Nice to see Avalanche at the top of this list. https://twitter.com/Coin98Analytics/status/1349176217514037249

Note that the metric that really matters is the number of validators that participate in each round. Let me explain why this is.

Imagine a protocol called BAD where just one node makes a decision. It'll work correctly as long as that node is correct and well-intentioned. And it totally breaks if that node is evil, aka Byzantine.

Now imagine you have 10000 nodes, and you use BAD round robin.

Clearly, even though you have 10,000 nodes, they won't do you any good. In fact, because you're rotating through committees (of size 1), you're actually weaker than if you used BAD with just 1 node. Now just 1 bad node in the bigger set of 10,000 nodes can compromise you.

How would this system break down? When it's the byzantine node's turn, he announces one decision to one set of nodes (e.g. Binance), and another decision to the other set (e.g. everyone else), creating a double spend. Those 9999 nodes add nothing, they are bystanders.

Now let's make it more complicated. Instead of BAD, we employ BETTER. BETTER uses 4 nodes to make a decision, and employs a run of the mill protocol from the 1990s, eg PBFT, to come to a decision correctly in the presence of 1 Byzantine node. This is much better than BAD.

And yet, the security of the system depends on the correctness of the 4 nodes chosen for each round. If there's ever a set of 4 nodes selected for a round where 2 or more of them are byzantine, then the system is toast. The 9996 nodes that don't participate add nothing.

In fact, opening the system up to large numbers of participants made it less secure again. I, an attacker, just have to compromise one of the many groupings of 4 nodes.

If the system consisted of just 4 nodes, I'd have to compromise 50% of the system to break it.

Now that you have 10k nodes, there's a chance I can double-spend having compromised just 2 out of 10k nodes, that is 0.02% Byzantine presence. That's not 2% Verizon math btw, it's tiny

So, what's the takeaway?

Total number of validators isn't a good metric for security.

It's a good metric for *inclusivity*.

The correct metric for security is the number of nodes involved in each decision.

And I'm proud of Avalanche's performance on both metrics.

The two numbers are the same for Avalanche. We are as secure as we are inclusive.

/end microlecture
/there will be a quiz later