  Digital money can be implemented efficiently by avoiding consensus. However,
no-consensus implementations have drawbacks, as they cannot support smart
contracts, and (even more fundamentally) they cannot deal with conflicting
transactions. We present a novel protocol that combines the benefits of an
asynchronous, broadcast-based digital currency, with the capacity to perform
consensus. This is achieved by selectively performing consensus a posteriori,
i.e., only when absolutely necessary. Our on-demand consensus comes at the
price of restricting the Byzantine participants to be less than a one-fifth
minority in the system, which is the optimal threshold. We formally prove the
correctness of our system and present an open-source implementation, which
inherits many features from the Ethereum ecosystem.
