1 Introduction↩︎

Distributed data management systems rely on consensus protocols to stay consistent and available despite failures [1]–[5]. Consensus protocols realize State Machine Replication (SMR) [6], [7]: every replica executes the same transactions in the same order (safety) and every valid transaction is eventually executed (liveness). When some replicas may behave maliciously, the protocol must be Byzantine fault-tolerant (BFT). Classically, a single designated proposer collects transactions, packs them into an ordered batch, and broadcasts it, so a transaction’s position in that batch is its execution order. This hands the proposer a quiet power: it can choose which transactions to include and how to order them without ever violating safety or liveness.

That power becomes profit once the underlying application is holding real money [8], [9]. In decentralized finance (DeFi), a proposer can reorder trades for gain, an exploit known as maximal extractable value (MEV) [10]–[16]. The textbook case is the sandwich attack: seeing a victim’s large trade on an automated market maker [17], the proposer places its own buy just before it and its sell just after, pocketing the price move the victim causes. On Ethereum alone, such ordering games have extracted over a billion dollars from ordinary users [18]. How a consensus protocol decides transaction order is therefore a first-order fairness question, not an implementation detail.

Classical BFT protocols incur high communication costs as they rely on a single node to disseminate transactions and propose an order. Recently, DAG-based BFT protocols [19]–[23] have been proposed to remove the bottleneck by letting every node propose blocks in parallel, forming a directed acyclic graph (DAG) from which the total order is derived afterward. These protocols have been widely used in production systems such as Sui [24], [25], Aptos [26], Celo [27], Chainlink [28], and Supra [29], with Sui among the largest: a market capitalization of roughly $3 billion and more than $150 billion in cumulative on-chain exchange volume [30].

Sui’s consensus protocol, Mysticeti [31], is a state-of-the-art DAG-based BFT protocol widely believed to fairly order transactions for two main reasons. First, in DAG-based BFT protocols and with all validators proposing in parallel, no single party is the sole gatekeeper of ordering. Second, and more specific to Mysticeti, after consensus commits, Sui re-sorts the committed transactions by the fee they pay (their gas price), so that, supposedly, whoever pays most goes first, and nobody gets a free ordering edge.

This paper shows that both reassurances are weaker than they appear, and that the resulting bias is not merely theoretical: it is currently active on Sui’s production chain (mainnet), where MEV already extracts roughly $18,000 a day from users [32], under normal operating conditions with no special configuration required. As illustrated in Figure 1, a transaction’s execution order is determined in two stages: the consensus protocol first produces a total order over the committed graph, and a gas-price re-sort is then applied on top of it. Our analysis shows that each stage independently leaks an advantage to a well-placed validator. More specifically, in a 13-validator deployment running the current Sui consensus code, we find the following opportunities for order manipulation.

• A low-index head start (§4.2). When the transaction blocks in the committed graph are totally ordered, same-round blocks are ordered by validator index. Hence, in the same round, the blocks generated by lower-indexed validators appear first \(\approx\) 89% of the time, with no attack running: this is the protocol’s default behavior.

• A tie loophole (§4.3). The gas-price re-sort is a stable sort: on equal fees, it preserves the incoming (biased) order. Because ordinary transactions follow the reference gas price, ties are the common case, so the head start opportunity exists for the attackers without paying any extra cost.

• Strategic silence (§4.4). A validator can amplify its head start using nothing more than a legitimate action, choosing not to broadcast on most rounds, pushing its ordering-win rate above 94% over one-second windows.

Our investigations also show that below the Byzantine fault threshold, Mysticeti’s ordering across rounds stays essentially fair. Hence, the three aforementioned order manipulation opportunities do not break consensus safety (§6). We further address those order manipulation opportunities with a minimal fix: replacing the validator-index tiebreak with an unpredictable per-commit key. We implement this technique and measure it: it drops the same-round head start from 89% to about 45%, essentially the 50% fair line, removing both the head start and the tie loophole gaps without touching consensus safety, liveness, or gas-price priority. Note that this fix does not close strategic silence, whose advantage comes from round position and is bounded by causality.

The bias we study is a property of the linearization tiebreak, not of Sui: any DAG-based BFT protocol that breaks same-round ties by a fixed validator order inherits the same head start, so the fix matters for the whole family. Our finding is also distinct from prior DAG-MEV work, which studies attacker-driven front-running [33]: the bias we measure needs no attacker, is visible only in the same-round comparison that an aggregate all-pairs metric hides, and is live in production.

In summary, the paper makes the following contributions. First, we identify and measure three order manipulation opportunities in the Mysticeti DAG-based BFT protocol and its production system, Sui, and verify each against the current source; two are structural flaws, and one is a legitimate-action attack. Second, we show the advertised gas-price defense is a no-op at tied fees, which is the common case. Finally, we give a simple, safety-preserving fix and situate it against order-fairness and MEV-mitigation work.

2 Background↩︎

The paper focuses on the impact of MEV attacks on BFT DAG-based protocols. In this section, we give a brief background on BFT and DAG-based BFT consensus protocols. We then discuss MEV and order-fairness.

Byzantine fault-tolerant consensus. BFT protocols realize the State Machine Replication (SMR) algorithm [6], [7] where the system provides a replicated service whose state is mirrored across multiple deterministic replicas. At a high level, the goal of a BFT SMR protocol is to assign each client request an order in the global service history and execute it in that order [34], [35]. In a BFT SMR protocol, to agree on an ordering of incoming requests, all non-faulty replicas execute the same requests in the same order (safety) and all correct requests are eventually executed (liveness). In an asynchronous system, where replicas can fail, no consensus solutions guarantee both safety and liveness (FLP result) [36]. In the Byzantine failure model, faulty nodes may exhibit arbitrary, potentially malicious behavior. In BFT consensus protocols, while there is no upper bound on the number of faulty clients, the maximum number of concurrent Byzantine replicas is assumed to be \(f\) out of \(3f+1\) replicas. BFT protocols assume that a strong adversary can coordinate malicious replicas and delay communication. However, the adversary cannot subvert cryptographic assumptions.

Traditional BFT protocols, e.g., PBFT [37] and HotStuff [38], despite their extensive use in distributed data management systems, suffer from multiple shortcomings. First, BFT protocols tightly couple data dissemination with the consensus routine. Specifically, they share transaction data as an integral part of the consensus routine, creating a significant performance bottleneck. Second, most such protocols adopt a leader-based approach, where a designated leader receives client transactions, validates them, constructs a new block, and broadcasts it to all replicas. While this method ensures consistency, it also leads to resource imbalance. Finally, the protocols suffer from a costly view-change mechanism to change the leader.

DAG-based BFT. DAG-based consensus protocols have recently been proposed to address the shortcomings of traditional BFT protocols. DAG-based protocols decouple transaction dissemination from the consensus routine. They further enable concurrent dissemination of transaction blocks where every validator proposes blocks continuously and in parallel. Each new block references several blocks from the previous round, recording its causal history; the blocks and their references together form a directed acyclic graph (DAG), a graph whose arrows always point back in time and never form a cycle. DAG-based protocols process transactions in two stages [19], [20]. In DAG construction, validators simply gossip blocks and grow their own local copy of the graph. In ordering, each validator independently flattens the committed part into the same total order by applying a fixed, deterministic rule, with no extra voting messages. Different protocols differ in how they build and confirm the DAG: Narwhal/Tusk [20] and Bullshark [21] attach explicit certificates to blocks (a certified DAG), whereas Mysticeti [31], the protocol Sui runs, skips certificates and lets a block’s references stand in as votes (an uncertified DAG). They share the one feature this paper turns on: the final transaction order is produced by a linearization rule that flattens the committed graph, and whatever tie-break that rule uses quietly decides who is ordered first (§5).

Maximal extractable value (MEV). A blockchain’s state, e.g., token balances and on-chain exchange prices, depends on the order in which transactions execute, so whoever influences that order can extract value from it. Maximal extractable value (MEV) is the profit a party can obtain purely by choosing the order, inclusion, or exclusion of transactions [10], [13]. First studied on leader-based chains such as Ethereum [10], [11]. MEV is now understood as a systemic cost paid by ordinary users [16]. Its textbook forms all involve a victim trade on a decentralized exchange [17]: front-running places an attacker transaction just before the victim’s, to act at the old price; back-running places one just after, e.g., to arbitrage the price the victim moved; and a sandwich does both around the victim, so the victim is forced to trade at the worst price [11], [14]. MEV is not a flaw in any one application; it is the direct consequence of someone getting to decide transaction order, which makes it a consensus-level fairness problem.

Daian et al. [10] showed that control over transaction order is monetizable and that the resulting competition destabilizes consensus. Eskandari et al. [11] give a taxonomy (displacement, insertion, suppression) into which our head start falls as low-cost displacement. Most MEV work targets chains with a public mempool and fee auctions; Sui has neither. Hence, the advantage instead comes from the consensus tiebreak we isolate. Closest to us, Zhang and Kate [33] show front-running is feasible on DAG-based blockchains. We differ by pinning the advantage to a specific, deployed linearization rule, showing the advertised gas-price defense is a no-op at tied fees, and adding a legitimate-action amplifier.

Order-fairness. To mitigate order manipulation, early studies focus on censorship resistance [39], where the goal is to ensure that correct transactions are eventually ordered, i.e., not censored. However, reordering transactions, e.g., sandwich attacks, is still possible. Similarly, reputation-based systems [40]–[43] only detect unfair censorship. Order manipulation can also be addressed by hiding transaction contents until the order is fixed (encrypted or commit-reveal mempools) or by relying on trusted hardware [44]. Such techniques either add latency or assume trust. Recently, the notion of order-fairness is presented to address the manipulation of transaction ordering [45]–[51]. Order fairness ensures that the committed order of transactions respects the order in which validators actually received the transactions, denying anyone a purely positional advantage. A foundational result is that perfect order-fairness is impossible: the receive order seen by different honest validators can disagree in a cycle (one saw \(t_1\) before \(t_2\), another \(t_2\) before \(t_3\), a third \(t_3\) before \(t_1\)), a Condorcet paradox that no total order can satisfy [48]. Protocols such as Aequitas [48], Themis [49], and Rashnu [51] therefore settle for a weaker, batched notion of fairness [45], [46], [50]. Recently, order fairness has been applied on top of DAG-based protocols, e.g., FairDAG [52], DoD [53], where they layer fair ordering on multi-proposer causal designs. Finally, Mahé and Tucci-Piergiovanni [54] evaluate order-fairness of DAG ledgers and conclude that the linearization rule is what determines fairness, directly supporting our thesis. Our paper is complementary and deliberately lighter: rather than adding a fairness protocol, we show that a deployed DAG chain’s existing linearization rule already hands out a positional advantage, and that a minimal change to that one rule removes most of it.

3 Ordering Transactions in Mysticeti↩︎

Mysticeti stores state as objects. An owned object has a single owner (for example, a coin in your wallet); a shared object can be touched by anyone (for example, a trading pool). Transactions that touch only owned objects need no global order and take a fast, consensus-free path [25]. Only transactions that touch the same shared object (e.g., two swaps against the same pool) can conflict, so only these are sent through consensus to be put in a definite order. Ordering bias, and therefore MEV, lives entirely on this shared-object path.

Mysticeti runs on a DAG [19], [31]. Time proceeds in numbered rounds. In each round, every validator may propose one block (a batch of transactions) that references blocks from the previous round; those references are themselves votes for the blocks they point to, so no separate voting messages are needed. Certain blocks are designated leaders; once a leader has enough support, it is committed, which also commits everything the leader’s block transitively references, i.e., its sub-DAG (its causal history). To execute the result, the sub-DAG (a partial order, with many blocks left unordered relative to each other) must be turned into one total order. Mysticeti does this by linearizing: it sorts the committed blocks by \((\mathrm{round},\mathrm{author})\) (round number first, then validator index), using a stable sort. This sort is the first place bias can enter (§4.2).

Figure 2 traces two rounds. In round \(r\), validators \(V_0\)–\(V_3\) each propose a block \(A_0\)–\(A_3\), carrying transactions. In round \(r{+}1\), the leader \(L\) (could be any of the validators) references those blocks (a reference doubles as a vote), and once \(L\) collects enough support, it is committed, which commits its causal history: the sub-DAG \(\{A_0, A_1, A_2, A_3, L\}\). Mysticeti totally orders the blocks of this sub-DAG by \((\mathrm{round},\mathrm{author})\). The round number orders across rounds, so all four blocks of round \(r\) precede block \(L\) (of round \(r+1\)). Within round \(r\), where the four blocks tie, the validator index alone decides the order, so \(A_0\) runs first and \(A_3\) last. If \(t_1\) (in \(A_0\)) and \(t_7\) (in \(A_3\)) swap against the same pool, \(t_1\) executes first purely because \(0<3\), letting \(V_0\) front-run \(V_3\) with no fee paid and no attack running (§4.2).

After consensus fixes the block order, Mysticeti makes one more pass over the transactions inside the committed batch and re-sorts them by gas price (the fee per unit of computation), highest first, before execution. Mysticeti presents this as a defense against ordering bias: pay more, go first. But every validator quotes a reference gas price each epoch (a low, standard fee the network agrees to honor), and most ordinary transactions simply pay that reference rate. As a result, equal gas prices (ties) are the common case. What happens on a tie turns out to decide whether the re-sort is a real defense (§4.3).

4 Ordering Exploitation↩︎

4.1 Threat Model↩︎

We assume a strong but protocol-compliant adversary. A rational adversary may take any action an honest validator could legally take: which parent blocks to reference, which of several valid blocks to propose, how to fill a block, and when to broadcast, all within the protocol’s rules [33]. It may not forge signatures, violate a validity or quorum check, rewrite committed history, or make an honest node accept anything it would normally reject. Staying inside this legitimate action set is what makes the effects we report robust: they are not defended by any patch that hardens message handling, because no message is malformed. We assume up to \(f\) rational adversary validators out of \(n=3f+1\), the standard Byzantine fault tolerance (BFT) bound [55], [56].

4.2 The Low-Index Head Start↩︎

Recall that Mysticeti turns a committed sub-DAG into a total order by sorting blocks by (round, author). The function that does this, sort_sub_dag_blocks in commit.rs, carries the comment “any deterministic & stable algorithm works.” Any such rule is indeed safe. However, choosing the validator index as the tiebreaker is not neutral: whenever two validators have a block in the same round, the one with the smaller index is always placed first. Nothing an honest higher-indexed validator does can change this.

4.3 The Tie Loophole↩︎

Mysticeti addresses this ordering bias using the post-consensus gas-price re-sort: sort the committed transactions by gas price, highest first, so paying more buys priority and equal-priority transactions are, supposedly, no longer decided by consensus position. The implementation, order_by_gas_price in post_consensus_tx_reorder.rs, is a single call to Rust’s sort_by_key. That call is a stable sort: when two keys are equal, it preserves their input order. Here, the input order is exactly the consensus order, the head start of §4.2. So on a tie, the re-sort changes nothing, and the low-index transaction stays first. The defense only works when one transaction pays strictly more.

4.4 Strategic Silence↩︎

The first two findings are structural: they hold with no one misbehaving. The third is an attack that breaks no rule.

A validator’s own blocks help its overall ordering-win rate only when they land early; a block it produces on a late round lands late and drags its average position down. The round leader is chosen in a round-robin manner, so a low-index validator leads on the first rounds of each cycle. If such a validator simply stays silent on every round except the ones it leads, it emits only early blocks and deletes its own late ones from the comparison. Staying silent is always allowed (an honest validator with a slow link does it all the time), so no honest node rejects anything and no protocol rule is violated. In summary, this flaw encourages validators to speak only on their leader rounds.

5 Experimental Evaluation↩︎

We now evaluate the three flaws against the current Sui source code. We deploy the current Sui consensus code (code/sui) on a cluster of \(n{=}13\) validators. Unless stated otherwise, we label validators \(0\)–\(3\) as the (rational) attackers and \(10\)–\(12\) as the victims, collect \(60\) commits per run, and report the median over 5 independent runs. A run with the disabled attack represents the baseline.

Since our metric is block-level ordering rather than execution, transaction contents do not affect what we measure; what matters is that the input load favors no validator. Each run therefore uses a synthetic, content-neutral workload of \(5n\) distinct fixed-size (\(32\)-byte) transactions, submitted round-robin, so that every validator receives an equal share (five each) and the consensus layer, which never inspects a payload, treats them identically. For the two structural flaws below, which run with no attack, any ordering advantage therefore reflects the linearization rule rather than a skewed input; strategic silence keeps this same symmetric input but has the attacker choose when to propose.

Our metric is the Attack Success Rate (ASR) [33]: among pairs of an attacker block \(B_a\) and a victim block \(B_v\), the fraction in which the attacker’s block appears earlier in the committed order. We report it two ways. First, Same-round ASR restricts to pairs whose two blocks share a round \(r\): \(\Pr[B_a \text{ before } B_v \mid r(B_a) = r(B_v)]\). This isolates the linearization tiebreak. Second, All-pairs ASR takes every attacker–victim pair regardless of round: \(\Pr[B_a \text{ before } B_v]\). A perfectly fair protocol gives \(50\%\) on both, because with no systematic advantage each attacker–victim pair is equally likely to fall either way, so wins and losses cancel to a coin flip. The two metrics differ by design: across rounds, both sides produce a block every round, so those pairs cancel to \(50\%\), and one can show all-pairs ASR \(=\tfrac{1}{2}+\tfrac{1}{2R}\) for \(R\) rounds, tending to \(50\%\). The same-round metric is therefore where a per-round tiebreak shows up, and the all-pairs metric is where a genuine across-round advantage would show up.

5.1 The Low-Index Head Start↩︎

The Low-Index Head Start is a structural advantage that the Mysticeti protocol gives to the low-index validators. To prove the advantage comes directly from index position, we run one baseline (no attack) and compute the same-round ASR under different labelings of the same data. As shown in Figure 3, if we call the low-index validators the “attacker,” they win \(\approx\) 90% of same-round pairs; if we swap the labels and call the high-index validators the “attacker,” the number flips to \(\approx\) 10%. The result mirrors around 50%: the winner is always whoever has the lower index, even for validators two positions apart. A per-pair sweep over all \(78\) validator pairs tells the same story: the lower index wins in every pair (mean 87.4%).

The head start does not depend on a large attacker set. With only two validators per side, and a narrow index gap at that (\(4\)–\(5\) labeled the attacker vs. \(6\)–\(7\) the victim; the rightmost bars of Figure 3), the low-index side still wins \(92.0\%\) of same-round pairs, dropping to \(8.0\%\) once the labels are swapped. The \(78\)-pair sweep above is precisely the one-attacker/one-victim limit, and there too the lower-indexed validator is favored in every pair. A lone low-index validator competing against a single peer therefore already inherits the advantage; group size changes only who shares the head start, not whether it exists.

We think this bias has not been explored until now because when we average over all pairs, the effect disappears: all-pairs ASR stays at \(\approx\) 50% because cross-round pairs cancel (§4), and it does not grow with the number of low-index validators; it is a per-pair property of the sort, not a coalition effect. An evaluation that reports only all-pairs ASR would therefore conclude that Mysticeti is fair. The bias lives entirely in the same-round comparison, which is basically the comparison that matters for two transactions competing to touch the same pool in the same round.

5.2 The Tie Loophole↩︎

Most transactions pay the reference gas price (§3); as a result, ties are the common case between competing transactions. Figure 4 shows the consequence for a low- vs.high-index transaction pair. With no re-sort, the attacker’s transaction will be executed first \(\approx\) 89% of the time (the head start). Even after applying the re-sort technique at a tied fee, the number remains unchanged; only when the victim outbids by even one unit does the defense work. Crucially, the attacker pays no premium: the bias is exploitable at the minimum fee.

This exploitation has not been detected in the Sui blockchain, as its test for the re-sort checks only the textual form of the output transactions, which is identical for equal-fee transactions. The test therefore passes regardless of which tied transaction comes first: it checks only transaction identity, so it confirms the sort is stable without checking whether that stability is fair. The flaw is not a coding mistake in the sort; it is the assumption that a stable sort randomizes ties, when it does the opposite.

5.3 Strategic Silence↩︎

Figure 5 reports the result of strategic silence. At \(n{=}13\), strategic silence lifts all-pairs ASR to \(94.6\%\) over a 10-commit window (roughly one second of mainnet activity, the timescale on which front-running and sandwiching actually happen) and \(61.5\%\) over a 40-commit window. Doubling the committee to \(n{=}25\) (holding the attacker’s stake fraction fixed) does not remove the effect: \(80.8\%\) and \(77.3\%\), respectively.

The gap narrows with larger committee size. This is expected because all-pairs ASR is dominated by cross-round pairs (at least \(89\%\) of the pairs in these runs), which the attacker wins when its block lands in an earlier round than the victim’s; because strategic silence front-loads the attacker’s blocks, the score tracks how early that block-mass sits within the measurement window. At \(n{=}13\) the attacker’s blocks fill nearly the whole \(10\)-commit window (mean attacker round \({\approx}1.5\)) but form only a thin early slice of the \(40\)-commit window (\({\approx}16\) of \(40\) rounds), so the advantage dilutes toward the \(50\%\) fair line (\(94.6{\to}61.5\)). At \(n{=}25\) the blocks instead stay in the front quarter of the window at both lengths (\({\approx}3\) of \(12\) vs.\({\approx}10\) of \(41\) rounds), so the lead keeps pace with the window and the two scores nearly coincide (\(80.8{\to}77.3\)); the larger committee also lowers the short-window peak, because more validators dilute the attacker’s dominance within any single round.

Note that these high rates assume an attacker controlling \({\approx}31\%\) of the stake, just under the Byzantine safety bound; a single validator with a realistic stake gains far less. Moreover, all-pairs ASR is a ratio of pairs won, and strategic silence inflates it by producing fewer but better-placed blocks. A high ratio, therefore, need not translate into more realized profit, which depends on how many front-running slots the attacker actually fills, something our positional metric does not capture. We also note that the same early-only block pattern can be reached through a bug rather than a choice: a validator that signs a far-future timestamp trips Sui’s minimum-round-delay throttle (which uses a saturating subtraction) and is forced to skip rounds. That timestamp path relies on a missing validation (§6); strategic silence needs no such bug, which is why we treat it as the primary result.

6 Is the Core Broken? A Fix↩︎

It would be wrong to conclude that Mysticeti’s ordering is generally unsafe. Below the BFT threshold, the standard in-protocol attacks (e.g., excluding a victim’s blocks, delaying one’s own proposals, withholding blocks from specific peers, or bribing a minority of validators) leave all-pairs ASR within about one point of 50% in our runs. The commit rule still commits every honestly supported leader, and honest validators still advance rounds using only non-attacker blocks. The problems we report are not a failure of agreement; they are the consequence of one arbitrary tiebreak (sorting equal-round blocks, and equal-fee transactions, by validator index) applied at the two points where the order is finalized.

This problem can be fixed by replacing the validator-index tiebreak with an unpredictable but deterministic key. First, when linearizing a committed sub-DAG, sort equal-round blocks by a hash of the committed-leader digest and the block digest, instead of by author. Second, in the gas-price re-sort, break equal-fee ties by a hash of the leader digest and the transaction digest, rather than leaving them in consensus order. Both keys are fixed at commit time and identical for every validator, so the order stays deterministic (all nodes agree) and safety and liveness are untouched; both preserve the “higher fee first” rule that honest users rely on. Because the key depends on the leader digest, which a validator cannot grind, no index position is favored. Each change is confined to a single function. Encouragingly, Sui’s own (currently gated) reputation-based leader schedule already replaced a fixed tiebreak with a per-epoch seeded shuffle for the same reason, so this style of fix is already considered acceptable in the codebase.

4pt

We implemented this tiebreak (env-gated; the default path is unchanged) and ran it on the \(n{=}13\) cluster. The head start collapses: same-round ASR falls from 89.3% (median) to 44.8%, i.e.to the 50% fair line, confirming the validator index was its sole cause. Strategic silence, however, barely moves: its all-pairs ASR goes from 95.7% to 92.3%. The tiebreak removes silence’s same-round component (100% to 78%) but not its dominant advantage, because silence wins by concentrating blocks in early rounds, and the linearization is round-first out of causality: a block cannot precede its ancestors. Closing strategic silence, therefore, needs a round-level change, not a tiebreak, which we leave to future work.

The timestamp path behind the buggy variant of strategic silence exists because block verification never bounds a block’s timestamp against the local clock. Today, this unchecked clock has limited impact (the committed timestamp is a stake-weighted median that a minority cannot move), but any future feature that reads a raw block timestamp would inherit an unchecked attack surface. A single drift-bound check at verification closes it.

7 Conclusion↩︎

Fair ordering on Mysticeti rests on two beliefs: that a DAG spreads ordering power across validators, and that a gas-price re-sort neutralizes what is left. We showed both are weaker than assumed and live on the Sui mainnet. First, linearizing the committed graph by validator index hands lower-indexed validators a permanent head start. Second, the gas-price re-sort, being a stable sort, does nothing on the tied fees that dominate real traffic, so the head start reaches execution with no premium paid; and third, a validator can amplify its position with the fully legitimate act of staying silent. None of this breaks consensus: below the Byzantine threshold, Mysticeti’s across-round ordering remains fair, which is why a single change (replacing the index-based tiebreak with an unpredictable per-commit key) removes the structural head start (we measure the same-round bias fall from 89% to the fair line) without touching safety, liveness, or fee priority. Strategic silence, which exploits round position rather than the tiebreak, is causality-bounded and remains the harder open problem. The broader lesson is that in a DAG protocol, the linearization tiebreak is not a harmless implementation detail: it is where fairness is actually decided.

References↩︎