papers/lux-master-security-model/sections/05-failure-modes.tex

\section{Failure Modes}

\label{sec:failure-modes}

For each component, we enumerate what happens when it breaks.

\subsection{BLS12-381 Broken (Quantum Attack)}

\begin{itemize}[leftmargin=2em]
  \item \textbf{Impact}: Per-block BLS aggregate signatures can be forged. Classical
        consensus is compromised.
  \item \textbf{Mitigation}: Epoch-level ML-DSA signatures (post-quantum) provide
        finality with $\sim$100-block granularity.
  \item \textbf{Degradation}: Block confirmation time increases from 1\,ms (per-block
        BLS) to $\sim$100\,ms (per-epoch ML-DSA).
  \item \textbf{Recovery}: Protocol upgrade to ML-DSA-only per-block consensus.
        Pre-deployed ML-DSA keys mean no new key ceremony is needed.
\end{itemize}

\subsection{ML-DSA Broken (Lattice Breakthrough)}

\begin{itemize}[leftmargin=2em]
  \item \textbf{Impact}: Post-quantum epoch proofs can be forged. Hybrid key exchange
        loses its post-quantum component.
  \item \textbf{Mitigation}: BLS per-block consensus continues to provide finality
        (classical security). STARK proofs based on hash functions remain valid for
        state commitment.
  \item \textbf{Degradation}: Loss of post-quantum guarantee. System reverts to
        classical security level.
  \item \textbf{Recovery}: Migrate to SLH-DSA (FIPS 205), which relies on hash
        function security (Family~3), not lattice assumptions.
\end{itemize}

\subsection{Hash Functions Broken (Collision Attack)}

\begin{itemize}[leftmargin=2em]
  \item \textbf{Impact}: STARK proofs compromised. Merkle state commitments can have
        forged proofs. Address derivation collision attacks possible.
  \item \textbf{Mitigation}: BLS + ML-DSA consensus continues independently of
        STARK proofs. State can be verified by re-executing transactions.
  \item \textbf{Degradation}: STARK compression unavailable. Epoch proofs grow from
        $\sim$200 bytes to Z-Chain ZKP ($\sim$192 bytes, Groth16 proving BLS $\land$ ML-DSA $\land$ Pulsar).
  \item \textbf{Recovery}: Migrate to a hash function with larger state (SHA-512,
        BLAKE3-512) or a hash function based on different assumptions.
\end{itemize}

\subsection{Consensus Threshold Breached ($f \geq n/3$)}

\begin{itemize}[leftmargin=2em]
  \item \textbf{Impact}: Safety violation possible---adversary can finalize conflicting
        blocks. Liveness may be lost.
  \item \textbf{Mitigation}: Slashing destroys attacker stake (economic cost $> f/3 \times
        \text{total stake}$). Social consensus and chain reorganization as last resort.
  \item \textbf{Degradation}: Chain halts or forks.
  \item \textbf{Recovery}: Social consensus to select the canonical fork. Slashing of
        equivocating validators. Restart with honest supermajority.
\end{itemize}

\subsection{Network Partition}

\begin{itemize}[leftmargin=2em]
  \item \textbf{Impact}: Under partial synchrony, liveness is lost during the partition.
        Safety is maintained (no conflicting finalized blocks across partitions because
        neither partition has $> 2n/3$ validators).
  \item \textbf{Mitigation}: Consensus resumes automatically when the partition heals.
  \item \textbf{Degradation}: Blocks are not finalized during the partition. Pending
        transactions queue.
  \item \textbf{Recovery}: Automatic upon network healing. No manual intervention needed.
\end{itemize}

%% ========================================================================
%%  6. TRUST ASSUMPTIONS
%% ========================================================================