Seeing like a protocol

Transcript

[Music] foreign [Music] yes okay hi hi everyone bonjour uh really glad to open ECC this year with my talk seeing like a protocol my name is barnabemono I'm a research scientist at the robust incentives group it's a

research team of the Ephraim Foundation we mostly deal with mechanism design protocol crypto economics and there'll be a few talks from us today and so what is this seeing like a protocol about what I really want to try and give a perspective on today is the idea that there are some things that the protocol sees and the protocol being the ethereum protocol it's FCC and there are some things that the protocol doesn't see and kind of hides its face about as we all know today the protocol itself is only one part of the ethereum ecosystem there's a lot of infrastructure that has been developed in the recent years it's increasing very

rapidly there's a lot of innovation in all of these different parts that I'll go about one by one in this talk and so my plan today is to try and give you a sense of what this map is and how we think about it in terms of protocol development and so I wrote this piece a couple of months ago trying to address these questions that I've been asking myself for now some time as I've been doing more and more research on the ethereum protocol and namely these questions are where does protocol credibility come from because oftentimes we feel like we need to enshrine things in the protocol because the protocol has more power because the ethereum protocol is more

highly regarded or has can do things that maybe infrastructure that's developed on the protocol cannot do and and when we do this we have to ask ourselves well if we keep putting things in the protocol what is the capacity of the protocol and how much can it defend because it's really a question of how do you defend these mechanisms that you've enshrined in the protocol and then what is the relation between the ethereum protocol and other domains that may interact with it and I think this relation is very important when you think about the defense too so I just give you the tldr now um but that's basically the tlr post is the idea that the protocol is really set

up by this diffuse Community which is you me everyone in this room people attending conferences people using ethereum to do their economic transactions yeah many stakeholders that will be too long to to enumerate and how is politically set up you have this process of governance which is what we know as the rough consensus trying to add things to the protocol trying to decide well how should we shape ethereum so that it suits our needs and really the ultimate goal of a protocol to me at least but to many people I expect is the decentralized provision of blog space for users to achieve maximal welfare so we want to satisfy the maximal amount of economic needs with our protocol and the

implication of that if you want to maximize the user welfare it means that we need to minimize the rents of people who are running the protocol and so to achieve this goal the protocol that the community has set up delegates is execution to a set of operations that we know as validators in proof of stake and that we knew as miners in proof of work but the delegation is not without issues when we delegate things we have what we call a principal agent problem and then we need to ensure that the people we delegate things to are aligned with our objectives so we need to ensure that the validators are aligned with the objectives of a protocol and so two ways

that we kind of keep check on their work uh with these two things so think of it as like information and action so first one is protocol introspection so we try to build into the protocol ways to obtain credible signals about the environment or about the performance validators in the protocol State and by building these signals we can then act upon them so you have the second step of protocol agency which is that we respond to the signal that we get with either updates to our state with Rewards or with punishments to validate us and so you really have this relationship between the protocol and the and the validators here but with this opportunity so

building in introspection building an agency it gives us let's say more space it gives us more room to to act upon things and to control the environment that the protocol evolves in but it also means that there are threats and one thread for instance one threat to introspection is that most of the signals that the protocol gets they actually come from validators themselves and so the validators may try to attack The credibility of a signal for instance by credibly committing to doing rational majority attacks or to doing many other attacks that have been discussed for now at least even since Bitcoin existed and now afraid to to protocol agency when we when we say okay we're going to

shape the behavior or validators or shape the behavior of a protocols that we achieve these outcomes that we want then we might end up being too prescriptive about these outcomes we might say you know we really want eip1559 to burn things we want PBS to be enshrined so that we have this block production that happens trustlessly by the protocol we enshrine some kind of Market structure but the more we enshrine the more we have to ask ourselves are we optimizing for the right thing because when we're trying something we're trying some kind of mechanism and we're enshrine the outcomes that we are trying to induce with this mechanism and if we choose wrong we might optimize for the wrong thing and so yeah that's pretty much with the

idea now I just want to go through like some of these uh bubbles that were on the initial map I'll talk a bit about first the validators as consensus allocators and it's really the foundational role of validators we're here to come to consensus over some state of a ledger and to get these consensus then approved by the larger let's say community so how we do that is the consensus protocol which is known as the consensus layer in ethereum it specifies rewards and penalties to evaluate the work of the validators so some of the rewards you have a block rewards when you make a block and you include votes from validators you have summary world when you are voting correctly so that you

induce consensus and then you also get rewards from having transaction fees from the execution payload in proof of sake we have this property that we can also penalize directly validators we don't need to rely on the extrinsic energy spend as a as a penalty to to the operator so we can for instance penalize the validators if they are inactive within activity penalty we can penalize them with a slashing if they do fold that are attributably bad and so the whole release that with this fairly comprehensive system of rewards and penalties we align the validators with the duty of making the blockchain that matches the specification of a

protocol but at the end of the day though we try to reason as much as possible about you know the equilibrium properties of saying rational validators will follow the protocol Etc we can still ask ourselves question that well is the protocol that we are writing really incentive compatible for validators to to follow and so one way that we've seen that is so here is another way of saying it is the ethereum protocol has a partial view on what the validators are doing and this partial view is obtained with these rewards and penalties but among things that the protocol does not see is is timing it has a loose vision of timing it knows that blocks arrive at a certain time but it doesn't

have like a very precise vision and something we've explored in our latest paper with among others Casper and Tomah is this idea of timing games that validators may have this rational incentive to to try and carve out more time while they are doing their duties so instance if it's my turn to propose a block I might want to wait a second or two more so that I get more Mev and get more profitable blocks and get more revenue for myself but if everyone is waiting for a tiny bit more then it just starts delaying everyone Downstream and so that can lead to potentially bad consequences and so we have this paper that came out um I I won't say too much about it

because right after this Tokyo we have Casper in the same room telling you all about this okay so that was the first role of validators validators as consensus agents consensus allocators now I want to talk about validators as resource allocations which is to me the second most important function of validators is this idea of providing blog space providing gas so that the users can run their transactions and this is a mental model that I've adopted for some time now the idea of the protocol essentially gives gas to validators almost like lens

gas or sales gas to validators so that the validators can use it to satisfy user transactions so thinking of validators as as market makers between on the one hand the supply of gas which is protocol determined and protocol sold and the users who want to use this gas so that they can execute their their transactions and the validators are in the middle we are trying to make that allocation we are trying to make that market and what comes out of this is the build blocks so of course there are constraints on this market for one thing they can't use more than the gas limit for instance when we make a block but another constraint that we have since August 2021 is eip1559 which is

really you can think of it as a way for the protocol to have this introspection over the demand for its resources it's a really really powerful signal if you don't know eip1559 this idea that a transaction needs to pay at least a minimum fee to enter the chain and how this minimum fee is determined think of it as like uber search pricing when too many people want to go on chain the minimum price raises and tries to eliminate as much demand as possible to equalize the supply and the demand when the fee is too high and people are not willing to pay it the fee decreases automatically to then again readjust and let more demand in this is done with this update rule that

is here there's a we've already talked about it quite a lot so we yeah find more details in in many of our talks but what's powerful with vip1559 is that it's a very generalizable pattern like we found this way to get this credible signal for let's say the execution gas and we realized well actually you can use it for pretty much any kind of resource that the protocol is is giving and nowadays we know that there's a kind of special type of users on our protocol which are rollups and Roll-Ups they require this resource which is data availability we need to post their data on chain to secure themselves and so now what we can do is separate the ip1559 between the execution gas as we know it

today and with data gas that allows the Roll-Ups to to post their blobs and so now the validators are market makers between these two um these two users hmm and all right okay and so now the protocol starts having some Vision over the over the rollups thanks to this EIP 4844 which adds the data availability facility to the

provision of gas okay what's next let's do the builders and so for that I want now to think about validators as state allocators so resource is really I give you the raw material to execute your transactions but now as a validator I also have some control over the state transition that will happen in my blog I choose the order of transaction I choose what gets in what does not get in and so that gives me some power over allocating the state to certain users so if I have two users that want to do the same Arbitrage ultimately me as a validator as a block producer I'm the person who's going to decide which one of the two is going to be able to perform that Arbitrage or not

and so what we've observed is that far away from the vision from the side of the protocol the validators have started to delegate the construction of their blocks to the builders and how this delegation is done is we have a auction today is known as MAV boost an auction where Builders are trying to compete to return as much profit to validator as possible so it's rational for evaluator to to join this auction and to let the builders compete to return as much revenue as possible and so this is what we we observed today but the question of course is well if this is so systemic and it really is because about 90 percent of ideators are currently using this system if it is so systemic should the protocol have

something to do with it like should we ensure that the system is properly backed up and doesn't induce some kind of new failure modes on the protocol so yeah the question is do we push the bubble of what ethereum sees all the way to the to the network of Builders and as I was doing the slide I was reminded of this French cartoon it looks exactly like uh Okay so you know um

I don't have any jokes okay the joke is that the protocol should also organize conferences and then we will backstop these types of failure modes okay now

okay we're back that means I get 10 minutes more right okay okay uh right so so we're asking ourselves if the protocol should have something to do with uh the Builder Network and and if it does it also gives us let's say some um ways of extending the zone of control so for instance in the future if a protocol was able to see that auction that's going on between the validators and the builders it could potentially capture the the revenue from this auction so it's this idea of Mev capture no one also has Mev burn or mev's moving depending on what you want to do with

the with the Mev but having this Vision over what the market is currently doing what this billiard proposal Market is doing allows the protocol to to backstop a fair exchange and to ensure that this fare exchange is done and that the protocol can capture the value yeah it's not working very well maybe I stopped moving yes

yep okay we're back whoo sorry about that um good so okay so once we maybe entering protocol Builder separation we start having some vision of what's going on with this network of Builders and so that potentially gives us this introspection over the market between these um Builders and proposals and also extends our agency in that now we have this action that we can actually capture the value and minimize the rents that the the proposals are getting um from this auction all right so next on the list is eigen

layer sorry before that yeah I want to say that even if we do and shrine epbs this Market of proposal Builder separation is only the tip of the iceberg of this what's known as supply chain or what we've called supply network and the idea that block production nowadays is so complex that you have all of these very specialized actors in the chain or in the network helping to build the blocks with one another and so even if we're enshrine epbs there's still a lot of things that we don't see from the protocols perspective and this is getting deeper and deeper or adding more and more layers as time goes

on with some things like account abstraction VIP erc4337 order flow auctions and many other things so super fascinating theme check out Thomas talk building M at 205 pm today all right so now moving on to validators as commitment allocations and so in our hierarchy so we had first consensus the fundamental agreeing on the data when we had resource providing this raw material when we had State allowing for the allocation of State transitions essentially and now we have this commitment which is in my sense a much

more powerful object than any of the other ones so commitment is really a specification of something you will do given some state of the world and so that has come to the fall uh we once eigen layer came out once there the ID came out the idea that the validator of stake can be encumbered the way you would encumber some kind of debt or Liam with with extra extra collateral let's say so how to encumber the data stack you do that by essentially adding slashing conditions to your own stake and so you're saying my stake is at

stake for proof of stake ethereum protocol for the consensus but now I also allow myself to be slashed if I don't satisfy these new conditions that I add on top of my own stake and these conditions they are written as evm programs we are basically smart contracts if a smart contract gets the signal that you did something wrong it makes which raises the flag and it says okay the stake of that validator actually also will get slashed for this reason Beyond being simply securing the ethereum protocol and so essentially what we're doing here what eigen layer is doing is letting validators make touring complete commitments secured by their stake it's a really really

powerful primitive but it can be a bit dangerous too because today the protocol is blind for instance if your slash diagonal layer the protocol still thinks you're fully staked you are slashing on eigen layer that's an execution layer problem so the protocol doesn't really see that actually you have 32ef at stake but if the minute you get out the minute you withdraw you'll only get 16 if back so for you as a as a Staker you feel like you have 16 if at stake but from the protocol's perspective steel 32 E5 stake and that can be dangerous this misalignment and so one way to fix it is with the execution layer trigger role exits EIP

7002 and so that would allow once you're slashed by some eigen layer middleware with slashing could be communicated to the consensus layer to properly account for your actual stake but you can potentially go even further with something that I've written about called Pepsi protocol and first proposal commitments and it's the idea that now you tie the block validity so when the pro when the proposal is making the block you type a validity of this block to commitments that we entered into and really what this gives you is the idea of if your room has this general

purpose commitment engine and commitment that are secured by the validators take also known as a contract enforcing institution had tip uh Diego about this one and so by hope with Pepsi and it's currently under research and I would say pretty far from implementation but my hope is that it could generalize construction such as PBS which are really just commitments to using the block made by your Builder and and the Builder giving you the block and so potentially pepsiq will have like this more generalizable properties and potentially it could also span multiple domains so you could have commitments written on ethereum that have some sort of information from other

domains and that could make it fairly powerful and so I think of this analogy instead of having this power by Intel you could have secured by ethereum so you could have like these very general way of reusing validators take and so now you start having um some Vision on on what eigenlayer is is doing uh and I'm not going to talk about liquids taking dough I think it's a very interesting topic about alignment between liquid stickers and between the ethereum protocol as well but I will stop here for the cartography and some parting worlds so in all of these uh ways of seeing the validators I think

the most important way of seeing them is as agents of a community so as people that are there to execute the will of a community that set up the protocol and often the most of the mechanism that I described here so things like eip1559 things like entering PBS or math burn they really only work if a majority of validators are honest and so variators can disable the mechanisms if they wanted to they can already do things like timing attacks which are invisible to the protocol but maybe there are more powerful attacks out there that validators can rationally ape in and participate into so some things that are kind of on a radar is this idea

of commitment attacks and so for instance I could trustlessly bribe a bunch of validators to do something that's detrimental to the goals of a protocol so I could bribe them to to misreport some kind of signal and so what we're asking ourselves is whether the validator set is resistant to Coalition deviations from coalitions also known as strong Nash safety in Game Theory and so in these cases where we see the validators let's say deviating as a group you may require the community to to step in but the more mechanism you build into the protocol the larger and the larger is the fence that you have to to defend and so the question is yeah how far can this fence extend

but some let's say more optimistic view on this is the idea that with proof of stake specifically it's possible for the community to to intervene and Fork out but most of the time you don't want to do that because it's messy and because the reason why you set up this protocol in the first place is because you wanted to automate away all of the rewards all of the punishments all of inducing the outcomes of the protocol you didn't want to have anything to do with this so you set that protocol so you would just autonomously go and realize your goals and so that's really what we're trying to do right we're trying to commit to a course of action and have this introspection and agency help us realize these outcomes that we that we want

of course evalidators actively on domain either the community still provides that defense of Last Resort and so to me how I now summarize it is the idea that credibility is both introspection and agency and with boundary condition of defenses of Last Resort and as a boundary condition if you don't password differential equations most of the time they're really like extreme conditions of your system that you may not ever reach but they really matter for how your system behaves as a as a whole and so yeah so with these with these norms and with these expectations we're really building up a room as an institution so as something that's greater than than just the the protocol

sorry that was a bit rushed but yeah that's the end of my talk check out our new website there's all of our talks papers and posts from the robust incentives group and get in touch if you are interested in these topics as well thank you [Applause] email [Music] foreign