Be Aware of Your Leaders

Abstract

Advances in blockchains have influenced the State-Machine-Replication (SMR) world and many state-of-the-art blockchain-SMR solutions are based on two pillars: Chaining and Leader-rotation. A predetermined round-robin mechanism used for Leader-rotation, however, has an undesirable behavior: crashed parties become designated leaders infinitely often, slowing down overall system performance. In this paper, we provide a new Leader-Aware SMR framework that, among other desirable properties, formalizes a Leader-utilization requirement that bounds the number of rounds whose leaders are faulty in crash-only executions.

We introduce Carousel, a novel, reputation-based Leader-rotation solution to achieve Leader-Aware SMR. The challenge in adaptive Leader-rotation is that it cannot rely on consensus to determine a leader, since consensus itself needs a leader. Carousel uses the available on-chain information to determine a leader locally and achieves Liveness despite this difficulty. A HotStuff implementation fitted with Carousel demonstrates drastic performance improvements: it increases throughput over 2x in faultless settings and provided a 20x throughput increase and 5x latency reduction in the presence of faults.

Appendix ACorrectness

Lemma 9

If $\mathtt {choose\_leader}$ returns the same honest party at all honest parties for infinitely many rounds, then each honest party commits an unbounded number of blocks.

Proof

If $\mathtt {choose\_leader}$ returns the same honest party at all honest parties for infinitely many rounds, then there are infinitely many rounds after GST for which it does so. Let r be such a round. By the Pacemaker guarantees, all honest parties make LBR-synchronized($\ell$) invocations with the same honest leader $\ell$ returned from the $\mathtt {choose\_leader}$ procedure. By the LBR Progress property, they all return a certified block B and commit it at line 6.

Lemma 1

In a crash-only execution, let r be a round with $k \ge 2f+1$ LBR-synchronized($\ell$) invocations, such that $\ell$ is alive at round r, then these k invocations return a certified B with round number r authored by $\ell$.

Proof

Let $\pi _1$ be a crash-only execution, such that round r has $k \ge 2f+1$ LBR-synchronized($\ell$) invocations with a leader $\ell$ that is alive at round r. If $\ell$ is honest, then the LBR Progress property concludes the proof.

Otherwise, $\ell$ is faulty and by definition it crashes in round $> r$. Let $\pi _2$ be a crash-only execution that is identical to $\pi _1$ until $\ell$ crashes, and the rest of $\pi _2$ is an arbitrary execution where the honest parties in $\pi _1$ remain honest but $\ell$ never crashes and is also honest. Thus, in $\pi _2$ the preconditions of the LBR Progress property hold and all k LBR-synchronized($\ell$) invocations return a certified B with round number r authored by $\ell$.

An $LBR(r, \ell )$ invocation by any party p completes within $\varDelta _l$ time, and starts immediately after Pacemaker’s $\mathtt {new\_round(r)}$ notification at p (because $\mathtt {choose\_leader}$ is computed locally and takes 0 time). By Pacemaker’s guarantees, no party receives $\mathtt {new\_round} (r+1)$ notification until $\varDelta _p = \varDelta _l$ time after the last $\mathtt {new\_round} (r+1)$ notification at some party, hence all $LBR(r, \ell )$ invocations must complete before any party receives a $\mathtt {new\_round} (r+1)$ notification.

$\pi _1$ and $\pi _2$ are identical until $\ell$ crashes, which must happen after $\ell$ receives its $\mathtt {new\_round} (r+1)$ notification from the Pacemaker. This is because $\ell$ is alive in round r and follows the protocol, invoking LBR in round $r+1$ after receiving the $\mathtt {new\_round} (r+1)$ notification. As a result, $\pi _1$ and $\pi _2$ are indistinguishable to all $LBR(r, \ell )$ invocations, and the k LBR-synchronized($\ell$) invocations in $\pi _1$ return certified block B with round number r authored by $\ell$ as in $\pi _2$, as desired.