Every block, one node is drawn to build it. The draw is a uniform random pick from the whole registry, derived from the previous block’s seed. Not the richest node. Not the best-behaved node. Every registered node, equally, every time.
So influence over the chain is simply your share of the registry — and it is linear. There is no 51% at which something snaps. Hold a tenth of the registry and you build a tenth of the blocks; that is the whole of what you get.
Which makes the registry the only thing worth attacking, and the queue into it the defence. You cannot buy a place. You join one node at a time, behind everyone else who wants in — and the numbers below are what that costs.
From the previous block’s seed, every node computes the same endless sequence of draws. Round 1 names a node; if it does not publish within its 15-second window, round 2 names another, and so on. The first one to publish builds the block.
The seed itself is
sign(node_key, hash(previous seed)), checked by every validator. Ed25519 signatures
are deterministic, so for a given builder there is exactly one valid seed — a builder
cannot try seeds until one favours them. The only freedom an attacker has is to publish or stay
silent: one bit, once, per block they are drawn for.
Participation score does not affect selection. It is often assumed to — it does not. Score decides one thing only: whether you stay in the registry at all. It falls when you miss turns, and at zero you are expelled and your stake is returned. A perfect score buys you no better chance of the next block than a node that joined yesterday. Stake does not affect selection either; it only buys your place in the queue to get in.
| Attacker holds | Blocks they build | Has a node in the content window |
Censor one transaction for 10 blocks | Honest nodes to silence to steal a turn |
|---|
The middle column is not influence. It is only how often at least one of their nodes lands among the first 10 draws — a seat near the front of the queue for that block, nothing more. They still build a block only when they are drawn first, which is the second column, and that is exactly their share of the registry.
Censorship is the thing that decays, and it decays fast. To keep a transaction out you must hold every consecutive turn while it waits. At a third of the registry that is a 1-in-59,000 shot over ten blocks — two and a half minutes. There is no share below total control at which sustained censorship works.
A node may include transactions only if it is drawn
within the first 10 rounds (max_priority_blocksmiths). Drawn later, it
may still build — but its block must be empty. That rule is what keeps the chain moving
when nodes are offline: it takes every one of those first draws being absent before a block loses
its content.
It is also the sharpest edge on the design. Those nodes are named 15 seconds in advance, the moment the previous block lands. An attacker who can knock all of them offline inside that window forces an empty block — censoring everyone, not merely competing. This is a denial-of-service problem, not a consensus one, and it is why the number is set to 10 rather than a smaller, tidier figure.
Raising the number is close to free — it costs only a few more nodes building candidate blocks at once — and each one added is another machine an attacker must find and drop inside the same 15 seconds.
The slot share is a stake ratio. The queue is ordered by locked balance, so “wins 100% of slots” is not luck — it is the assumption that nobody outbids them. Every figure here is a best case for the attacker.
The moment an honest operator stakes more per node, they go in front. Win only half the admissions and your share of the registry tends to half and stops — the honest nodes taking the other half grow the registry as fast as you grow your part of it. A target above your slot share is not slow, it is unreachable, which the table below prints as never.
▬ wait per node (weeks) ▬ years to build half the blocks ▬ your genesis size
| Registry | Wait per node | Nodes for ⅓ | Time | Nodes for ½ | Time |
|---|
Admissions are serial, so the time to double a registry
is just registry size × wait per node. That is an identity, not a setting —
which means a small registry cannot have both a short wait and a slow takeover. It is the one
trade-off in the whole design that no formula can argue away.
| Registry at launch | Wait 1 week | Wait 2 weeks | To double in 2 years, the wait must be |
|---|
So the lever is the launch, not the curve. Start with a dozen nodes and every honest operator waits months, because that is what it takes to make twelve nodes hard to double. Start with a hundred and a two-week wait already buys nearly four years — and nobody is kept out. A larger genesis registry is worth more than any tuning of the delay.
Admissions are serial. The registry admits one node at a time, network-wide. Wanting a hundred nodes does not mean waiting once — it means waiting a hundred times, in sequence. That single fact turns a funded attack into a multi-year project.
The share you need grows with the chain. One node among ten is a tenth of the influence. One among a thousand is nothing. The wait per node falls as the registry grows, but never below the minimum, so the total time climbs anyway.
The queue is priced. Position is ordered by locked balance, so an attacker is not merely waiting — they are outbidding every honest operator who also wants in, every single time. Every slot they lose costs them the wait and hands an honest operator a node.
They fund the chain while they try. Every node locks ZBC. A decade-long attack means a large, illiquid, entirely public position in the asset it is trying to break. Nothing is slashed — leave, or be expelled for going dark, and the stake comes back in full. The bond buys a place in the queue, not a hostage.
And nothing accumulates. Each block is an independent draw. A node that has been perfect for a year has no more claim on the next block than one admitted this morning, and an attacker who held the last ten turns is no likelier to hold the eleventh. There is no position to build up, which is why the only lasting way to gain influence here is to be a larger honest part of the network.