🤖 AI Summary
This work addresses the vulnerabilities in blockchain-based registration systems arising from reliance on a single privileged operator, which enables indistinguishable user behavior and tree pollution attacks—including spurious root registrations, malicious subtree mounts, and identity spoofing. To mitigate these issues, the paper proposes a two-layer cryptographic commitment scheme that binds tree roots to registration identifiers via client-side keys, rendering false attribution a strictly dominated strategy in game-theoretic terms. The study innovatively integrates Nash equilibrium analysis into provenance systems, formally demonstrating that honest behavior constitutes the unique equilibrium. It further establishes that integrity of the provenance tree is guaranteed only through the synergistic interplay of cryptographic prioritization, governance cascades, and contract execution. Built upon standard cryptographic assumptions, the system implements an AnchorRegistry on Ethereum L2 (Base) with O(1) gas cost, enabling trustless reconstruction of the registry from event logs, and its correctness and pollution resistance are formally verified.
📝 Abstract
We present a formal treatment of provenance trees, directed acyclic graphs of artifact registrations anchored immutably on a public blockchain, and introduce the operator trust problem: when a single privileged operator submits all on-chain registrations on behalf of users, the on-chain record alone cannot distinguish user-initiated registrations from unilateral operator actions. We resolve this through a dual-layer cryptographic commitment scheme in which two commitments derived from a single client-side secret key, binding the key to the tree root and to each unique registration identifier, make false attribution claims strictly dominated strategies. We prove correctness under standard cryptographic assumptions and establish honest behavior as the unique Nash equilibrium without relying on operator trust. We further introduce and analyze the tree poisoning problem: adversarial attacks on users' provenance trees via fraudulent root registration, malicious child attachment, and tree identity spoofing. We characterize the closure properties of each attack variant and prove that a complete provenance tree integrity model requires three distinct mechanisms: cryptographic priority, governance cascade, and contract enforcement, each necessary and none individually sufficient. The construction is deployed on Base (Ethereum L2) as AnchorRegistry, an immutable on-chain provenance registry. We provide gas complexity analysis demonstrating O(1) cost invariant to registry scale, and a trustless reconstruction algorithm recovering the complete registry from public event logs alone.