See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/330693364

DAGsim: Simulation of DAG-based distributed ledger protocols

Article  in  ACM SIGMETRICS Performance Evaluation Review · January 2019

DOI: 10.1145/3308897.3308951

CITATION READS

1 75

3 authors, including:

Dominik Harz
Imperial College London
7 PUBLICATIONS   7 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

The Scalability of Trustless Trust View project

All content following this page was uploaded by Dominik Harz on 08 July 2019.

The user has requested enhancement of the downloaded file.

 DAGsim: Simulation of DAG-based distributed ledger
protocols

Manuel Zander Tom Waite Dominik Harz

Department of Computing Department of Computing Department of Computing
Imperial College London Imperial College London Imperial College London
London, UK London, UK London, UK
[email protected] [email protected] [email protected]

ABSTRACT DAGs are proposed as a generalisation of blockchains, e.g. [Som-

Scalability of distributed ledgers is a key adoption factor. As an polinsky et al. 2016, Sompolinsky and Zohar 2018, Popov 2016,
alternative to blockchain-based protocols, directed acyclic graph Baird 2016]. Instead of having a sequence of blocks, blocks or
(DAG) protocols are proposed with the intention to allow a higher transactions can exist in parallel. The network reaches consensus
volume of transactions to be processed. However, there is still not about a single next block, but over a range of several blocks.
limited understanding of the behaviour and security considerations Yet, DAG-based cryptocurrencies are little understood. Most DAG-
of DAG-based systems. We present an asynchronous, continuous based systems have not been formally analysed, for example with
time, and multi-agent simulation framework for DAG-based cryp- regard to the asynchronous communication model by Pass et. al.
tocurrencies. We model honest and semi-honest actors in the sys- [Pass et al. 2017] or as extension of the formal framework by Ki-
tem to analyse the behaviour of one specific cryptocurrency, IOTA. ayias and Panagiotakos [Kiayias and Panagiotakos 2016]. Mesh-
Our simulations show that the agents that have low latency and a cash, a recent work by Bentov et. al. [Bentov et al. 2017], is an
high connection degree have a higher probability of having their exception.
transactions accepted in the network with honest and semi-honest
strategies. Last, the simulator is built with extensibility in mind. Contribution Simulations help to verify formal work and are use-
We are in the process of implementing SPECTRE as well as in- ful to check analytical calculations. We contribute an asynchronous,
cluding malicious agents. continuous time, and multi-agent simulator of DAG-based cryp-
tocurrencies. Specifically, we implement our simulator in Python
with extensions for various DAG-based protocols in mind. In our
Categories and Subject Descriptors current version we implement an asynchronous representation of
C.2 [Networks]: Network types—Peer-to-peer networks IOTA [Popov 2016] and an initial, yet incomplete, version of SPEC-
TRE [Sompolinsky et al. 2016]. We evaluate the performance of
General Terms our simulator and note that we depend on the computational com-
plexity of the algorithms we simulate. Further, we present results
Design, Experimentation, Measurement, Performance, Security, Stan-
of attachment probabilities (i.e. having transactions accepted by the
dardization, Theory
network) in relation to the latency and degree of connections of an
agent in the IOTA network.
Keywords
cryptocurrency, blockchain, distributed public ledger, directed acyclic Outline Our article is structured as follows. We explain our sim-
graph, simulation ulation framework in section 2. Section 3 details our results w.r.t
simulator performance and the IOTA protocol. We present future
1. INTRODUCTION work and conclude in section 4.
Bitcoin introduced the possibility to transact monetary value be-
tween parties without the need to trust an intermediary and pro- 2. SIMULATION FRAMEWORK
vides for the prevention of censorship [Nakamoto 2008]. A com- The framework enables the simulation of arbitrary scenarios, and
bination of consensus algorithms, cryptographic proof, and game evaluates whether the implemented consensus algorithms have the
theory allows mutually distrusting participants to interact on dis- desired effects in terms of stability and security. Adversaries devi-
tributed ledgers. However, eliminating trust requirements comes ating from a protocol are currently not implemented.
with trade-offs. One of the main obstacles for cryptocurrency adop-
tion is its limited scalability of a few transactions per second while 2.1 A Network of Agents
being independent of trusted third parties [Sompolinsky and Zohar Nodes are called agents in our framework, and multiple agents
2013, Decker and Wattenhofer 2013, Bamert et al. 2013]. are supported by default. Pass et. al. [Pass et al. 2017] propose a
Several proposals have been made to increase the scalability of way of modelling blockchain protocols in a fully asynchronous set-
distributed ledgers [Croman et al. 2016], including alternative data ting, including an arbitrary number of players with identical com-
structures like directed acyclic graphs (DAGs) [Lewenberg et al. putational power. This is superior to models assuming fully or par-
2015, Sompolinsky and Zohar 2018]. tially synchronous network channels, which is a strong assump-
tion (the Internet and most peer-to-peer (P2P) networks are essen-
Symposium on Cryptocurrency Analysis (SOCCA) 2018 Toulouse, France tially asynchronous networks with network latencies). Thus, we
Copyright is held by author/owner(s). call the framework an asynchronous multi-agent simulation frame-
work, generally supporting N ∈ N agents, and each newly incoming exponential distribution according to the rate of incoming transac-
transaction is issued by an agent i. tions λ , which follows a Poisson process.
Along the lines of [Gal and Shikhelman 2018], agents can be Together with a parameter h, defining the average computational
thought of being part of an agent network, which is a weighted cost for transaction propagation (mainly POW), the network laten-
undirected graph. We define the network G ≡ (A, E, f ) where A is cies stored in d are crucial in deciding of which part of the network
the set of agents, E ⊆ A × A is the set of edges and f : A × A → is visible for an agent at a certain point in time (during the simu-
R is the weight function. We enforce (a1 , a2 ) ∈ E ⇔ (a2 , a1 ) ∈ lation). As explained above, we assume that agents have the same
E (because G is undirected) f (a, b) ≥ 0 (non-negative weights), f (a, a) =computational power, such that we can fix h = 1 for simplicity.
0 (zero self-distance), and extend f such that f (a, b) = ∞ ⇔ (a, b) ∈ / Note that the presented Algorithm 1 deals with the creation of the
E. DAG data structure and that the method called in line 11 differs for
Essential for implementing an asynchronous model are the net- every protocol, e.g. IOTA has a different method of adding trans-
work latencies between agents, which are stored in a distance ma- actions to the DAG as opposed to other DAG-based protocols such
trix d. This matrix can be obtained by considering the shortest as SPECTRE. The methods to determine the part of the ledger that
paths between agents d (a1 , a2 ), thus the distance function d A × the agents agree on as the true state are not included in this algo-
A → R is defined as: d (a1 , a2 ) ≡ minP∈P(a1 →a2 ) ∑e∈P f (e), where rithm, because different protocols use different ideas and methods
P (a1 → a2 ) is the set of all paths from a1 to a2 . We then obtain a to resolve this question. Besides, how confirmed a transaction is
N × N distance matrix d over R, such that the following holds: does not directly play a role when the ledger is formed but is of in-
terest for a merchant who needs to decide whether or not to accept
• For all i : dii = 0 a transaction. Consequently, this is not of interest during the sim-
• For all i 6= j : di j > 0 ulation, but can be done after run() is finished, together with any
other methods concerned with the analysis of the resulting ledger.
• For all i, j, k : di j + d jk ≥ dik More important for correct functioning of the asynchronous sim-
ulation framework is that an agent in every iteration of the main
2.2 The DAG model simulation loop deals with the currently visible part of the DAG,
There are two classes of DAGs we have considered for our sim- i.e. it is bounded by the network latencies contained in d.
ulator. Vertexes in the graph can either transactions (i.e. IOTA It is also important to note that when this simulation framework
[Popov et al. 2017]) or blocks that contain multiple transactions is extended to blockDAG-protocols, such as SPECTRE, then trans-
(i.e. SPECTRE and PHANTOM [Sompolinsky et al. 2016, Som- action instances in this algorithm are instead blocks. Each block
polinsky and Zohar 2018]). We refer to the first class as txDAG contains a list of transactions.
and the second class as blockDAG. The DAG data structure built up
during a simulation can be defined as a stochastic process:
2.4 Current limitations
Let G be the set of all DAGs G = (V, E) with the following prop- One of the main limitations of the currently implemented simula-
erties: tion framework is that it assumes honest and semi-honest agents, as
opposed to specifically including malicious agents as well. These
• G is finite and the root of the DAG is called genesis G, such honest and semi-honest agents might influence the build DAG struc-
that degout (v) ≥ 1 for all v ∈ V \{G}, and degout (G) = 0. ture within the range of the simulated protocol only. However,
the simulator is built in a flexible and modular way, which would
• Any v ∈ V such that v 6= G references G. make future extensions possible. Thus, in future versions, mali-
cious agents could be included, and scenarios of specific attacks
At time t ≥ 0 the state of the DAG ledger is L (t) ≡ (V (t), E(t)), against the network could be modelled, where these agents pur-
where V (t) is the set of vertices and E(t) is the multi-set of directed posely break the protocol and use different consensus algorithms.
edges. Furthermore, the following dynamics hold:

• The initial state of the DAG at t = 0 is defined by V (0) = 3. RESULTS

{G}, E(0) = 0./
3.1 Performance results
• Over time, the DAG grows: if 0 < t1 < t2 then V (t1 ) ⊆ The efficiency of the framework determines at which scale sim-
V (t2 ) and E (t1 ) ⊆ E (t2 ). ulations can be performed. IOTA was simulated with 5000 transac-
• Transactions arrive with a rate λ > 0 according to a Poisson tions [Zander 2018], using the Python module cProfile to generate
process. They are either included in a block (i.e. blockDAG) profiling statistics of the simulation. The simulation is completed
or become vertices of the DAG (i.e. txDAG). in 10 minutes 14 seconds on an i7 processor with 8 threads and 16
GB RAM. Significantly, it was found that the process of updating
• A miner attaches a vertex v to the graph (i.e. a transaction the cumulative weights [IOTA Foundation 2018b] took the largest
or a block). The consensus protocol votes on accepting the amount of time - responsible for 61.81% of the run-time [Zander
vertex. If a vertex arrives at time t, then V (t+) = V (t) ∪ 2018]. This analysis, together with the investigation of the effect
{v} and E(t+) = E(t) ∪ {(v, v0 )}. of different weight update algorithms, allows us to conclude that
the simulator efficiency is fundamentally restricted by the compu-
2.3 Design and Implementation Details tational complexity of the underlying weight update algorithm. As
There are two main methods being executed during a simulation, outlined in the IOTA documentation [IOTA Foundation 2018b, Gal
setup() and run(). setup() initialises Agent and Transaction 2018], the run-time complexity is O(n2 ).
instances, whereas run() iterates over all transaction instances ex- In practice, the IOTA implementation avoids this efficiency prob-
cept for the genesis G in the order of their arrival times. This is lem through the use of milestones [IOTA Foundation 2018b]. These
the main simulation loop, i.e. the arrival of each transaction is one are checkpoints in the ledger past that define a sub-graph upon
event. Arrival times of incoming transactions are sampled from the which the tip selection process, and as a result the weight update
 Algorithm 1: Setup and run of a simulation weight). The larger the cumulative weight, the more likely a trans-
action is to be part of the main, agreed-on branch of the DAG (over
Input : Number of transactions x, number of agents N, time). We can measure the following, at any specified iteration of
transaction rate λ , POW parameter h, the simulation: How likely are the currently unreferenced trans-
distance matrix d actions (called tips) of an agent to be referenced by an incoming
Output: DAG data structure with all transactions transaction. Since this calculation incorporates exit probabilities,
which are the specific probabilities of the weighted random walk
returning a given tip (i.e. resembling the Markov Chain Monte
1 procedure setup()
Carlo algorithm), our proposed measure called attachment proba-
2 Create set of agents A, consisting of N agents
bilities tells us the relative “importance” of agents in the system
3 Generate x inter-arrival times τ1 , . . . , τx ∼ Exp(λ ) [Zander 2018].
4 Initialise V (t) with arrival times: atv for each
v ∈ V (t)\{G} is given as at1 = τ1 and ati = ati−1 + τi Experimental results We want to examine the impact of network
5 atG = 0 latencies on attachment probabilities. The idea is to find a rela-
6 end tion between the centrality of agents in the random agent network
and the development of attachment probabilities per agent. We ex-
7 procedure run() pect well connected agents to refer to each other more frequently,
thus building heavier branches and becoming more “important”,
8 foreach v ∈ V (t)\{G} do
i.e. more likely to being attached to (higher attachment probabil-
9 Choose issuing agent i ∈ A with uniform probabilities
ity). Since the network latencies in our simulation framework are
10 Determine which transactions are visible and valid for represented by the shortest paths between agents, which are held in
agent i according to h and d a distance matrix, then a measure for agent centrality, namely close-
11 Add v to DAG according to chosen protocol ness centrality, proves useful [Sabidussi 1966]. Closeness central-
12 end ity is high (an agent is central in a network), if his average shortest
13 end path to all other agents is small.
In the initial agent network, the distance between two neighbour-
ing agents is one by default. When ten agents are simulated, this
causes the relative differences in network latencies between agents
to be small (multiples of 1). To make differences in network laten-
process, is applied. However, this relies on a centralised and trusted
cies more pronounced, we scale the distance matrix by 10 (network
entity called the coordinator [IOTA Foundation 2018a].
latencies are multiples of 10). All agents issue the same amount
It is anticipated that our investigations of SPECTRE will yield
of transactions (equal hashing power). We run 20 simulations for
similar efficiency results, as it is noted that the published core block
each parameter set and average the attachment probabilities. We
wise ordering algorithm has a run-time complexity of O(n3 ) [Som-
also report results for different α-values. α is a parameter used in
polinsky et al. 2016]. Potentially, we can reduce the complexity and
the IOTA consensus mechanism regulating the strength of the bias
optimise resources in the simulation by holding intermediary com-
in the weighted random walk. In other words, a higher α-value
putation steps in memory with frameworks such as Apache Spark
means that heavier transactions (tips) are favoured when attaching
[Zaharia et al. 2016].
new transactions to the DAG.
3.2 IOTA protocol Table 1 suggests a clear trend, i.e. higher closeness centrality
corresponds to larger average attachment probability. Furthermore,
In this section we present results obtained by using our multi-
this effect becomes pronounced with higher α-values, where the
agent simulation framework to simulate the IOTA protocol, first
most central agent builds even heavier transaction branches. How-
presented in [Zander 2018]. The created DAGs contain 10,000
ever, we cannot show what happens in the long-run, and whether
transactions. We generate random sparsely connected agent net-
the values eventually stay stable at their respective level. Larger
works and examine attachment probabilities per agent, a measure
simulations should examine this matter. More results can be found
concerned with the relative “importance of agents”, i.e. telling us
in [Zander 2018].
how likely the transactions issued by an agent are being part of the
Overall, this shows how latency in the asynchronous IOTA net-
consensus part of the formed ledger (accepted by the network). We
work can play together with the consensus mechanism for the ad-
show the development of this measure over time (during a simula-
vantage of well connected agents.
tion) and how it is affected by the network latencies between agents.
Sparse networks are commonly found in practice and have a num-
ber of links L between nodes N (here agents) much smaller than the 4. CONCLUSION
maximal possible number of links Lmax . Similarly to [Sompolinsky Summary This paper contributes an asynchronous, continuous time,
et al. 2016], we generate a Erdős-Rényi random network topology and multi-agent simulator for DAG-based protocols. The frame-
[Erdos and Rnyi 1960] with N = 10 agents for the experiments. work does not yet model malicious agents and run-time complex-
ity remains a concern. IOTA has been simulated. This has shown
Quantifying heaviness The IOTA protocol uses a Markov Chain that tips issued by centrally located agents are more likely to be
Monte Carlo algorithm as core of the consensus mechanism [Popov referenced by an incoming transaction, i.e. these agents have a
2016]. When a new transaction comes in and the protocol specifies higher probability of having their transactions accepted in the net-
a transaction to attach to for the incoming one, a weighted ran- work over time, assuming honest and semi-honest strategies. Thus,
dom walk is used. This walk is biased towards heavy transactions in the real world IOTA implementation, adjustments of α might be
or branches of the ledger. Heaviness is a measure specifying how needed for less well connected agents.
many other transactions are directly or indirectly referencing any
transaction in the DAG (the integer storing this is called cumulative Future Work The next steps involve simulating additional DAG-
 Agent Closeness Average attachment prob. Alon Gal. 2018. Algorithm for calculating cumulative
centrality α = 0.001 α = 0.005 α = 0.01 weights. (2018). https://github.com/alongalky/
1 0.6 0.127 0.127 0.145 iota-docs/blob/master/cumulative.md Accessed:
2 0.53 0.123 0.129 0.13 2018-09-29.
3 0.47 0.109 0.107 0.116 Alon Gal and Clara Shikhelman. 2018. Partitioning in the
4 0.43 0.099 0.094 0.101 Tangle: a Multi-Agent Extension. (2018). Unprinted,
5 0.39 0.092 0.088 0.094 Accessed: 2018-09-29.
6 0.39 0.095 0.097 0.084 IOTA Foundation. 2018a. IOTA docs: Consensus. (2018).
7 0.36 0.09 0.094 0.081 https:
8 0.36 0.098 0.093 0.098 //docs.iota.org/introduction/tangle/consensus
9 0.36 0.089 0.092 0.081 Accessed: 2018-09-29.
10 0.27 0.078 0.078 0.07 IOTA Foundation. 2018b. IOTA docs: Tip selection. (2018).
https://docs.iota.org/introduction/tangle/
Table 1: Transaction attachment probabilities depending on tip-selection Accessed: 2018-09-29.
closeness centrality of agents in the P2P network with average Aggelos Kiayias and Giorgos Panagiotakos. 2016. On Trees,
results for 20 simulation rounds per α-level. Chains and Fast Transactions in the Blockchain. IACR
Cryptology ePrint Archive 2016 (2016), 545.
based protocols, refining the existing work and simulating larger Yoad Lewenberg, Yonatan Sompolinsky, and Aviv Zohar.
networks. The initial focus is on blockDAG-protocols, such as 2015. Inclusive block chain protocols. In International
SPECTRE [Sompolinsky et al. 2016] and PHANTOM [Sompolin- Conference on Financial Cryptography and Data Security.
sky and Zohar 2018]. An initial, albeit incomplete, implementation Springer, 528–547.
of SPECTRE is under development. SPECTRE separates the min- Satoshi Nakamoto. 2008. Bitcoin: A Peer-to-Peer Electronic
ing and consensus protocols into two distinct stages. The core of Cash System. (2008).
the consensus algorithm is made up of a pairwise vote over the https://bitcoin.org/bitcoin.pdf Accessed:
order of the blocks, the outcome of which is then used to help de- 2018-09-29.
termine which transactions in each block are accepted. A robust Rafael Pass, Lior Seeman, and Abhi Shelat. 2017. Analysis
transaction algorithm then proceeds to specify a subset of accepted of the blockchain protocol in asynchronous networks. In
transactions that are guaranteed, up to a particular error probability, Annual International Conference on the Theory and
to remain accepted [Sompolinsky et al. 2016]. Applications of Cryptographic Techniques. Springer,
643–673.
Acknowledgments Serguei Popov. 2016. The Tangle. (2016).
https://www.iota.org/research/academic-papers
This research is funded by the Outlier Ventures grant. The authors Accessed: 2018-09-29.
thank Will Knottenbelt and Aron van Ammers for feedback and Serguei Popov, Olivia Saa, and Paulo Finardi. 2017.
discussions on the simulator. We further thank Alon Gal for his Equilibria in the Tangle. arXiv preprint arXiv:1712.05385
help and support on the IOTA specifics. (2017).
Gert Sabidussi. 1966. The centrality index of a graph.
5. REFERENCES Psychometrika 31, 4 (1966), 581–603.
Leemon Baird. 2016. The swirlds hashgraph consensus Yonatan Sompolinsky, Yoad Lewenberg, and Aviv Zohar.
algorithm: Fair, fast, byzantine fault tolerance. Swirlds, 2016. SPECTRE: Serialization of proof-of-work events:
Inc.Technical Report SWIRLDS-TR-2016 1 (2016). confirming transactions via recursive elections. (2016).
Tobias Bamert, Christian Decker, Lennart Elsen, Roger https://eprint.iacr.org/2016/1159.pdf Accessed:
Wattenhofer, and Samuel Welten. 2013. Have a snack, pay 2018-09-29.
with Bitcoins. In Peer-to-Peer Computing (P2P), 2013 IEEE Yonatan Sompolinsky and Aviv Zohar. 2013. Accelerating
Thirteenth International Conference on. IEEE, 1–5. Bitcoins transaction processing: Fast Money Grows on
Iddo Bentov, Pavel Hubcek, Tal Moran, and Asaf Nadler. Trees, Not Chains. (2013).
2017. Tortoise and Hares Consensus: the Meshcash https://eprint.iacr.org/2013/881 Accessed:
Framework for Incentive-Compatible, Scalable 2018-09-29.
Cryptocurrencies. IACR Cryptology ePrint Archive 2017 Y. Sompolinsky and A. Zohar. 2018. PHANTOM,
(2017), 300. GHOSTDAG: Two Scalable BlockDAG protocols. (2018).
Kyle Croman, Christian Decker, Ittay Eyal, Adem Efe https://eprint.iacr.org/2018/104.pdf Accessed:
Gencer, Ari Juels, Ahmed Kosba, Andrew Miller, Prateek 2018-09-29.
Saxena, Elaine Shi, and Emin Gn Sirer. 2016. On scaling Matei Zaharia, Reynold S Xin, Patrick Wendell, Tathagata
decentralized blockchains. In International Conference on Das, Michael Armbrust, Ankur Dave, Xiangrui Meng, Josh
Financial Cryptography and Data Security. Springer, Rosen, Shivaram Venkataraman, Michael J Franklin, et al.
106–125. 2016. Apache spark: a unified engine for big data processing.
Christian Decker and Roger Wattenhofer. 2013. Information Commun. ACM 59, 11 (2016), 56–65.
propagation in the bitcoin network. In Peer-to-Peer Manuel Zander. 2018. A Multi-Agent Simulation Framework
Computing (P2P), 2013 IEEE Thirteenth International and Analysis of the IOTA Tangle. (2018). Master’s thesis.
Conference on. IEEE, 1–10. Imperial College London, UK.
Paul Erdos and Alfrd Rnyi. 1960. On the evolution of random
graphs. Publ.Math.Inst.Hung.Acad.Sci 5, 1 (1960), 17–60.

View publication stats