The Decentralisation Threshold: When More Validators Reduce Net Security
On Wednesday 8 July I present paper #1571269089, “The Decentralisation Threshold: When More Validators Reduce Net Security,” at IEEE SmartNets 2026.
On Wednesday 8 July I present paper #1571269089, “The Decentralisation Threshold: When More Validators Reduce Net Security,” at IEEE SmartNets 2026. What follows is the argument in full prose, for readers who prefer their theorems with the scaffolding visible.
The most expensive superstition in distributed systems
Every industry has its pieties, and the blockchain industry has elevated one above all others: more decentralisation is more security. It is recited at conferences, embedded in whitepapers, and wielded as a cudgel in governance disputes. It has the great advantage of all superstitions—it requires no arithmetic—and the great disadvantage of most: it is false. Not false at the margin, not false in exotic corner cases, but false as a structural matter, provably, for any consensus system that pays for its own coordination out of a finite budget.
The paper I am presenting proves a simple and, once seen, obvious result. Net security in a distributed consensus system is not monotone in the number of validators. There exists a unique interior optimum n. Below it, each additional validator adds security. Above it, each additional validator subtracts* security—not merely fails to add it, but actively degrades it, because the resources it consumes would have bought more protection spent elsewhere. For a representative parametrisation, that optimum sits at eighty-five validators. Not five hundred thousand. Eighty-five.
The literature has treated the tension as a monotone trade-off: validators are good, coordination is costly, pick your poison along a smooth frontier. The contribution here is to show that the frontier bends back on itself. There is a peak, the peak is unique, and it is computable from three quantities a system designer can actually estimate. The result is economic rather than protocol-specific. It applies to any system in which (i) consensus resilience improves with the number of independent participants, and (ii) the cost of running the consensus mechanism grows faster than linearly in that number. Blockchain validator committees, committee-based governance, multi-party computation, sensor-network consensus—the theorem is indifferent to the application. It cares only about the shape of two curves.
One budget, two sinks
The mechanism is a budget identity, and the honest way to present it is as bookkeeping rather than metaphysics. A consensus system has a fixed security budget Bsec. That budget is split between two sinks:
Bsec = Bcoord(n) + Bhard(n).
The first sink is coordination: the cost of actually operating the consensus protocol among n validators. For PBFT-class protocols this scales quadratically, Bcoord(n) = cn2, because message complexity is O(n2) per round [2]. The second sink is whatever is left over for per-node hardening: patching, monitoring, key management, the unglamorous work that determines whether an individual validator can actually be compromised. The per-node hardening budget is therefore (Bsec − cn2)/n, and this quantity does something the more-is-better crowd never pauses to compute: it collapses.
Take Bsec = 100 units and c = 0.005. At fifty validators, coordination eats 12.5 units and each node enjoys 1.75 units of hardening. At one hundred validators, coordination eats half the budget and each node gets 0.50. At one hundred and forty-one validators, each node gets 0.004—effectively nothing. At one hundred and forty-two, coordination cost alone exceeds the entire budget. The system now has a magnificent number of validators and no capacity to defend any of them. It has purchased the appearance of decentralisation at the price of its substance, which is the sort of bargain usually reserved for politics.
Budget allocation: coordination cost grows quadratically while the hardening residual and per-node hardening budget collapse, reaching zero at n_max = 141.
Figure 1. The budget mechanism (Bsec = 100, c = 0.005). (a) Coordination cost grows quadratically and consumes an increasing share of a fixed budget; the residual for hardening shrinks correspondingly. (b) Per-node hardening collapses hyperbolically: 1.75 units at n = 50, 0.50 at n = 100, effectively zero at nmax = √(Bsec/c) = 141. Beyond that point the system has many validators and no per-node defence.
Hardening buys down the per-node compromise probability: a node with budget b is compromised with probability p(b) = p0e−ηb. As n grows and the per-node budget approaches zero, p approaches p0: the nodes are essentially unhardened. This is the drain side of the ledger, and in the baseline model it is captured as R(n) = cn2 + an, where the linear term is attack surface—every node adds endpoints, keys, and code paths. The function is strictly convex and strictly increasing, and it is derived from the budget identity, not assumed for algebraic convenience. That derivation matters, because a convexity assumption pulled from the air would deserve exactly the scepticism it usually receives.
The gain side: what the binomial tail actually does
Against the drain stands the gain. An attacker succeeds by controlling at least ⌈fdn⌉ of the n nodes, where fd is the decisive fraction—one third for standard Byzantine fault tolerance [1]. Under independent per-node compromise with probability p < fd, the attack-success probability π(n) is a binomial tail, and the security gain is G(n) = Gmax(1 − π(n)).
Here the paper does something the tidy version of this argument never bothers with: it looks at the exact tail rather than its smooth caricature. The exact binomial tail converges to zero by the law of large numbers, but it does not decrease monotonically. It oscillates. The threshold ⌈fdn⌉ is a staircase: when n increases but the threshold stays put, the attacker gets an extra lottery ticket at no extra price and π rises; when the threshold steps up, π drops. For fd = 1/3 the sawtooth has exact period three. The paper proves both directions of the oscillation with a one-step coupling argument—Bin(n+1, p) is Bin(n, p) plus an independent Bernoulli—and the strict inequalities fall out in two lines each.
Why insist on this pedantry? Because the smooth envelope is where the theorem lives, and one should know precisely what one is smoothing. The Chernoff bound gives π(n) ≤ e−κn with κ = DKL(fd‖p), the Kullback–Leibler divergence between the decisive fraction and the compromise probability. The surrogate gain built on that envelope is strictly increasing and strictly concave. The exact gain wiggles around it with small amplitude. The net security maximiser exists regardless, because the gain is bounded above by Gmax while the drain grows without bound—boundedness plus divergence guarantees a maximum on the integers, sawtooth or no sawtooth.
The theorem
With both curves in hand, the main result is almost embarrassingly classical. Let G be increasing and strictly concave, let R be increasing and strictly convex, let the marginal gain exceed the marginal drain at n = 1, and let the marginals cross as n → ∞. Then S(n) = G(n) − R(n) is strictly concave and has a unique interior maximum n* characterised by the first-order condition
G′(n) = R′(n**).
Below n, the marginal validator buys more resilience than it costs. Above n*, it costs more than it buys. The proof is the intermediate value theorem plus strict concavity of the difference—elementary machinery, deliberately so. The force of the result is not in the mathematics but in the conclusion it licenses: not the mushy claim that “decentralisation has diminishing returns,” but the sharp one that there is a specific number beyond which decentralisation is actively harmful*. Diminishing returns would still counsel “more, just less eagerly.” A unique interior maximum counsels “stop here, and if you are past it, retreat.”
Net security S(n) computed from the exact binomial tail rises steeply, peaks at n* = 85 with S = 99.48, and then declines as the quadratic drain dominates.
Figure 2. The decentralisation threshold at the baseline parametrisation (Gmax = 100, r = 5×10−5, p = 0.20, fd = 1/3), computed from the exact binomial tail. The gain saturates, the drain grows quadratically, and net security peaks at n = 85 with S = 99.48 before declining. By n* = 500, net security has fallen to 87.5—a twelve per cent sacrifice purchased entirely by enthusiasm.
A closed form, and the honesty tax it pays
The Chernoff-smoothed problem admits a closed form, and it involves everyone’s favourite special function. Setting the marginal gain of Gmax(1 − e−κn) against the marginal drain of rn2 and substituting u = κn yields ueu = κ2Gmax/(2r*), hence
ñ = (1/κ) · W(κ2Gmax/(2r*)),
where W is the Lambert W function. Two remarks, both of which the paper states out loud rather than burying. First, the argument of W carries κ2, not κ—the extra factor arises from the substitution and passes through W intact, and getting this wrong is a common algebra error in closed forms of this type. Second, and more importantly: the closed form optimises an upper envelope on the attack probability, not the attack probability itself. The Chernoff bound overestimates the exact tail by a factor of five to ten in the relevant range, and the closed-form optimum consequently overestimates the exact optimum by roughly forty per cent at the baseline parameters—123 against 85. The paper tabulates this error across a full parameter grid, where it ranges from 31% to 75%.
Most papers in this genre would present the closed form as the result and let the reader discover the gap the hard way. The correct posture is the reverse: the closed form is for structural insight—the asymptotics show the optimum grows only logarithmically in Gmax/r, which is why committee sizes cluster in a narrow band across wildly different systems—and the exact binomial enumeration, a trivial computation over n ∈ {1, …, 1000}, is for actual design decisions. An approximation acknowledged is a tool; an approximation concealed is a fraud with better typography.
What the numbers say
The baseline parametrisation takes Gmax = 100, r = 5×10−5, p = 0.20, fd = 1/3, giving κ = DKL(1/3‖0.2) = 0.0487. Exact enumeration puts the optimum at n = 85, where the attack probability is 1.6×10−3 and net security is 99.48 out of a possible 100. Push on to two hundred validators and the attack probability improves to a decorative 10−7—while the drain quintuples and net security falls* to 98.0. At five hundred validators, net security is 87.5. The marginal validator past the optimum is not a hedge; it is a leak.
The sensitivity analysis across the (r, p) grid produces optima from 19 (strong nodes, expensive coordination) to 223 (weak nodes, cheap coordination)—always finite. Two patterns deserve attention. First, the compromise probability p dominates: moving from p = 0.10 to p = 0.25 roughly quintuples the optimal committee size for any fixed r, while a tenfold change in coordination cost only halves it. When individual nodes are strong (p = 0.10), the binomial tail collapses so fast that at most 37 validators suffice regardless of how cheap coordination becomes. The design implication is blunt: hardening individual nodes is more effective than adding more of them. Money spent making each validator harder to compromise buys down the required committee size faster than money spent making coordination cheaper buys up the affordable one. Second, the comparative statics behave exactly as the closed form predicts where it can be proved analytically—costlier coordination shifts the optimum down, higher security value shifts it up—and numerically for the two parameters whose composite effects resist clean signs.
The deployed world already obeys the theorem
Here the paper is careful to claim illustration rather than calibration, and the distinction is worth respecting. Mapping the model’s r and p to a specific protocol requires protocol-specific work the paper does not do. But the qualitative pattern is difficult to miss. Ethereum’s beacon chain has over half a million nominal validators—and organises attestation into per-slot committees of 128. Cosmos Hub caps its active set at 180. Aptos runs approximately 130. Algorand does not even attempt a fixed large committee; it samples one cryptographically per round [10]. The systems that survive at large nominal scale all deploy the same family of mitigations—committee subsampling, signature aggregation, checkpointed finality—and the model explains why those mechanisms are load-bearing rather than ornamental: they reduce the effective n in the drain function while preserving the nominal count for stake distribution. A system that scaled its live consensus committee with its validator headcount would march straight past the optimum into the region where Figure 2 slopes down. The engineering folklore got there before the theorem did; the theorem explains the folklore.
Objections, met in the paper rather than deferred
A model this spare invites three immediate objections, and each receives a labelled extension rather than a wave of the hand.
“Your validators are homogeneous.” The baseline assumes identical compromise probabilities. The extension replaces the single p with a vector {pi}, making the compromised count a Poisson-binomial variable. A Jensen’s-inequality argument shows the Chernoff envelope survives with the mean compromise probability standing in for p, so existence and uniqueness of the smoothed optimum are preserved. Numerically, drawing 300 compromise probabilities from a Beta distribution with mean 0.20 and standard deviation 0.05 moves the exact optimum from 85 to 82—three validators, in the direction the envelope predicts. The claim is conditional and stated as such: moderate heterogeneity around a mean below the threshold changes nothing of substance; severe heterogeneity, where some nodes approach the threshold or where weakness correlates with jurisdiction or operator type, is explicitly outside the proposition’s reach.
“Compromises are correlated in the real world.” They are, and the direction of the effect is the opposite of what decentralisation maximalists might hope. Under exchangeable compromises with pairwise correlation ρ, the tail decays more slowly, the gain rises more slowly, the drain is untouched—and the optimum moves down. In the limit ρ → 1, where all nodes share a single point of failure, additional validators buy nothing at all and the optimum collapses to n = 1. Correlation does not rescue large committees; it indicts them. The practical corollary: when infrastructure correlation is high, mandating validator diversity beats mandating validator count*.
“Your p should depend on n through the budget.” Indeed it should, and the endogenous extension is where the result acquires teeth. Feed the budget model back into the compromise probability, so that p(n) rises as per-node hardening is diluted, and there is an integer ceiling ncrit—the smallest n at which p(n) reaches the BFT threshold fd. Past that ceiling, an anti-concentration lemma pins the attack probability at no less than one third, and a short comparison argument shows the global optimum must lie strictly below ncrit. In the worked example, budget dilution drags the optimum from 100 down below 11—an order of magnitude. The fixed-p baseline is thus the optimistic case for decentralisation: every relaxation toward realism pushes the optimum toward fewer validators, not more. A critic who attacks the baseline’s simplicity is attacking the assumption most favourable to the position the paper undermines, which is a curious hill to defend.
What the model does not claim
Candour about scope is cheaper than retraction. The result is an economic optimisation, not a cryptographic safety proof: it characterises the probability that an attacker controls fewer than the decisive fraction of nodes under a stochastic compromise model, and whether such control actually breaks safety or liveness depends on execution-model details—synchrony assumptions, view-change logic—outside the paper’s scope. The attacker is not strategic; its budget is exogenous, and a full Stackelberg treatment producing an equilibrium (n, k*) is posed as Open Problem 1. The model is single-period, offered as the per-period benchmark of any dynamic model whose periods preserve the budget split; adaptive adversaries, validator churn, and reputation effects each shift the optimum’s location without disturbing its existence. And the quadratic drain is a transparency device, not a hostage: the theorem requires only some* strictly convex component in system-level cost, and even linear-messaging protocols such as HotStuff [7] retain superlinear terms in audit, view-change, and key distribution. If the drain were genuinely linear everywhere, the interior optimum could degenerate to a boundary—the paper says so, in print, because a limitation stated is a limitation controlled.
How a designer actually uses this
The paper closes the loop with a five-step procedure that requires nothing exotic. Estimate the coordination cost coefficient from protocol benchmarks. Estimate the per-node compromise probability from threat modelling—software vulnerabilities, key theft, social engineering, regulatory coercion. Estimate the security ceiling from risk assessment. Enumerate the exact binomial net security over a thousand integers, a computation that completes before the coffee cools. Read off n*. Use the Lambert W closed form for intuition and comparative statics; use the enumeration for the decision; never confuse the two, because the closed form will overshoot by a third to three quarters depending on where you sit in parameter space.
The point
None of this is an argument against decentralisation. It is an argument against treating decentralisation as a virtue that compounds without limit—against the substitution of a slogan for a first-order condition. The correct number of validators is the number at which the marginal security gain of one more equals the marginal security drain of one more. That number exists, it is unique, it is finite, and for representative parameters it is about eighty-five. Systems operating above their optimum are not more secure; they are less secure and more expensive simultaneously, which is a combination only ideology could market as progress. The burden of proof now sits where it belongs: anyone claiming that a system needs more validators must show it is operating below n*. Arithmetic is available. I recommend it.
Complete proofs, the Lambert W derivation, the binomial anti-concentration lemma, and reproducibility code for every figure and table are in the standalone supplementary appendix on Zenodo (doi:10.5281/zenodo.20078799). I present the paper at IEEE SmartNets 2026 on Wednesday 8 July.
References
-
L. Lamport, R. Shostak, and M. Pease, “The Byzantine Generals Problem,” ACM Transactions on Programming Languages and Systems, vol. 4, no. 3, pp. 382–401, 1982.
-
M. Castro and B. Liskov, “Practical Byzantine fault tolerance,” in Proc. OSDI, 1999, pp. 173–186.
-
M. Yin, D. Malkhi, M. K. Reiter, G. Golan Gueta, and I. Abraham, “HotStuff: BFT consensus with linearity and responsiveness,” in Proc. PODC, 2019, pp. 347–356.
-
Y. Gilad, R. Hemo, S. Micali, G. Vlachos, and N. Zeldovich, “Algorand: Scaling Byzantine agreements for cryptocurrencies,” in Proc. SOSP, 2017.
-
I. Eyal and E. G. Sirer, “Majority is not enough: Bitcoin mining is vulnerable,” in Proc. Financial Cryptography, 2014.
-
E. Budish, “Trust at scale: The economic limits of cryptocurrencies and blockchains,” Quarterly Journal of Economics, vol. 140, no. 1, pp. 1–62, 2025.
-
J. Abadi and M. Brunnermeier, “Blockchain economics,” Review of Financial Studies, vol. 35, no. 3, 2022.
-
T. Roughgarden, “Transaction fee mechanism design,” in Proc. ACM EC, 2021.
-
L. Kiffer, J. Neu, S. Sridhar, A. Zohar, and D. Tse, “Nakamoto consensus under bounded processing capacity,” in Proc. ACM CCS, 2024, pp. 363–377.
-
S. Mssassi and A. Abou El Kalam, “The blockchain trilemma: A formal proof of the inherent trade-offs among decentralization, security, and scalability,” Applied Sciences, vol. 15, no. 1, art. 19, 2025.
-
C. S. Wright, “A formal refutation of the blockchain trilemma,” arXiv:2507.05809 [cs.CC], 2025.
-
C. S. Wright, “A formal rebuttal of ‘The Blockchain Trilemma: A Formal Proof of the Inherent Trade-Offs Among Decentralization, Security, and Scalability’,” arXiv:2507.21111 [cs.CR], 2025.
-
C. S. Wright, “The decentralisation threshold: When more validators reduce net security,” in Proc. IEEE SmartNets, 2026, paper #1571269089. Supplementary appendix: Zenodo, doi:10.5281/zenodo.20078799.