Prism: Scaling Bitcoin by 10,000×

Lei Yang 1 Vivek Bagaria 2 Gerui Wang 3 Mohammad Alizadeh 1

David Tse 2 Giulia Fanti 4 Pramod Viswanath 3

1MIT CSAIL

2Stanford University

3University of Illinois Urbana-Champaign

4Carnegie Mellon University

The Stanford Blockchain Conference 2020

Bitcoin: high security, low throughput, and long latency

I Security: 50% adversary

I Throughput: 7 tps

I Confirmation Latency: hours

Prism: decoupling performance from security

I Bitcoin: throughput, latency coupled with security

I Prism: decouple performance from security

This talk

The Prism consensus protocol

System implementation

Evaluation results and findings

This talk

The Prism consensus protocol

System implementation

Evaluation results and findings

Bitcoin: the longest chain rule

Mining rate = 1 block per 10 min

Bitcoin: k-deep confirmation rule

TXTXConfirmed TX Private chain

Longest chaink

Longest chain

30% adversary powerFor 10−3 attack probability, wait 250 mins!

Nakamoto’s Table

k ε0 1.00000005 0.1773523

10 0.041660515 0.010100820 0.002480425 0.000613230 0.000152235 0.000037940 0.000009545 0.000002450 0.0000006

Calculating the performance of Bitcoin

Throughput

Block size × Mining rate

Latency

Confirmation depth (k) ÷ Mining rate

Increasing the mining rate or the block size causes forking

Forking happens when the next block ismined before the previous one is received.

I Mine faster → Shorter interval

I Bigger blocks → Slower propagation

Forking compromises security

0%

25%

50%

Security

Mining rate / Block sizeBitcoin performance is coupled with security!

Deconstructing a block: proposing and voting

TX Add new transactions

Certify previous blocks

Scale proposing with lots of transaction blocks

Forking does not matter among transaction blocks!

Throughput , latency

Scale voting with lots of voter chains

. . .

. . .

. . .

. . .

I 1 voter chain: 25-deep

I 1000 voter chains: 2-deep

Prism is provably fast and secure

Adversary power β < 0.5Network bandwidth C , network latency D, confirmation reliability ε, m voter chains

I Security: consistency and liveness

I Throughput: (1− β)C

I Confirmation Latency: O (D) + O(−D log(ε)

m

)

Understanding the real-world performance of Prism

I Protocol more complex than Bitcoin

I Theory based on simplified assumptions

I Unknown constants in confirmation latency

I Other bottlenecks besides network

This talk

The Prism consensus protocol

System implementation

Evaluation results and findings

Implementing Prism in Rust

I 10,000 lines of Rust

I Unspent Transaction Output (UTXO) model

I Pay-to-public-key transactions

I Code available at t.leiy.me/prism-code

Prism: ∼70,000 tps and ∼10s latency

100

101

102

103

104

105

1 10 100 1000

β=20%

β=20%

Throughput (tps)

Latency (s)

AlgorandLongest Chain

Prism

β=20%

Bitcoin-NG

β=20%

Blockchain client: consensus and ledger keeping

I Consensus: keep track of theblockchains and mine

I Ledger keeping: process transactionsand calculate the UTXO set

Blocks

Consensus

Ordered Transactions

Ledger Keeping

UTXO Set

Achieving high throughput

LessonsI Bottlenecks: ledger keeping, SSD

I Must parallelize

Optimizations

I “Scoreboarding”

I Async ledger keeping

I Functional design pattern

I No transaction broadcasting

Parallelize ledger keeping with scoreboarding

A→C

A→D

B→E

E→F

BAC EFD E A C

A D

B EE

E F

Scoreboard: A, C A, B, C, E A, D A, D, E, F

Parallelize ledger keeping with scoreboarding

2×104

4×104

6×104

8×104

0 2 4 6 8 10 12 14 16

Throughput (tps)

#Cores

Parallelize consensus with async ledger update

I Ledger updates are “infrequent”

I Don’t do it every new block

The Prism consensus protocol

System implementation

Evaluation results and findings

Testbed setup

I 100 - 1000 AWS EC2 instances

I Random 4-regular graph

I 120ms propagation delay

I 400 Mbps bandwidth

Experiments

I Comparison of throughput, latency with Algorand, Bitcoin-NG, Longest Chain

I Scalability to 1000 nodes

I CPU, bandwidth utilization

I Censorship, spamming, balancing attacks

Comparison with Algorand, Bitcoin-NG, Nakamoto

100

101

102

103

104

105

1 10 100 1000

β=20%

β=20% β=33%

Throughput (tps)

Latency (s)

AlgorandLongest Chain

Prism

β=20%

β=33%

β=40%

β=43%

β=44%

Bitcoin-NG

β=20%

β=33%

Our implementation is efficient

CPUI Signature check: 22%

I RocksDB: 53%

I Data serialization: 7%

BandwidthI Transaction blocks: 99.5%

I Voter blocks: 0.4%

I Proposer blocks: 0.1%

Takeaways

I Deconstruct blockchain into proposing and voting

I Scale each part to the physical limit

I Must parallelize everying in the client

I Current bottleneck is ledger keeping and SSD

I Simple and natural extension of Natamoto

Resources

I Code: t.leiy.me/prism-code

I Theory Paper: Deconstructing the Blockchain to Approach Physical Limits

I System Paper: t.leiy.me/prism-paper

I Online Demo: t.leiy.me/prism-demo