A deterministic tiebreak guarantees that every reader who runs it gets the same winner. It does not guarantee that the winner was chosen fairly. If the secondary key is derived from bytes the submitting party controls, that party can generate many valid versions of its record, keep the one that sorts first, and submit only that version. The comparison stays deterministic, but the input to it has been selected.
This risk is laid out in a DEV Community post titled “Your deterministic tiebreak is a search space,” published September 24, 2026 by the ANP2 Network account. The post uses a claim-ordering protocol as its example. Its system details, including the ledger history it cites, are the author’s own account and have not been independently checked. The design lesson applies to any system that breaks ties with a value a participant can influence before binding.
How the tiebreak works in the example
The example queues competing claims and sorts them by the pair (declared_start_time, record_id). At each position the smaller value wins. The primary key is the declared start time. The secondary key, record_id, is described as a SHA-256 hash of the claim payload.
The payload contains an advisory estimated-completion field. According to the author, downstream execution does not read that field. Changing it by one second changes the hash, while the price, the promise and the ranking timestamp stay the same. The table below shows which fields matter for ordering and which only affect the identifier.
#1 Best Overall
| Field | Role in ordering | Effect of editing it |
|---|---|---|
declared_start_time |
Primary key; decides the winner unless two claims tie exactly | Not changed in the author’s example |
record_id (SHA-256 of payload) |
Secondary key; used only when start times tie exactly | Changes completely when any payload byte changes |
| Estimated-completion field | None; described as advisory and not read downstream | Changes record_id without changing price, promise or ranking timestamp |
| Price and promise | Not used for ordering | Left unchanged in the author’s edit |
The article does not say whether declared_start_time itself is part of the hashed payload. That detail matters for implementers, because it determines whether a party can move its own start time to create a tie.
Agreement is not the same as neutrality
Determinism answers one question: given two fixed records, do all readers agree on the order? The answer is yes. The question the article raises is different: before one record is bound, who can decide which records exist to be compared?
In the author’s account, a submitter can compute candidate identifiers locally and publish only a favorable one. Discarded candidates never enter the append-only record, so the other party and any later auditor see only the winner. The author puts it this way: “A value can look random to an observer and be highly selectable by its author.”
The author stresses that this is not forgery. Each candidate is a valid claim. The signatures verify, the content hash matches its payload, and the ordering rule runs exactly as specified. The attack lies in choosing among valid inputs, not in breaking any check.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow much searching buys
The author’s illustration assumes that the hash behaves like a uniform random function. If a submitter generates n independent valid candidates and keeps the smallest identifier, that smallest value beats one honest, fixed identifier with probability n/(n+1). For n = 4,096 this is 4,096/4,097, about 0.99976.
The author states the result directly: “Search about 4,096 variants and keep the smallest, and you win an exact tie against a single honest competitor roughly 4096 times out of 4097, assuming the hash behaves the way we already assume it behaves everywhere else.”
Rank #3
Three conditions limit the figure. It applies only when the declared start times are exactly equal, because the secondary key is never consulted otherwise. It assumes the candidates are independent and cheap to generate. It is a model calculation from the author’s assumptions, not a measurement from a production system.
Why a clean history does not clear the design
The author reports 1,443 claims and zero observed timestamp ties in the ledger history considered. Read in isolation, that looks reassuring. The author’s argument is that it shows the secondary branch was never exercised, which is a different claim from showing it is safe.
Two points follow. First, an append-only ledger records only what was submitted, so it cannot reveal valid variants that were generated and discarded before submission. Second, a branch that has never fired gives no evidence about what happens when it does. The author recommends forcing the branch under test rather than waiting for production to hit it. The history itself is the author’s characterization of an unnamed system, and the article does not provide a dataset that readers can check.
Rank #4
Mitigation options
The article proposes three ways to remove the search advantage. Each one moves cost to a different part of the protocol. They are compared below by who controls the tie-break input, when that input is fixed, and what the design must add.
| Option | Who controls the tie-break input | When the input is fixed | Cost added to the design |
|---|---|---|---|
| Committed, later-revealed round seed | The ranking side, which commits to the seed | At commitment, before any claim in the round binds | Round state, a reveal step, and a rule for a missing reveal |
| Ranking on load-bearing offer fields only | Participants still control any field included in ranking | When the record is submitted, so the protection depends on which fields are chosen | Ongoing maintenance of the field set and a canonical encoding; drift or alternate encodings can reopen the choice |
| Fresh binding tie round | Each tied party, once, in a new binding submission | At the new round, after the tie is known | An extra round trip, deadlines, and handling of parties that do not respond |
Committed, later-revealed round seed
The ranking side commits to a per-round seed before any claim binds, then reveals it afterward so that anyone can verify and reproduce the ordering. The article notes that publishing the seed before claims bind would let participants search against it, so the commitment has to come first. The cost is a reveal step and a rule for what happens if the reveal never comes.
Ranking on load-bearing offer fields
The full content hash stays in the record for integrity. The ranking, however, uses only the fields that determine what each party receives or owes. An advisory field such as the estimated completion time then cannot influence the order. This only works if the field list is kept current and encoded canonically. A new field added later, or two encodings of the same value, can give a submitter a new way to vary the result.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
Fresh binding tie round
When two claims tie, each tied party submits one new binding record before the tie is decided. A party that has to commit to a final version cannot search after seeing the other side’s choice. Simply asking for another payload is not enough. If the new round does not change the binding rules, the same search can happen again.
Choosing between them
The article does not name a universally better option. It frames the choice as a trade-off between statelessness, immediate resolution, and confidence that the ranked fields represent the substance of the offer. A design that needs no round state may have to accept a weaker tie rule, while a design with committed seeds accepts more operational state in return.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Reviewing an implementation
Use the following sequence to check whether a tiebreak can be searched. It is a code-review method drawn from the article’s approach, not a measured test.
- Trace the secondary comparator back to the exact bytes that produce it, including any fields added by serialization or defaults.
- For each of those bytes, determine whether the submitting party sets it or can change it.
- Count how many valid alternatives the party can generate, and check whether generating them is cheap and unobserved.
- Establish the point at which a record becomes binding, and compare it with the point at which the tie-break inputs become visible to others.
- Construct a reachable exact-tie case in a test environment, vary the candidate input, and confirm whether the winner changes.
Several conditions can make a payload-derived key safe, and a review should check for them before treating the design as exposed:
- Admission rules may cap how many candidates a party can submit.
- The identifier may be assigned after submission by a party the claimant does not control.
- The tie procedure may stop any participant from searching before a commitment is made.
The question to ask is whether one participant can evaluate several valid versions before exactly one becomes binding. If it can, the key is a search space, whatever its name suggests.
What the evidence does and does not establish
The source for this analysis is a single author article, published September 24, 2026 on DEV Community by the ANP2 Network account. The ledger, the 1,443-claim history and the implementation are not named or independently confirmed. The 4,096-variant figure is a conditional model calculation from stated assumptions, and it describes the exact-tie branch only. The reasoning about discarded candidates and search cost is the author’s analysis, and readers who operate a similar system should verify it against their own admission rules and binding procedure.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
