Competition, Collusion, and Corruption: The Spectrum of MEV Attacks on DAG-Based BFT Consensus Protocols

What it is

An arXiv paper (2609.20069, Mirzaei/Patel/Wu/Amiri, dated Sep 2026) that builds a four-family taxonomy of MEV attacks on DAG-based BFT consensus and empirically evaluates 50+ representative attack points across six named production protocols: Narwhal-Tusk, Bullshark, Mysticeti, AlephBFT, Mahi-Mahi, and Autobahn. The summary states the taxonomy and the top-line "design over sophistication" finding; below are the concrete results and the threat model an engineer needs.

The threat model that scopes every result

The adversary is rational, not Byzantine: confined to a "legitimate action set L" — the choices an honest validator could legally make. It picks (i) which valid parent blocks to reference (subject to the 2f+1 quorum), (ii) content and internal ordering of its own block, and (iii) when it broadcasts. It never forges signatures, equivocates, alters validity predicates, or breaks safety/liveness. DoS and liveness attacks are explicitly out of scope. This matters: every extraction the paper demonstrates works without breaking any protocol rule, so mitigation has to come from the ordering mechanism, not from tightening the fault model. A "bribe" is modeled as paying an otherwise-honest validator to make one specific legal choice (omitting a victim's parent references); the resulting messages are indistinguishable from an honest validator referencing a different valid parent set.

Specific findings worth acting on

• Mysticeti has an attacker-free ordering bias. Its rule breaks intra-round ties using the validator's identifier, so a low-numbered validator is systematically ordered ahead of a high-numbered one — an advantage present with no attack at all.
• Bribery beats compromise. A single malicious validator that bribes three honest validators achieves a higher success rate than four validators colluding outright. That same lone validator, acting alone without bribing, does worse than not attacking at all.
• Coordination is the multiplier; competition is not. Attackers each targeting their own victim gain nothing from one another (four ≈ one). Attackers colluding on a single shared victim gain with every added member.
• The success metric moves the number more than anything else. For back-running, the measured success rate depends heavily on how large a gap between attacker and victim block still counts as success — so cross-study comparisons that don't fix this definition are not comparable.

Named DAG-specific primitives include fissure (omitting a victim's block from the attacker's parent set), speculative, and sluggish.

Caveats

The paper does not model what a bribe costs (pricing a validator's willingness would require stake/reputation/slashing assumptions it declines to make) — it measures only what a bribe achieves. The evaluation covers one representative point per dimension value, not the full space, which the authors state is too large and partly uninformative to enumerate exhaustively.