What prevents a primary staker from holding off staking to wait for a specific outcome they want in BABE?

Question

One of the issues of PoS as far as I understand is the randomness that selects a staker. Ouroboros Praos, and also BABE use VRFs (Verifiable Random Functions) to assign primary and secondary leaders roles to block producers. What's special about this is that only the individual block producer knows whether they're gonna win a block, making targeted attacks infeasible. All good so far.

If I understand correctly, secondary leaders exist in case primaries are not available for any reason (whether it's network latency issue, or being offline). Basically to solve the liveliness problem. BABE chooses the longest chain by finding the most primaries in a chain.

Let's say I'm a bad block producer, and I want to produce a certain outcome on the blockchain. What prevents me from doing that by:

1. Producing the block, and keeping it with me (not broadcasting it)
2. Waiting for the secondary producer to publish
3. If I like the outcome, I keep it, otherwise, I publish my block and overwrite it

I can even see Sassafras having the same issue, because it pre-publishes the list of producers to eliminate the probability of having missing producers in slots (the current problem with BABE). What if a producer holds off publishing their block and waits for the next producer in order to publish and then overwrites their work if they don't like it? Same issue with primary and secondary producers.

This is an attack that's prevented in bitcoin by giving all miners the same strength/chainwork per block height. Basically the chainwork is a function of the difficulty, not the inverse of the hash of a block.

Answer 1

Praos has a performance & resource utilization problem, not a liveness problem. BABE's secondary slots, and Sassafras, make the chain faster & more efficient.

As proven by the Praos paper, we never care if some block producers carry out this "attack", only if too many do. It's tricky however because we intuitively think about attackers as being malicious together, while our results often say less than 1/2 or 1/3 byzantine.

In other words, are these protocols secure if all block producers are malicious, but no more than 1/3rd form cartels together? Although some work exists, there is afaik no analysis proving exactly this for Praos or any byzantine agreement protocol. Instead, there are results after you add economic assumptions, which makes sense because this requires the cartels goals differ. We do know bicoin's consensus collapses after enough halvings within the cartels model, due to their stupid economics.

We believe Sassafras admits simpler analysis, and should be stronger, in the cartels model, for two reasons:

Any (semi-)SSLE like Sassafras admits only one block per slot, which also means fewer blocks always reduces total rewards. Although important, I kinda dislike the second bit here for polkadot because we'll be cheaper by making as much of the validator rewards as possible to go for approval checks of parachain blocks.

In sassafras, we'll eventually build tor-like circuits through which users send tx almost to block producers, bypassing the memepool. We could then make block producers "own" tx via half-aggregation aka pre-batching of signatures, snarks, etc. If we've both advancements, then skipping others' block merely excludes the contained tx entirely, but does not permit attackers to benefit from those tx. This looks powerful.

As an aside, Tor does not pay relay operators, largely because they believe altruism mitigates these economic concerns, and they've a worse threat model than blockchains, but this assumption remains hotly debated.