The Ethereum Network

Section VII: Ethereum Framework

Army Cyber Institute

April 9, 2026

Agenda

  • Explain transaction flow, signatures, and EIP-1559 fee mechanics.
  • Describe client diversity, sync modes, and P2P networking.
  • Trace how MEV arises from transaction ordering and how PBS addresses it.

Review: The Life of an Ethereum Transaction

In the last lesson we covered block structure and PoS consensus. Now we trace what happens inside those blocks – how transactions are built, priced, propagated, and executed.

  • A user signs a transaction – a message requesting a state change.
  • The transaction propagates through peer-to-peer gossip into node mempools.
  • Validators select pending transactions to include in blocks.
  • Every node re-executes transactions to verify the same post-state.
  • Receipts and logs record what happened for off-chain consumers.

TxLife A User / Wallet (EOA) B Mempool (P2P Gossip) A->B C Block Builder / Validator B->C D EVM Execution C->D E New State + Receipt D->E

Transactions: Structure and Flow

  • A transaction is a signed instruction from an EOA describing a desired state change.
  • Core fields define:
    • Ordering: nonce increments per account, ensuring sequential execution and replay prevention.
    • Resource bounds: gasLimit, maxFeePerGas, maxPriorityFeePerGas.
    • Intent: to, value, and optional data for contract calls.
  • Nodes verify the nonce before adding to the mempool; transactions with gaps are held.
  • Builders select transactions ordered by effective gas price, processing valid transactions per account in nonce order.
  • Each transaction produces a receipt with status, gas used, and emitted logs.
  • Type-1 and Type-2 formats add optional access lists and EIP-1559 fee terms.

ETH Execution-Network Message

ETHMsg TCP TCP / IP RLPx RLPx / devp2p (encrypted session) TCP->RLPx ETH ETH Subprotocol (msg code + payload) RLPx->ETH RLP RLP-encoded payload ETH->RLP

  • TCP/IP – standard transport layer
  • RLPx/devp2p – EC-based handshake, encrypted frames, capability negotiation (e.g. eth/68, snap/1)
  • ETH subprotocol – message code identifies the type: NewBlock, Transactions, GetBlockHeaders, etc.
  • Payload – RLP-encoded structs/lists; request IDs tie req/resp pairs

Transaction Fields and Signatures

  • Each transaction is digitally signed to prove control of the sender’s EOA.
  • The signed payload encodes: nonce, gasLimit, fee fields, to, value, data, chainId.
  • Encoding uses RLP (legacy) or SSZ (newer) for deterministic byte layout.
  • chainId (EIP-155) binds signature to a specific network.
  • to = null indicates contract creation; data holds init code.
  • Clients reject invalid signatures, bad gasLimit, or insufficient balance before gossip.

TxFields cluster_tx EIP-1559 Transaction chainId chainId nonce nonce maxPri maxPriorityFee maxFee maxFeePerGas gas gasLimit to to value value data data sig v, r, s

EIP-1559 Fee Mechanics

  • Base fee adjusts per block to target 15M gas usage; burned each block.
  • Users specify max_fee_per_gas and max_priority_fee_per_gas (tip to proposer).
  • Effective gas price = min(max_fee, base_fee + priority_fee).
  • Overpaying refunds the difference between max_fee and actual fee to the sender.

Gas Strategy and UX

  • gas_limit must exceed expected execution cost; unused gas is refunded (minus intrinsic cost).
  • Gas estimation relies on simulated execution; complex contracts may require manual buffers.
  • Reverts still consume gas up to the failure point.
  • Bundling actions into one transaction can save gas but raises failure risk.
  • Builders/relays may enforce inclusion lists or filters – consider for MEV-aware design.

MEV (Maximal Extractable Value): extra profit a block builder or validator can earn by choosing how to order, include, or exclude transactions.

The Mempool

  • When a user submits a transaction, it enters a local mempool (memory pool) – a holding area of unconfirmed transactions.
  • The EL gossips new transactions to peers via devp2p; within seconds most nodes have a similar (but not identical) view.
  • Transactions sit in the mempool sorted by effective gas price; builders pull the most profitable ones first.
  • The mempool is public by default – anyone running a node can watch pending transactions in real time.
    • This visibility is what enables MEV: searchers monitor the mempool to find arbitrage, liquidation, and sandwich opportunities.
  • Private/direct submission: users can bypass the public mempool by sending transactions directly to builders (e.g. via Flashbots Protect), hiding their intent until the block is built.
  • Each Ethereum account has a nonce (sequence number, not cryptographic) – a strict counter (0, 1, 2, …) that must increment by exactly one. Resubmitting with the same nonce and a higher fee replaces a stuck transaction.

Two Networks, One Chain

  • The Consensus Layer (CL) runs the Beacon Chain: validator duties, fork-choice, and finality. It speaks libp2p.
  • The Execution Layer (EL) runs the EVM, maintains world state, and manages the mempool. It speaks devp2p/RLPx.
  • They are joined locally by the Engine API (JSON-RPC):
    • CL sends EL: the execution payload (block header + transactions) and fork-choice state (head, safe, and finalized block hashes).
    • EL replies: VALID (executed, state root matches), INVALID (state root mismatch or bad transaction), or SYNCING (EL hasn’t caught up to the parent block yet).
  • The CL uses this status to accept or reject the block for its fork-choice rule.

EngineAPI CL Consensus Client (libp2p) API Engine API (JSON-RPC) CL->API head block API->CL status +  latestValidHash EL Execution Client (devp2p) API->EL block header + transactions EL->API  VALID / INVALID / SYNCING

Block Production: Anatomy of a Slot

Every 12 seconds, one validator is selected to propose a block. Here is the sequence:

  1. The CL selects a proposer for this slot via the RANDAO-based shuffling algorithm.
  2. The proposer’s CL calls engine_forkchoiceUpdatedV* with payload attributes, telling its local EL: “start building a block.”
  3. The EL assembles an execution payload from its mempool – selecting transactions by effective gas price, respecting per-account nonce order.
  4. The CL retrieves the payload via engine_getPayloadV*, wraps it into a Beacon block (adding attestations, slashings, sync committee data), and signs it.
  5. The signed block is broadcast via libp2p GossipSub to the rest of the network.
  6. Receiving validators pass the execution payload to their own EL via engine_newPayloadV*, which re-executes the transactions and returns VALID/INVALID/SYNCING.
  7. If VALID, the CL attests to the block, and after enough attestations accumulate, the block is justified and eventually finalized.

Nodes and Clients

  • Execution clients (Geth, Nethermind, Besu, Erigon) run EVM and state transition.
  • Consensus clients (Prysm, Lighthouse, Teku, Nimbus, Lodestar) run Beacon Chain logic.
  • Three primary node types:
    • Full node – runs both an execution and consensus client. Stores current state, verifies every new block. Validators pair a full node with a validator service to propose and attest. Non-validating full nodes verify independently without staking.
    • Archive node – a full node that also retains all historical state (terabytes). Required for queries like “what was this contract’s storage two years ago?” without recomputation.
    • Light client – stores only block headers and requests Merkle proofs on demand. Minimal resources, but depends on at least one honest full-node peer to serve proofs. Typically runs only a consensus light client; execution-layer light clients are still maturing (portal network).

Client Diversity & Pairing Practices

  • Diversity mitigates correlated bugs, as shown in these examples involving Prysm:
    • May 2023: Prysm and Teku clients choked on attestations with old target checkpoints, causing resource exhaustion.
      • Finality was lost for multiple epochs – the first time ever on mainnet – triggering Ethereum’s inactivity leak mechanism.
      • Non-affected clients maintained the chain; patched in Prysm v4.0.4.
    • Dec 2025 (Fusaka upgrade): a bug in Prysm v7.0.0 caused nodes to reprocess stale attestations, exhausting CPU/memory.
      • ~23% of validators affected; participation dropped to ~75% (nearly breaching the 2/3 finality threshold).
      • ~248 blocks missed over ~4.4 hours; validators lost ~382 ETH (~$1.18M).
      • Resolved via an emergency runtime flag, then permanent fix later.
    • In both cases, client diversity prevented a full finality failure.
  • Community dashboards track share of each client combination.
  • Some organizations run canary validators before upgrading production fleets.

Sync Modes & Data Availability

  • Full sync replays blocks from genesis; resource-intensive but trust-minimized.
  • Snap sync (geth/Nethermind) downloads state snapshots + verifies Merkle proofs.
  • Archive mode retains historical state for each block – required for some analytics.
  • Light clients track headers, request proofs on demand (in development via portal network).
  • Checkpoint sync (post-Merge default) starts from a recent finalized checkpoint.

Execution-Layer Networking (devp2p / RLPx)

  • The devp2p stack defines how Ethereum nodes discover, authenticate, and communicate.
  • It includes:
    • Discovery (v4/v5): UDP-based peer discovery using Ethereum Node Records (ENRs).
    • RLPx transport: session handshake, encryption, and multiplexing over TCP.
    • Capability negotiation: peers advertise supported subprotocols (e.g., eth/66, snap/1).
    • Subprotocol messaging: each capability defines its own message set and encoding.
  • Typical message types:
    • eth: NewBlock, NewBlockHashes, Transactions, GetBlockHeaders, GetBlockBodies.
    • snap: GetAccountRange, GetStorageRanges, etc. for fast state sync.
  • Peer scoring and limits protect against spam and eclipse attacks.

Aside: Trust Mechanisms in Ethereum Networking

  • Ethereum clients operate in an open, permissionless network – every peer connection must be evaluated for trustworthiness.
  • Remember the peer scoring and reputation models from our trust and P2P lectures? Ethereum clients implement exactly those ideas.
  • Examples of peer-scoring behavior:
    • Responds correctly to requests: score increases.
    • Serves stale or malformed data: score decreases.
    • Floods invalid transactions or blocks: large penalty or disconnect.
    • Fails to respond or times out repeatedly: moderate penalty.
    • Maintains reliable connection and valid data exchange: slow positive drift.
  • Client implementations:
    • Geth uses numeric reputation scores (−3000 to +100).
    • Nethermind and Erigon use adaptive credit and bucket models.
    • Besu tiers peers into trust levels with exponential backoff for misbehavior.

Consensus-Layer Networking (libp2p / GossipSub)

  • The consensus layer (Beacon Chain) uses libp2p, a modular P2P framework from IPFS.
  • libp2p provides:
    • Transports: TCP, QUIC, or WebSockets for secure, multiplexed connections.
    • Encryption: Noise or TLS handshakes for authenticated channels.
    • Peer discovery: via bootnodes, DNS records, or discovery topics.
    • Pub/Sub overlay: GossipSub for message dissemination.
  • GossipSub organizes messages by topics:
    • Beacon blocks, attestations, sync committees, voluntary exits, etc.
  • Each topic forms a rotating mesh of peers to balance bandwidth, diversity, and resilience.

Maximal Extractable Value (MEV)

  • MEV is the extra profit a block producer (builder or validator) can earn by choosing how to order, include, or exclude transactions in a block.

  • Arbitrage – exploit price gaps between DEXes.

    • Ex: token at 100 DAI on Uniswap, 102 on Sushiswap.
  • Liquidations – seize undercollateralized loans.

    • Ex: Aave loan below threshold; liquidator gets 5% discount.
  • Sandwich attacks – front/back-run a user’s swap.

    • Ex: buy before Alice’s swap, sell after, profit on price move.
  • Censorship/delay – withhold transactions for advantage.

    • Ex: delay oracle update to profit from stale prices.

DeFi terms: DEX = decentralized exchange (e.g. Uniswap). DAI = USD-pegged stablecoin. Aave = decentralized lending protocol.

Builder / Relay Stack and MEV

  • Goal: separate block proposing (validator duty) from block building (searching for profitable transaction orderings).
  1. Searchers Off-chain actors scanning the mempool for MEV opportunities.
    • Submit bundles of transactions with bid values to builders.
  2. Builders (off-chain)
    • Aggregate normal txs + MEV bundles to assemble full blocks with estimates of value/gas use.
  3. Relays (off-chain coordination services)
    • Receive built blocks, verify validity, and blindly forward block headers (hash + bid value) to validators running MEV-Boost.
  4. Validators (Proposers) (on L1 consensus layer)
    • Run MEV-Boost client alongside their validator software.
    • After signature, relay releases the full block body for inclusion.

Conclusion: Putting It All Together

  • Transactions and Execution: EOA -> mempools -> EVM execution.
  • Networking: Distinct but coordinated P2P networks:
    • The execution layer (devp2p/RLPx) gossips transactions and execution payloads.
    • The consensus layer (libp2p/GossipSub) spreads attestations, block proposals, and sync data.
  • Economic Design: base fees that burn ETH and priority tips reward inclusion.

Next: we look at what runs inside those execution payloads – smart contracts and Solidity.

References

[1]
Ethereum.org, “Transactions — Developer Docs.” 2025. Available: https://ethereum.org/en/developers/docs/transactions/
[2]
Ethereum.org, “Networks — Developer Docs.” 2025. Available: https://ethereum.org/en/developers/docs/networks/
[3]
Go-Ethereum (Geth), “Getting Started.” 2025. Available: https://geth.ethereum.org/docs/getting-started
[4]
Ethereum.org, “JSON-RPC API.” Accessed: Mar. 18, 2026. [Online]. Available: https://ethereum.org/en/developers/docs/apis/json-rpc/
[5]
Ethereum.org, “Nodes and ClientsDeveloper Docs.” 2025. Available: https://ethereum.org/en/developers/docs/nodes-and-clients/
[6]
V. Buterin, E. Conner, R. Dudley, M. Slipper, I. Norden, and A. Bakhta, EIP-1559: Fee market change for ETH 1.0 chain.” Accessed: Oct. 27, 2025. [Online]. Available: https://eips.ethereum.org/EIPS/eip-1559
[7]
Ethereum.org, “Gas and FeesDeveloper Docs.” 2025. Available: https://ethereum.org/en/developers/docs/gas/
[8]
Flashbots, Ltd, “Flashbots.” Accessed: Oct. 27, 2025. [Online]. Available: https://www.flashbots.net
[9]
Ethereum Developers, “Proof-of-stake (PoS).” Accessed: Oct. 27, 2025. [Online]. Available: https://ethereum.org/developers/docs/consensus-mechanisms/pos/
[10]
Ethereum Developers, “Block proposal.” Accessed: Oct. 27, 2025. [Online]. Available: https://ethereum.org/developers/docs/consensus-mechanisms/pos/block-proposal/
[11]
Ether Alpha, “Client Diversity | Ethereum.” Accessed: Oct. 27, 2025. [Online]. Available: https://clientdiversity.org
[12]
Beaconcha.in, “Ethereum Beacon Chain epochs 200750–200756: Finality issues.” Accessed: Mar. 27, 2026. [Online]. Available: https://beaconcha.in/epoch/200752
[13]
M. Hristov, “Ethereum Validators Lost Over $1 Million to Prysm Bug.” Accessed: Mar. 27, 2026. [Online]. Available: https://beincrypto.com/ethereum-validators-lost-over-1-million-to-prysm-bug/