transfer proto- and effective framework, which can address both security col to allow interoperability between a main chain and a side and performance issues for cross-chain transfers, is in urgent chain. The cross-chain transfer protocol in [16] is proposed need for the future development of blockchain networks. with formal definitions, and a consensus mechanism is also presented in a similar way as in [15]. However, there are 1.2 Related Work several limitations in this work, such as the lack of formal Sidechain technology was first introduced in [8] as a novel security analysis and the unaddressed risk of centralization. method to facilitate cross-chain transfers. Particularly, two- way peg and Simplified Payment Verification (SPV) proof To the best of our knowledge, the risk of centralization mechanisms are developed so that the validators can verify in federated-blockchain systems has not been addressed in and confirm transactions between different blockchains. Al- any previous work. Specifically, the ability to transfer tokens though this work paves the way for many research works between blockchains may lead to situations where the users and applications, the security and performance issues of centralize to a single blockchain in the system. Particularly, sidechain are only briefly mentioned and not well investi- in PoS blockchains, a user who participates in the consensus gated [8]. After the introduction of the sidechain technology, mechanism has a chance to be selected to create new blocks there have been several notable real-world applications such and obtain a reward. That chance is directly proportional as PoA [10], Liquid [11], and RSK [12]. However, these appli- to the tokens the user possesses in the network [1], [2]. cations are facing several challenges. In particular, the PoA Therefore, a blockchain with a higher reward might attract approach relies on a fixed federation of 23 validators to vali- more users and tokens, as the users will transfer their tokens date the cross-chain transactions between the [13] to that blockchain to earn more profits. Such centralization and several sidechains. This results in a low decentralization of tokens and users may have negative impacts on the secu- level for the consensus process. Moreover, these validators’ rity and performance of the other blockchains in the same identities are publicly known, making them easier to be tar- system. This is because the state of each PoS blockchain is geted by attackers. Similarly, the Liquid approach [11] also determined by the majority of stakes (tokens), i.e., users who relies on a federation to validate cross-chain transactions. have more stakes (tokens) are more likely to be selected Although these validators are not publicly known, they are to add new blocks. Consequently, it is easier for attackers chosen only by the network operators, and thus Liquid is to target the blockchains that have fewer tokens. This can not a public blockchain network. Moreover, Liquid is using significantly impact these blockchains’ security and perfor- a version of the PoW consensus mechanism which requires mance. Furthermore, since the cross-chain transfer requires even more computational resources than Bitcoin (Liquid the confirmation of transactions in both the originating and requires the validators to run a Bitcoin node in parallel with destination chains, the centralization of stakes also reduces a Liquid node). Similar to Liquid, RSK employs a federa- the overall system performance. More detailed analysis of tion to validate transactions via a PoW-based mechanism. these negative impacts will be presented in Section3. 1.3 Contributions and Paper Organization 2 FEDERATED-BLOCKCHAIN SYSTEM 2.1 System Overview The main contributions of this paper are summarized as follows: Before elaborating on our proposed consensus mechanism and incentive mechanism, we provide a brief overview of • Propose FedChain, an effective and secure frame- the federated-blockchain system and the cross-chain trans- work for cross-chain transfer in federated-blockchain fer procedure in this section [8], [9]. As illustrated in Fig.1, systems. Particularly, Fedchain facilitates two-way the system is composed of two types of entities as follows: transfers of assets between different blockchains in • Chains (blockchains): In FedChain, individual the system by utilizing the sidechain technology. blockchain networks, managed by blockchain opera- Moreover, to address the security and performance tors, can communicate with each other via the cross- limitations of current sidechain technology, we de- chain transfer protocol. Each chain has its own type velop a PoS consensus mechanism and a Stackelberg of token and an individual consensus mechanism. game model specifically for FedChain. When a new blockchain network wants to join the • Develop a novel PoS-based consensus mechanism for system, it only needs to negotiate with the existing the individual blockchain in FedChain. By designing chains and create smart contracts accordingly. new effective rules, we can significantly improve the • Users: Users are the participants of the chains in security and performance of the consensus mecha- the system. These users can freely exchange different nism. Particularly, through theoretical and numeri- types of tokens by using the smart contracts created cal analyses, we prove that the proposed consensus by the operators. They can also participate in the con- mechanism can satisfy the persistence and liveness sensus mechanism in every chain to earn economic properties [24], prevent many blockchain-specific at- profits through block rewards. tacks, and achieve a more desirable transaction con- firmation time compared to several other mecha- nisms such as the Nakamoto protocol (of Bitcoin) [25] 2.2 Cross-chain Transfer Procedure and Ouroboros (of Cardano) [17]. The SPV mechanism allows tokens from one chain to be • We develop an incentive mechanism using a Stack- securely transferred to another at a predetermined rate. elberg game model [30] for FedChain in order to When a user wants to prove that a transfer transaction provide additional benefits for the users, enhance from an originating chain to a destination chain is valid, an FedChain’s security and performance, and address SPV proof is submitted. This proof shows that the transfer the problem of centralization in the sidechain tech- transaction belongs to a valid block of the originating chain. nology. Moreover, we propose a highly effective Although this process takes a long time for confirmation, utility function for the chain operators, which can it eliminates the risk of centralization and single-point-of- help to attract more stakes to the individual chains failure compared to those of the centralized and federated while still ensuring the overall decentralization of scheme [9]. Therefore, the SPV proof is selected as the cross- the system. To the best of our knowledge, this is chain transfer mechanism in our proposed FedChain. As il- the first paper addressing the risk of centralization in lustrated in Fig.1, the SPV-based token exchange procedure federated-blockchain systems. Furthermore, by ana- consists of several steps as follows: lyzing interactions between the stakeholders and the chain operators, we can prove the uniqueness of the • Step 0: Two chains negotiate an agreement which Stackelberg equilibrium and find the exact formula specifies the exchange rate between the two tokens. for this equilibrium. These results are especially im- The chain operators then create in each chain a according to the agreement. portant for the stakeholders to determine their best o • T investment strategies and for the chain operators to Step 1: When a user wants to exchange 2 tokens T o Tx1 design the optimal policy to enhance the system’s into 1 tokens, the user sends a transaction , T o security and transaction processing capabilities. containing 2 tokens, from its account on chain 2 SC • Extensive simulations are performed to evaluate the to the smart contract 2. • Tx2 system performance of FedChain. The simulation Step 2: The user then sends a transaction and an SC Tx2 results then confirm the analytical results and show SPV proof from its account on chain 1 to 1. SC that FedChain can help the users to maximize their then triggers 1 to validate the SPV proof. • SC profit and the blockchain operators to determine Step 3: During the confirmation period, 1 checks their optimal blockchain parameters to improve the (1) the validation of the SPV proof and (2) any system’s security and performance. conflicts of the submitted SPV proof. • Step 4: After the confirmation period, SC1 sends a number of T o tokens to the customer’s address on The rest of this paper is organized as follows. We first 1 chain 1 in accordance with the exchange rate. present the federated-blockchain framework in Section2. We then analyze the proposed consensus mechanism for The security features of the SPV proof mechanism are our framework in Section3. After that, we introduce and proven in [8]. Generally, the SPV proof points to the block analyze the Stackelberg game in Section4. Finally, simula- that contains the cross-chain transfer transaction in the orig- tions and numerical results are presented in Section5, and inating chain. Therefore, the validators only have to validate conclusions are drawn in Section6. the block that contains the transaction. Thus, the security of Chain 4 Chain 1

Token 1 Cross-chain Transfer $ $ Chain 1 Token 4 $ Token 1 ... User 1 SC1 2 checks if Send transaction 3 the SPV 4 Create Tx2 and a SPV SC1 sends proof is o Cross-chain smart tokens T to Cross-chain proof to SC1 valid 1 Transfer contracts Store on the user’s Transfer 0 0 SC1 and chain 1 account on SC2 User Confirmation chain 1 Send period transaction $ Token 2 Chain 1 Chain 2 1 Tx1 operators operators containing o Cross-chain 0 Store on tokens T 2 to Transfer Chain 2 chain 2 SC2 ... Chain 3 Chain 2

Fig. 1. The federated-blockchain system.

the SPV proof only relies on the security of the originating Committee chain, i.e., the SPV proof is secure if the originating chain and PVSS protocol Seeds is secure. However, this leads to a drawback of the SPV leaders proof mechanism, which is the low confirmation speed (the election validators have to wait until the transaction is confirmed protocol Follow-the-Satoshi Algorithm on the originating chain). Moreover, as the stakes can be Committee members transferred between chains, if the security of one chain is violated, the whole system will fail. Therefore, in the next section, we will propose an effective consensus mechanism that can achieve lower transaction confirmation time com- ... pared to other conventional mechanisms while satisfying the persistence and liveness properties [24] and being able Time slot Time slot Time slot Time slot Time to prevent various blockchain attacks.

Fig. 2. Epoch-based committee and leader election. 3 FEDCHAIN’S CONSENSUS MECHANISM In this section, we develop an effective consensus mecha- nism for FedChain with four new consensus rules based on form of strings and any network user to verify these strings, the consensus mechanism proposed in [17]. Compared with as long as the majority (51%) of participants are honest, as other conventional consensus mechanisms such as [17]– proven in [26]. Once the random strings are created, they are [23], our proposed consensus mechanism can satisfy both used as the seeds for the FTS algorithm. The FTS algorithm the liveness and persistence properties, prevent various is a hash function that takes any string as input and outputs blockchain attacks, and achieve an especially low transac- token indices [2]. The current owners of these tokens are tion confirmation time as discussed in the following. then chosen as the leaders of this epoch or committee members of the next epoch. 3.1 Proposed Consensus Mechanism The probability Pn that user n is selected to be the leader 3.1.1 Epochs and time slots and committee member by the FTS algorithm in a network of N stakeholders is As illustrated in Fig.2, time is divided into epochs, and each s epoch is divided into time slots in FedChain’s consensus P = n , n PN (1) mechanism. At the first time slot of epoch ek, a committee i=1 si consisting of some users (stakeholders) executes an election where sn is the number of stakes (tokens) of stakeholder n. protocol to elect the leaders for the epoch ek, such that for As observed in (1), the more stakes a stakeholder has, the each time slot there is one designated leader who adds one higher chance it can be selected to be the leader. Compared new block to the chain. Similar to [17], we assume that a to [17], we design four new consensus rules as follow: time slot duration of 20 seconds is sufficient for the leader to broadcast a block to every node in the chain. The committee • I1: After executing the PVSS protocol, the leader list also select the committee members for the epoch ek+1. is broadcast to every node in the chain. • I2: If a leader fails to broadcast its block during its 3.1.2 Leaders and committee election protocol designated time slot (e.g., being offline during its To elect the leaders and committee, the current epoch’s time slot), an empty block will be added to the chain committee members execute the Publicly Verifiable Secret • I3: Once a block is broadcast, the designated leader Sharing (PVSS) protocol [26] to create seeds for the Follow- will not change the block at any later time. the-Satoshi (FTS) algorithm [2]. The PVSS protocol allows • I4: Upon receiving two forks (different versions of the participants to produce unbiased randomness in the the chains), an honest user will adopt the longest valid , i.e., the longest fork that has no conflicting • Static Adversary: This type of adversary uses a stake blocks and each block is signed by a designated budget BA to attack a chain. Let Bn and γ denote leader. the stake budgets of stakeholder n and the honest These new consensus rules help to considerably reduce the stake ratio, respectively. Then, the ratio of adversarial B probability that an adversary can successfully create an 1 − γ = A stakes is PN . alternative version of the chain, thereby significantly im- n=1 Bn + BA proving the chain’s security and performance. The detailed • Adaptive Adversary: In contrast to the static adver- analysis will be discussed in Theorem 1. sary setting, the adaptive adversary does not have a fixed number of stakes. However, this type of adver- 3.1.3 Incentive mechanism sary can choose to corrupt NA honest stakeholders The incentive mechanism plays a crucial role in ensur- and use their stakes to attack. Let NA denote the set ing that the stakeholders follow the consensus mechanism of corrupted stakeholders, the budget of the adaptive B = P B properly. To this end, the incentive mechanism needs to adversary can be defined by A i∈NA i. incentivize consensus participants via a reward scheme and penalize malicious behavior via a penalty scheme. The models for the blockchain-specific attacks consid- For the reward scheme, a leader will receive a fixed ered in this paper are as follows: number of tokens when the leader adds a new block to the chain. This is also to incentivize the leaders to be on- • Double-spending attack: For such kind of attack, the line during their designated time slots. In single-blockchain attacker aims to revert a transaction that has been settings such as Bitcoin [25] and Cardano [17], the block confirmed by the network (to gain back the tokens reward is set at a fixed value for a long period of time, e.g., 4 it has already spent). First, the attacker creates a years in Bitcoin. However, in FedChain, having a fixed block transaction Tx1 in block Bi and waits until the block reward scheme may pose security threats. The reason is that is confirmed. Then, the attacker can either create a the stakes can be transferred between chains in our system, conflicting transaction Tx2 or erase the block Bi from and the total network stakes can also vary in times, e.g., the chain, so that the proof of its spending is gone. stakes increase from block rewards, and the stakes decrease • Grinding attack: In grinding attacks, the attacker from cross-chain transfers, etc. Since the probability that a attempts to influence the leader and committee elec- stakeholder is elected to be the leader and able to obtain tion protocol to unfairly increase its chance to be a block reward depends on the individual chain’s stakes, selected as a leader or a committee member. Gen- stakeholders may transfer their stakes to a chain with a erally, in protocols where the seeds of the FTS algo- higher block reward to earn more profits. Consequently, this rithm are derived from the block header, the attacker may attract stakes into a single chain and make it easier for can check many possible different block contents adversaries to control the majority of stakes in the other (because block headers are created by hashing the chains. Therefore, in the following sections, we analyze the block contents) to determine which one can give the stakeholder rational strategy and propose a dynamic reward attacker the best chance to be elected as a leader scheme to protect the decentralization of the whole system. again. With our proposed dynamic reward scheme, at the end of • Nothing-at-stake attacks: This type of attack specifi- each epoch, the chains will adjust new block reward values cally targets the PoS blockchains because, in contrast for the next epoch, taking the total network stakes and the to PoW, blocks in PoS can be created with very little final stakes distribution among the chains in the current computation. In this attack, the attacker tries to create epoch into account. The dynamic reward scheme will be many forks or conflicting transactions. For example, discussed in more details in Section4. the attacker can create two transactions to spend the For the penalty scheme, the leader is required to make same tokens at two vendors, i.e., Tx1 in fork C1 a deposit that will be locked during its designated epoch to and Tx1 in fork C2. At this point, although both the prevent nothing-at-stake, bribe [2], and transaction denial transactions are not confirmed, they are both valid (not attacks [17]. The stakes of committee members are also conflicted within their own fork). locked during the epoch that they are serving in the com- • Bribe attacks: For such attacks, the attacker tries mittee to prevent long-range attacks [2]. How the proposed to bribe the leaders to create specific blocks, e.g., penalty scheme can prevent the mentioned attacks will be to support other types of attacks such as double- discussed in the following security analysis. spending or transaction denial. • Transaction denial attack: In this attack, the attacker 3.2 Security Analysis tries to prevent transactions of every or some specific 3.2.1 Adversary and attack models users from being included in the chain. To achieve Since the SPV proof mechanism’s security depends on the this objective, the attacker has to either block the security of the individual chains, the security of the whole users’ connection to the blockchain or not include system also relies on the security of each chain. We consider the transactions when the attacker is the leader. two types of adversaries that target the individual chains, • Long-range attack: In a long-range attack, a leader aiming to perform attacks such as double-spending, grind- immediately transfers its stakes to another account ing, nothing-at-stakes, bribe, transaction denial, and long- at the beginning of its designated epoch, and thus it range attacks [2]. As illustrated in Fig.3, the considered can behave maliciously, e.g., performing attacks, for types of adversaries are: the rest of the epoch without consequences. Static Adversary Adaptive Adversary Adversary corrupts some $ stakeholders Adversary Chain operators Chain operators Chain operators Adversary Chain operators moves its stakes adjust Rm based adjust Rm based adjust R based moves its stakes adjust R based to attack one m $ m on dt-1 on dt on dt-1 and corrupted $ on dt chain stakes to attack $ Epoch et Epoch et+1 Epoch et one chain Epoch et+1 starts starts starts starts

Time Time

$ $ Final stake Stakes change Final stake Stakes change Committee Final dt at Committee Committee Final dt at Committee distribution during et distribution during e Honest the last and leaders Honest t the last and leaders dt-1 at the and leaders d at the and leaders stakeholders block of election t-1 stakeholders block of election last block of election last block of election based on d epoch et based on dt epoch et based on dt epoch et-1 t-1 epoch et-1 based on dt-1

Fig. 3. Illustrations of the considered adversaries.

3.2.2 Blockchain properties PrCP, PrCG, and PrCQ are overwhelmingly low (< 0.1%), To maintain the blockchain’s security, a consensus mecha- in the following Theorem. nism must satisfy the following properties [24]: Theorem 1. FedChain’s consensus mechanism can satisfy the • Persistence: Once a transaction is confirmed by an CP, CG, and CQ properties with overwhelming probabilities. honest user, all other honest users will also confirm Proof: See AppendixA that transaction, and the transaction’s position in the Fig.4 illustrates the CP and CQ violation probabilities blockchain is the same for all honest users. under different parameter values. As the adversarial ratio • Liveness: After a sufficient period, a valid transac- increases (i.e., the adversary controls more stakes in the tion will be confirmed by all the honest users. chain), the attacker has more chances to successfully attack. In FedChain, persistence ensures that once a transaction is However, the higher κ is, the lower the CP violation prob- confirmed, it cannot be reverted. Without the persistence ability is. This means that the longer since a transaction is property, the adversary can successfully perform a double- added to the chain, the more stable the transaction becomes. spending attack by firstly sending a transaction to spend For example, if a transaction is at least seven blocks deep some tokens. After that transaction is confirmed, the ad- in the chain, the adversary has less than 1% chance to versary can create a fork to erase the transaction from the revert it, even if the adversary controls nearly 50% of the blockchain. If that fork is accepted by the honest users, total network stakes. In contrast, if the transaction is only the adversary can gain back the tokens it already spent. four blocks deep, the adversary with 49% stakes has more While the persistence property ensures data immutability, than 5% chance to revert the transaction. This implies that the liveness property ensures that every valid transaction the more stakes the adversary controls, the longer it takes will eventually be included in the chain. Without liveness, to confirm a transaction, which is directly related to the an attacker can block every transaction in a blockchain. performance and security of the chain. The persistence and liveness properties are ensured if the For the PrCQ, the more blocks we consider, the higher consensus mechanism satisfies the following properties [24]: chance the adversary can create more than (1 − γ)l blocks. For example, an adversary controlling 30% of network • Common prefix (CP) with parameter κ ∈ N: For any stakes has less than 0.1% chance to create more than three pair of honest users, their versions of the chain C1, C2 in ten blocks, but it has around 0.3% chance to create more must share a common prefix. Specifically, assuming than 30 in 100 blocks. This could be harmful to the network that C2 is longer than C1, removing κ last blocks of if the adversary wants to reduce the network’s throughput C1 results in the prefix of C2. (i.e., blocks/time slot). For example, an adversary with 30% • Chain growth (CG) with parameter ς ∈ N and τ ∈ network stakes has 0.3% chance to reduce the network (0, 1]: A chain possessed by an honest user at time throughput by 30% during 100 time slots by creating only t + ς will be at least ςτ blocks longer than the chain empty blocks every time it is elected to be the leader. it possesses at time t. • Chain quality (CQ) with parameter l ∈ N and µ ∈ 3.2.3 Blockchain attacks prevention (0, 1]: Consider any part of the chain that has at least In the following Theorem, we prove that our FedChain’s l blocks, the ratio of blocks created by the adversary consensus mechanism is able to prevent a variety of emerg- is at most 1 − µ. In the ideal case, 1 − µ equals the ing blockchain attacks such as double spending, grinding, adversarial ratio 1 − γ. bribe, nothing-at-stakes, and long-range attacks.

Let PrCP, PrCG, and PrCQ denote the probabilities that Theorem 2. FedChain’s consensus mechanism can prevent the CP, CG, and CQ properties are violated. We prove double-spending, nothing-at-stakes, bribe, transaction denial at- that FedChain’s consensus mechanism can satisfy the CP, tacks, grinding, and long-range attacks according to the consid- CG, and CQ properties with overwhelming probability, i.e., ered adversary models. Common Prefix Violation Probability stakes and prevent the adversary from controlling more 0.06 than 50% of network stakes. In the next section, we will in-

=4 troduce an effective incentive mechanism developed based 0.04 =5 =6 on a Stackelberg game model that can jointly maximize =7 profits for the participants and significantly enhance the 0.02 =8 =9 network’s performance and security for chain operators.

CP Violation Probability Violation CP 0 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5 Adversarial Ratio 4 STACKELBERG GAME FORMULATION 10-3 Chain Quality Violation Probability 6 In practice, chains usually announce their block rewards

4 first, and then the stakeholders will decide how much to l =10 l =50 invest accordingly. Therefore, the interaction between the l =100 2 chains and stakeholders in FedChain can be formulated as a multiple-leaders-multiple-followers Stackelberg game

CQ Violation Probability Violation CQ 0 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5 model [30]. In this game, the leaders are the chains (man- Adversarial Ratio aged by the chain operators) who first announce their block rewards, and then the stakeholders, i.e., followers, will make Fig. 4. Blockchain properties violation probabilities. their decisions, e.g., how much to invest in each chain.

TABLE 1 4.1 Stakeholders and Chain Operators Transaction confirmation time in minutes FedChain consists of a set M of M chains and a set N FedChain’s N R = Adversarial of followers. The leaders offers block rewards Bitcoin Cardano Consensus Ratio (R1,...,RM ). Stakeholders possess stakes with budgets, Mechanism denoted as B = (B1,...,BN ). The stakeholders can use 0.10 50 5 1 their stakes to take part in the consensus process of every 0.15 80 8 1.3 chain to earn additional profits. Particularly, when stake- 0.20 110 12 1.6 holder n invests sm to chain m, its expected payoff U m is: 0.25 150 18 1.6 n n 0.30 240 31 2 sm U m = n R , 0.35 410 60 2.3 n m P m m (2) sn + i∈N si 0.40 890 148 2.6 −n 0.45 3400 663 3 where N−n is the set of all stakeholders except stakeholder n. The stakeholders can freely invest within their budgets PM m to any chain, i.e., m=1 sn ≤ Bn. Thus, the total payoff of Proof: See AppendixB stakeholder n is M M X X  sm  U = U m = n R , (3) 3.3 Performance Analysis n n sm + T m m=1 m=1 n m From the security perspective, we prove that the higher P m where Tm = s expresses the total stakes invested the adversarial ratio is, the higher the probabilities that the i∈N−n i adversary can successfully perform attacks on the chain. in chain m by all the other stakeholders. Similarly, the adversarial ratio also has a negative impact on the performance of the network. In Table1, we examine and 4.2 Game Theoretical Analysis compare the transaction confirmation time under different 4.2.1 Followers’ strategy adversarial ratio (percentage of stakes in PoS or computa- tional power in PoW that the adversary controls) of a PoW To analyze the game, we first examine the existence of the blockchain network (Bitcoin), a PoS network with delayed follower sub-game equilibrium in Theorem 3. finality (Cardano), and FedChain’s consensus mechanism. Theorem 3. There exists at least one Nash equilibrium in the The transaction confirmation time of Bitcoin and Cardano follower sub-game. is presented in [17]. The transaction confirmation time is the time it takes to reach a CP violation probability Proof: See AppendixC. PrCP ≤ 0.1%. Based on (7), κ can be determined, and then Then, we examine the uniqueness of the equilibrium in κ is multiplied with the time slot duration to calculate the Theorem 4. transaction confirmation time. Our time slot duration is set Theorem 4. The follower sub-game equilibrium is unique. to be 20 seconds (the same as that of Cardano [28]). As observed in Table1, the more stakes the adversary Proof: See AppendixD. controls, the longer the transaction confirmation time is. In this game, the stakeholders can invest any number of Moreover, the PVSS protocol no longer ensures unbiased stakes within their budgets. However, as shown in Theorem randomness if the adversary controls more than 50% stakes 5, a rational stakeholder will always invest all its budget in a chain. Therefore, it is critical to attract more participants to maximize its profits regardless other stakeholders’ strate- to individual chains in order to increase the network’s total gies. Theorem 5. For every follower n, the strategies that invest 15 PM m less than its total budget, i.e., m=1 sn < Bn, always give 10 Optimal Strategy

lower payoffs than the strategy that invests all the budget, i.e., m 5 Leader Utility PM m U m=1 sn = Bn, regardless of other followers’ strategies. 0 Proof: See AppendixE. -5 An important result from Theorem 5 is that the strategies 0 10 20 30 40 50 60 R which invest less than the total budget can be removed from m the strategy space of every follower. Then, we can reformu- Fig. 5. An example of the leader’s utility function. late the utility function to reflect the budget constraint as follow: M−1  m  PM−1 m X sn Bn − m=1 sn As a result, this utility function, as illustrated in Fig.5, Un = Rm + RM . sm + T PM−1 m encourages the chain operator to set an appropriate level m=1 n m Bn − m=1 sn + TM (4) of block reward such that it can attract sufficient stakes to the chain while ensuring that individual stakeholders do With the existence and uniqueness guaranteed, the only not control too much of the network stakes. Moreover, this question remained is how to find the equilibrium point. also discourages the chain operators from setting a too high Interestingly, for the considered game model, we can prove block reward that will cause the centralization of stakes into the exact formula of the equilibrium in Theorem 6. a single chain in FedChain. Based on the proposed utility function, we proceed to find the equilibrium of the upper Theorem 6. The point where every follower’s strategy satisfies R sub-game and the Stackelberg equilibrium of the considered s∗m = B m , ∀m ∈ M, ∀n ∈ N n n PM is the unique equilib- Stackelberg game in Theorem 7. i=1 Ri rium of the follower sub-game. ∗ Theorem 7. The point where every leader’s strategy is Rm = M − 1  B  Proof: See AppendixF PN n 2 n=1 Bn 1 + ln and every follower’s strategy Then, we can conclude that there is a unique sub-game M M R equilibrium for every fixed leader strategy set, and at the s∗m = B m , ∀m ∈ M, ∀n ∈ N satisfies n n PM is the unique equilibrium the stakeholders will play their optimal strate- i=1 Ri gies, i.e., Stackelberg equilibrium of the considered game. R Proof: See AppendixG. s∗m = B m , ∀m ∈ M, ∀n ∈ N . n n PM (5) Interestingly, the result from Theorem 7 shows that the i=1 Ri optimal strategies are the same for all the chain operators. This optimal strategy only depends on the stakeholder’s The reason is that since stakes can be transferred, the secu- total budget and the ratios of block rewards between the rity of the whole system is as strong as that of the weakest R PM sm = PN B m , ∀m ∈ M chain. Therefore, the highest utility can only be achieved chains, i.e., m=1 n n=1 n PM . i=1 Ri when every chain is equally secure. In the next stage, we will analyze the leader strategy to determine the optimal block reward for the leaders.

4.2.2 Leader strategy 5 PERFORMANCE EVALUATION

The proposed incentive mechanism for FedChain has two In this section, we conduct experiments and simulations main aims. The first one is to attract stakes to improve the to (i) show that the proposed Stackelberg game can help individual chain’s performance and security. The second the stakeholders to maximize their profits, (ii) confirm our aim is to ensure the decentralization of the system, i.e., analytical results, and (iii) demonstrate that the proposed encourage the stakeholders to distribute their stakes evenly incentive mechanism can enhance FedChain’s security and across all the chains. For these two aims, we propose a utility performance. To this end, we first examine the utility func- function Um for the leaders as follows: tion of a stakeholder to confirm our results from Theorem N 6 and show that the Stackelberg game model can help to X n ∗m Um = ωmsn − Rm maximize the stakeholder’s profit. After that, to evaluate n=1 the security and performance of the FedChain, we imple- N ! (6) X BnRm BnRm ment extensive simulations under various settings. In the = ln − Rm, PM R PM R simulations, we first show that the rational stakeholders will n=1 i=1 i i=1 i act according to our proposed Stackelberg game-theoretical n where ωm is a weight factor which can be defined by analysis. We will then demonstrate that the FedChain’s n ∗m ωm = ln(sn ). By using the logarithm of the stakes as the consensus mechanism can satisfy the security properties weight factor, we can achieve two main aims. In particular, and attain reasonable performance even under extreme ad- from this designed utility function, a leader can attract more versarial scenarios. Furthermore, we will show that under stakes invested to its pool by increasing its block reward. the same simulation setting, the proposed dynamic reward However, at a certain level, if this leader keeps increasing its scheme achieves better security and performance compared block reward to get more stakes, its utility will be decreased. to those of the static reward scheme. TABLE 2 Parameter setting

Parameter Weak Medium Strong Adversary Adversary Adversary N 100 100 100 M 3 3 3 LB 50 50 50 UB 100 100 100 ∆s (0, 1) (0, 1) (0, 1) BA 500 1000 1500 NA 10 20 30 ne 10 10 10

Fig. 6. Stakeholder’s utility function. 5.1 Simulation Setting First, we examine the utility function of stakeholder 1 in try to attack the chains under the static and dynamic reward a small case which consists of two stakeholders and three schemes. In the remaining scenarios, an adaptive adversary chains. The stakeholders have budgets B = [100, 300], and will try to attack the chains. For each type of adversary, we the chains set block rewards to be R = [10, 20, 30]. In this simulate three different levels of adversary capacity (low, experiment, the strategy of stakeholder 2 is fixed according medium, and high) as shown in Table 1. to (5). Then, we simulate a system with N stakeholders In terms of security, we measure the CP and CQ violation and M chains under different adversarial models (static probabilities. These probabilities can be determined by (7) and adaptive), reward schemes (static and dynamic), and and (9), respectively. In terms of performance, we measure different adversarial levels (weak, medium, and strong). The how much the adversaries can negatively impact the trans- simulation parameters are presented in Table2. action confirmation time and transaction throughput. To The simulation has several steps as presented in Algo- calculate the transaction confirmation time, for each chain, rithm 1 (see AppendixH). In particular, at the beginning, we find the value of κ such that PrCP < 0.1%. For the each stakeholder has a budget Bi ∈ [LB, UB] generated transaction throughput, we want to examine the case where randomly with uniform distribution. Each chain operator the adversary wants to reduce the transaction processing then sets a block reward Rm based on Theorem 7’s result in capability of one of the chains. Specifically, the adversary the case of the dynamic reward scheme. In the static reward will move all its stakes to a chain and participate in the scheme, Rm are fixed as constants based on several real- leader selection process. For every block the adversary is world PoS blockchain networks [32]–[34]. After the block elected to be the leader, it creates an empty block without rewards are set, the stakeholders make their decisions. To any transaction, thereby reducing the network’s transaction find the best strategies for each stakeholder, we employ the throughput. In the simulation, we measure a transaction Matlab fmincon function [29], starting from stakeholder 1. throughput reduction threshold Θ, such that the probability Then, the newly found optimal strategy is fixed for the that the adversary can reduce the transaction throughput stakeholder, and the algorithm continues to find the best more than Θ is overwhelmingly low (i.e., PrCQ < 0.1%). response for player 2 until stakeholder N. After that, the adversary begins to attack. In the static adversary scenario, 5.2 Performance Results the adversarial stakes budget BA is constant and predeter- mined. In the adaptive adversary scenario, the adversary 5.2.1 Economical benefits chooses a number NA of stakeholders to corrupt, making Fig.6 illustrates the utility function of stakeholder 1 in the their stakes to be adversarial stakes, i.e., the adversarial case where stakeholder 2 invest according to (5). As ob- P stakes budget is S Bi. Then, we measure the impacts served from the figure, stakeholder 1 can achieve maximum i∈NA of the adversary on PrCP, PrCQ, transaction confirmation utility when it also invests according to (5). Particularly, ∗ time, and transaction throughput. Finally, we simulate the stakeholder 1 achieves a utility U1 = 15 with the opti- ∗ stake changes during the epoch by randomly choosing N∆ mal strategy s1 = [16.6, 33.3, 50]. This result shows that stakeholders and changing their budgets by ±∆sBn, ∆s ∈ our Stackelberg game model can help the stakeholders to ∗1 (0, 1). The epoch is then ended, and the simulation moves to achieve maximum profits. Moreover, the ratios between s1 , ∗2 ∗3 the next epoch until the stopping criteria are met, i.e., after s1 , and s1 are the same as the ratios between R1, R2, and ne epochs. R3, which confirms our results in Theorem 6. During the simulation, we measure several important se- curity and performance criteria. First, we measure the stake 5.2.2 Stake distribution distribution at the beginning of each epoch to see if the ra- Fig.7 illustrates the stake distribution at the end of each tional stakeholders invest according to our game-theoretical epoch. As can be seen from the figure, although the to- analysis. Then, we examine four different scenarios. In the tal number of stakes vary across the epochs, the ratio of first two scenarios, we simulate a static adversary who will stakes invested in each chain remains unchanged in both Stake Distribution-Static Reward 10000 Weak Static Adversary-Common Prefix 0.02

5000 0.015

(%) 0.01 Stakes in chain in Stakes CP Chain 1 Chain 2 Chain 3 Pr 0 0.005 1 2 3 4 5 6 7 8 9 10 Epoch 0 Stake Distribution-Dynamic Reward 1 2 3 4 5 6 7 8 9 10 10000 Epoch Medium Static Adversary-Common Prefix 0.3

5000 0.2

(%) Stakes in chain in Stakes CP Chain 1 Chain 2 Chain 3 Pr 0.1 0 1 2 3 4 5 6 7 8 9 10 Epoch 0 1 2 3 4 5 6 7 8 9 10 Epoch Strong Static Adversary-Common Prefix Fig. 7. Stake distribution. 1.5

1

the dynamic and static reward schemes. Moreover, we can (%) observe that the stakes are distributed more evenly in the CP 0.5 Pr dynamic reward scheme, which is more beneficial to the 0 chains’ security and performance. Furthermore, the stake 1 2 3 4 5 6 7 8 9 10 ratios in both schemes equal the ratio of the block rewards, Epoch Chain 1-Static Chain 2-Static Chain 3-Static which confirms our analytical results in Theorem 6. Chain 1-Dynamic Chain 2-Dynamic Chain 3-Dynamic

5.2.3 Security properties Fig. 8. PrCP under static adversary settings. Fig.8 and Fig.9 illustrate PrCP of each chain at the end of each epoch under the static and adaptive adversary settings, respectively. From the figures, we can observe that the more stakes the adversary controls, the higher chance it can violate the security of the system. For example, Weak Adaptive Adversary-Common Prefix 15 in the static adversary setting, with a low budget (weak adversary), PrCP is at most 0.02%, whereas this probability 10 (%)

increases to 1.5% in case of an adversary with a high budget CP (strong adversary). Secondly, the total system stakes have Pr 5 different effects on the chains’ security under the static and 0 adaptive adversary setting. For instance, the system has 1 2 3 4 5 6 7 8 9 10 the highest stakes in the last epoch. At this epoch, PrCP Epoch Medium Adaptive Adversary-Common Prefix achieve the lowest value under the static adversary because 20 the static adversary has a fixed budget. However, PrCP achieve the highest value under the adaptive adversary 15 setting because the adaptive adversary can corrupt the (%) 10 CP stakeholders with the most stakes. Therefore, it is crucial Pr 5 to not only attract more stakes to the system but also to 0 incentivize more diversity, i.e., encourage the stakeholders 1 2 3 4 5 6 7 8 9 10 to split their stakes across more chains. We can observe the Epoch effect of such diversity between the dynamic and the static Strong Adaptive Adversary-Common Prefix reward schemes. Although the total network stakes are the 20 same, the dynamic scheme, which encourages equal stakes 15

Pr (%) distribution, achieves much lower CP, e.g., at most 14% 10 CP

compared to 24% of the static reward scheme. Pr 5 Fig. 10 and Fig. 11 illustrate PrCQ of each chain under the 0 static and adaptive adversary settings, respectively. Similar 1 2 3 4 5 6 7 8 9 10 to the PrCP, we can draw several conclusions from examin- Epoch Chain 1-Static Chain 2-Static Chain 3-Static ing PrCQ. Firstly, the stronger the adversary is, the higher Chain 1-Dynamic Chain 2-Dynamic Chain 3-Dynamic chance it violates system security. For example, in the weak adaptive adversary scenario, PrCQ is at most 1.2%, whereas Fig. 9. PrCP under adaptive adversary settings. this probability increases to 2.4% in the case of a strong adaptive adversary. Generally, PrCQ gets higher in the case Weak Static Adversary-Chain Quality Weak Adaptive Adversary-Chain Quality 1.2 4

1 3 (%) 0.8 (%) CQ CQ Pr

Pr 2 0.6

0.4 1 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Medium Static Adversary-Chain Quality Medium Adaptive Adversary-Chain Quality 2 4

3.5 (%) (%) 1.5 3 CQ CQ Pr

Pr 2.5

1 2 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Strong Static Adversary-Chain Quality Strong Adaptive Adversary-Chain Quality 2.5 4

3.5 2 (%) (%) 3 CQ CQ

Pr 1.5 Pr 2.5

1 2 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Chain 1-Static Chain 2-Static Chain 3-Static Chain 1-Static Chain 2-Static Chain 3-Static Chain 1-Dynamic Chain 2-Dynamic Chain 3-Dynamic Chain 1-Dynamic Chain 2-Dynamic Chain 3-Dynamic

Fig. 10. PrCQ under static adversary settings. Fig. 11. PrCQ under adaptive adversary settings.

of the adaptive adversary. The reason is that according settings, whereas the opposite holds true in the adaptive to the simulation setting, the adversary can corrupt more adversary settings. The reason is the same as that of the stakes compared to BA in the case of the static adversary. PrCP scenarios, i.e., the adaptive adversary can corrupt Secondly, similar to the results of PrCP, PrCQ is inversely more stakes, whereas BA of the static adversary is fixed. proportional to the total system stakes in the case of the Furthermore, the transaction confirmation time of the three static adversary, and it is proportional to the total system chains under the dynamic reward schemes is always better stakes in the case of the adaptive adversary. As a result, than at least two chains under the static reward scheme. we can observe that the dynamic scheme achieves lower Fig. 14 and Fig. 15 illustrate the transaction throughput PrCQ, e.g., at most 14% PrCQ compared to 24%. Moreover, reduction percentages of each chain under the static and since the security of the system is only as good as that of its adaptive adversary setting, respectively. Similar to the pre- weakest chain (especially with the SPV proof mechanism), it vious scenarios, we can observe that a stronger adversary can be observed that the dynamic reward scheme achieves can cause more negative impacts on the system perfor- better security compared to the static reward scheme, i.e., mance, e.g., a weak static adversary can reduce the through- the chains of the dynamic reward scheme always achieve put by at most 24%, whereas the strong static adversary better PrCP and PrCQ compared to those of the weakest can reduce the throughput by nearly 50%. Moreover, it chain under the static reward scheme (i.e., Chain 3). can be observed that as the system has more stakes, the static adversary becomes weaker, whereas the adaptive ad- 5.2.4 Performance properties versary becomes stronger, similar to the previous scenario. Fig. 12 and Fig. 13 illustrate the transaction confirmation Finally, one can observe that the dynamic reward scheme time of each chain under the static and adaptive adversary can achieve a better overall performance compared to that settings, respectively. From the figures, we can observe that of the static reward scheme (the performances of the three the stronger the adversary is, the more it can negatively chains in the dynamic scheme are better than those of at affect the system performance. For example, the chains takes least two chains in the static scheme). at most 120 seconds to confirm a transaction in case of a weak static adversary, but it takes up to 220 seconds in case of a strong static adversary. This is because the 6 CONCLUSION transaction confirmation time is directly related to PrCP. In this paper, we have introduced FedChain, an effective A stronger adversary has a higher chance to violate the framework for federated-blockchain systems together with CP property, and thus the users have to wait longer to a cross-chain transfer protocol to facilitate the secure and confirm a transaction. Moreover, we can also observe that decentralized transfer of tokens between the blockchains. In the transaction confirmation time is inversely proportional this framework, we have proposed a novel consensus mech- to the total stakes of the system in the static adversary anism which can satisfy the CP, CG, and CQ properties, Weak Static Adversary-Throughput Weak Static Adversary-Tx Confirmation Time 25 250 20 200

150 15

100 10

Throughput reduction (%) 1 2 3 4 5 6 7 8 9 10 Tx confirmation time (s) 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Medium Static Adversary-Throughput Medium Static Adversary-Tx Confirmation Time 40 250 35 200 30

150 25

100 20 Throughput reduction (%) Tx confirmation time (s) 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Strong Static Adversary-Throughput Strong Static Adversary-Tx Confirmation Time 50 250 45

200 40

150 35 30 100 Tx confirmation time (s) 1 2 3 4 5 6 7 8 9 10 Throughput reduction (%) 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Chain 1-Static Chain 2-Static Chain 3-Static Chain 1-Static Chain 2-Static Chain 3-Static Chain 1-Dynamic Chain 2-Dynamic Chain 3-Dynamic Chain 1-Dynamic Chain 2-Dynamic Chain 3-Dynamic

Fig. 12. Transaction confirmation time under static adversary settings. Fig. 14. Transaction throughput reduction under static adversary set- tings.

Weak Adaptive Adversary-Tx Confirmation Time Weak Adaptive Adversary-Throughput 80 400

300 60

200 40

100 20 Tx confirmation time (s)

1 2 3 4 5 6 7 8 9 10 Throughput reduction (%) 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Medium Adaptive Adversary-Tx Confirmation Time Medium Adaptive Adversary-Throughput 600 80

500 70

400 60

300 50

200 40

Tx confirmation time (s) 1 2 3 4 5 6 7 8 9 10 Throughput reduction (%) 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Strong Adaptive Adversary-Tx Confirmation Time Strong Adaptive Adversary-Throughput 600 80 500 70 400 60 300 50 200

Tx confirmation time (s) 1 2 3 4 5 6 7 8 9 10 40

Throughput reduction (%) 1 2 3 4 5 6 7 8 9 10 Epoch Epoch Chain 1-Static Chain 2-Static Chain 3-Static Chain 1-Dynamic Chain 2-Dynamic Chain 3-Dynamic Chain 1-Static Chain 2-Static Chain 3-Static Chain 1-Dynamic Chain 2-Dynamic Chain 3-Dynamic

Fig. 13. Transaction confirmation time under adaptive adversary set- Fig. 15. Transaction throughput reduction under adaptive adversary tings. settings. prevent various blockchain-specific attacks, and achieve [16] A. Garoffolo, D. Kaidalov and R. Oliynykov, “Zendoo: better transaction confirmation time compared to existing a zk-SNARK verifiable cross-chain transfer protocol enabling decoupled and decentralized sidechains,” 2020, consensus mechanisms. Robust theoretical analyses have arXiv preprint arXiv:2002.01847. [Online]. Available: been then conducted to prove FedChain’s consensus mech- https://arxiv.org/abs/2002.01847. anism security and performance properties. After that, a [17] A. Kiayias, A. Russell, B. David, and R. Oliynykov, “Ouroboros: A Stackelberg game model has been developed to examine the Provably Secure Proof-of-Stake Blockchain Protocol,” in Proc. 37th Annu. Int. Cryptolog. Conf. (CRYPTO), Santa Barbara, CA, USA, Aug. interactions between the stakeholders and the blockchains 2017, pp. 357–388. managed by chain operators. This model can provide addi- [18] P. Daian, R. Pass, E. Shi, “Snow white: Robustly reconfigurable tional profits for the stakeholders and enhance the security consensus and applications to provably secure proof of stake,” in International Conference on Financial Cryptography and Data Security, and performance of the blockchains. Through analyses of Saint Kitts and Nevis, Feb. 18-22, 2019, pp. 23-41. the Stackelberg game model, we can prove the uniqueness [19] V. Buterin and V. Griffith, “Casper the friendly finality gad- of the Stackelberg equilibrium and find the exact formula for get,” 2017, arXiv preprint arXiv:1710.09437. [Online]. Available: this equilibrium. These results are especially important for https://arxiv.org/abs/1710.09437 [20] E. Buchman, J. Kwon, and Z. Milosevic (Sep 2018) the stakeholders to determine their best investment strate- The latest gossip on BFT consensus. [Online]. Available: gies and for the chain operators to design the optimal policy, https://tendermint.com/static/docs/tendermint.pdf i.e., block rewards. Finally, extensive experiments and sim- [21] I. Bentov, A. Gabizon, and A. Mizrahi, “Cryptocurrencies without ,” in International Conference on Financial Cryptography ulations have been conducted to show that our proposed and Data Security. Barbados, Feb. 2016, pp. 142–157. framework can help stakeholders to maximize their profits [22] I. Bentov, C. Lee, A. Mizrahi, and M. Rosenfeld, “Proof of activity: and the chain operator to design appropriate parameters to Extending bitcoin’s proof of work via proof of stake (extended enhance FedChain’s security and performance. abstract),” ACM SIGMETRICS Performance Evaluation Review, vol. 42, no. 3, pp. 34–37, Dec. 2014. [23] Y. Gilad, R. Hemo, S. Micali, G. Vlachos, and N. Zeldovich, “Algorand: Scaling byzantine agreements for cryptocurrencies,” in REFERENCES Proceedings of the 26th Symposium on Operating Systems Principles, Oct. 2017, pp. 51–68. [1] W. Wang, D. T. Hoang, P. Hu, Z. Xiong, D. Niyato, P. Wang, Y. Wen, [24] J. Garay, A. Kiayias and N. Leonardos “The bitcoin backbone and D. I. Kim, “A Survey on Consensus Mechanisms and Mining protocol: Analysis and applications,” in Annual International Confer- Strategy Management in Blockchain Networks,” IEEE Access, vol. ence on the Theory and Applications of Cryptographic Techniques, Sofia, 7, pp. 22328–22370, Jan. 2019. Bulgaria, April 26-30, 2015, pp. 281-310. [2] C. T. Nguyen, D. T. Hoang, D. N. Nguyen, D. Niyato, H. T. Nguyen, [25] S. Nakamoto, (May 2008). “Bitcoin: A peer-to-peer electronic cash and E. Dutkiewicz, “Proof-of-Stake consensus mechanisms for fu- system”. [Online]. Available: https://bitcoin.org/bitcoin.pdf International ture blockchain networks: Fundamentals, applications and oppor- [26] M. Stadler “Publicly verifiable secret sharing,” in Conference on the Theory and Applications of Cryptographic Techniques tunities,” IEEE Access, vol. 7, pp. 85727–85745, June 2019. , Saragossa, Spain, May 12–16, 1996, pp. 190-199. [3] “Global Charts,” CoinMarketCap. [Online]. Available: [27] L. Luu, D. Chu, H. Olickel, P. Saxena, and A. Hobor, “Making https://coinmarketcap.com/charts/. Accessed on: 04-Nov-2020. smart contracts smarter,” in Proc. of the ACM SIGSAC Conference on [4] “Buy & sell Crypto in minutes,” Binance. [Online]. Available: Computer and Communications Security, Vienna, Austria, Oct. 2016, https://www.binance.com/en. Accessed on: 04-Nov-2020. pp. 254-269. [5] “Bitcoin & ,” Kraken. [Online]. Available: [28] Cardano, “Ouroboros Proof of Stake Algorithm,” Cardano. https://www.kraken.com/. Accessed on: 04-Nov-2020. [Online]. Available: https://cardanodocs.com/cardano/ [6] Selfkey, “A Comprehensive List of Cryptocurrency Exchange proof-of-stake/. Hacks,” Selfkey. [Online]. Available: https://selfkey.org/list-of- [29] MathWorks, “Fmincon,” Mathworks. [Online]. Available: https:// cryptocurrency-exchange-hacks/. Accessed on: 04-Nov-2020. www.mathworks.com/help/optim/ug/fmincon.html. [7] Y. Xiao, N. Zhang, W. Lou and Y. T. Hou YT, “A survey of [30] Z. Han, D. Niyato, W. Saad, T. Bas¸ar, and A. Hjørungnes, Game distributed consensus protocols for blockchain networks,” IEEE theory in wireless and communication networks: theory, models, and Communications Surveys & Tutorials, vol. 2, no. 22, pp. 1432-1465, applications. Cambridge: Cambridge University Press, 2012. Jan, 2020. [31] M. Mitzenmacher and E. Upfal, Probability and computing: Ran- [8] A. Back et al. (Oct. 2008). Enabling blockchain inno- domization and probabilistic techniques in algorithms and data analysis. vations with pegged sidechains. [Online]. Available: Cambridge: Cambridge University Press, 2017. http://kevinriggen.com/files/sidechains.pdf [32] StakingRewards, “Cardano,” Digital Asset Research [9] A. Singh et al., “Sidechain technologies in blockchain net- Platform for Staking & Dividends. [Online]. Available: works: An examination and state-of-the-art review,” Journal of https://stakingrewards.com/asset/ada. [Accessed: 16-Aug-2020]. Network and Computer Applications, vol. 149, Jan. 2020, doi: [33] StakingRewards, “Algorand,” Digital Asset Research https://doi.org/10.1016/j.jnca.2019.102471 Platform for Staking & Dividends. [Online]. Available: [10] V. Arasev. (Sep. 2018). POA network whitepaper. [Online]. Avail- https://stakingrewards.com/asset/algo. [Accessed: 16-Aug-2020]. able: https://github.com/poanetwork/wiki/wiki/POA-Network- [34] StakingRewards, “,” Digital Asset Research Plat- Whitepaper form for Staking & Dividends. [Online]. Available: [11] J. Dilley et al., “Strong federations: an interoperable https://stakingrewards.com/asset/xtz. [Accessed: 16-Aug-2020]. blockchain solution to centralized third-party risks,” [35] J. B. Rosen, “Existence and Uniqueness of Equilibrium Points for 2016, arXiv preprint arXiv:1612.05491. [Online]. Available: Concave N-Person Games,” Econometrica, vol. 33, no. 3, pp. 520-534, https://arxiv.org/abs/1612.05491. July 1965. [12] S. Lerner. (Jan. 2016). Drivechains, Sidechains and Hybrid 2-way Peg Designs [Online]. Available: https://docs.rsk.co/Drivechains Sidechains and Hybrid 2-way peg Designs R9.pdf. [13] G. Wood, “Ethereum: A secure decentralised generalised trans- action ledger,” Ethereum Project, Zug, Switzerland, Yellow Paper EIP-150 Rev., Aug. 2017, vol. 151. [14] A. Garoffolo, and R. Viglione, “Sidechains: Decoupled consensus between chains,” 2018, arXiv preprint arXiv:1812.05441. [Online]. Available: https://arxiv.org/abs/1812.05441. [15] P. Gazi,ˇ A. Kiayias and D. Zindros, “Proof-of-Stake Sidechains,” in 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA, May 18-19, 2019, pp. 139-156. APPENDIX A total network stakes, the probability that the adversary is PROOFOF THEOREM 1 elected to be the leader for κ consecutive blocks is κ PrCP = (1 − γ) , (7) We first prove that our FedChain’s consensus mechanism can satisfy the CP property in Lemma 1. which is also the probability that the CP property is violated.

Lemma 1. The probability that FedChain’s consensus mechanism Then, we prove that our FedChain’s consensus mecha- κ ∈ violates the common prefix property with parameter N is less nism satisfies the CG property in Lemma 2. than or equal to (1 − γ)κ. Lemma 2. FedChain’s consensus mechanism satisfies the chain Proof: In order to violate the CP property, the adver- growth property sary must have two forks with at least κ conflicting blocks, and both forks must be accepted by the honest stakeholders. Proof: Even if a new block is not broadcast during However, an honest stakeholder will accept only one fork in a time slot, an empty block will be added to the chain. the same time slot. Therefore, the adversary must (i) create Therefore, the CG property will always be satisfied. a fork, (ii) have the honest stakeholders accept it, (iii) create Next, we prove that FedChain’s consensus mechanism another fork with a conflicting block at a later time slot, and can satisfy the CQ property in Lemma 3. (iv) have the honest stakeholders accept the new fork. We Lemma 3. The probability that FedChain’s consensus mechanism will prove that the adversary can only do that if it is elected violates the ideal chain quality property with parameters l, µ over to be the leader for κ consecutive blocks. l(γ − 1)δ2  l blocks is no more than 1 − exp . Without loss of generality, assume that the adversary is 2 l l l elected to be the leader at time slot s1, s2, and s4. This means l Proof: We can characterize the block adding process that at s3 an honest stakeholder is elected to be the leader. Assume that the adversary wants to create two conflicting among the honest stakeholders and the adversary as a i binomial random walk [31]. During the considered l slots, forks C1, C2. Let Bj denote the block from fork Ci at time l l l the leader election processes can be considered indepen- slot sj. Firstly, at s1 and s2, the adversary broadcasts blocks 1 1 dent Bernoulli trials X1,...,Xl such that, for 1 ≤ i ≤ l, B1 and B2. At this point, the adversary can create fork C2 2 1 2 1 Pr[Xi = 0] = γ and Pr[Xi = 1] = 1 − γ. Then, the expected with different blocks, i.e., B 6= B and B 6= B , and has l 1 1 2 2 value of the trials is [X] = P (1 − γ). Applying the both forks accepted by the honest stakeholder (some honest E i=1 Chernoff bound [31], the probability that the adversary cre- stakeholders will adopt C1 while some will adopt C2). l ates less than l(1 − µ) blocks, i.e., X = P X < l(1 − µ), However, at sl , the honest leader will either choose one i=1 i 3 is of the two forks to adopt. Assume that the leader chooses  2  C , it will add block B1 to the chain, and the fork C will −E[X]δ 1 3 2 Pr[X < (1 − δ)E[X]] = exp , be discarded by all honest stakeholders. Next, at sl , the 2 4 (8) adversary is elected to be the leader and can create a fork (µ − 1)lδ2  Pr[X < (1 − δ)l(1 − µ)] = exp , again. At this point, the adversary can try to broadcast C2 2 2 1 to the honest stakeholder again with block B1 6= B1 (e.g., 1 where δ is any real number such that 0 < δ ≤ 1. In the case to gain back the tokens spent in block B1). Nevertheless, any change in a block’s content results in a different block’s of ideal CQ [24], we have µ = γ, and the ideal CQ violation hash, and the block’s hash is linked to its previous block. probability is 1 1 Thus, B1 cannot be changed unless block B3 is changed. l(γ − 1)δ2  1 Pr = 1 − exp (9) However, since the leader of B3 is honest, the block will not CQ 2 be changed (due to consensus rules I2 and I3). Moreover, the leader election is conducted at the begin- ning of each epoch, and as long as the PVSS protocol is From Lemma 1, we have the CP violation probability Pr = (1 − γ)κ κ secure (proven in [26]), any honest stakeholder can obtain CP which decreases exponentially as grows. and verify the correct leader list if that stakeholder is online Then, we proved in Lemma 2 that the CG property will at least once during the epoch (thanks to consensus rule I ). always be satisfied. Finally, from Lemma 3, we have the CQ 1 l(γ − 1)δ2  Since the epoch is long (e.g., 5 days [17]), we can assume violation probability PrCQ = 1 − exp which that every honest stakeholder will have the correct leader 2 decreases exponentially as l and δ grow. Thus, all the three list. Therefore, the adversary also cannot broadcast B1 6= B2 3 3 violation probabilities can be satisfied with overwhelming on its own since it is not the designated leader. Thus, the 1 probabilities, and the proof is completed. adversary must include B3 and every block before that. Otherwise, it will create an invalid fork that will be rejected due to due to consensus rule I4. APPENDIX B As a result, the part of the chain from the first block to PROOFOF THEOREM 2 the latest honest block (e.g., until B1 in the above analysis) 3 We prove FedChain’s consensus mechanism’s ability to pre- is confirmed by every honest user. Therefore, the adversary vent each attack as follows: can only create forks with κ last blocks different from the honest fork if it is elected to be the leader for κ consecutive • Double-spending attack To double-spend, the at- blocks. Since (1 − γ) is the ratio of adversarial stakes in the tacker has to either create a conflicting transaction 1 in the same fork, i.e., create Tx1 in Bi and Tx2 Lemma 5. Un is concave over Sn, ∀n ∈ N . 1 in Bj , or create two transactions in two forks, i.e., 1 2 Proof: We have: create Tx1 in Bi ∈ C1 and Tx2 in Bj ∈ C2. For the first approach, Tx2 is not a valid transaction and ∂2U m −2R T n = m m ≤ 0. will be rejected. For the second approach, if the CP m 2 m 3 (13) ∂(sn ) (sn + Tm) property is not violated, only one of C1 and C2 will m PM m be confirmed. Thus, this attack is prevented. Thus, Un is concave over Sn. Then, Un = m=1 Un is also • Grinding attack: The seeds for leader and committee concave over Sn. selection are created by the committee via the PVSS According to [30], if Sn is compact and convex and protocol in FedChain’s consensus mechanism. There- Un is quasi-concave ∀n ∈ N , there exists at least one fore, grinding attacks are prevented. Nash equilibrium. It follows from Lemma 4 and 5 that the • Nothing-at-stake attacks: Although the adversary follower sub-game satisfies these conditions, and thus the can create valid forks, they are not confirmed. There- proof of this Theorem is complete. fore, the vendors only have to wait until a transaction is confirmed. Thus, this attack is prevented as long as the CP property holds. APPENDIX D • Bribe attacks: In the considered adaptive adversary ROOFOF HEOREM model, the adversary can only corrupt honest stake- P T 4 holders with a delay. Since the adversary cannot According to Rosen’s theorem [35], a sufficient condition know who is the leader in advance, the adversary to guarantee the uniqueness of the equilibrium is that the cannot bribe the leaders. Thus, this attack is pre- T matrix [G(s, ω) + G (s, ω)] is negative definite for a fixed vented. ω > 0. G(s, ω) can be calculated by: • Transaction denial attack: With the liveness prop- erty, a transaction will eventually be included in  2 2 2  a block created by an honest leader. As a result, ∂ U1 ∂ U1 ∂ U1 ω1 1 1 ω1 2 1 ··· ω1 M 1 this attack can be prevented as long as the liveness  ∂s1∂s1 ∂s1∂s1 ∂s1 ∂sN   2 2 2  property (or the CG and CQ properties) holds.  ∂ U1 ∂ U1 ∂ U1   ω ω ··· ω   1 1 2 1 2 2 1 M 2  • Long-range attack: FedChain’s consensus mecha-  ∂s1∂s1 ∂s1∂s1 ∂s1 ∂sN  G(s, ω) =   nism can prevent this attack by locking committee  . . . .   . . . .  members’ stakes during their designated epochs.  . . . .     2 2 2   ∂ UN ∂ UN ∂ UN  ω ω ··· ω N ∂s1 ∂sM N ∂s2 ∂sM N ∂sM ∂sM APPENDIX C N 1 N 1 N N (14) PROOFOF THEOREM 3 Let ωn = 1, ∀n ∈ N , G(s, ω) can be rewritten as (15). Let Sn denote the strategy space of follower n. Then, any The entries of G(s, ω) can then be calculated as follows: 1 M strategy sn = [sn, . . . , sn ] that satisfies  2  M m 2Rm −Tm X Φ = , (16) sm ≤ B , n PN (sm + T )3 n n (10) n=1 Bn n m m=1 and  m  is a feasible strategy of follower n, i.e., sn ∈ Sn. We first m 2Rm sn Tm φn = . (17) prove Sn to be compact and convex ∀n ∈ N in Lemma 4. PN (sm + T )3 n=1 Bn n m Lemma 4. Sn is compact and convex ∀n ∈ N . From (16) and (17), we can calculate 0  m  Proof: Let sn and s n be any two different strategies 2Rm −Tm(s + Tm) ∆m = Φm − φm = n , (18) in Sn. To prove Sn is convex, we prove that any convex n n n PN (sm + T )3 0 n=1 Bn n m combination of sn and s n is in Sn, i.e., 0 1 01 M which is negative. Then, G(s, ω) can be expressed as a sum λsn + (1 − λ)s n = [λsn + (1 − λ)sn , . . . , λsn + of 2 matrices G = D + E, where: 0M 0 (11) (1 − λ)sn ] ∈ Sn, ∀λ ∈ (0, 1), ∀sn, s n ∈ Sn. • 0 0 D is similar to G, except that all the diagonal entries m m m m m m Since λsn +(1−λ)sn ≤ max{sn , sn }, ∀m ∈ M, we have of D are φn instead of Φn . Then, D has identical M    M M  columns (columns i and M + i are identical), and X 1 01 X m X 0m λs + (1 − λ)s ≤ max s , s ≤ Bn. thus it is negative semi-definite. n n n n m m=1 m=1 m=1 • E is a diagonal matrix with entries equal to ∆n . (12) Thus, E is negative definite 0 From (12), all convex combinations of sn and s n satisfy (10), and thus they all lie in Sn. As a result, Sn is convex. As a result, G(s, ω) is the sum of a negative semi-definite Moreover, since Sn is closed and bounded, it is compact. matrix and a negative definite matrix (E). Thus, G(s, ω) is negative definite. Therefore, [G(s, ω)+GT (s, ω)] is negative Then, we prove that Un is concave in Lemma 5. definite, and the proof is completed.  1 1 1  Φ1 0 ··· 0 0 ··· φ1 0 ··· 0 0 ··· φ1 0 ··· 0 0    m m m   0 Φ1 0 ··· 0 ··· 0 φ1 0 ··· 0 ··· 0 φ1 0 ··· 0      0 0 ··· 0 ΦM ··· 0 0 ··· 0 φM ··· 0 0 ··· 0 φM   1 1 1       ......   ......       1 1 1  φ 0 ··· 0 0 ··· Φ 0 ··· 0 0 ··· φ 0 ··· 0 0   n n n     m m m   0 φn 0 ··· 0 ··· 0 Φn 0 ··· 0 ··· 0 φn 0 ··· 0   . (15)    0 0 ··· 0 φM ··· 0 0 ··· 0 ΦM ··· 0 0 ··· 0 φM   n n n       ......   ......   ......      φ1 0 ··· 0 0 ··· φ1 0 ··· 0 0 ··· Φ1 0 ··· 0 0   N N N     m m m   0 φN 0 ··· 0 ··· 0 φN 0 ··· 0 ··· 0 ΦN 0 ··· 0    M M M   0 0 ··· 0 φN ··· 0 0 ··· 0 φN ··· 0 0 ··· 0 ΦN 

APPENDIX E thus this is the Nash equilibrium of this game. Substitute Rm ∂Un PROOFOF THEOREM 5 sm = B into , we have n n PM ∂sm i=1 Ri n

Assume that follower n is employing strategy sn which ∂Un RmTm RM TM PM m m = m 2 − M 2 , invests less than the available budget, i.e., m=1 sn < Bn. ∂sn (sn + Tm) (sn + TM ) The utility function in this case is given in (3). Without loss R2 R2 0 P m P M of generality, if the follower chooses a strategy s which j∈N Bj j∈N Bj n −n PM R −n PM R invests the remaining budget ∆sj into a chain j, its utility = i=1 i − i=1 i , n R R function becomes: PN (B m )2 PN (B M )2 n=1 n PM n=1 n PM  m  j j i=1 Ri i=1 Ri 0 X sn sn + ∆sn U = Rm + Rj,  PM PM  n m j j (19) Ri Ri sn + Tm sn + ∆sn + T X i=1 i=1 m∈M−j j = Bj − , PN (B )2 PN (B )2 j∈N−n n=1 n n=1 n where M−j is the set of all chains except chain j. Then, the difference in the utilities between the two strategies is: =0, ∀m ∈ M, and ∀n ∈ N . (21) j j j 0 sn + ∆sn sn The proof is now completed. Un − Un = j j Rj − j Rj, sn + ∆sn + Tj sn + Tj (20) ∆sj P sj n k∈N−n k APPENDIX G = j j j , (sn + ∆sn + Tj)(sn + Tj) PROOFOF THEOREM 7 which is always positive. This means that sn always gives To find the equilibrium of this upper sub-game, we first find 0 ∗ a lower payoff than sn regardless of the other followers’ the best response Rm for each leader, i.e., the strategies that strategies, and the proof is completed. maximizes Um when the strategies of the other leaders are fixed. To this end, we first take the derivative of Um:  ! P BnRm Bn Ri 1 + ln N i∈M−m PM dUm X Ri = i=1 − 1. APPENDIX F R P 2 d m n=1 (Rm + Ri) PROOFOF THEOREM 6 i∈M−m (22)

∗ dUm We prove that at the point where every follower’s strategy To find Rm, we solve = 0, i.e., m Rm dRm satisfies sn = Bn , ∀m ∈ M, ∀n ∈ N , every PM R  ! i=1 i P BnRm ∂Un Bn i∈M Ri 1 + ln follower’s strategy maximizes its utility ( = 0). There- N −m PM R ∂sm X i=1 i (23) n 2 − 1 = 0. fore, no rational follower will deviate from this point, and (R + P R ) n=1 m i∈M−m i Since the leaders’ utility functions are the same, we have APPENDIX H P R = (M − 1)R i∈M−m i m. Then, (23) becomes ALGORITHM 1  ! P BnRm Algorithm 1 Bn Ri 1 + ln Simulation Steps N i∈M−m PM ∂Um X Ri = i=1 − 1 = 0, 1: k ← 0 ∂R (R + P R )2 2: repeat m n=1 m i∈M−m i  ! 3: if reward scheme = dynamic then P BnRm Bn Ri 1 + ln /*Chains set block rewards at each epoch*/ N i∈M−m PM Ri m := 1 M X i=1 4: for to do    P 2 = 1, M − 1 N Bn (Rm + Ri) ∗ P n=1 i∈M−m 5: Rm ← 2 n=1 Bn 1 + ln    M M BnRm 6: end for N Bn(M − 1)Rm 1 + ln X MRm 7: end if = 1, (MR )2 8: for n := 1 to N do n=1 m    /*Followers make decisions*/ Bn N Bn(M − 1) 1 + ln 9: for m := 1 to M do X M ∗m = 1, 10: Find sn using fmincon M 2R n=1 m 11: end for N    12: end for M − 1 X Bn B 1 + ln = R . 13: if Adversary = Static then M 2 n M m n=1 /*Static Adversary*/ (24) 14: Adversary attacks with fixed BA Thus, 15: else N    /*Adaptive Adversary*/ ∗ M − 1 X Bn R = Bn 1 + ln , (25) 16: Adversary corrupts N stakeholders m M 2 M A n=1 B = P B 17: Adversary attacks with A i∈NA i ∗ 18: end if is the optimal strategy of leader m. Since Rm is uniquely defined by constants, i.e., M and Bn, the equilibrium of 19: for i := 1 to N∆ do this upper sub-game exists and is unique. As a result, the /*Randomly adjust followers’ budgets*/ considered Stackelberg game admits a unique Stackelberg 20: Adjust a random follower budget by ±∆sBn equilibrium. 21: end for 22: k ← k + 1 23: until k > ne