The Geography of Trust: What Solana's SIMD-0675 Asks the Network to Believe

Over the past seven days, a single document has been moving quietly through Solana's governance machinery, and almost nobody is talking about it — which is precisely why it deserves our attention. SIMD-0675, filed on September 29 by Roger Wattenhofer and Quentin Kniep, proposes something deceptively modest: reorder Solana's block production so that validators sitting physically near one another hand off leadership to one another in sequence. The authors' own simulation reports average handoff latency falling from 36.2 milliseconds to 17.0, and median latency collapsing from 23.4 milliseconds to 4.5 — a fifty-three percent improvement, produced on paper, on a chain that has not yet deployed a single line of it. I have spent enough years auditing protocol proposals to be suspicious of numbers that arrive before the code does. In 2017, I withdrew from a token sale that would have paid me handsomely, and spent three weeks inside the relayer architecture of a young decentralized exchange instead, because I wanted to understand where freedom actually lives. The lesson from that exercise has never left me: the interesting question is never the headline metric. It is the input the metric silently depends on. And SIMD-0675 has exactly one such input — the physical location of every validator — which the Solana network, by its own architecture, cannot verify. Let me be precise about what this proposal is, because the framing matters more than the figure. SIMD-0675 is not a consensus change. It does not alter the validator set, the stake weights, or the leader selection itself. It is a scheduling-layer optimization, a reordering pass that sits on top of Solana's existing stake-weighted random scheduler. The mechanism is a two-step process. First, the network computes its leader schedule exactly as it does today — random, weighted by stake. Second, and this is the new part, it regroups the resulting leader windows into clusters the authors call bins, using reported geographic proximity as the organizing principle. Every validator keeps precisely the same number of windows it was always going to receive. What changes is only when those windows arrive, and who precedes them. The payoff rests entirely on Alpenglow, Solana's in-progress consensus overhaul. Alpenglow introduces fast leader handoff: instead of a full gossip round, the outgoing leader sends its block directly to the incoming one. That makes the physical distance between consecutive leaders a first-order determinant of handoff latency. Under random scheduling, validators clustered near large stake concentrations tend to be close to the leaders they follow; validators on the periphery get stuck with what the authors call long jumps. Reordering by geography is meant to eliminate those long jumps — nothing more, nothing less. It is a patch on Alpenglow's performance, and its value is bound to Alpenglow's fate. The authorship matters here. Wattenhofer is Anza's head of research and a professor at ETH Zurich; Kniep is a researcher at both. This is not a stray academic paper drifting in from the periphery. Anza is a core Solana development entity, and Alpenglow is its flagship project. A proposal filed by Anza's own research leadership carries a shorter path from document to deployment than a community submission ever would. That cuts both ways: it means the idea is serious, and it means the idea may arrive with more momentum than independent scrutiny would justify. As of October 7, both SIMD-0675 and its companion location-registry proposal remain open pull requests. Neither is deployed. The scheduling proposal depends on the registry, because without a usable location input, the reordering pass has nothing to sort by. The two were filed the same day and opened together — a paired design, not two independent ideas. And on October 2, a third document appeared: an alternative approach, since truncated in the public record, suggesting the design is still iterating and has not converged. Here is where the analysis has to get uncomfortable, because the engineering is genuinely clever and the flaw is genuinely structural, and they are the same fact viewed from two angles. Start with the simulation itself. To measure the latency benefit, the authors reconstructed Solana's mainnet stake distribution from epoch 1038 — 661 validators — and mapped them onto urban areas using RIPE Atlas, with Globalping used to correct reported positions. Then they priced handoffs. And this is the detail that determines whether the seventeen-millisecond figure means anything: the simulation prices any handoff within the same metropolitan area as zero latency. Zero. Not small — zero. The authors assume that if two validators sit in the same city, the transfer between them is instantaneous. That assumption is the whole ballgame. A real intra-metro network hop is never zero; it is a few hundred microseconds at best, a few milliseconds at worst, and it varies by ISP, by peering arrangement, by time of day, by the congestion of the moment. When you build a model where the dominant cost of the optimized case is defined as nothing, you have not measured the improvement. You have measured the upper bound of it. The absolute figure of 17.0 milliseconds should be read as an optimistic floor on latency, not a prediction. The relative reduction — roughly half — is more likely to survive contact with reality, because it is a ratio between two scenarios that share the same optimism, and optimism largely cancels in a ratio. But even that ratio deserves skepticism until someone runs it on a testnet with real network conditions. As I learned modeling undercollateralized lending for underbanked populations years ago, a simulation is only as honest as the assumptions you refuse to question. The authors here questioned many of theirs. They did not question this one. Now consider what the proposal is willing to accept in exchange. The authors are admirably candid about the downside, and their candor is itself the tell. The draft documents that, under a three-window bin configuration, the network can experience six consecutive adversarial windows — a control sequence assembled from two bins placed back to back. The nominal safety boundary of a three-window bin works out to about 2.4 seconds of ideal time. But the design explicitly permits adjacent bins to extend continuous control beyond the configured bin size. So the nominal boundary is not the real boundary. The real worst case is longer, and it is longer by design, not by accident. When a proposal documents its own worst case, that is technical honesty. When the worst case is inherent to the mechanism rather than an edge condition, it is also a warning. Then there is the stake floor. The proposal sets a 10% stake floor for bin construction, which sounds like a robustness guarantee until you read the fine print: a completed bin may contain less than 10% of stake, and may contain repeated windows from the same operator. The floor governs the neighborhood radius the algorithm searches, not the actual concentration of control it produces. Those are different quantities, and only the first one is bounded. A floor on the search radius feels like a floor on control, and in well-behaved conditions it approximates one. In adversarial or merely sparse conditions, it does not. This is where the isolated-stake attacker enters, and it is the most vivid finding in the entire document. In the simulation, a single adversarial validator holding just 5% of stake — located in Sydney — was able to fill entire bins by itself, because Oceania contains no other validators to dilute it. The authors call this close to worst case. I would call it a demonstration that stake geography can become an attack surface, not merely a performance variable. The 10% floor does not defend against this, because there is no neighbor to enforce a floor against. The floor manages a radius; the attacker lives in an empty region. And the repeated-windows clause compounds the concern: even when the floor is satisfied, a single entity running multiple nodes in a bin may monopolize that bin at the operator level rather than the validator level. Concentration hides in the gap between validator identity and operator identity. The regional dimension is the second structural concern, and it cuts against Solana's own recent history. The draft acknowledges that regional power, network, or jurisdictional outages could affect consecutive leaders, producing longer runs of skipped slots than random scheduling would — and it explicitly notes the possibility of more effective regional censorship during a run. Bind block continuity to physical geography and you have partially exposed on-chain consensus to off-chain geopolitics. A three-window bin ideally spans 2.4 seconds, but regional exposure can cross bin boundaries. Anyone who watched 29% of Solana's stake go offline and bring the network to the edge of a freeze knows how quickly a regional correlation can become a systemic one. Geographic scheduling does not mitigate that failure mode. It amplifies it. What random scheduling scatters, geographic scheduling concentrates — and concentration is exactly what you do not want in the one variable that a single outage can move. And the trust gap underneath all of this is not incidental — it is the load-bearing flaw. The entire reordering scheme rests on a physical input the network cannot verify. Attackers can simply lie about where they are to manipulate their placement, and there is no on-chain mechanism to check the claim. A system that was designed to be trust-minimized is quietly downgraded to trust-reported. The location-registry proposal is meant to close this gap, but it cannot close it fully, because the problem is not measurement precision — it is the absence of any cryptographic anchor for physical reality. Globalping and RIPE Atlas are external instruments, and they sit outside Solana's trust boundary. To make the scheduler work, the protocol must reach outside itself and believe a third party about where its validators live. This is the same discipline I have had to apply to my own work. When I helped a major UK pension fund draft its Bitcoin thesis, the pressure was to reduce everything to financial metrics — hashrate, correlation, drawdown. I insisted instead on a section framing energy as a grid stabilizer, because I believed the ethical dimension was not decoration but the actual investment case. That fund adopted the nuanced view and allocated 2%. The lesson applies here with uncomfortable symmetry: the moment you reduce a system to a single convenient metric, you have already decided what you are willing to stop verifying. A latency figure is a convenient metric. A validator's location is not. In my current work, I spend my days building a provenance layer — a system that uses cryptography to verify that human-created content is human-created, in an age when synthetic media floods every channel. The whole point of that project is to make one specific fact verifiable: who made this, and was it a person. SIMD-0675 asks the network to accept a fact that is structurally similar and structurally unverifiable — where is this node — and to build an ordering decision on top of it. I do not say this to equate the two. I say it because I have learned, building the first, how much depends on the second. I want to be fair to the authors, because I think the instinct behind the proposal is sound. Latency is real, and long jumps are real, and the observation that Alpenglow's fast handoff makes predecessor distance matter is a sharp one. The question is not whether the idea has merit. It is whether the merit justifies the trust it imports. Every time we let a verifiable system depend on an unverifiable input, we do not merely accept a small inefficiency. We move a boundary. We teach the network that some facts are taken on faith. And once that precedent exists, the next unverifiable input is easier to justify than the last. Trust is not given; it is verified — and this proposal, however carefully, asks us to make an exception. Consider, too, the incentive direction the authors describe. The scheme is meant to nudge validators out of the existing hubs: if local handoffs are faster, an operator gains by relocating toward the geographic periphery where it will have fewer neighbors competing for scheduling quality. That is a real economic signal, and it is aimed at a real problem. Solana's stake, like every major chain's, is geographically concentrated. But a nudge is not a guarantee. The signal only works if operators respond to it, and the response depends on costs the simulation never models: the price of multi-region deployment, the latency of the operators' own internal infrastructure, the regulatory and operational realities of running nodes in new jurisdictions. The mechanism assumes a rational, mobile validator. Real validators are neither perfectly rational nor perfectly mobile. The measurement infrastructure deserves its own scrutiny. The simulation leans on RIPE Atlas for urban-area mapping and Globalping for position correction. Both are credible tools. Neither is part of Solana. That means the proposal's correctness depends on a chain of external dependencies — measurement network, correction methodology, urban-area definitions — each of which can drift, fail, or be gamed. If Globalping's correction is wrong for a region, the scheduler places validators wrongly there. If RIPE Atlas's urban boundaries do not match economic reality, the bins do not match economic reality. This is the hidden bottleneck: the proposal is not just a scheduling change. It is a scheduling change plus a trusted measurement pipeline, and the pipeline is the harder half to get right. Here is the angle almost nobody is taking, and it is the one I keep returning to. The proposal's stated benefit is not only speed. It is decentralization. The theory goes like this: if local handoffs are faster, validators are economically nudged to spread out of the existing hubs, and geographic diversity improves as a side effect. It is a lovely story. It is also, by the authors' own admission, completely unmeasured. The simulation tracks scheduling and latency. It does not track whether any operator actually migrates, and it does not track stake concentration afterward. The decentralization dividend is asserted as an expectation, not demonstrated as a result. Read that again, because it is the quiet scandal of the document. The proposal's most attractive claim — that it improves decentralization — is the one claim its own evidence never tests. We are being asked to accept a performance benefit that is optimistic, in exchange for a decentralization benefit that is hypothetical, secured by a location input that is unverifiable. Three soft spots stacked on top of each other, and each one is used to justify the next. And the deeper contrarian point is this: I am not sure the location-verification problem is even the hardest one. Suppose, generously, that someone solves it — that we get a location registry robust enough to resist forgery. The proposal could still fail, and fail toward centralization, because the operators best positioned to exploit geographic scheduling are the large ones. A well-capitalized staking operation can afford multi-region deployment and precise location reporting. A solo validator in a single rented rack cannot. Introduce a rule where physical placement determines scheduling quality, and you have handed an advantage to whoever can afford to optimize placement. The decentralization dividend may invert into a centralization tax on the small. That is the blind spot: the mechanism meant to spread validators out may reward the ones already large enough to spread. We have seen this pattern before — in NFT markets, where the blue-chip label concentrated attention and liquidity until, when liquidity dried up, nothing remained beneath the name. A geographic advantage could become the next blue-chip trap: a credential that looks like a feature and behaves like a moat. So what should we actually watch? Not the seventeen milliseconds — that number will not survive first contact with a real network. Watch the location registry, because if it cannot make self-reported positions trustworthy, the scheduling proposal never leaves the runway. Watch whether the October 2 alternative supplants this design entirely. And watch whether any independent party ever reproduces the simulation, because at present it has been validated by no one but its authors. The protocol remembers what the market forgets. Price never noticed this proposal, and price is right not to — it is an open pull request, not a shipped feature. But the decisions we make about where trust is allowed to enter are the decisions that outlive every cycle. Solana is being asked, gently and with good engineering, to trust a fact it cannot check. Whether that trade is worth half a handoff is a question no benchmark can answer. It is a question about what kind of network we are willing to have.