ZOOBC / CHAIN SECURITY
Chain security
What it would actually cost to take over this chain. The draw is uniform, influence is linear, and the only thing worth attacking is the registry, so the queue into it is the defence.
Every block, one node is drawn to build it. The draw is a uniform random pick from the whole registry, derived from the previous block’s seed. Not the richest node. Not the best-behaved node. Every registered node, equally, every time.
So influence over the chain is simply your share of the registry, and it is linear. There is no 51% at which something snaps. Hold a tenth of the registry and you build a tenth of the blocks; that is the whole of what you get.
Which makes the registry the only thing worth attacking, and the queue into it the defence. You cannot buy a place. You join one node at a time, behind everyone else who wants in, and the numbers below are what that costs.
01 / THE DRAW
How the builder is chosen
From the previous block’s seed, every node computes the same endless sequence of draws. Round 1 names a node; if it does not publish within its 15-second window, round 2 names another, and so on. The first one to publish builds the block.
The seed itself is sign(node_key, hash(previous seed)), checked by every validator. Ed25519 signatures are deterministic, so for a given builder there is exactly one valid seed, a builder cannot try seeds until one favours them. The only freedom an attacker has is to publish or stay silent: one bit, once, per block they are drawn for.
Participation score does not affect selection. It is often assumed to, it does not. Score decides one thing only: whether you stay in the registry at all. It falls when you miss turns, and at zero you are expelled and your stake is returned. A perfect score buys you no better chance of the next block than a node that joined yesterday. Stake does not affect selection either; it only buys your place in the queue to get in.
03 / DENIAL OF SERVICE
The one real attack: silence the draw
A node may include transactions only if it is drawn within the first 10 rounds (max_priority_blocksmiths). Drawn later, it may still build, but its block must be empty. That rule is what keeps the chain moving when nodes are offline: it takes every one of those first draws being absent before a block loses its content.
It is also the sharpest edge on the design. Those nodes are named 15 seconds in advance, the moment the previous block lands. An attacker who can knock all of them offline inside that window forces an empty block, censoring everyone, not merely competing. This is a denial-of-service problem, not a consensus one, and it is why the number is set to 10 rather than a smaller, tidier figure.
Nodes to silence
10
named, per block
Warning given
15 s
before the turn opens
Empty block by accident
with 20% of nodes offline
Raising the number is close to free, it costs only a few more nodes building candidate blocks at once, and each one added is another machine an attacker must find and drop inside the same 15 seconds.
04 / PRICED IN YEARS
The cost of buying a share
- Formula
- delay = clamp(base ÷ registry size, min, max)
- Admissions
- one at a time, in stake order
The slot share is a stake ratio. The queue is ordered by locked balance, so “wins 100% of slots” is not luck, it is the assumption that nobody outbids them. Every figure here is a best case for the attacker.
The moment an honest operator stakes more per node, they go in front. Win only half the admissions and your share of the registry tends to half and stops, the honest nodes taking the other half grow the registry as fast as you grow your part of it. A target above your slot share is not slow, it is unreachable, which the table below prints as never.
Wait right now
per node admitted
Nodes for ⅓
to build a third of blocks
Time for ⅓
of continuous queueing
Nodes for ½
to build half of blocks
Time for ½
of continuous queueing
ZBC locked
minimum, at 100 ZBC/node
05 / GROWTH
How the wait changes as the chain grows
At different chain sizes
| Registry | Wait per node | Nodes for ⅓ | Time | Nodes for ½ | Time |
|---|
06 / THE ONE TRADE-OFF
Why the genesis registry is the number that matters
Admissions are serial, so the time to double a registry is just registry size × wait per node. That is an identity, not a setting, which means a small registry cannot have both a short wait and a slow takeover. It is the one trade-off in the whole design that no formula can argue away.
| Registry at launch | Wait 1 week | Wait 2 weeks | To double in 2 years, the wait must be |
|---|
So the lever is the launch, not the curve. Start with a dozen nodes and every honest operator waits months, because that is what it takes to make twelve nodes hard to double. Start with a hundred and a two-week wait already buys nearly four years, and nobody is kept out. A larger genesis registry is worth more than any tuning of the delay.
07 / FOUR PROPERTIES
Why this holds
Admissions are serial. The registry admits one node at a time, network-wide. Wanting a hundred nodes does not mean waiting once, it means waiting a hundred times, in sequence. That single fact turns a funded attack into a multi-year project.
The share you need grows with the chain. One node among ten is a tenth of the influence. One among a thousand is nothing. The wait per node falls as the registry grows, but never below the minimum, so the total time climbs anyway.
The queue is priced. Position is ordered by locked balance, so an attacker is not merely waiting, they are outbidding every honest operator who also wants in, every single time. Every slot they lose costs them the wait and hands an honest operator a node.
They fund the chain while they try. Every node locks ZBC. A decade-long attack means a large, illiquid, entirely public position in the asset it is trying to break. Nothing is slashed: leave, or be expelled for going dark, and the stake comes back in full. The bond buys a place in the queue, not a hostage.
And nothing accumulates. Each block is an independent draw. A node that has been perfect for a year has no more claim on the next block than one admitted this morning, and an attacker who held the last ten turns is no likelier to hold the eleventh. There is no position to build up, which is why the only lasting way to gain influence here is to be a larger honest part of the network.