Summary

FOCIL (Fork-Choice Enforced Inclusion Lists, EIP-7805) is the censorship resistance mechanism planned for Hegotá (H2 2026). A 17-member inclusion list (IL) committee is randomly selected each slot; each member creates an IL from their mempool view; builders must include all valid IL transactions or their blocks fail attestation. The protocol operates on a 1-out-of-N honesty assumption: even if 16 of 17 committee members are censoring, the single honest member’s IL transactions must be included.

How FOCIL Works

Per-Slot Flow

  1. At slot start, 17 validators are randomly selected for the IL committee.
  2. Each committee member creates an Inclusion List (IL) from transactions they observe in their mempool.
  3. ILs are propagated via GossipSub in the early part of the slot (first ~4 seconds).
  4. The block builder must include all IL transactions that are valid (meet gas fit and pass validity checks) at post-state.
  5. Attesters verify that the block satisfies IL conditions; they refuse to vote for non-compliant blocks.
  6. A block that violates ILs cannot become canonical (enforced by fork-choice).

Omission Excuses

Not all omitted IL transactions are violations. A transaction is excused if:

  • It doesn’t fit in the remaining gas (gas_left < tx_gas_limit)
  • It is invalid at post-state (nonce mismatch, insufficient balance, execution failure)
  • For FrameTxs: it fails the three-tier eligibility check (see below)

EOA/EIP-7702 vs. Frame Transactions

For standard EOAs and EIP-7702 transactions, the omission check is cheap: one account lookup per excluded transaction (nonce + balance). No execution required.

For Frame Transactions (EIP-8141), the standard proxy doesn’t work because the payer may differ from the sender (discovered only during VERIFY execution). FOCIL + Native AA (Thomas Thiery, Mar 2026) defines a three-tier eligibility check:

Tier 1 (static):

  • VERIFY frames precede DEFAULT/SENDER frames
  • verify_gas(tx) ≤ MAX_VERIFY_GAS_PER_FRAMETX (~100,000)
  • Transaction within the per-IL VERIFY budget (~250,000 gas)
  • Basic transaction sanity (chain ID, fee parameters, no blobs)

Tier 2 (post-state reads):

  • tx.nonce == state[tx.sender].nonce
  • tx_gas_limit ≤ gas_left

Tier 3 (bounded validation prefix replay):

  • Execute VERIFY frames against post-state
  • State access bounded to sender/payer account + N storage slots (N=2–4)
  • Check payer solvency

A FrameTx that fails any tier is excused. PQ signatures (Falcon) exceed MAX_VERIFY_GAS_PER_FRAMETX → FOCIL-ineligible at launch; propagate via private channels.

Builder Complexity for FrameTxs

After building the payload, the builder runs an iterative append loop:

  1. Try to append each remaining eligible IL FrameTx
  2. If any succeed, repeat from step 1 with updated state
  3. Stop when a full round appends nothing

This is O(k²) in the number of excluded eligible FrameTxs. With k=16 and the proposed gas parameters: ~22.7% of the block gas limit in VERIFY-gas. Needs benchmarking against real conditions.

Censorship Model

FOCIL enforces transaction-level censorship resistance, not block-level:

  • A censor cannot prevent a transaction from being included as long as one honest IL committee member includes it.
  • Committee members are randomly sampled → attacker would need >16/17 of committee members to be malicious to prevent a single transaction.
  • For 17 members and adversarial stake <50%: P(all 17 malicious) ≈ (0.5)^17 ≈ 0.00076% per slot.

Geographic Requirement

For FOCIL’s censorship resistance to hold across jurisdictions:

  • Committee members should be in different legal jurisdictions
  • If all 17 members are in the US/EU, a single regulatory action could apply to all
  • This requires geographic distribution of validators — currently lacking (78.7% EU+NA)
  • Non-Western validators as the “last line of defense” for jurisdictional diversity

Comparison to Alternatives

ApproachCensorship model
FOCIL (1-of-N)Weakest honesty assumption; strongest censorship resistance
Attester-IL (m-of-N)Stronger: requires m honest members; less censorship-resistant
OFAC-compliant PBSTransaction-level censorship possible if all builders comply
Encrypted mempoolPrevents ordering-based attacks; censorship of ciphertext still possible

FOCIL + encrypted mempool (LUCID) is the Hegotá combination: FOCIL prevents transaction exclusion; LUCID prevents front-running.

IL Size and Propagation

  • Current target IL size: ~8KB
  • Propagated via GossipSub in the first 4 seconds of the slot
  • GossipSub mesh composition matters: non-Western nodes pushed out of the mesh may have their ILs propagate late or not at all, reducing FOCIL’s effectiveness in those regions
  • IDONTWANT (GossipSub v1.2, deployed late 2025) helps with duplicate suppression for large messages like IL payloads

Interaction with Relay Block Merging

Relay block merging provides an alternative path for pre-confirmed transactions: if a proposer has committed to including a specific transaction (via a pre-confirmation protocol), the relay can append it to the winning block rather than rejecting the block for non-compliance. This enables pre-confirmations via relays without requiring builder integration.

Open Questions

  • What are the incentives for IL committee members? Currently no explicit rewards for inclusion list duty; members are implicitly incentivized by the network health argument.
  • Does the O(k²) builder append loop add meaningful latency in practice?
  • How does FOCIL interact with ePBS? Under ePBS, the builder commits to a payload hash before full block construction — does FOCIL enforcement happen before or after the ePBS commitment?
  • Can the VERIFY gas budget be raised in a later fork to make PQ signatures FOCIL-eligible?

Key Sources

  • FOCIL + Native AA (Thomas Thiery, Mar 2026) — primary; three-tier eligibility; O(k²) analysis; PQ exclusion; DoS resistance
  • Ethereum’s Geographic Blind Spot (Four Pillars, Mar 2026) — geographic FOCIL effectiveness; jurisdictional diversity requirement
  • Protocol Priorities Update for 2026 (EF, 2026) — Hegotá inclusion confirmed