Introduction

This document provides a comprehensive adversarial analysis of the Logos Blockchain DA layer. The Logos Blockchain DA layer ensures that blob data submitted to the network is distributed, verifiable, and accessible by all participants. The protocol operates through three key stages, each of which presents a distinct surface for adversarial exploitation:

Encoding. An encoder divides the blob into chunks and expands the data using Reed–Solomon (RS) coding with expansion factor $e$ to produce $N = eK$ columns. Each column is paired with a cryptographic commitment and proof that allow any recipient to verify the data’s integrity without downloading the entire blob. The RS expansion factor $e$ determines the reconstruction threshold $K = N/e$: the data is recoverable from any $K+1$ columns. An adversary cannot forge valid proofs (the commitment scheme is computationally binding), but the expansion factor and reconstruction threshold define the redundancy budget that the adversary can exploit.
Dispersal and replication. Each of the $N$ encoded columns is assigned to a dedicated subnetwork of $R$ DA nodes. An encoder sends each column to one node per subnetwork; that node validates and replicates the column to all peers within the subnetwork via a fully connected overlay. The subnetwork structure — $N$ subnetworks, each of size $R$, drawn from a total pool of $n$ DA nodes — determines the adversarial occupancy distribution. An adversary controlling $k$ out of $n$ nodes (fraction $p_d = k/n$) will have a random number of nodes in each subnetwork. The dispersal stage is where the adversary’s node placement is realised, and where selective dispersal (sending data only to chosen subnetworks) becomes possible.
Sampling. A validator (or light node) samples $S$ subnetworks uniformly at random from $N$ and queries up to $t\le R$ nodes per subnetwork, stopping at the first valid response. The validator views the blob as recoverable if at least $\tau$ out of $S$ subnetworks return valid responses. This decision rule — parametrised by $(S, \tau, t)$ — is the target of both attacks analysed below.

An adversary who controls a fraction of DA nodes can exploit the statistical nature of the sampling protocol in two complementary directions:

Attack A — Available → Unavailable (Type II exploitation). The data is genuinely available, but the adversary causes targeted validators to conclude it is unavailable. This exploits Type II error. The adversary benefits by causing honest leaders to waste slots, disrupting liveness, or by creating asymmetric chain views across validators. The attack surface is determined by the encoding redundancy (which ensures global availability despite partial adversarial control) and the sampling decision rule (which can be fooled by silencing enough subnetworks).

Attack B — Unavailable → Available (Type I exploitation). The data is genuinely unavailable or has been withheld by the adversary after dispersal, but the adversary causes targeted validators to conclude it is available. This exploits Type I error. The adversary benefits by inserting unrecoverable data into the chain. The attack surface is determined by the dispersal stage (which subnetworks the adversary can populate with data) and the sampling decision rule (which can be fooled by enough false positives).

Both attacks are governed by the same underlying combinatorial structure: how many subnetworks the adversary can influence, and how the sampling decision rule responds to that influence. The analysis below derives general formulas in terms of all protocol parameters without fixing any specific numerical values.

Assumption: No-False-Proof Adversary

Throughout this document the adversary is assumed to never send false proofs. This assumption is grounded in the cryptographic properties of the protocol: the polynomial commitment scheme used for column proofs is computationally binding — an adversary cannot produce a valid proof for data it does not hold. Adversarial nodes therefore always respond with cryptographically valid proofs when they hold the data, and stay silent when they do not. The attack strategy — respond or stay silent — is chosen by the adversary depending on the target validator and the attack goal.

The two attacks have distinct subnet-level failure mechanisms, governed by two independent probabilities:

$p_\text{dis}$ (adversarial dissemination probability) — the probability that a given adversarial node holds a chunk for the targeted blob. This is determined entirely by the encoder’s dispersal strategy, independent of sampling. Note that subnetwork assignment is random and cannot be controlled by the adversary — only the decision of which subnetworks to send chunks to is adversarial.
$p_\text{samp}(a, R, t)$ (adversarial sampling probability) — the probability that the validator’s $t$ queries within a subnetwork hit at least one adversarial node. This is determined entirely by the sampling mechanism (adversarial occupancy $a$ the number of adversarial nodes in the subnetwork, subnetwork size $R$, query count $t$), independent of dispersal.

The two attacks are special cases:

Attack A ($p_\text{dis} = 0$): a subnetwork causes a false failure when all $t$ queried nodes are adversarial and stay silent. The per-subnetwork false-failure probability is $P_\text{fail}(a, R, t) = \binom{a}{t}/\binom{R}{t}$.
Attack B ($p_\text{dis} = 1$): a subnetwork produces a false positive when at least one of the $t$ queried nodes is adversarial and holds the data. The per-subnetwork success probability is $p_\text{samp}(a, R, t) = 1 - \binom{R-a}{t}/\binom{R}{t}$.

Note that $p_\text{dis}$ and $p_\text{samp}$ are useful conceptual labels but do not combine into a single unified probability expression — the two attacks are governed by complementary events (all adversarial vs at least one adversarial) and must be analysed separately.