In a networked world, decision making is dominated by peer-to-peer recommender systems. How many times have you gone to online recommender systems to find good restaurants in a new neighborhood, good doctors, good accommodation, good products to buy? And how many times have you seen a review stating: “Don’t trust the reviews on this site.”?

Why would there be doubt on the trustworthiness of such services and how can we clear this doubt out. Let’s answer these questions one by one.

– Why? Existing recommender systems are controlled by a single entity (company) which makes profit (1) from the vendors whose services are ranked, (2) from the users via advertising.

– How? Fueled by the blockchain movement, society has come to understand that rather than trusting a corporation to act on the user’s interest, they can actually “take over” trust and offer the service in a decentralized manner, so that no single entity needs to be trusted for the system to work on the user’s interest.

→ Why are we creating Möbby?

Möbby is a blockchain that bares the promise to revolutionize the way we take decisions online, by holding and improving transparent recommender systems that are not controlled by any single entity.

Why a new blockchain? Does the world need another blockchain for achieving that? Can’t we just import such services on existing ones? As straightforward as this might look, the answer is: No!

A blockchain which supports such recommender systems, would need to be tailored to useability so a generic smart contract is by far a sub-optimal solution. So designing a new system which from the blueprints aims to accommodate such recommendations is anyway a good idea. But this is not the main motivation: Most importantly, the above does not address one of the most basic plagues of all existing recommender systems: Why should a vendor care about maintaining a high reputation? There is always a solution to start from scratch (with a new name) and have people close to you give you a high ranking. Is there a way to avoid such “malicious resets”. Möbby will make that possible.

In a nutshell, our design goals are two-fold: (1) Build a simple, scalable decentralized reputation-based ledger with optimized finality, communication, and computation, and with a formal proof that relates the security of the protocol to the quality of the reputation system; importantly, our PoR-blockchain aims to satisfy a new intuitive notion of participation fairness that promotes inclusivity. (2) To address the subjectivity of reputation as a resource, by backing our blockchain’s safety and liveness with a fallback and underwriting mechanisms that ensure that even if the reputation estimate is severely flawed, our protocol does not create long forks.

→ Please explain me Möbby in a few sentences.

At its heart, Möbby includes a layer-1 blockchain protocol and an associated token which relies on a novel concept termed: “Proof of Reputation” (PoR). The system utilizes the reputation (assigned to its servers via a novel recommender system) by its users to iteratively select committees of reputable nodes that propose and vote on the next block in a hash-based blockchain—in each round, one such committee is chosen and proposes one block which might include multiple transactions and reviews. By a methodology, which combines PoR with a light-weight Proof-of-Stake (PoS) mechanism, the system ensures that (1) the recommendation of the committees can be trusted, and (2) even nodes with low reputation (that are trying to build it up) get their fair chance. But how does this address the issues discussed above? This is achieved by a sophisticated reward mechanism which shares block rewards to the voters of every block according to their reputation and service quality. This means that nodes/servers are incentivized to behave and users are incentivized to increase their ranking so that they maximize the profit.

On a more technical tone, Möbby is a hybrid blockchain-ledger design which is primarily based on reputation but uses a Nakamoto ledger as fallback. We use the term Nakamoto ledger similar to [17] to refer to blockchain-based ledger protocols that follow the eventual consensus paradigm (e.g., Bitcoin, Ouroboros, etc) and realize a ledger as described in [18, 16]. For the purpose of exposition, in this paper, we focus on the fallback ledger being proof-of-stake-based and tune our analysis accordingly—we refer to this paradigm as PoR/PoS-hybrid. This is also the choice made by the Möbby engineering team. However, the blueprint of our treatment can be extended to other types of fallback blockchains (even those that do not follow the Nakamoto paradigm) under their respective assumptions. In the following we provide an overview of our design and discuss its properties in comparison to existing approaches.

→ Why call it Möbby?

The name is inspired by the Möbius strip, a mathematical object often used to symbolize self-correcting processes. The Möbius strip, known for having only one surface and one edge, represents continuous cycles and transformations. This reflects the design of the Möbby blockchain, where reputation serves as the cornerstone: a robust reputation system enables a faster and more scalable blockchain. As the system evolves, it is designed to incentivize users to improve the underlying reputation system, which in turn enhances the blockchain itself. This creates a self-correcting pattern, similar to the infinite loop of the Möbius strip, where each improvement feeds into the next, driving further efficiency and scalability.

1.1 What Makes Möbby Appealing?

Reputation has in recent years become a topic of great interest in blockchain literature, being used as a detection mechanism and defence against malicious nodes. Nevertheless, previous works focused only on security arguments against specific attacks, proof-of-concept experiments, or economic arguments. Möbby stands out as the first provably secure reputation-based consensus blockchain. That is, given our core assumptions hold, our protocol is proven to satisfy the properties of security, blockchain liveness, and transaction liveness—even against attacks that have not been discovered yet.

Below, we pinpoint what makes Möbby an appealing blockchain. We also direct the interested reader to Section 1.2 for an overview of related academic results, and to the tokenomics analysis at the end of this paper for concrete use-cases and applications.

Reputation as a Resource: Reputation, the underlying assumption of the Möbby blockchain, can be a highly prized and useful resource. Unlike Proof-of-Work or Proof-of-Stake blockchains where the resource used (specialized mining hardware or stake) has value only within the blockchain system itself, being a high-reputation Möbby user is evidence of trustworthiness even outside of our system. Möbby can also become a platform for reputation-based applications, such as decentralized recommender systems, or rating systems for crowdfunded projects. For a first look at some of the myriad of applications that can be built on the Möbby blockchain, see also Section 1.4.

Resilience to Reputation System Failure: Möbby takes advantage of our reputation system, which, provided its accuracy, improves several properties of existing constructions. In Section 6 we will discuss how to incentivize parties to improve their reputation through honest behaviour, but nevertheless it is impossible to know (as is the case with any assumption on resources, like honest majority of work in PoW blockchains) whether our reputation system is always accurate. Indeed, previous works on reputation-based consensus in research literature have discussed little of contingencies when their reputation systems fail. Möbby addresses this issue with our fallback chain, which ensures basic security properties like consistency, even if our reputation system is grossly inaccurate. This means our reputation-based consensus can be naturally optimistic and efficient, while still allowing our users the peace-of-mind that even if errors were to occur, they would be swiftly detected and resolved on our fallback chain.

Fairness: An aspect of reputation-based consensus which has received little attention in previous works, is the idea of fairness. That is, all parties (even those with lower reputation, e.g., due to being new) have a chance to create blocks. Fairness is important for decentralization, and in particular helps prevent the effect of ‘the rich getting richer’.

Efficiency and Scalability: A reputation system estimates the probabilities that parties behaves maliciously, which in turn provides information to the protocol designer (and parties) on the corruption capabilities of the adversary. This allows us to avoid the need for communication- and setup-heavy adaptive security tools, e.g., compute and communicate proofs of verifiable random functions.¹ Additionally, it allows us to associate reputation parties with public keys and public physical IDs, e.g., public IP address, which means they can communicate through direct point-to-point channels rather than diffusion/gossip network. This yields both concrete and asymptotic improvements. First, depending on the network topology, this can improve the overall concrete message complexity and yield denial-of-service (DoS) attack protection in practice—open diffusion networks are more susceptible to DoS. Additionally, as most communication occurs only among the (polylogarithmic) size slot committees and between these committees and the player set, even ignoring the overhead of gossiping, the overall message complexity per slot is O(nlog ^ϵn) as opposed to the Ω(n²) complexity of standard blockchains relying solely on flooding.

High Throughput (Transaction-Liveness): Existing solutions implicitly assign to each block one effective-block proposer [65, 39, 16, 49]—multiple parties might win the lottery but only the proposal of one is adopted. Instead, in our PoR-blockchain a (small) committee BC of proposers is chosen in each slot, and the union of their transactions-views is included. To ensure that honest transactions are included in a block it suffices that any of the block proposers in the corresponding BC is honest. This will be true with probability at least 1 - 1∕2^L, where L is the size of BC, as we are choosing L parties out of BA which has honest majority. In comparison, in systems that choose one proposer per block, this probability is upper-bounded by (roughly) t∕n, where t is the number of corrupted parties/resources (e.g., the amount of adversarially owned stake) and n is the total amount of resources. The above discrepancy can be impactful in situations where the transaction-submitting mechanism has high latency—e.g., due to bad/restricted access to the blockchain network, or some points to the blockchain network are unreliable.

Finality: Since the parties decide on the next block by means of a Byzantine broadcast protocol, agreement is achieved instantly by the end of the slot. This is similar to standard synchronous BFT-based blockchains, and is in contrast to Nakamoto-style blockchains [74, 30, 65] which achieve eventual consistency, aka the common prefix property [48, 78]. We stress that this is the case assuming the reputation system is accurate. One can argue that this might be an insufficient guarantee as to get full confidence and some users might want to wait for the situation to settle also on the fallback chain—i.e., ensure that no honest party contests their view. Nonetheless, it allows for a tiered use of the assumptions, which naturally fits situations where different transactions have different degree of importance, as is for example the case in cryptocurrencies: For small-amount transactions the users can trust the PoR-blockchain and consider the transaction settled as soon as it is finalized there. The more risk-averse users (or users with high-stake transactions) can wait for the fallback chain to confirm that there is no accusation. The above mode is the natural blockchain analog of how reputation is used in reality: If a service or an investment is recommended by a highly reputable source, then it typically enjoys higher trust. However, for risky actions, the actors usually seek further assurances that might take longer time.

1.2 Related Works

Asharov et al. [13] defined reputation systems for multi-party computation (MPC) and proved necessary and sufficient conditions on a static reputation system for the existence of fair MPC—in particular, for the existence of an algorithm for selecting a committee where the majority of the participants is honest.

To our knowledge, ours is the first work which puts forth a rigorous specification, protocol, model, and treatment of reputation-system-based blockchains. Attempts to combine consensus with reputation were previously made in the context of blockchains and cryptocurrencies (see Section 1.3 below for an overview). None of these attempts addresses the subjective nature of the reputation systems, i.e., if the reputation system is inaccurately estimated, their security fails. This is in contrast to our fallback guarantee which allows us to preserve basic safety (unforkability) properties which are essential in blockchains and cryptocurrencies. Additionally many of these works lack a protocol specification, security model and proofs, and often even a credible security argument [46], and/or rely on complicated reputation mechanisms and exogenous limitations on the adversary’s corruption power [36]. Alternative approaches, use the proof-of-work (bitcoin) paradigm to assign reputation, by considering miners more reputable if they allocate, over a long period, more hashing-power to their protocol [88].

Notably, [25] proposed a reputation-module which can build a scalable blockchain on top of a BFT-style consensus protocol, e.g., PBFT or Honey Badger [73]. The idea is that this reputation module can be used by the parties to select smaller next round committees. In addition to lacking a security proof, the entire module needs to operate over a broadcast channel created by the original BFT consensus protocol, as it uses a global view of the computation to accurately readjust the reputations. Hence, its security relies on the security of the underlying consensus protocol, even if reputation is accurate. Instead our PoR-blockchain construction is secure under the assumptions of accuracy of the reputation system, irrespective of the properties of the fallback blockchain. The result from [25] also proposed a notion of reputation-fairness, which renders a reputation-based lottery more fair the closer its outcome is to a uniform sample. This notion of fairness seems unsuitable for our goals, as it is unclear why low distance from uniform is a desirable property. Why should it be considered fair that a large set of parties with low reputation has better relative representation in the output than a small set with higher reputation? And how would this incentivize parties to build up their reputation? Our fairness definition addresses this concern, at a very low overhead.

Hybrid blockchains which use an alternative consensus mechanism as a fallback were also previously used in Thunderella [79] and Meshcash [23]. Their protocols rely on smart refinements of the proof-of-work and/or proof-of-space-time paradigms, and uses novel methods to accelerate the blockchain and improve scalability and finality when a higher amount of the underlying resource is in honest hands while ensuring safety even under weaker guarantees. Finally, Afgjort [70] devises a finality layer module on top of a proof-of-stake blockchain. Their construction achieves fast finality under the combination of the assumptions underlying the PoS-blockchain—typically, honest majority of stake—and the assumption supporting the security of the finality layer. In contrast, our PoR/PoS-hybrid blockchain is secure as long as the reputation-system is accurate irrespective of the security of the underlying PoS-blockchain.

1.3 Reputation-based Blockchain Protocols: An Overview

In this section, we discuss the various works that connect the concepts of the blockchain and reputation systems. We first compare and contrast Möbby with the various ways reputation can be the basis of the core consensus mechanism of the blockchain protocol, including previous works in Proof-of-Reputation blockchains, BFT-based systems, Proof-of-X, and Sharding.

For completeness, we also discuss the various ways reputation systems can improve existing blockchain solutions, outside of consensus, as well as Proof-of-Authority blockchains. Reputation can also used to improve the security and performance of other aspects of the protocol, such as informing parties of reliable nodes on the network to achieve more secure message propagation [35, 80]. Lastly, as an aside, while this section will focus on blockchain systems based on reputation, the immutability property of blockchains makes it a natural basis for reputation systems as well. We point the interested reader to the plethora of works that leverage blockchain security properties to create a reputation system; several surveys on this topic can be found in [20, 10, 22].

Proof-of-Reputation

In the past few years there has been a line of research on Proof-of-Reputation (PoR) blockchains, which numerically quantify the reputation of individual nodes and use reputation to determine the eligibility of these nodes to participate in the blockchain consensus. PoR has been employed in various applications, such as to signify the trustworthiness of nodes in Internet-of-Vehicles [33] or industrial Internet-of-Things [86], or to disincentivize miners from ordering transactions to their own advantage [81].

One method reputation is generated in these works is via the aggregate of user ratings of the node’s quality of service [46]. The node with the highest trust is then chosen to create the next block. Several later works follow this method of generating reputation via ratings, such as [54] where reputation stem from the end user reviews, [91] where network nodes evaluate each other’s performance, and [12] where these evaluation are weighted by the evaluator’s reputation.

However, while basing reputation on participant feedback can allow quick detection of malicious behaviour, it is undeniable that rating and reviews can be highly subjective. Moreover, this kind of system can be manipulated by bad actors [46] to, for example, reduce the reputation of honest parties by repeatedly giving them poor reviews. Thus, several works have instead based reputation on the node’s own actions, e.g., whether they verified the valid transactions [94], or whether they have supported a bad block [27]. This non-subjective reputation system will be the method we follow. Lastly, another type of reputation system is the delegated PoR, which allows nodes to assign trust for specific parties as block producers; the weight of this assignment is based on the node’s reputation, and other factors like stake, resource usage [41] or carbon emission contribution in carbon Emission Trading Systems [56]. Though Möbby will also allow parties to endorse their reputation to others, our PoR consensus will only depend on the parties’ reputation, and reputation can increase or decrease based on the honesty of the party’s behavior, leading to a simpler scheme that is more adaptable to corrupt nodes.

Reputation Systems in BFT-based Blockchains

Like Möbby’s consensus, Byzantine Fault Tolerant (BFT)-based blockchain protocols generally offer finality, and the next block is often decided by a committee of parties. Reputation can be used to mitigate the strong assumption on a two-thirds honest majority, by removing or reducing the importance of likely corrupt nodes. For example, in [68] faulty nodes can be reported on the blockchain with evidence of their poor behavior, leading to a lower probability of being picked as the primary node in the practical BFT (PBFT) consensus, and in [83] high reputation parties vote on the next block, with their votes weighted by their reputation. Committees in BFT-protocols can also be selected based on reputation, which may be computed from an online learning algorithm via features such as response time [29], or adjusted based on whether consensus was reached when the node is selected as a committee member [26, 24]. Reputation values are also used as a threshold for participation, by limiting consensus nodes to the top 60% of reputation parties [31], or getting rid of parties with negative reputation [93]. See also below (“Reputation in the Blockchain Protocol Outside of Consensus”).

Proof-of-X

Reputation systems can a be valuable addition to Proof-of-Work (PoW) blockchains. For example, in [89] a miner’s reputation is based on his ‘integrated power’—the amount of valid work done over a period of time. In [19] PoW miners with higher reputation can create blocks by solving an easier puzzle, and [28] generalized this idea to Proof-of-X (where ‘X’ refers to work, stake, or some other assumption) blockchain while also requiring parties to place a security deposit as assurance of their good behavior.

Sharding

Sharding protocols are blockchain protocols that achieve higher throughput by partitioning the computation tasks (such as transaction validation) across several groups of nodes. Reputation has been used to select shard leaders [57, 87], or to determine the parties’ voting power [14].

Reputation in the Blockchain Protocol Outside of Consensus.

A prominent use case of reputation systems in blockchain applications, outside of consensus, is in Internet-of-Things (IoT), in particular vehicular networks [64, 62, 71] where vehicles share resources such as sensor data. In these works, reputation can be used to determine the trustworthiness of the shared resource and other vehicles, or to remove bad actors. The former can be generalized as schemes that rank the importance of each transaction [90, 92, 55], for example to decide on the order in which transactions are validated [90, 92]. The latter can be generalized to disincentivizing misbehaving miners, such as excluding or reducing the importance of low-reputation nodes [34, 11, 40, 84], or enforcing reputation biases in mining pool member selection [59, 75, 85]. An example of a deployed blockchain with a reputation system is Celo [60], which employs the Eigentrust [61] algorithm to assign a reputation score for each identity, in order to assist users in deciding who they should trust to send their coins to.

A Comparison with Proof-of-Authority Blockchains

Finally, we discuss and compare Möbby with the various deployed Proof-of-Authority (PoA) blockchains. Proof-of-Authority has become popular in recent years, having been adopted by various systems such as Binance [1], VeChain [9], Eurus [2], and Ethereum [4]. First proposed by Ethereum co-founder Gavin Wood [5], PoA allows only a limited number of known and authorized parties to become consensus participants. For example, in Binance (which calls their consensus “Proof-of-Staked-Authority”), parties stake an amount of their coins to vie for a spot in the validator set, and the top 21 nodes with most amount staked become validators. On the other hand, nodes in VeChain go through a rigorous know-your-customer (KYC) process in order to become an authority.

Outside of its usefulness in small, private chains, the small participant set in a PoA consensus results in a faster consensus and block production time. On the other hand, this also implies PoA is more centralized—that is, only a small number of nodes need to behave maliciously for the system to fail. Some PoA systems attempt to prevent this by penalizing recognizable misbehaviour by slashing some of the validator’s coins (e.g. Binance), or requiring the authorized parties to reveal their identity (e.g. VeChain), and thus risk their real-life reputation if they misbehave. GoChain [3], which calls its consensus ‘Proof-of-Reputation’ (which, while having the same name, is quite different from Möbby’s consensus and PoR in research literature) extends this idea by requiring consensus participants to have important enough reputation. It does so by allowing only large companies with more to lose to become an authoritative node. Regardless, in the blockchains described above, there is no direct representation of reputation in the blockchain system itself. Thus, unlike Möbby’s Proof-of-Reputation system, in PoA the decrease in reputation due to misbehavior in the blockchain is unquantified. Moreover, the small number of authority nodes means that collective misbehavior due to cyberattacks becomes more likely, and unlike Möbby which enjoys fallback security in case of reputation system failure, there is little resilience to flaws in the authority node selection process.

1.4 Möbby Use Cases and Future Applications

The Möbby blockchain offers the following to all our users:

• Reputation data: Users will be able to take advantage of our transparent, on-chain reputation data to make decisions about products or services, train a machine learning algorithm, or create their own recommender system.
• Incentives: The Möbby blockchain—in particular the rewards for participating in the concensus—will provide monetary incentives for achieving high reputation.
• Platform: Users will be able to host AI-relevant/driven applications on our blockchain. Not only will special smart contracts be available, we will also provide software tools, templates, and example applications.

One of our goals is to create a platform for applications with real world value. Below, we explore some of these future applications. Here are some examples of specific applications:

Recommender systems Möbby can become a common space for user-created recommender systems for products and services. These recommender systems, in turn, can also be rated based on their usefulness, which allows users to receive personalized recommendations based on their individual interests. Möbby can, for example, become a decentralized repository for the reputation of other blockchains or decentralized finance (DeFi) applications—using available, public data on these ledgers. The transparency afforded to us when using publicly accessible data to create recommendations means we can mitigate issues such as companies suppressing negative reviews of their products [6]. Of course, as with any recommender systems, care must be taken to avoid abusive behavior, such as the case of malicious reviewers on Goodread that threaten bad reviews if the authors do not give in to their monetary demands [8]. A future research direction is to study how to prevent malicious behavior like these and create a safer and more fair platform.

Crowdfunding Crowdfunding sites like Kickstarter, Indigogo, GoFundMe, and Patreon have become a major source of income for independent creators, and can have a large impact on individuals with financial needs. However, scams are also rampant on these sites, with victims collectively losing millions of dollars [7]. Möbby can provide crowdfunded projects with reputation ratings, which can help combat scam behavior. Moreover, as a payment platform, Möbby can help control the flow of money to these projects via smart contracts.

1.5 Informal Overview

We give a diagram and informal summary of the main everyday activities performed by participants on the Möbby network, and how we incentivize honest behaviour. We refer the interested reader to our Economics Parameters Document (App. G.2) for more information on the rewards distribution and passive rewards referenced below.

Spending and Receiving Tokens The simplest use case: Möbby users will be able to easily spend and receive tokens via their blockchain wallets, which broadcast the users’ transactions to reputation parties on the network, so that the transactions will be quickly included in the chain. In the future, Möbby will provide a host of rich functionalities via timelocked and multisignature transactions, as well as smart contracts.

---

---

---

---

Participating on the PoR Chain Reputation parties ensure the operation of the Möbby blockchain. They can actively participate (or endorse their reputation to other parties, see below) in the Proof-of-Reputation lottery, which is a process of selecting the committees responsible for creating the next block in the PoR chain. A reputation party who marks themselves as available will enter this lottery draw, which will determine whether they will be selected as part of the validator BA committee or the proposer BC committee. By participating honestly as a committee member, parties can increase their reputation, as well as gain a share of the block reward and transaction fees. To incentivize active participation in the consensus, we provide a passive reward to those who mark themselves as available and indeed participates regularly in the consensus (both PoR and the fallback PoS chains). To deter malicious actors, provable misbehaviour (e.g., a party who creates signatures for two conflicting blocks) is punished, and removed from the set of available parties (so that for some period of time, the misbehaving party cannot gain passive rewards).

Participating in the Fallback PoS Chain The security of our system is further ensured with a secondary, fallback chain whose consensus is based on Proof-of-Stake. A slot-by-slot digest/summary of the main PoR chain is recorded as transactions on the fallback chain, which allows inconsistencies or liveness failures on the POR chain to be quickly detected. Participation on the fallback chain—creating and sending such digests, as well as participating in the PoS consensus—does not directly result in monetary or reputation gains (unlike in the PoR). However, we do incentivize participation via a passive reward which is given to reputation parties that actively participate both in the PoR and PoS chains. As is with the PoR chain, we disincentivize and punish provable misbehaviour (such as submitting false digests) by allowing parties to accuse malicious parties with evidence.

---

---

Endorsement Parties with reputation may decide not to actively participate in the consensus, and rather participate by endorsing their reputation to other parties. When a validator or proposer is rewarded in the PoR consensus, their endorsers (and even the endorsers of their endorsers) will receive a portion of that reward (whether reputation or monetary). Similarly, any punishment doled out to a party for misbehaviour will reflect partially on their endorsers. This incentivizes endorsers to more carefully choose who they endorse.

Organization of the Remainder of the Paper. In Section 1.6 we give an overview of Möbby’s underlying assumptions. After discussing our model in Section 2, in Section 3 we define and instantiate a reputation-fair lottery. Section 4 describes a PoR-based blockchain-ledger protocol for static reputation systems, and Section 5 describes the hybrid PoR/PoS ledger protocol. Lastly, in Section 6 we discuss how a party’s reputation in Möbby is established, and how it changes with the party’s behaviour.

1.6 Preliminaries

We use the standard definition of negligible and overwhelming: A function μ : ℕ → ℝ⁺ is negligible if for any polynomial p(k): μ(k) = O(1∕p(k)); We say that a function f : ℕ → [0,1] is overwhelming if f(k) = 1 - μ(k) for some negligible function μ. Many of our statements and definitions assume an (often implicit) security parameter k. For two strings s₁,s₂ ∈{0,1}^* we denote by s₁||s₂ the concatenation of s₁ and s₂. For some n ∈ ℕ we will denote by [n] the set [n] = {1,…,n}. For a string s ∈{0,1}^k and for some D ≤ k we will say that T(s) ≥ D if s has at least D leading zeros, i.e., s is of the form s = 0^D||s′ for some s′∈{0,1}^k-D.