AI 中文总结
研究基于 Mysticeti DAG 的 BFT 协议中交易排序偏差与 MEV 问题，发现其公平性假设不成立，如按验证者索引排序、gas 价格重排有缺陷及验证者可利用沉默放大优势，提出用随机密钥替换验证者索引决胜器的修复方法。
AI 中文摘要
部署在不可信环境中的分布式系统通过拜占庭容错（BFT）共识协议就通用交易顺序达成一致，该顺序在许多去中心化应用中具有实际金融价值，影响它的人能以其他用户为代价获利，即最大可提取价值（MEV）问题。Mysticeti 是一种基于有向无环图（DAG）的先进 BFT 协议，许多验证者并行提议区块，总顺序随后从生成的 DAG 中得出。它为市值约 30 亿美元的生产区块链 Sui 提供共识协议，人们普遍认为它能公平排序交易，因为许多验证者并行提议区块且已提交交易在执行前按 gas 价格重新排序。但实际中这种公平假设不成立，在 Sui 的实时网络中已出现这种情况。首先，当已提交图的顶点合并为单个总顺序时，同一轮的区块按验证者索引排序，使索引较低的验证者有永久优势。在无攻击者的 13 验证者网络评估中，索引较低方在同轮排序中约 89%的时间获胜。其次，旨在消除此偏差的 gas 价格重新排序使用稳定排序，支付相同费用的交易（在参考 gas 价格时常见）保留原始偏差顺序，攻击者无需额外付费就能获利。第三，验证者可通过选择何时保持沉默来放大此优势，这是完全合法且不违反任何协议规则的行为，可将其排序胜率提高到 94%以上。我们测量了所有这三种利用方式，验证了 Mysticeti 在标准拜占庭容错阈值以下仍具有弹性，并提出了一个简单修复方法：用不可预测的每次提交随机密钥替换验证者索引决胜器。
英文摘要
Distributed systems deployed in untrustworthy environments agree on a common transaction order through Byzantine fault-tolerant (BFT) consensus protocols, and that order has real financial value in many decentralized applications: whoever influences it can profit at other users' expense, a problem known as maximal extractable value (MEV). Mysticeti is a state-of-the-art DAG-based BFT protocol in which many validators propose blocks in parallel, and the total order is derived from the resulting DAG afterward. Mysticeti is the consensus protocol powering Sui, a production blockchain with a market capitalization of roughly $3 billion, and it is widely believed to order transactions fairly, since many validators propose blocks in parallel and committed transactions are re-sorted by gas price before execution. We show this fairness assumption breaks down in practice, and the effect is already present on Sui's live network. First, when vertices of the committed graph are merged into a single total order, blocks from the same round are sorted by validator index, giving lower-indexed validators a permanent head start. In our evaluation on a 13-validator network with no attacker, the lower-indexed side wins same-round ordering about 89% of the time. Second, the gas-price re-sort intended to remove this bias uses a stable sort, so transactions paying equal fees (common at the reference gas price) retain the original biased order, letting an attacker profit without paying extra. Third, a validator can amplify this advantage by choosing when to stay silent, a fully legitimate action that violates no protocol rule; this raises its ordering win rate above 94%. We measure all three exploitations, verify that Mysticeti otherwise remains resilient below the standard Byzantine fault threshold, and propose a simple fix: replace the validator-index tiebreaker with an unpredictable, per-commit random key.
