Consensus Attack

The most fundamental consensus attack on Proof-of-Work networks. A malicious entity controlling more than 50% of the network's total hash rate can systematically reverse transactions and double-spend assets.

• Mechanism: The attacker privately mines a longer, alternate chain fork while transacting on the public chain.
• Execution: Once the private fork surpasses the public chain's length, it is broadcast, causing a chain reorganization that invalidates the attacker's original transactions.
• Impact: Enables double-spending and transaction censorship, though it cannot forge signatures or steal coins from existing addresses.

An attack targeting Proof-of-Stake systems where an adversary creates an alternate chain history originating from a point far in the past, often when they controlled a majority of stake.

• Weak Subjectivity: This attack exploits the fact that new nodes joining the network have no cryptographic way to distinguish the canonical chain without trusted checkpoints.
• Execution: The attacker builds a forked chain from a genesis block or early checkpoint, outpacing the current chain because there is no computational work requirement.
• Mitigation: Enforced by weak subjectivity checkpoints and social consensus on finality.

A theoretical vulnerability in early Proof-of-Stake designs where validators have no disincentive to build on multiple conflicting forks simultaneously.

• Rationale: Unlike Proof-of-Work, where mining on a losing fork wastes electricity, PoS validators can extend every fork at near-zero marginal cost.
• Consequence: This ambiguity prevents the network from converging on a single canonical history, stalling finality.
• Solution: Modern protocols implement slashing conditions—cryptographic penalties that destroy a validator's staked capital if they are caught signing conflicting attestations.

An attack where an external adversary offers direct financial incentives to existing validators to deviate from the honest protocol, typically to finalize conflicting checkpoints.

• Mechanism: The attacker uses smart contracts or off-chain payments to bribe validators into creating a surround vote—a pair of attestations where one surrounds the other, violating Casper FFG rules.
• Impact: This can create a permanent chain split, destroying finality and trust in the ledger.
• Countermeasure: High capital requirements and social slashing make the cost of bribery prohibitively expensive relative to the validator's locked stake.

An isolation attack where an adversary monopolizes all of a target node's inbound and outbound connections, effectively partitioning it from the honest network.

• Execution: The attacker floods the victim's peer table with malicious IP addresses until the node's connection slots are saturated.
• Consequence: The eclipsed node operates on a completely fabricated view of the ledger, enabling the attacker to feed it false transactions or double-spend unconfirmed payments.
• Relevance: Critical for multi-agent systems where a single agent's perception of consensus can be manipulated to trigger unauthorized actions.

A strategic deviation from the honest mining protocol where a miner withholds newly discovered blocks to gain a disproportionate share of rewards.

• Strategy: The selfish miner keeps discovered blocks private, creating a hidden lead over the public chain. When the public chain approaches their lead, they release their withheld blocks to orphan the honest miners' work.
• Threshold: Profitable with significantly less than 50% hash rate—theoretical models show advantage at as low as 25% of total hash power.
• Detection: Identified by anomalous rates of uncle blocks (orphaned blocks) and irregular block propagation timing.

The foundational property enabling a distributed system to reach correct consensus even when an arbitrary number of nodes—including agents—fail or act maliciously. Practical BFT protocols like PBFT and Tendermint can tolerate up to one-third of participants being Byzantine. In multi-agent systems, BFT ensures that a minority of compromised agents cannot force an invalid state transition or rewrite the agreed-upon history.

An attack where a single adversary creates and controls multiple fake agent identities to gain disproportionate influence over consensus or reputation mechanisms. In proof-of-stake or voting-based agent systems, a Sybil attacker fabricates enough pseudonymous identities to exceed the agreement threshold. Defenses include proof-of-work, proof-of-personhood, and binding agent identities to costly or verifiable real-world resources.

A cryptographic scheme where a private key is split into shares distributed among multiple agents. A minimum threshold of agents must collaborate to produce a valid digital signature—no single agent can forge it. This prevents a lone compromised agent from unilaterally authorizing malicious transactions. Commonly implemented via Shamir's Secret Sharing combined with distributed key generation protocols.

A cryptographic protocol enabling a group of agents to jointly compute a function over their private inputs while keeping those inputs completely confidential from one another. In consensus security, MPC allows agents to validate transactions or execute logic without revealing sensitive state. This eliminates the single point of failure where one agent's compromised view could leak the entire system's private data.

An attack where an adversary deliberately feeds falsified external data to a blockchain oracle or data feed that agents rely on for decision-making. By corrupting the input source rather than the consensus mechanism itself, attackers cause agents to execute incorrect on-chain actions. Mitigations include decentralized oracle networks with multiple independent data providers and staked reputation systems that penalize dishonest reporters.

A malicious agent action where it observes a pending transaction from another agent in the mempool or message queue and strategically places its own transaction first—with higher priority or gas fees—to profit at the victim's expense. In agentic systems, this manifests as time-bandit attacks where validators reorder, insert, or censor agent actions within a consensus round to extract value.