Partial Synchrony and BFT Consensus in Practice (Tendermint)
Longest-Chain Consensus and Proof-of-Work Security
Cryptoeconomics: Rewards, Mining Incentives, and Fee Markets
Proof-of-Stake: Randomness, Committees, and Attacks
Course Description
Blockchain Fundamentals and Consensus Protocols is a free online course in Technology and Programming that builds a rigorous understanding of why blockchains work and when they fail. It starts from core cryptographic tools such as digital signatures and the idea of state machine replication, then connects these foundations to the consensus mechanisms that keep distributed systems consistent under faults and adversarial behavior.
You will progress through the classical theory of Byzantine communication and agreement, learning what different network assumptions enable and why certain goals are impossible in fully asynchronous settings. The course develops key impossibility results and their meaning in practice, then moves to partially synchronous models and modern BFT-style designs, including an in-depth look at the Tendermint approach and the reasoning behind safety and liveness guarantees.
From there, the course explores permissionless consensus through longest-chain protocols, analyzing properties like common prefix, chain quality, finality, and liveness, and how timing assumptions affect them. You will examine proof-of-work systems, including difficulty adjustment and limitations, and then dive into incentive and mechanism-design questions such as block rewards, transaction fees, auction dynamics, and prominent fee-market designs like EIP-1559.
Finally, the course offers a thorough treatment of proof-of-stake: staking mechanics, randomness generation, VRFs and VDFs, Sybil resistance with uneven stakes, BFT-style and longest-chain PoS designs, slashing tradeoffs, long-range attacks, mitigations, and a careful comparison of PoS and PoW. Ideal for learners who want precise definitions, proofs, and a clear bridge from distributed systems theory to real blockchain protocols.
Course content
Video class: Foundations of Blockchains (Lecture 1.1: Focus of Lecture Series ( a Little Hype))09m
Exercise: What is the primary focus of this lecture series?
Video class: Foundations of Blockchains (Lecture 1.2: Overview of Lecture Series)18m
Video class: Foundations of Blockchains (Lecture 1.3: Digital Signature Schemes)18m
Exercise: In a digital signature scheme, which key is used to sign messages and which key is used to verify signatures?
Video class: Foundations of Blockchains (Lecture 1.4: State Machine Replication)17m
Video class: Foundations of Blockchains (Preview of Lectures 2--7: A Bootcamp on Classical Consensus)21m
Exercise: In the partially synchronous model, what honesty threshold is required to achieve strong consensus guarantees (e.g., consistency and eventual liveness)?
Video class: Foundations of Blockchains (Lecture 2.1: Four Assumptions)15m
Video class: Foundations of Blockchains (Lecture 2.2: SMR Reduces to Byzantine Broadcast)32m
Exercise: In the reduction from state machine replication (SMR) to Byzantine broadcast, which Byzantine broadcast property is used to guarantee SMR consistency?
Video class: Foundations of Blockchains (Lecture 2.3: Simple Protocols for Byzantine Broadcast)15m
Video class: Foundations of Blockchains (Lecture 2.4: The Dolev-Strong Protocol)11m
Exercise: In the Dolev-Strong Byzantine broadcast protocol, when does an honest node output the canonical default value (⊥)?
Video class: Foundations of Blockchains (Lecture 2.5: Analysis of the Dolev-Strong Protocol)18m
Video class: Foundations of Blockchains (Lecture 3.1: The PSL-FLM impossibility Result)14m
Exercise: What does the classic impossibility result for Byzantine broadcast state in the synchronous model when the fraction of Byzantine nodes is too high?
Video class: Foundations of Blockchains (Lecture 3.2: Proof of PSL-FLM impossibility)38m
Video class: Foundations of Blockchains (Lecture 3.3: The Importance of PKI and Trusted Setups)12m
Exercise: Why doesn’t a protocol that achieves Byzantine broadcast for any number of faults contradict the impossibility result that requires f ≤ n/3?
Video class: Foundations of Blockchains (Lecture 4.1: Relaxing the Synchronous Assumption)10m
Video class: Foundations of Blockchains (Lecture 4.2: The Asynchronous Model)09m
Video class: Foundations of Blockchains (Lecture 4.3: Byzantine Agreement)05m
Video class: Foundations of Blockchains (Lecture 4.4: The FLP Impossibility Theorem)07m
Exercise: What does the FLP impossibility result say about deterministic Byzantine agreement in the asynchronous model?
Video class: Foundations of Blockchains (Lecture 4.5: Configurations)09m
Video class: Foundations of Blockchains (Lecture 4.6: An Initial Ambiguous Configuration)14m
Exercise: In the proof setup for FLP, why must there exist an index i such that the initial configuration X_i is ambiguous?
Video class: Foundations of Blockchains (Lecture 5.1: Reducing The FLP Impossibility Theorem to Two Lemmas)26m
Video class: Foundations of Blockchains (Lecture 5.2: Completing the Proof of the FLP Impossibility Theorem)25m
Exercise: In the proof strategy for Lemma 2, what does it mean for a configuration to be ambiguous-star with respect to a distinguished message (r, m)?
Video class: Foundations of Blockchains (Lecture 5.3: Interpretation and Broader Context of the FLP Theorem)06m
Video class: Foundations of Blockchains (Lecture 6.1: The Partially Synchronous Model)41m
Exercise: In the partially synchronous model, what is the key Byzantine fault threshold for achieving safety always and liveness after global stabilization time (GST)?
Video class: Foundations of Blockchains (Lecture 6.2: Proof of the 33% Impossibility Result)16m
Video class: Foundations of Blockchains (Lecture 6.3: The CAP Principle)17m
Exercise: According to the CAP theorem, what tradeoff must a distributed system make when it must tolerate a network partition?
Video class: Foundations of Blockchains (Lecture 7.1: Tendermint (High-Level Ideas))18m
Video class: Foundations of Blockchains (Lecture 7.2: The Tendermint Protocol)39m
Exercise: In Tendermint, what is a quorum certificate (QC) for a given block height?
Video class: Foundations of Blockchains (Lecture 7.3: Proof of Consistency)19m
Video class: Foundations of Blockchains (Lecture 7.4: Proof of Liveness)34m
Exercise: In the liveness proof discussed, what weaker assumption is used to ensure a transaction T is eventually added to all honest nodes' local histories?
Video class: Foundations of Blockchains (Lecture 7.5: Can We Do Better?)07m
Video class: Foundations of Blockchains (Interlude: On Definitions, Theorems, and Proofs)34m
Exercise: Why is it recommended to prefer blockchain consensus protocols backed by mathematical proofs?
Video class: Foundations of Blockchains (Lecture 8.1: A Tale of Two Protocol Designs)08m
Video class: Foundations of Blockchains (Lecture 8.2: Longest-Chain Consensus)54m
Exercise: In longest-chain consensus, what does an honest leader do when choosing a predecessor for its new block?
Video class: Foundations of Blockchains (Lecture 8.3: Balanced Leader Sequences)21m
Video class: Foundations of Blockchains (addendum to Lecture 8.3)07m
Exercise: Under what conditions is the common prefix property established in the proof-of-work setting discussed?
Video class: Foundations of Blockchains (Lecture 8.4: Analysis of Random Leader Selection)17m
Video class: Foundations of Blockchains (Lecture 8.5: The Common Prefix Property)27m
Exercise: In longest-chain consensus, what does it mean for a leader sequence to be W-balanced?
Video class: Foundations of Blockchains (Lecture 8.6: Finality)12m
Video class: Foundations of Blockchains (Lecture 8.7: Liveness and Chain Quality)23m
Exercise: In the chain quality result (Theorem 3′) for longest-chain consensus, under an (α+ε)-balanced leader sequence, what lower bound is given on the fraction of finalized blocks that were produced by honest nodes?
Video class: Foundations of Blockchains (Lecture 8.8: Partial Synchrony; Toward Permissionless Consensus)36m
Video class: Foundations of Blockchains (Lecture 9.1: Permissionless Consensus)35m
Exercise: In a permissionless blockchain, what problem do proof of work and proof of stake primarily address?
Video class: Foundations of Blockchains (Lecture 9.2: Proof-of-Work)43m
Video class: Foundations of Blockchains (Lecture 9.3: Properties of Proof-of-Work)52m
Exercise: In proof-of-work leader election, what determines a node’s probability of being selected as the next leader?
Video class: Foundations of Blockchains (Lecture 9.4: Difficulty Adjustment)30m
Video class: Foundations of Blockchains (Lecture 9.5: Extension to the Synchronous Model)43m
Exercise: In the synchronous model of longest-chain proof-of-work consensus, what key parameter relationship helps keep inadvertent honest forks rare and preserves guarantees like common prefix and liveness?
Video class: Foundations of Blockchains (Lecture 9.6: An Impossibility Result for Proof-of-Work Protocols)15m
Video class: Foundations of Blockchains (Lecture 9.7: Cryptocurrencies and a Preview of Lectures 10-13)08m
Exercise: What new technical concern is introduced when a blockchain adds block rewards denominated in a native currency?
Video class: Foundations of Blockchains (Lecture 10.1: Block Rewards)21m
Video class: Foundations of Blockchains (Lecture 10.2: Maximizing Block Rewards)15m
Exercise: In Nakamoto longest-chain consensus with proof-of-work and fixed block rewards, what best explains why a miner with 10% hash rate might earn less than 10% of rewards?
Video class: Foundations of Blockchains (Lecture 10.3: The Case of a 51% Miner)17m
Video class: Foundations of Blockchains (Lecture 10.4: Selfish Mining with Deviator-Controlled Tie-Breaking)36m
Exercise: Under the assumption of worst-case (adversarial) tie-breaking by honest nodes, what fraction of blocks on the longest chain does a deviating node with hash rate α obtain using the described selfish-mining strategy?
Video class: Foundations of Blockchains (Lecture 10.5: Selfish Mining with Honest-Node-Controlled Tie-Breaking)37m
Video class: Foundations of Blockchains (Lecture 10.6: Markov Chain Analysis)1h07m
Video class: Foundations of Blockchains (Lecture 10.7: Discussion)28m
Video class: Foundations of Blockchains (Lecture 11.1: Transaction Fees and Economic Efficiency)13m
Exercise: What is the primary economic reason blockchains charge transaction fees?
Video class: Foundations of Blockchains (Lecture 11.2: First-Price Auctions)09m
Video class: Foundations of Blockchains (Lecture 11.3: Selfish Mining with Transaction Fees)13m
Exercise: Why can very large transaction fees make selfish mining (deliberate forking) profitable even for a miner with small hash power, under best-case tie-breaking?
Video class: Foundations of Blockchains (Lecture 11.4: Issues with First-Price Auctions)08m
Video class: Foundations of Blockchains (Lecture 11.5: EIP-1559)30m
Exercise: In EIP-1559, why are base fee revenues burned (or otherwise redirected away from the current block producer) instead of being paid to the block producer?
Video class: Foundations of Blockchains (Lecture 11.6: Excessively Low Base Fees)14m
Video class: Foundations of Blockchains (Lecture 11.7: Pros and Cons of Burning Fees)17m
Video class: Foundations of Blockchains (Lecture 12.1: Overview of Lecture 12)38m
Video class: Foundations of Blockchains (Lecture 12.2: Review of Permissionless Consensus)17m
Exercise: In a permissionless consensus setting, what key ingredient is needed to adapt permissioned consensus protocols so they still work despite unknown future participants?
Video class: Foundations of Blockchains (Lecture 12.3: The High-Level Idea of Proof-of-Stake)08m
Video class: Foundations of Blockchains (Lecture 12.4: Why Proof-of-Stake?)36m
Exercise: Why do many newer blockchains pair proof of stake with BFT-style consensus rather than longest-chain (Nakamoto) consensus?
Video class: Foundations of Blockchains (Lecture 12.5: Mechanics of Staking)22m
Video class: Foundations of Blockchains (Lecture 12.6: Why Proof-of-Stake Is Hard)10m
Exercise: Why does sampling a validator with probability proportional to its stake provide Sybil resistance in proof of stake?
Video class: Foundations of Blockchains (Lecture 12.7: Weighted Robin-Round)11m
Video class: Foundations of Blockchains (Lecture 12.8: Randomness Beacons)12m
Exercise: How can ideal randomness be converted into stake-proportional leader selection?
Video class: Foundations of Blockchains (Lecture 12.9: Verifiable Random Functions (VRFs))29m
Video class: Foundations of Blockchains (Lecture 12.10: VRFs: Challenges and Mitigations)36m
Exercise: Which VRF property ensures that no one can tell whether a public key was sampled (e.g., as leader) unless the owner reveals it?
Video class: Foundations of Blockchains (Lecture 12.11: Pseudorandomness Beacons)26m
Video class: Foundations of Blockchains (Lecture 12.12: Crowdsourcing a Randomness Beacon)24m
Exercise: In a two-phase commit–reveal randomness protocol, what is the key remaining “last-mover” advantage in phase two?
Video class: Foundations of Blockchains (Lecture 12.13: Verifiable Delay Functions (VDFs))17m
Video class: Foundations of Blockchains (Lecture 12.14: Proof-of-Stake BFT-Type Protocols)29m
Exercise: In a proof-of-stake BFT-style protocol using VRF-based sampling, what is a main reason to sample a voting committee instead of letting all active validators vote?
Video class: Foundations of Blockchains (Lecture 12.15: Issues with PoS BFT-Type Protocols)28m
Video class: Foundations of Blockchains (Lecture 12.16: Sybil-Resistance with Non-Uniform Stakes)32m
Exercise: Why doesn’t simply dividing a VRF credential by a validator’s stake (credential / Qᵢ) correctly implement stake-proportional leader selection?
Video class: Foundations of Blockchains (Lecture 12.17: Proof-of-Stake Longest-Chain Protocols)21m
Video class: Foundations of Blockchains (Lecture 12.18: Issues with PoS Longest-Chain Protocols)42m
Exercise: Why is the difficulty parameter μ set sufficiently small in a VRF-based proof-of-stake longest-chain protocol?
Video class: Foundations of Blockchains (Lecture 12.19: Further Discussion of PoS LC Protocols)38m
Video class: Foundations of Blockchains (Lecture 12.20: Pros and Cons of Slashing)35m
Exercise: Which prerequisite is emphasized as important for slashing to work in a proof-of-stake protocol?
Video class: Foundations of Blockchains (Lecture 12.21: Long-Range Attacks)26m
Video class: Foundations of Blockchains (Lecture 12.22: Mitigations for Long-Range Attacks)26m
Exercise: Why does setting a cooldown period (and requiring nodes to return online within a bounded time) help mitigate certain long-range attacks in proof-of-stake?
Video class: Foundations of Blockchains (Lecture 12.23: Proof-of-Stake vs. Proof-of-Work, Part 1)29m
Video class: Foundations of Blockchains (Lecture 12.24: Proof-of-Stake vs. Proof-of-Work, Part 2)37m
Exercise: Which distinction was given as a reason Nakamoto consensus (proof of work) can be considered slightly more permissionless than typical proof of stake protocols?
