Owner: @Thomas Lavaur

Reviewers: 🟢@David Rusu 🟢@Mehmet 🟢@Álvaro Castro-Castilla 🟢@Frederico Teixeira

Introduction

In many blockchain designs, leaders receive rewards for producing valid blocks. Traditionally, this reward is linked directly to the block or its producer, potentially opening the door to manipulation or self-censorship, where leaders may avoid including certain transactions or messages out of fear of retaliation or reputational harm. As Nomos must protect its nodes while avoiding self-censorship, we must design a reward mechanism that preserves the anonymity of block leaders while maintaining correctness and preventing double rewards.

This document specifies the mechanism for anonymous reward distribution based on voucher commitments, nullifier, and zero-knowledge (ZK) proofs. The goal is to ensure that block leaders can claim their rewards without linking them to specific blocks and without revealing their identities.

Overview

The protocol introduces a concept of vouchers to unlink the block reward claim from the block itself. Instead of directly crediting themselves in the block, leaders include a commitment (a hash in this protocol) to a secret voucher. These commitments are gathered into a Merkle tree, accumulating the vouchers together in a set. Leaders may anonymously claim their reward using a ZK proof later, proving the ownership of their voucher. This is summarized in the following diagram:

graph LR
    A[Leader block] --> B[reward voucher]
    B --> C[Merkle tree]
    C --> D[Claim with ZK proof]
    D --> E[Reward]

By anonymizing the identity of block leaders at the time of reward claiming, the protocol removes any direct link between block production and the recipient of the reward. This is essential to prevent self-censorship behaviors. With anonymous claiming, leaders are free to act honestly according to protocol rules without concern for external consequences, thus improving the overall neutrality and robustness of the network.

Key properties of the protocol:

• Anonymity: Block rewards are unlinkable to the blocks they originate from (avoiding deanonymization).
• Soundness: No reward can be claimed twice.

Protocol

Voucher creation and inclusion

When producing a block, a leader performs the following:

1. Generate a one-time random secret $voucher \overset{{\scriptscriptstyle\$}}{\leftarrow} \{0,1\}^{128}$.
2. Compute the commitment: $voucher\_cm := Hash(\text{LEAD\_VOUCHER\_CM\_V1}||voucher)$.
3. Include the voucher_cm in the block header.

Each voucher_cm is added to a Merkle tree of voucher commitments by validators, maintained throughout the entire blockchain history by everyone.

Claiming the reward