权威性证明的不公平性探究：订单操纵攻击与补救
Exploring Unfairness on Proof of Authority: Order Manipulation Attacks and Remedies
摘要：
权威证明（PoA）是一种具有固定委员会的许可共识算法。由于其更好的性能和更快的终结性，PoA已被社区和行业广泛采用。在本文中，我们探讨了\textit{unfairness}问题存在于当前的PoA实现。我们已经调查了2，500多个\textit{in the wild}项目，并选择了10多个作为我们的主要关注点（包括以太坊，Binance智能链等）。我们已经确定了两种类型的订单操纵攻击，以分别打破交易级别（即事务排序）和块级（块位置排序）公平性。这两种方法都只依赖于诚实但\textit{profitable}的假设，而不修改原始设置。我们在一个孤立的环境下对分叉分支发起攻击，并对不同的实现方式仔细评估了攻击范围。到目前为止（截至2021年11月），潜在受影响的PoA市值可能高达$681,087$百万美元。此外，我们进一步深入到选定的项目的源代码，并相应地，提出我们的修复建议。据了解，这项工作提供了第一次探索的\textit{unfairness}问题的PoA算法。
英文摘要：
Proof of Authority (PoA) is a type of permissioned consensus algorithm with a fixed committee. PoA has been widely adopted by communities and industries due to its better performance and faster finality. In this paper, we explore the \textit{unfairness} issue existing in the current PoA implementations. We have investigated 2,500+ \textit{in the wild} projects and selected 10+ as our main focus (covering Ethereum, Binance smart chain, etc.). We have identified two types of order manipulation attacks to separately break the transaction-level (a.k.a. transaction ordering) and the block-level (sealer position ordering) fairness. Both of them merely rely on honest-but-\textit{profitable} sealer assumption without modifying original settings. We launch these attacks on the forked branches under an isolated environment and carefully evaluate the attacking scope towards different implementations. To date (as of Nov 2021), the potentially affected PoA market cap can reach up to $681,087$ million USD. Besides, we further dive into the source code of selected projects, and accordingly, propose our recommendation for the fix. To the best of knowledge, this work provides the first exploration of the \textit{unfairness} issue in PoA algorithms.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
