  The LMD GHOST consensus protocol is a critical component of proof-of-stake
Ethereum. In its current form, this protocol is brittle, as evidenced by recent
attacks and patching attempts. We propose Goldfish, a new protocol that
satisfies key properties required of a drop-in replacement for LMD GHOST:
Goldfish is secure in the sleepy model, assuming a majority of the validators
follows the protocol. Goldfish is reorg resilient so that honestly produced
blocks are guaranteed inclusion in the ledger, and it supports fast
confirmation with expected confirmation latency independent of the desired
security level. Subsampling validators can improve the communication efficiency
of Goldfish, and Goldfish is composable with finality/accountability gadgets.
Crucially, Goldfish is structurally similar to LMD GHOST, providing a credible
path to adoption in Ethereum. Attacks on LMD GHOST exploit lack of coordination
among honest validators, typically provided by a locking mechanism in classical
BFT protocols. However, locking requires votes from a quorum of all
participants and is not compatible with fluctuating participation. Goldfish is
powered by a novel coordination mechanism to synchronize the honest validators'
actions. Experiments with our prototype implementation of Goldfish suggest
practicality.
