A lecture series on the science and technology of blockchain protocols and the applications built on top of them, with an emphasis on fundamental principles.
Full playlist:    • Foundations of Blockchains  
Lecture 8: Longest-Chain Consensus (8 videos + 1 addendum)
Lecture 8 notes: https://timroughgarden.github.io/fob2...
Lecture 8 slides: https://timroughgarden.github.io/fob2...
Leave comments/questions below or at   / 1576286108107051008  
Lecture 8 tl;dr:
1. Longest-chain consensus protocols as in Bitcoin and (the original version of) Ethereum are an important category of blockchain protocols (different from BFT-type protocols like Tendermint).
2. Longest-chain consensus starts with a genesis block and consists of a sequence of rounds, where in each round one node acts as the current block proposer.
3. Different implementations of longest-chain consensus (permissioned, proof-of-work, proof-of-stake) implement leader selection in different ways and impose different constraints on the block proposer’s behavior.
4. Relative to BFT-type protocols, longest-chain consensus favors liveness over consistency.
5. Longest-chain consensus loses consistency under network attacks (in the partially synchronous model) and is analyzed primarily in the synchronous model.
6. An honest block proposer is instructed to propose a single block, with its predecessor set to the current end of the longest chain (breaking ties arbitrarily).
7. Byzantine block proposers can, among other things, deliberately create or perpetuate forks by proposing blocks with predecessors that are not the end of the longest chain.
8. If there is a sequence of consecutive rounds in which the Byzantine block proposers out- number the honest block proposers by k, those Byzantine nodes can force the rollback of the last k blocks of the longest chain.
9. The last few blocks on the longest chain should always be regarded as tentative and still under negotiation.
10. A sequence of block proposers is w-balanced if, for every window of at least w consecutive rounds, the honest block proposers outnumber the Byzantine ones.
11. If block proposers are chosen randomly, with each round’s choice independent and more likely than not to be an honest block proposer, the sequence of block proposers will be w-balanced with high probability (provided w is set appropriately).
12. The reason is that, with randomly selected block proposers, all sufficiently long sequences of consecutive rounds will have a near-proportional representation of honest nodes.
13. The common prefix property states that every pair of longest chains should agree on all but at most their last k blocks.
14. The common prefix property implies finality, meaning that confirmed blocks will never be rolled back.
15. As long as the sequence of block proposers is sufficiently balanced with honest proposers, longest-chain consensus satisfies the common prefix property.
16. As long as the sequence of block proposers is sufficiently balanced with honest proposers, longest-chain consensus satisfies liveness.
17. The chain quality of a blockchain is the fraction of the confirmed blocks that were contributed by honest nodes.
18. If each leader has at most an α probability of being a Byzantine node, the typical chain quality of longest-chain consensus is at least ≈ (1−2α)/(1−α).
19. A permissionless consensus protocol has no knowledge of which nodes are running the protocol.
20. The only missing ingredient from a permissionless implementation of longest-chain consensus is a permissionless and non-manipulatable method of leader selection that guarantees that each leader is more likely to be honest than Byzantine.