💻 computer science

Economic Security of VDF-Based Randomness Beacons: Models, Thresholds, and Design Guidelines

This paper introduces a formal economic security framework for VDF-based randomness beacons, modeling rational adversaries as optimal-stopping agents to derive necessary delay thresholds that prevent profitable attacks via hardware speedup and reward exploitation, ultimately demonstrating that many current proposals are economically insecure and offering guidelines for selecting robust parameters.

Original authors: Zhenhang Shang, Kani Chen

Published 2026-04-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zhenhang Shang, Kani Chen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are running a high-stakes lottery for a digital city. Every few minutes, you need to pick a "winner" (a validator, a committee member, or a leader) to run the city's affairs. To keep things fair, you use a Randomness Beacon—a machine that spits out a number that no one can predict or rig.

In the past, people built these machines using Verifiable Delay Functions (VDFs). Think of a VDF as a digital hourglass.

The Rule: You must wait for the sand to run out (say, 5 seconds) before you can see the number.
The Promise: Even if you have a super-fast computer, you can't speed up the sand. It takes exactly 5 seconds for everyone.

The Problem:
The paper argues that while these digital hourglasses are mathematically secure (you can't break the laws of physics), they might be economically insecure.

Here is the catch: In the real world, attackers aren't just math wizards; they are rational business people. If they can make a profit, they will try to break the system, even if it costs them money to do so.

The Analogy: The "Rigged Lottery" vs. The "Speedy Thief"

Imagine the lottery prize is $100.

The Honest Way: You wait 5 seconds, the sand runs out, and you get the number.
The Thief's Way: The thief has a super-fast sand-sifter (specialized hardware) that runs 3 times faster than normal.
- The thief can see the number in 1.6 seconds.
- The honest people are still waiting for the sand.

The Economic Question:
Is it worth it for the thief to buy that super-fast sifter?

Cost: Renting the sifter costs $1.
Reward: If the thief sees the number early, they can place a bet or front-run a trade to win $100.
Result: Profit = $99. Go for it! The thief attacks.

But what if the prize is only $0.50?

Cost: $1.
Reward: $0.50.
Result: Loss = -$0.50. Don't do it. The thief walks away.

The Paper's Big Insight:
Many current blockchain systems set the "wait time" (the delay) to be very short (e.g., 2 or 5 seconds) because they want the system to be fast. However, the authors show that with today's technology and the huge amounts of money (called MEV or Maximal Extractable Value) available in crypto, a 5-second wait is not enough. The potential profit is so high that attackers will happily pay to be faster, even if they have to rent expensive super-computers.

The "Stop-Loss" Strategy

The authors model the attacker as a smart investor playing a game of "When to Stop?"

The attacker watches the market.
If the potential prize is huge (e.g., a big crypto crash or a rare opportunity), they say, "I'll spend $100 to get the answer early."
If the prize is small, they say, "Not worth the cost."

The paper proves that for the system to be safe, the Wait Time must be long enough that the Cost of the Attack is always higher than the Potential Profit.

The "Grinding" and "Abort" Tricks

The paper also looks at sneaky ways attackers try to cheat:

Grinding: Imagine the thief can try 1,000 different lottery tickets at once. They only show the one that wins. This multiplies their chances of winning big, making the attack even more profitable.
Selective Abort: Imagine the thief can see the result, and if they don't like it, they can say, "I quit!" and force the system to restart until they get a result they like. This is like a gambler who only cashes out when they are winning.

Both of these tricks make the "prize" effectively larger, meaning the Wait Time needs to be even longer to stop them.

The Solution: "Economically Secure Delay Parameters" (ESDP)

The authors propose a new way to design these systems. Instead of just asking, "Is this math hard enough?" we should ask, "Is this delay long enough to make the attack unprofitable?"

They suggest a formula for designers:

Wait Time = (Speed of Attacker's Computer) × (Potential Prize) / (Cost of Running the Computer)

Real-World Example from the Paper:

If the prize is $50 (a typical crypto trade opportunity).
And the attacker can rent a super-computer for $0.0005 per second.
The math says the wait time needs to be roughly 3 days to make the attack unprofitable!

Wait, 3 days?
Yes. The paper concludes that for many current systems, the "wait time" of a few seconds is dangerously short. To be truly safe, we either need to:

Wait much longer (which slows down the system).
Limit the prize (so there's less money to steal).
Use better defenses (like hiding the data until everyone is ready).

Summary

This paper is a wake-up call for blockchain designers. It says: "Don't just trust the math; trust the economics."

If you build a digital lottery where the prize is huge, you can't just use a 5-second timer. You have to calculate exactly how much money a thief could make, how much it costs them to steal it, and set the timer long enough that stealing is a bad business deal.

The Golden Rule: A system is only as secure as the cost it forces an attacker to pay. If the cost is lower than the reward, the system will eventually be broken.

1. Problem Statement

Verifiable Delay Functions (VDFs) are increasingly used to construct randomness beacons for blockchains and distributed systems. These beacons rely on the property that computing the output requires a prescribed amount of sequential time ( $T$ ), preventing adversaries from predicting or influencing the result significantly faster than honest participants.

The Gap: Existing security analyses focus primarily on cryptographic hardness (assuming a worst-case polynomial-time adversary) but ignore economic rationality. In real-world deployments (e.g., public blockchains), adversaries are motivated by profit (e.g., Maximal Extractable Value (MEV), validator selection, or side bets).

A VDF may be cryptographically secure (no algorithm can break sequentiality), yet economically insecure if a rational adversary can profit by purchasing faster hardware (speedup $\delta$ ) to compute the output early.
Current parameter choices (often a few seconds) may be insufficient when the potential reward ( $V$ ) from manipulating the beacon exceeds the cost of the attack.

2. Methodology

The authors develop a formal framework modeling the interaction between a VDF-based beacon and a rational adversary using stochastic control and optimal stopping theory.

A. The Economic Model

Adversary Capabilities: The adversary has a computational speedup factor $\delta \ge 1$ (time to compute is $T/\delta$ ) and incurs a cost rate $c$ (e.g., cloud rental or amortized hardware costs).
Reward Process: The adversary gains a reward $V_t$ if they learn or manipulate the beacon output before honest participants reveal it. $V_t$ is modeled as a stochastic process (e.g., MEV opportunities).
Decision Problem: The adversary faces an optimal stopping problem. They must decide whether to initiate an attack in a given round based on the current reward landscape and the cost of computation.
Profit Function:
$\text{Profit} = \mathbb{I}_{\text{success}} \cdot V_{\tau} - \int_{t_0}^{\tau} a_t c(t) dt$
Where $\tau$ is the stopping time, and success implies completing the VDF before the honest deadline ( $t_H$ ).

B. Theoretical Analysis

Threshold Structure: The authors prove that the optimal adversarial strategy follows a monotone threshold structure. There exists a decision boundary in the state space (remaining work, current reward, time) such that the adversary attacks if and only if the state exceeds this boundary.
Linear Threshold Condition: Under simplified assumptions (constant reward, full commitment), the condition for economic security reduces to a linear inequality:
$T \ge \frac{\delta}{c} \mathbb{E}[V]$
This implies the delay $T$ must be large enough such that the cost of computation exceeds the expected reward.
Robustness: The framework extends to parameter uncertainty (using interval bounds or moment bounds like Chebyshev's inequality) and multi-protocol composition (summing rewards from multiple dependent protocols).

C. Extended Attack Surfaces

The model is expanded to account for:

Grinding: Adversaries exploring $G$ candidate seeds. This increases the effective reward to $\mathbb{E}[\max(V_1, \dots, V_G)]$ , requiring significantly larger delays.
Selective Abort: Adversaries who can suppress unfavorable outputs and retry. This effectively multiplies the reward by a factor of $1/(1-p)$ , where $p$ is the probability of having abort leverage.
Multi-Adversary Games: Modeling competition among $n$ rational agents. While competition reduces individual expected profit, the authors show that without strict delay parameters, a non-zero equilibrium attack rate can persist. Coalitions further amplify the threat, requiring delays scaled by coalition size.

3. Key Contributions

Rational Adversarial Model: The first explicit model for VDF beacons that incorporates economic rationality, hardware speedup, and dynamic decision-making.
Formal Security Definitions: Introduced the concept of Economic Security, defined as the condition where no rational adversary can achieve positive expected profit by deviating from honest behavior.
Analytical Thresholds: Derived tight necessary and sufficient conditions linking the delay parameter $T$ to adversarial cost ( $c$ ), speedup ( $\delta$ ), and reward distributions ( $V$ ).
Case Studies & Real-World Evaluation:
- Used realistic cloud costs, hardware benchmarks (FPGAs/ASICs), and MEV data.
- Finding: Many proposed VDF delays (2–5 seconds) are economically insecure under plausible conditions. For example, with a median MEV of $50 and FPGA speedups, the required delay for economic security is approximately 3.1 days, far exceeding the 12-second slot time of Ethereum.
Design Guidelines & ESDP: Introduced Economically Secure Delay Parameters (ESDP), a new abstraction for protocol specifications that allows designers to explicitly declare delay requirements based on economic bounds.

4. Key Results

Insecurity of Short Delays: Standard delays (seconds) are insufficient when rewards (like MEV) are in the tens or hundreds of dollars. The required delay scales linearly with the expected reward.
Impact of Grinding and Abort: Attack surfaces like grinding (trying multiple seeds) and selective abort drastically increase the effective reward, necessitating even longer delays or stricter protocol constraints (e.g., limiting seed derivation).
Coalition Threat: A coalition of $m$ attackers can pool resources, effectively reducing the per-member cost and requiring the delay $T$ to be $m$ times larger to maintain security.
Trade-off: There is a fundamental tension between economic security (requiring large $T$ ) and system liveness/usability (requiring small $T$ ). The paper argues that $T$ must be a dynamically adjustable parameter, not a static cryptographic constant.

5. Significance

Paradigm Shift: The paper shifts the security paradigm for VDFs from purely cryptographic assumptions to cryptoeconomic security. It demonstrates that cryptographic soundness is a necessary but insufficient condition for safe deployment.
Practical Impact: The results suggest that current proposals for VDF-based randomness in blockchains (e.g., replacing RANDAO in Ethereum) may be fundamentally flawed if they rely solely on short delays. Without additional protocol-level defenses (e.g., encrypted mempools, MEV redistribution, or threshold VDFs), these systems remain vulnerable to economically motivated attacks.
Actionable Framework: The introduction of ESDP provides a concrete tool for protocol designers to calibrate parameters against real-world market conditions, ensuring that the cost of attack always outweighs the potential gain.

In conclusion, Shang and Chen demonstrate that economic incentives are the primary determinant of VDF beacon security. A beacon is only secure if the delay parameter is calibrated to make attacks unprofitable for rational agents, a requirement that often demands delays far longer than those currently proposed in the literature.