How Bitcoin Rewired a Classic Computer Science Problem

We're excited to share a special feed drop from The a16z Crypto Show. In the first episode of First Principles: The Scientific Roots of Blockchain Technology, Tim Roughgarden and Ittai Abraham trace the decades of computer science research that laid the foundation for modern blockchains. Long before Bitcoin, researchers were studying one of distributed computing's hardest challenges: how independent machines can reliably agree on a shared state, even when some participants are faulty or malicious. Bitcoin didn't invent that problem, but it introduced a breakthrough solution in a radically different, permissionless setting. The conversation explores Byzantine agreement, state machine replication, proof of work, proof of stake, Tendermint, Casper, DAG-based protocols, and why concepts developed decades ago continue to shape the design of today's fastest and most secure blockchain networks.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  So this was in 2007. I was at a workshop and the goal of the workshop is to see whether Byzantine fault tolerance is practical or not. But there was actually two big complaints. One is that maybe nobody needs it. And the other was that the performance was horrible.

• 0:12Speaker 01

  So the question wasn't whether consensus protocols are practical. The question was, did you really need to be robust to potentially very unpredictable failures as opposed to just crashing?

• 0:22Speaker 00

  Satoshi Nakamoto, he kind of realized that. He said, "The core technical aspect of Bitcoin is solving Byzantine agreement." I would say de facto, all the major chains that we know are running some version of Byzantine fault tolerance. The early proof of state protocols, they were not very efficient. They had blocks every 10 minutes. And so really, if you're thinking about serving billions of people or systems that really manage large economies, you want to have kind of a wartime mode and a peacetime mode. So in peacetime, there's no failures. And the thing is that you do want to be able to switch to wartime. So if you are under attack, then you do have a way to kind of overcome a massive attempt to corrupt your system.

• 0:56Erik Torenberg?

  People often tell the story of Bitcoin as if it appeared out of nowhere. But the ideas behind Bitcoin stretch back decades, drawing on foundational work in computer science, cryptography, and distributed systems. In this episode, Tim Roughgarden and Ittai Abraham explore the scientific roots of blockchain consensus, explain why Bitcoin represented a breakthrough in Byzantine fault tolerance, and discuss how decades of academic research continue to influence the design of modern blockchain protocols. Whether you're new to crypto or have been following the space for years, this conversation offers a deeper look at the scientific ideas that underpin modern blockchains. If you enjoy this episode, be sure to subscribe to the A16Z Crypto Show for more conversations like this.

• 1:42Speaker 01

  Hi, everyone. I'm Tim Roughgarden, head of research at A16Z Crypto and professor of computer science at Columbia University. And today, we're kicking off a new series called First Principles: The Scientific Roots of Blockchain Technology, that explores one of the most exciting areas of research at the intersection of theory and practice today: blockchains and where the ideas that make them possible come from. At their core are decades of work across computer science, economics, and mathematics, ideas about how distributed systems reach agreement, how trust can emerge without central authority, and how computation can be verified across networks of strangers. So we'll trace these ideas from their origins to the systems running in production today.

• 2:27Speaker 01

  And we'll talk with the scientists and the scholars whose breakthroughs made it all possible. To start, we're going to focus on one of the deepest threads, which is distributed consensus: how many machines can agree on a shared state even in the presence of failures and adversarial behavior? Concepts like Byzantine agreement and state-machine replication developed decades ago now sit at the heart of modern blockchain technology. So to begin, I'm joined by A16Z crypto research partner Ittai Abraham. Ittai is one of the world's leading researchers in Byzantine agreement and consensus protocols. He's a founding member of VMware's Blockchain Project. He's also the founder of Decentralized Thoughts,

• 3:10Speaker 01

  one of the field's most respected and long-running technical blogs. Together, we unpack the work of two pioneers, Barbara Liskov and Leslie Lampert, whom you'll hear directly from in the episodes ahead. All right, so Ittai, very, very cool. We get to interview both Leslie Lampert and Barbara Liskov. It's a great honor. Really, really cool we get to do this. Maybe for the audience benefit, we should talk a little bit about how the pioneering work that they did connects to blockchain technology. So the first blockchain that came out, Bitcoin, 2008, 2009, you know, part of what it is is a consensus protocol. And so the question is, like, what does that mean? A lot of the work that Lampert and Liskov both did, it's way before Bitcoin, right?

• 3:55Speaker 01

  It's from the 90s, from the 80s, even earlier. What's the connection? Bitcoin is a consensus protocol, but there's also this classic working consensus protocols. Was Bitcoin reinventing the wheel, or how should we think about that?

• 4:07Speaker 00

  Bitcoin was not just a whole disruption in distributed computing. It also has innovation in economics and cryptography. But here, we're going to focus on the distributed computing part. It actually took quite a few years for people to realize that this is kind of solving a Byzantine agreement problem. So Byzantine agreement problem is kind of this very core academic problem that has been studied for 40 years. And that sense Bitcoin is kind of this huge revolution in how to solve Byzantine agreement. In fact, if you look at early emails from Satoshi Nakamoto, he kind of realized that. So he said, "The core technical aspect of Bitcoin is solving Byzantine agreement."

• 4:41Speaker 01

  So Nakamoto apparently knew that this was a well-known problem that should be computing. So what's the connection then between the Bitcoin protocol and the protocols we're going to hear about?

• 4:52Speaker 00

  Yeah, so in a sense, both the protocols that we're going to hear about from Barbara Liskov and Leslie Lampert are Byzantine agreement protocols or agreement protocols in general. So Bitcoin solved this in a much different setting, permissionless, with a much smaller setup, much more kind of geared towards cryptocurrency and cryptoeconomics. But if you kind of think about this from the foundational perspective, they're both solving the same agreement problem. So agreement is kind of this problem where you have multiple different parties, and they might have different types of inputs, and they need to reach agreement even though a fraction of the participants are behaving maliciously or in a corrupt manner.

• 5:29Speaker 01

  So again, the Bitcoin protocol, who are the parties that have to agree and what is it that they're agreeing on?

• 5:34Speaker 00

  Right. So you have miners, right? And the miners are trying to kind of push the protocol forward by generating new blocks, by solving proof of work. And it might be that not all the miners are trying to do the right thing. Some of them may try to subvert the protocol or they're behaving in a corrupt manner. Maybe they're trying to create some sort of double spend attack or some attack that will basically cause different people to see different views on the blockchain. And what this protocol basically does, Nakamoto consensus, it's called, right? The consensus protocol of Bitcoin is a kind of guarantee that even if a fraction of the miners are corrupt, this protocol still gives you a single, consistent view of the ledger. And in a sense, that's exactly the thing that has been studied 40 years ago, right? In state-machine replication and Byzantine fault tolerance.

• 6:20Speaker 01

  And so state-machine replication, how does that compare to agreement?

• 6:24Speaker 00

  So in a sense, the core problem is just reaching an agreement on the content of the log. So now you have kind of a log that has different commands on them.

• 6:32Speaker 01

  So a log would be an abstraction of a blockchain in this case?

• 6:35Speaker 00

  Yeah, so you could think about every block in your blockchain as just a set of commands. And then you have kind of a chain of commands. It would be kind of a log or a chain. It's kind of the same thing. But really, what you want to do is not just record things, but you want to try to see what is the outcome of executing them. So this is where you have some sort of a smart contract language or some scripting language like Bitcoin script. And in this case, you know, maybe you're, you want to verify some signatures or run some sort of a contract. So this is the execution part of it. And so the very powerful abstraction, this is an abstraction that we'll hear about from Leslie Lampert, is what's called a state-machine replication. It's that clients are basically thinking as if they are interacting with a single state machine. So what is a state machine?

• 7:19Speaker 00

  It's simply a single system that you've extended commands. And through that command, it updates its state from one state to the other to the next. And each time you kind of run a command, the state updates to the next state of the system.

• 7:32Speaker 01

  And then I guess in a blockchain context, that state would include, for example, everybody's balances in a native cryptocurrency, plus, I guess, maybe like local storage and smart contracts. That would all be kind of part of this state, right?

• 7:45Speaker 00

  Exactly. So for example, in Bitcoin, maybe the state of the system is that I have a token. And maybe if I send a payment to you, then the way the state would change is that now my token is erased and there's a new token that forms that's under your public key, right? So now you can use that token. So the state is kind of recording what are all the unspent tokens or transactions that are on the chain.

• 8:04Speaker 01

  So one thing that I think I find fascinating is, you know, you had for a while two parallel threads of research that at least, it seems to me, have converged to a large degree over the last five years. But I'm curious about your thoughts. Right, so you have distributed computing, dates back, again, at this point, you know, 45 years or more. And we'll hear from both doctors Lampert and Liskov about that early work. And then separately, you know, Bitcoin launched kind of blockchain technology and sort of a research community around that, thinking about how to build better and better blockchain protocols. And that was in 2009. So that was maybe about 30 years after some of the earliest pioneering work on the should be computing side.

• 8:45Speaker 01

  And so in addition to being 30 years later, I felt like it was kind of a parallel thread for a while there. But now, it seems to me that those two threads have been coming together over the past maybe five years or so. So I guess, do you sort of share that view? And if so, like, what do you think's been driving that sort of convergence recently?

• 9:02Speaker 00

  Yeah, absolutely. First of all, I really think that Bitcoin is just kind of huge revolution. We're probably going to spend a lot of time talking about that. But in a way, when it happened, people didn't really understand what it's doing. It actually took quite a few years for the research community and for everybody to understand that this is solving kind of a very hard academic problem. Once it was clear that that is the problem that Bitcoin solves, there was this effort to try to connect that to this classical work. You know, it took quite a few years. Around 2017 or 16 was when this changed. I think the first protocols were Tendermint as an example. These were the protocols that kind of were using the classical Byzantine fault tolerance protocols, but applying them on proof of stake. So really, I think that this is this transition from proof-of-work-based protocols to proof-of-stake ones.

• 9:47Speaker 00

  And the realization that you can kind of mimic the same effect that Bitcoin obtained in proof-of-work using proof-of-stake protocols. So I think that was kind of this first wave of 2016, 17. Maybe the next one to mention is Casper. This was the Ethereum finality gadget appeared around 2017.

• 10:04Speaker 01

  That's a great point. I mean, now even the theories are the point where we understand. There's a formal sense in which you can't do the traditional consensus protocols in a proof of work context, which is an interesting interaction between the type of symbol resistance. So if you don't know who people are and you can't do one vote per person because you don't know who the people are, so you have to do one vote per some scarce resource. That's what I mean by symbol resistance mechanism. And Bitcoin famously uses proof of work. In some sense, that's incompatible with the types of techniques that Drs. Lampard and Liskov will be talking about. Whereas proof of stake symbol resistance, well, there's a lot of other reasons you might want to use that as well. Maybe you're concerned about environmental reasons or scalability, what have you. It also actually unlocks those techniques that Drs. Lampard

• 10:49Speaker 01

  and Liskov will tell us about. So that's a great point.

• 10:51Speaker 00

  And it was not trivial at the time. So I remember 2015, people were saying, oh, there's this idea of proof of stake, but how do we do it? It seems impossible. There were a lot of people that said that there's no way to do something similar. So it was a non-trivial advance during those years.

• 11:04Speaker 01

  Absolutely. So for example, Ethereum, I know, was already talking about proof of stake before they even launched their original mainnet in 2015, and then the actual transition to proof of stake wasn't until 2022, right? Seven, eight years later. So I agree. It seems like that turned out to be a much more difficult problem than just the initial idea. So you mentioned Tendermint, which may be familiar to listeners from the Cosmos ecosystem, among other places. You mentioned Casper, which is used in today's Ethereum. So today's Ethereum has two layers. It has a longest chain, sort of lower layer, and then a finality gadget based on top, Casper. And as you say, the techniques in Casper are going to be very related to the techniques that our guests tell us about today.

• 11:46Speaker 01

  I actually, on a personal note, I think I first became aware of this interesting interplay, the idea that the Bitcoin protocol, on the one hand, was solving a well-established academic problem, but then doing so in a way no one had ever thought about. It was a survey you wrote, I think, with Dahlia Mulkey that first pointed that out. So that was maybe 2017 or something like that. That made a big impression on me at the time.

• 12:07Speaker 00

  Yeah, so it actually took, I think, quite a few years for this prevailing, I guess, community understanding, right? That Byzantine fault tolerance is the core thing that blockchains are doing. But that actually wasn't obvious. There were early protocols that did things that were not consensus protocols or didn't solve a Byzantine agreement. And it took quite a while until things settled, I would say. And today, or at least even from 2017 to the 2020s, there was an explosion of research in Byzantine fault tolerance. And I would say, de facto, all the major chains that we know are running some version of Byzantine fault tolerance.

• 12:43Speaker 01

  One thing that's been wild, I'd say, about blockchain technology is it breathed a lot of new life and also, frankly, a lot of new resources into a lot of areas of computer science that have been around for quite a while. So another example would be, say, the development of SNARKs, which for many decades was viewed as a purely theoretical construct. It was something magical which you'd never hoped to implement. And now we're really seeing very concretely efficient SNARKs come into production. And while consensus protocols, they were always meant to be practical, as I think we'll hear about today, they've been supercharged as well by having blockchain technology as a extremely high-value application of better consensus protocols.

• 13:25Speaker 00

  But let me even tell you another story. So this was in 2007. So 2007, I was at a workshop, and the goal of the workshop is to see whether Byzantine fault tolerance is practical or not. This was really a few years after Google and Yahoo and Microsoft were using the non-Byzantine version of agreement. This is Paxos-type protocols.

• 13:44Speaker 01

  So the question wasn't whether consensus protocols are practical. The question was, did you really need to be robust to potentially very adversarial or very unpredictable failures as opposed to just crashing? Is that right?

• 13:57Speaker 00

  Right, but there was actually two big complaints. One is that maybe nobody needs it, and the other was that the performance was horrible. So people didn't believe that it's possible to do it any better. They said, oh, this is going to be very slow. We now have these very efficient Paxos-like algorithms. Those are practical. Those are used by a lot of these cloud service providers. But Byzantine fault tolerance, oh, that's not practical. That's too expensive. So yeah, I think we've seen this arc of a lot of work in a space really exponentially improve it.

• 14:26Speaker 01

  Say like last five years, are there some sort of innovations in consensus but originating from the blockchain community that you find particularly notable?

• 14:34Speaker 00

  So we are seeing, not just a lot of systems are using Byzantine fault tolerance, but we're also seeing a lot of innovations in this space. A lot of it is focused on getting much higher throughput and much lower latency.

• 14:46Speaker 01

  And to make that concrete, so from the user perspective, you want high throughput because you want there to be space for your transactions and even you want it to be cheap to send your transactions. A lot of latency just means whatever you ask the blockchain to do, like do a transfer, whatever you want it to happen, ideally close to instantaneously. That would be the latency, right?

• 15:03Speaker 00

  Yeah, and maybe we can go back to Bitcoin 2009, or even 2017, the early proof of state protocols. They were not very efficient. They had blocks every 10 minutes if it's Bitcoin or every tens of seconds. And the throughput was actually quite small. And so really, if you're thinking about serving billions of people or systems that really manage large economies, then that wouldn't be enough for some types of use cases. So you want to have something that can serve many, many users. And not only that, they can give them a real-time experience. So serving a lot of users, that's going to be high throughput. And giving people a real-time experience, that would be low latency. One type of innovation is these DAG-based protocols. These are protocols that have two different layers, and they

• 15:48Speaker 00

  really push the throughput of these systems quite a bit. We've seen this, for example, in Sui and protocols like Mr. Seddy. That's one family of major improvements. And the other one was a focus on trying to reduce latency. Can you reach Byzantine agreement with very, very few round trips? And we've seen these new protocols that have two different modes, so a regular mode that maybe has three message delays and a fast path that has just two message delays. And this is the optimal thing that you could expect, even in a non-Byzantine setting. You could just think about this. It's really just a server sends it to all replicas and gets a response back and the transaction is committed. So really, you get the smallest latency that you could possibly imagine.

• 16:27Speaker 01

  Yeah, and I think this is a very cool approach. This is basically just optimizing the common case, which is just usually a good idea. And this itself has precursors in the academic literature that predate blockchain technology, maybe most famously with Alpenglow, which is the proposed new version of Solana's consensus protocol, which I think will be rolled out in 2026. That's really an in-production of this idea. Like maybe 90-some-odd percent of the time, you can be super fast while losing little, if any, in the remaining percent from what you had before.

• 17:02Speaker 00

  Yeah, the way I like to think about this is from a systems design perspective, is that you want to have a wartime mode and a peacetime mode. So in peacetime, there's no failures. Everything is good. You want to be super fast and super efficient.

• 17:13Speaker 01

  And that's going to be most of the time.

• 17:14Speaker 00

  That's going to be 90% of the time or even more.

• 17:15Speaker 01

  And we now empirically can be just watching all these blockchains in production, empirically, we know that's most of the time.

• 17:21Speaker 00

  Exactly. I mean, there's cryptoeconomic incentives. So once you make attacking it not efficient, then people will attack it less and so on. And the thing is that you do want to be able to switch to wartime. So if you are under attack, then you do have a way to overcome, again, a massive attempt to corrupt your system. So I think these dual-mode protocols are fascinating and I think make a lot of sense in this world.

• 17:42Speaker 01

  One final thought on the influence of the academic literature on consensus protocols to modern blockchain protocols. I'd also say even just the language people use to talk about blockchain protocols and the guarantees they have, I'd say, is deeply, deeply informed by the foundations that were laid on the research side. Like even if it's just meant to be a purely practical blockchain protocol, still is an expectation that you would have, for example, optimal fault tolerance in partial synchrony, which is a bunch of academic words. I mean, it all translates to precise mathematical statements about a mathematical abstraction of the practical protocol. But yet, that has almost become table stakes for new generations of blockchain protocols. And so to me, just the whole way people think about what makes

• 18:27Speaker 01

  a protocol good or state-of-the-art, that is, I think, very deeply shaped by the last, now almost half-century of work in this field.

• 18:37Speaker 00

  Yeah, for us, this is extremely exciting because we come from a theoretical computer science. And here we have something that's extremely practical. As you said, the language and the way to think about these, to reason about these protocols, is actually using theory and mathematical abstraction. And this is a non-trivial idea, that you have a real-world system and you're actually using abstract mathematical thinking and you're using proofs and you're using that language in order to reason about your system. And what's, to me, even more exciting is that this is not a new idea. This is an idea that, as we're going to see, has been studied for 40 years in distributed systems. So there's this very deep and successful connection between relatively theoretical notions and mathematical models and things that are just in theory and practical systems that are

• 19:20Speaker 00

  deployed in real world, both in clouds in the 2000s and today in basically all blockchain protocols.

• 19:27Speaker 01

  Yeah, right. The famous quote is that the gap between theory and practice is always smaller in theory than in practice. But I will say, I really feel like this gap has been getting narrower, thanks to the efforts of lots of smart people, both on the research side and on the engineering side. I mean, it's not perfect convergence, but like you said, really, the theory being developed right now really is intended to usefully inform the next generation of in-production blockchain protocols. It's just very exciting to see that synergy between them.

• 19:58Speaker 00

  Very much. And for me, I think it's because it's a two-way street. So it's not that, oh, there's somebody sitting in every tower and writing theorems. It's actually, you see what's happening in practice and you analyze that and then you realize, oh, you can... So there's two-way connections. It's extremely important and was very fruitful, I think, for both sides.

• 20:14Speaker 01

  And I would guess for both, there's a Lampard and Barbal Liskov. I mean, anyone can see there's a really major loop between the theoretical innovations and the practical solution. So I'm sure we'll hear more about that from them as well.

• 20:30Erik Torenberg?

  Thanks for listening to this episode of the A16Z Podcast. If you liked this episode, be sure to like, comment, subscribe, leave us a rating or a review, and share it with your friends and family. For more episodes, go to YouTube, Apple Podcasts, and Spotify. Follow us on X at A16Z and subscribe to our Substack at a16z.substack.com. Thanks again for listening, and I'll see you in the next episode.

• 20:56Erik Torenberg?

  As a reminder, the content here is for informational purposes only, should not be taken as legal, business, tax, or investment advice, or be used to evaluate any investment or security, and is not directed at any investors or potential investors in any A16Z fund. Please note that A16Z and its affiliates may also maintain investments in the companies discussed in this podcast. For more details, including a link to our investments, please see a16z.com/disclosures.