  Existing committee-based Byzantine state machine replication (SMR) protocols,
typically deployed in production blockchains, face a clear trade-off: (1) they
either achieve linear communication cost in the happy path, but sacrifice
liveness during periods of asynchrony, or (2) they are robust (progress with
probability one) but pay quadratic communication cost. We believe this
trade-off is unwarranted since existing linear protocols still have asymptotic
quadratic cost in the worst case. We design Ditto, a Byzantine SMR protocol
that enjoys the best of both worlds: optimal communication on and off the happy
path (linear and quadratic, respectively) and progress guarantee under
asynchrony and DDoS attacks. We achieve this by replacing the
view-synchronization of partially synchronous protocols with an asynchronous
fallback mechanism at no extra asymptotic cost. Specifically, we start from
HotStuff, a state-of-the-art linear protocol, and gradually build Ditto. As a
separate contribution and an intermediate step, we design a 2-chain version of
HotStuff, Jolteon, which leverages a quadratic view-change mechanism to reduce
the latency of the standard 3-chain HotStuff. We implement and experimentally
evaluate all our systems. Notably, Jolteon's commit latency outperforms
HotStuff by 200-300ms with varying system size. Additionally, Ditto adapts to
the network and provides better performance than Jolteon under faulty
conditions and better performance than VABA (a state-of-the-art asynchronous
protocol) under faultless conditions. This proves our case that breaking the
robustness-efficiency trade-off is in the realm of practicality.
