What is censorship-resistance?

Public blockchains are designed to allow anyone to transact on them: pay or be paid, interact with smart contracts etc. Censorship is the act of stopping one or more entity from being able to transact on a blockchain. In contrast, censorship-resistance is the property of a blockchain that ensures anyone can, with reasonable efforts, transact on the chain and form part of the permanent record¹. Censorship-resistance is fundamental to ensuring trust in a blockchain: without the guarantee that a transaction will be recorded, an individual may be blocked from transferring funds, submitting information to a smart contract etc.

Some cryptocurrencies allow censorship to some degree, arguing that, for example, blocking transactions from known bad actors can be beneficial for the network². Others look at censorship as undesirable under all circumstances, and take steps to minimise and mitigate its impact. In either case, it is important to understand the situations in which censorship can occur.

Censorship can be broken down to two broad categories: financial censorship and political censorship. These are both considered below in the context of normal operation of the blockchain i.e. mechanisms that are expected under the assumptions and implementation of the protocol. Unexpected censorship, for example due to a bug in the software implementation of a blockchain, a 51% attack on a proof of work blockchain, a denial of service on specific nodes, a significant regional power cut or similar situations are not within the context of this article.

Financial censorship

Financial censorship is the ability of a one or more entities (commonly other users of the blockchain) to impose an unaffordably high cost on a transaction to be processed.

Taking an example of a blockchain with transaction fees: rational block miners will fill blocks with the most profitable transactions available to them. It follows that if an entity wishes to censor a particular transaction they can do so by ensuring that at any time there are more profitable transactions available for miners. For example, a blockchain might accept 5 transactions per block and miners have the following list of transactions from which to fill their block:

The list is sorted by transaction fee, so regardless of the transaction ID the miner will take the top 5 transactions from the list and use them to fill the block:

If an entity wished to censor transaction 21 they could do so by creating additional transactions with a higher fee. If they do so, the list of transactions would now be as follows:

Now the miner takes the top 5 transactions from the list to fill the block, and transaction 21 is no longer one of them:

The censor has stopped the transaction from becoming part of the blockchain, at a cost of $3.52 (the total cost of the transactions added to keep transaction 21 from being one of the top 5 transactions). Now that the block has been mined a new list of candidate transactions will be built, and the censor can carry out the same actions to continue to keep transaction 21 from becoming part of the blockchain. As long as the censor continues to provide new higher-fee transactions each time a block is mined this process can continue indefinitely.

Cryptocurrencies that are open to financial censorship include Bitcoin and Ethereum.

Political censorship

Political censorship is the ability of a strict subset of entities to decide not to process a transaction.

Political censorship applies to the mechanisms used within the protocol to secure a blockchain. These are commonly votes, attestations or similar activities made by trusted entities within the blockchain.

Taking an example of a blockchain with 7 validators \(V_1\) through \(V_7\), the blockchain must have two-thirds agreement to include a transaction i.e. at least 5 validators must agree to include a transaction. The list of candidate transactions might be:

Note that there is no transaction fee present; although a transaction fee may be part of the validation process (e.g. a transaction is invalid unless it includes a given fee) it is not relevant to the censorship process so not displayed. If a validator is behaving correctly it will consider the rules for the transaction to decide if it is valid or not. These rules vary from blockchain to blockchain but commonly include ensuring the relevant funds are available, that the transaction is signed correctly, that it does not cause any invalid state transitions etc. Note that in the normal behaviour of validators it is possible for them to disagree on the validity of a transaction, or for a validator to be unavailable or faulty (in our example \(V_4\) is faulty and rejects all transactions).

An example of the validators coming to consensus on the validity of the transactions is shown below:

Everything appears to be normal, however, unbeknownst to the blockchain at large, validators \(V_1\), \(V_2\) and \(V_5\) have agreed to censor transaction 21. As \(V_4\) is faulty only two additional invalid results are required to exclude the transaction, and these are supplied by \(V_2\) and \(V_5\) with the result that the transaction is discarded by the blockchain.

Note that unlike the financial model explained above there is no second attempt to submit transaction 21 during the next block formation as it has been discarded rather than held pending the next block. The sender of the transaction can submit a new transaction with the same data but without a change to the colluding validators, such further transactions will meet the same fate.

Cryptocurrencies that are open to political censorship include EOS and Libra.

Comparing the systems

In general, financial censorship systems are more trustworthy when there is no trust in the nodes running the protocol. This is because the cost to censor the blockchain is significantly higher than the cost of a single transaction; for example if a single transaction was worth \$10,000 then at current prices it would only be financially viable to censor the blockchain for approximately 5 minutes (as the cost of censoring the blockchain is around \$120,000 per hour at time of writing). As such, any contract participant could assume that the costs to censor the blockchain for any appreciable amount of time is significantly higher than their potential loss and as such would trust the parties to act rationally.

By contrast, political censorship systems are more trustworthy when there is trust in the validators. For example, if the validators of a new blockchain were subject to English law, users might be confident that smart contracts would be adhered to without political interference, as the obligations of the validators could be enforced in English courts. If the same blockchain had validators based exclusively outside of the reach of the jurisdiction of the English courts there could be understandable disquiet about the validators’ desire to enforce the terms of smart contracts even-handedly.

Note that it is possible for a financial system to become a political one: if a consortium of Bitcoin miners between them hold more than 50% of the total hash power of the blockchain and decide to censor certain transactions, they will be able to do so. However, this does not have to be a permanent situation: entities not related to the consortium can increase their hash power until the consortium no longer has more than 50% of the hash power and the financial censorship rules will then reassert themselves.

Finally, it is important to understand that most blockchains include a degree of both financial and political censorship, either because financial systems have relatively small numbers of entities with high hash power or because political systems still require some sort of payment to include transactions.

Is one system better than the other?

The simple answer is no. This is because the best system is case-dependent on the requirements of the blockchain, the application developer and the user.

Political censorship can be said to be less decentralised than financial censorship, because a political decision only has to be taken once by the relevant entities and has a permanent (and free) effect. On the other hand, financial censorship systems generally come with a higher cost for all transactions to guard against cheap or free censorship.

It is also the case that financial systems are more susceptible to censorship because anyone can initiate financial censorship, whereas political censorship can only be carried out by the entities responsible for securing the blockchain. However, this has to be balanced against the fact that although fewer entities in a political system can carry out censorship, if they decide to do so there is no way to stop them.

Is a censorship-proof blockchain possible?

Censorship appears to be an emergent property of blockchains: whatever the method of including a transaction in a blockchain, there is a way in which the method can be subverted to not include it. So could a blockchain ever be censorship-proof?

Resource scarcity is one cause of censorship: if all transactions could fit in the next block the question of which transactions to choose becomes moot and so financial censorship becomes significantly more difficult.

Self-serving selection of transactions to include in blocks is another cause of censorship: blockchains could be built where transaction fees were always the same for similar transactions, and transactions that were not included within a given timeframe would be eligible for recompense from the blockchain.

Creators of blockchains will continue to improve performance and transaction cost, resulting in higher censorship resistance. But the ability to have a truly censorship-proof blockchain is one that has yet to be realised.

---

1. Censorship-resistance is not to be confused with finality, another property of a blockchain. Finality is the property that a given transaction that has been recorded on the blockchain can no longer be modified, to within a given degree of certainty, at a given time after the transaction has been recorded.↩

2. There is, of course, an obvious limitation to this argument: it relies on a common definition of “bad actor”, which is implausible as, at a minimum, those labeled as such would disagree.↩