Consequently, increasing the block rate or block size does indeed lead to a linear increase in the effective throughput.

5 CONFIRMATION TIMES As in Nakamoto Consensus, the waiting time for transaction confirmation depends on the assumed attacker size , and on the allowed error . The security analysis given in Appendix A shows that within constant expected time the chain of the honest network enters into a block race with any hypothetical or actual attacker chain. It is implied that the waiting time for the ordering between a given block B and other blocks becomes robust at a rate (cid:17). This analysis was asymptotic, and we leave the of O task of tightening the analysis and improving the constants (hidden in the O) for future work.

(cid:16)log (1/) 1 Still, we observe that in the case of payments, transactions of honest users can be confirmed much faster. Indeed, an honest user will not publish a conflicting transaction, and her transaction will therefore be commutative with all other published transactions. Of course, the payee does not know a priori who of the payers is honest, and will thus wait until the block containing the transaction is guaranteed (w.h.p.) to precede any new block that might be published by the attacker. Blocks that are published in the interim will not contain a conflicting transaction, in the case of an honest payer, and will therefore not delay acceptance.

Yonatan Sompolinsky, Shai Wyborski, and Aviv Zohar Formally, we argue that GHOSTDAG enjoys the following property: Given a published block b, the probability that a newly added block in anticone (b) will be accepted as a blue block decays exponentially: Proposition 6. If blocks b and c were published at times t and t + r , respectively, and c anticone (b), then the probability that c will ever be considered blue is O(eC r ) for some positive constant C.