← Citizens Internet Portal | Simulator: mild majority, intense minority | Simulator: liquid delegation | Simulator: ranked-choice

Ledger fork and halt power: when operators or guardians collude

The paper's answer to a 51% attack is a stack of safeguards (section 4.2.3): consensus must be spread across regions and institution types, and the Judicial Guard can halt a detected attack. This page tests two things: how big a colluding group of node operators must be to pass the consensus tests, and what a colluding group of guardians could do with the halt power drafted in docs/halt-power.md.

Set up the model

Who colludes Node operators trying to fork the ledger Guardians trying to abuse the halt power

How the colluders are spread Evenly across regions (and institution types) Concentrated in as few regions as possible Concentrated in as few institution types as possible Random (300 placements, using the seed)

Random seed (used only for random placement)

Result

Pick a preset or set the sliders, then run the model.

What the model assumes

Operators. Every node has equal weight. Each region has 20 nodes, split evenly across four institution types (universities, libraries, non-profits, individuals). The three tests are this page's reading of safeguards 3 and 4 in section 4.2.3: colluders hold a majority of all nodes, a majority in more than half of the regions, and a majority in at least three of the four types. The paper gives no numbers for these tests, so all of them are placeholders.
Guardians. The corps size (500 to 2,000+) is from the paper. The thresholds are the draft numbers in halt-power.md, which that document calls placeholders: a scoped hold needs 5 guardians from 3 regions (72 hours); a full pause needs 1% of the corps, at least 15, from 5 regions (24 hours); a 14-day cap; a review panel drawn by lottery from regions other than the signers'. The panel size is a placeholder of this page. Guardians are split evenly across regions.
The model gives the colluders the best case: it assumes they can supply the evidence a hold needs. In the draft, a trigger must be checkable by an independent node, so a false hold would also have to get past that test.
A hold never deletes or changes ballots, and the voting window is extended by the length of the hold (halt-power.md). The "stall" figures show delay only.
Not modeled: proof-of-stake slashing and its cost to attackers, the time delays in safeguard 5, the multiple competing implementations in section 4.2.1, the 10% per-location and 5% per-funder limits in section 4.2.2, and colluders who bribe or capture honest participants.

Illustrative model, not a prediction. It tests proposed rules against colluding groups that you size and place; it does not estimate how likely a real attack is. Every rule and number is a proposal from the paper or a placeholder in the draft docs, and CIP is not live.