LibraryConsensus2018Design paperCorpus record
PHANTOM and GHOSTDAG
PHANTOM. Yonatan Sompolinsky, Shai Wyborski and Aviv Zohar.
A blockDAG protocol that still ends in one linear order. Honest blocks cluster. The parameter k is how wide that cluster may be. Kaspa is a later network in this line, not the paper.
PHANTOM keeps a blockDAG for throughput and then forces one linear order by colouring a well-connected cluster of blocks as honest. The parameter k is the network-delay assumption, written as a number.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 5
Code
Source, repository, and what is actually hosted
- ePrint 2018/104https://eprint.iacr.org/2018/104
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
Why SPECTRE was not enough
Pairwise votes can leave two blocks unordered. Balances and contracts need one sequence. PHANTOM's job is the sequence.
Claim 02 · Paper model
Honest blocks cluster
If propagation is fast relative to the block rate, honest blocks see each other. Their anticone stays small. An attacker publishing in private has a large anticone against the honest set.
Claim 03 · Paper model
k is the whole security knob
k is the largest anticone the protocol will still call honest. It must cover normal delay and must not cover a patient attacker. There is no universal k.
Claim 04 · Paper model
Kaspa is later
The paper defines GHOSTDAG, the greedy colouring. A live network chooses k, a block rate, and a monetary policy. Those choices are not theorems.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 Why SPECTRE was not enough
Observation
What the study says
Pairwise votes can leave two blocks unordered. Balances and contracts need one sequence. PHANTOM's job is the sequence.
Falsifier
What would retire it
What is k, and what delay and block rate justify it?
02 Honest blocks cluster
Observation
What the study says
If propagation is fast relative to the block rate, honest blocks see each other. Their anticone stays small. An attacker publishing in private has a large anticone against the honest set.
Model
What has to hold
The maximum honest anticone really is bounded by k at the chosen block rate.
Falsifier
What would retire it
What happens to a block outside the cluster?
03 k is the whole security knob
Observation
What the study says
k is the largest anticone the protocol will still call honest. It must cover normal delay and must not cover a patient attacker. There is no universal k.
Model
What has to hold
The maximum honest anticone really is bounded by k at the chosen block rate.
Falsifier
What would retire it
What is k, and what delay and block rate justify it?
04 Kaspa is later
Observation
What the study says
The paper defines GHOSTDAG, the greedy colouring. A live network chooses k, a block rate, and a monetary policy. Those choices are not theorems.
Model
What has to hold
Users wait until the colouring of their block is stable, not until the block merely exists.
Falsifier
What would retire it
Is the live system still GHOSTDAG or a later commit rule?
03 Sequence
One action, as an operating tape
- 01A miner publishes a block that points at every tip it knows.
- 02Nodes colour the DAG, searching for a k-cluster: a set whose internal anticones are at most k.
- 03The largest such cluster is treated as the honest backbone.
- 04A topological order of that cluster, then of the rest, is the ledger order.
- 05Confirmation is a claim that a block's place in that order is stable.
04 Load-bearing
The argument, and where a pitch drops it
The DAG is not the ledger
The cut
Throughput comes from accepting many blocks. Safety for applications comes from the order imposed afterward. A product that exposes the DAG and never states the order has stopped halfway through the paper.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
The paper does not describe Kaspa's current parameters, clients, or monetary policy.
Wrong k fails in a specific direction
The cut
Too small, and ordinary latency paints honest blocks as attackers, so the chain stalls or forks itself. Too large, and a withheld attacker sits inside the cluster and gets ordered with everyone else.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A later client, parameter or reward formula is a different object from this paragraph.
05 Register
What has to be true
Cryptography · Not re-measured
Most hash power is honest and publishes promptly.
Adversary · Not re-measured
The maximum honest anticone really is bounded by k at the chosen block rate.
Network · Not re-measured
Nodes see the same DAG eventually. A partitioned miner colours a different graph.
Model · Not re-measured
Users wait until the colouring of their block is stable, not until the block merely exists.
06 Divergence
What happened after the paper
Kaspa is the public network associated with this line of research. Its parameters and clients moved after the paper. GHOST and SPECTRE remain different algorithms. Cite the 2018 paper for the colouring, and cite a live client only for what that client does.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
SPECTRE can confirm fast and still leave some pairs of blocks without a total order. Contracts and account balances want one order. PHANTOM tries to keep the DAG's throughput and still linearise it.
What the design proposes
- Blocks point at every block the miner has seen, not only one parent.
- A colouring separates a well-connected honest cluster from an attacker's anticone.
- The linear order is a topological sort of that cluster, then the rest.
How the mechanism is specified
- k is the largest honest anticone the designer will tolerate. It encodes the assumed network delay.
- Set k too small and honest blocks look like an attack. Set it too large and an attacker fits inside the cluster.
- Confirmation is a statement about that colouring, not about a single chain length.
What this page does not treat as proven
Why the desk still reads it
Ask which object is ordered: a chain, a pairwise vote, or a coloured DAG. Then ask what k assumes about how fast blocks actually travel.
09 Lexicon
Terms, opened into the record
- Anticone
- Blocks that neither precede nor follow a given block. They are the ones it did not see and that did not see it.
- k-cluster
- A set of blocks whose anticones inside the set are no larger than k.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.