  Filecoin is the largest storage-based open-source blockchain, both by storage
capacity (>11EiB) and market capitalization. This paper provides the first
formal security analysis of Filecoin's consensus (ordering) protocol, Expected
Consensus (EC). Specifically, we show that EC is secure against an arbitrary
adversary that controls a fraction $\beta$ of the total storage for $\beta m<
1- e^{-(1-\beta)m}$, where $m$ is a parameter that corresponds to the expected
number of blocks per round, currently $m=5$ in Filecoin. We then present an
attack, the $n$-split attack, where an adversary splits the honest miners
between multiple chains, and show that it is successful for $\beta m \ge 1-
e^{-(1-\beta)m}$, thus proving that $\beta m= 1- e^{-(1-\beta)m}$ is the tight
security threshold of EC. This corresponds roughly to an adversary with $20\%$
of the total storage pledged to the chain. Finally, we propose two improvements
to EC security that would increase this threshold. One of these two fixes is
being implemented as a Filecoin Improvement Proposal (FIP).
