Jorge Arce - A mechanism for decentralized maintenance of Lido's operator set

Transcript

thanks a lot ready are we ready okay please join me in welcoming to the stage Jorge AR who is a researcher at nethermind thank you very hello hello hello okay hello everyone good afternoon uh thank you for joining me for the very very last talk in the entire conference uh so I'm representing NM research here sorry this is upside down and uh today I'm going to talk about my name is hor researcher never mind and today I'm going to talk about a mechanism for decentralized maintenance of lios operator set with a focus on white labeling detection so that's a lot of

words I would like to give some context before we get into the uh NR of what the research is about um to give some context this uh research project we're going to talk about today is a collaboration that was born between Lio and NM researchers with the goal of Designing a mechanism for decentralized maintenance of lios operator set and to be slightly more specific here there have been efforts by Lio to introduce Community staking or permissionless staking to the protocol you may have seen a talk by Demitri one of lid's contributors uh I think earlier today on the introduction of the community staking module and this research fits very nicely with this community staking module that currently

Works only via a bonding mechanism and we are looking into more sophisticated mechanisms to increase the capital efficiency of this module and bring down the bonding requirements so stuff like identity um reputation and even civil resistant or Y labeling resistant mechanisms via uh game theoretical uh approaches or so are part of the sort of like prongs we're using to approach is research so this is a multiphase research project the for phase one we did whoops sorry about that for phase one we did a systematization of knowledge for identity and credentials this was completed late last year and we looked at over a 100

different implementations of uh identity decentralized identity and verifiable credentials stuff we selected like the 70 of those that we thought could be relevant to the problem at hand that could be integrated into a Lio permissionless staking module we delivered something that looks like that a big database where we indexed all of these papers we ranked them by relevance quality score uh and gave our recommendations as to what to move forward with I'll have a QR code later on for you to check all of these sources if you're interested and then for phase two uh which is the what's going to concern us for the res presentation today white label in resistance this was completed in late August uh this year and yeah as we said before this is one of the steps

towards enabling Li to unboard new operators in a permissionless manner and in a more Capital efficient way so that was phase one as we talked about uh phase two this is like a screenshot of the main uh part of the deliverable there's a QR code there if you want to have a look I'll also have the QR code at the very end of the talk um I'm just going to give a few seconds for people who have their cameras out awesome okay so I've been talking saying white labeling this white labeling that maybe I should motivate the problem as to why we care about white labeling uh let us Define very informally white labeling as what

happens when a note operator delegates their notes to another third party to run them for them without the protocol in this case Lio having any knowledge of that and there's a few problems with this Um this can lead to disproportionate control over the protocol over the protocol stake by a single entity without us being aware of that or being able to uh prevent it or intervene it can also weaken resistance to correlate slashing and it can introduce single points of failure if there's a single party that is holding a bunch of stake behind the scenes and finally we note that it is easier to deal with this with the uh standard W list uh module for where the majority of lios St is at the moment but as we

transition toward towards a permissionless uh mechanism for onboarding node operators or validators this can become harder and harder to deal with we can see that for light OD da the goal or the attribute that operators run their own nodes that is that there is no white labeling is high in the priority list right now it looks good for Li's current validator set as we go permissionless we have to be careful okay and so uh after some discussions between Lio contributors and Lio and nethermind researchers we began began to think about doing research on

the design of a decentralized dispute resolution mechanism for Lio that would penalize Miss behaving operators so it's hard to do this while labeling resistance in a fully decentralized fashion maybe a dispute resolution mechanism can be introduced such that um we look at the operator set or the validator set we identify any offenses that we would like to uh punish and we do so but in order to do this in a decentralized fashion what building blocks are required to construct this mechanism well um so let me walk you through the kind of things that we looked at we analyzed so-called arbit protocols and this is like an umbrella term that we're using for any kind of

protocol that can be used to look at evidence that happened either offchain or onchain and come to a resolution as to the meaning of that evidence so here we have prediction markets decentralized oracles or decentralized Justice protocols so we're looking at these seeing which ones are good assessing the feasibility of using them for the question we have um then we look at a very interesting part of the research which is mechanism design so if we are armed with such a protocol that can provide decentralized dispute resolution what kind of mechanism what kind of economic incentives what kind of bonding require ments you would have to introduce for all the parties to for all rational parties participating of this game to behave as intended and these parties are

node operators accus accusers and jurors I will Define them in a in a few slides and then finally as part of the research we also looked at evidence types against white labeling that is uh how can you okay you have a resolution mechanism for the evidence but what is the evidence how does white labeling look like on the validator set so that's just a bird type view of what the research was about here are the five tasks that we uh took that we uh set upon to resolve in detail and you can find more details in the deliverable so I'm going to give you a brief overview of some of the interesting findings of these tasks uh as much as time allows us in

this today and so let me start with task two um in the interest of Time s so on arbit protocols this time we looked at like 35 papers and implementations of arbitary protocols in the space we started looking at prediction markets which you can Define as well essentially any mechanism where or protocol where people can bet on binary outcomes of future events so you may have seen a few of these prediction markets going around and intuitively given that the prices of the binary options in a prediction Market allow you to interpret what is the mean belief of the Traders participating of the market and they're also back in the back in this up with capital you wonder is it possible to use this as a way for people to kind of like

in a decentralized manner resolve what is the meaning of a given piece of evidence unfortunately we have found that most prediction markets require some kind of trusted party to come in at the very end of the process and give resolution to the prediction market so of like say okay this was the truth this is the option that wins this is the option that loses despite it having been in the minority right so removing this uh trusted Authority from the prediction Market it's kind of hard and actually let lets us to naturally uh takes us to study other kinds of arbitrary protocols that we will explain next there's also decentralized oracles like the any mechanism for bringing

offchain data on chain and there's a few we're familiar with chain link uh there's Nest there's Yuma so on and so forth normally they use different types of economic incentives to remain decentralized and the main problem here although this is a step in the right direction already but there's many kinds of oracles that are not the most suited to deal with subjective interpretations of data so they're very good at reporting a numerical value or whether an event uh some kind of event but maybe not so much the significance of of that event and this is where we would like some kind of Oracle that was like more subjective to look at these kinds of things and so we come up on these third category of arbitrary protocols

decentralized justice so just a formal definition protocols that use blockchain technology to decentralized thep resolution by crowdsourcing the adjudication of disputes to a worldwide pool of will urer arbitrators so yeah you the most intuitive way to think about this is a subjective Oracle where what is related to the chain is a resolution as to what's the significance of a given piece of evidence um here similar to the case of decentralized oracles we leverage Financial incentives for people to rule truthfully for example we use something that that is known as shelling Point mechanisms where uh you have people you restrict people from communicating from

with each other and you ask them a question and so the natural equilibrium point that arises is sorry and I'm missing a very important part and you only reward the people that vote in the majority and you punish the people that vote in the minority assuming that people cannot communicate the truth arises as sort of a natural equilibrium although it can certainly be gamed uh if by some kinds of attacks which is something to be aware of when studying these protocols so yeah after looking at these things the centralized Justice protocols came out on top for our study and we analyzed a few of them we found some very interesting ideas on how to address the different kinds of attacks that are decentralized protocol normally

encounters by the claros protocol it seemed to be the most mature upon amongst the one we studied um and we also analyze some critiques of decentralized Justice by law experts but I'll spare you the details for now okay so let's say we are armed with a correct dispute resolution mechanism which could be either something like Claris or in the case that uh there are challenges towards the integration with such a tool then some kind of dedicated Fork of equivalent functionality then uh what we need to do next is the interesting part where you construct a mechanism that involves these three parties that I was referring to before you have the LI operators and you request you ask these people to post

a bond which by the way as we will see later or validate later this bond is much much smaller than the bond that you were required to post for General slash in protection uh this is good because it keeps the mechanism Capital efficient there's also and and if they misbehave if they do white labeling you take that Bond away there's the accusers so these are parties that will be incentivized via the uh via this game to submit a case with the appropriate evidence to the mechanism they post a bond they they also must post a bond in order to prevent any kind of griefing mechanisms where they just uh submit cases without any like substantiated evidence and they just are trying to you know uh game the mechanism so to prevent

this kind of spamming they also must submit upon and they are they stand to gain a reward if things go if uh they are found to be in the right and then there's the jurors who will will be appointed by the mechanism to arbitrate the dispute they should be knowledgeable uh to understand the significance of the evidence and uh they split a reward the court fees that are taken from the loose inside here's a brief diagram of how the whole thing can be put together you have the validator set up here especially for the permissionless case you have evidence providers these are people who are not an like directly appointed by anyone they are this is completely permissionless is they look at the validator set they put together a case

as to whether someone is doing white labeling or not and they submit an evidence to the dispute resolution mechanism which would integrate with lighter contracts and leverage some juror set in order to come to a resolution okay so the question as to what are the what's the right way to economically tweak this mechanism for the economic incentives to match the game theory for a rational actor is very interesting like to give a very intuitive and quick overview of what's going on you would compute the expected profit of someone using delegating their notes to a third party that is doing white labeling and

getting those middleman fees um you would so you would take that expected profit you would also consider sort of like the probability of being caught as a function of time and this is a probability distribution that becomes becomes large or we model it at something as something that becomes larger and larger as time goes by because the more evidence you're sending out uh sort of like the more you're doing this the more likely you're of being caught and given that probability distribution we computed okay what is the expected gain for this person before they get caught and so once you have that and involve some nice stochastic analysis of uh the the whole mechanism once you have that what is the punishment that you need to apply in

order to make these people be an expectation that is on average in the red if they try to apply white labeling to lose money on average if they try to do that and so this depends on a bunch of variables this depends on the price of ether ether this depends on the mean time for detection this depends on the probability of being detected this depends on the probability of the Court coming to A A just resolution because we cannot expect a perfect court and put all of these factors together we generated a simulation tool to be able to compute that crucial answer like what would be the necessary punishment to apply in order to have these people in expectation be losing money so that as rational actors they would not attempt

white labeling you can find this in the deliverable as well uh the the link the QR link that I shared earlier and I will share at the end as well and we come to this uh graph and to explain the significance of this this is the minimum accuser's reward that is the minimum reward that's that must be paid for a white labeling case as a function of the number of validators involved we have a linear offset here um simply because to make a small case worth the accuser's while you need to well provide some uh at least a minimum amount of payment and then you see that the scales actually well linearly but the slope is pretty small which is good because that means like for example for

100 validators if if someone is trying to Post 100 validators for the mechanism to gain this y Lael resistant property resistance property look at the Y axis we have something like five e or so so that means that with five ether or like approximately 0.05 additional eth per validator assuming the market conditions of uh a couple of months ago when the research was uh posted we could adequately collateralize against the threat of white labeling and this is like once again a very small percentage of what you would need to defend yourself against against slashing risks which is much more than that right at least one e per value later this is good because the goal of achieving adequate Capital efficiency this leads some Credence to the fact that this mechanism

could work for that and um our deliverable also provides uh bunch of other goodies which I encourage you to check out uh economic analysis abundant requirements and financial incentives um so kind of like the math behind those graphs and those tools that you saw a simulation tool to update the the the above off like these economic analysis versus market and Tech parameters I show a screenshot uh guidelines for a test net phase and experiments for initial initialization we want to validate these things with some kind of experimental phase that shows that our formulas are indeed uh indeed whole water a description of a fail safe mechanism what you would do if like uh the decentralized core just

stops working from uh overnight and strategies for how to achieve juror curation that is how to check that jurors know what they should know okay and then let's talk about task four which I have been talking about the game theory behind making this whole thing work but you may be interested in knowing okay what kind of evidence am I looking at what kind of identifying mechanisms am I looking at to see whether someone is doing white labeling or not on ethereum well um we reviewed the literature here and the known ecosystem insights on how you can gain sort of like additional information about a validator and who is running a validator behind the scenes and this has

actually been an interesting problem in the ethereum ecosystem for a long time to provide a couple of examples and I'll come back to what has been known for a while uh like this relates to the concerns to some concerns about validator anonymity that have been known since like 2020 in the ethereum uh ecosystems when like the transition to proof of stake was first proposed but coming back to the task at hand uh some ways in which you could do that in which you could identified white labeling would be one would be using machine learning classifiers or heris approaches that are trained on features of the validators related to the validator performance so by analyzing the the sort of like

metrics of validators you could come up with unsupervised machine learning approaches to kind of like attempt to Cluster those validators into their operator sets and you can ask like how effective is that like how much data we have to to make this work and I would direct you to some research a very interesting research I rated this article called solo stakers the backbone of ethereum shows how you would do exactly that and how they identified some clusters of whales that were um that that that it was highly consistent that they belong to the same person behind the scenes and they used this to identify 6.5% of validator indices that belong with very high probability to

solo stakers but we can adapt these techniques also for the purpose of clustering directly so that was one thing that we discussed another one would be and this is related to the whole validator uh to the discussions and validator privacy that have been going around in ethereum research for a while um networking layer analysis to correlate validators with the same beon node so you could have a crawler on the ethereum networking layer and this crawler looks at how added stations are propagated on the ethereum network to tell whether attestations belonging to different validator keys are likely to be originated from the same ethereum node that is from the same consensus

node which would uh be used as strong evidence that these validators are being connected to the same node hence being ran by the same same person with white labeling this works really really well especially if someone gets sloppy and just like delegates it to a major uh delegate delegates their validator to a major uh um node operator because they are likely to just mix validators with validators or of their own or validators of other parties now and the research goes or like the the deliverable we wrote goes into some more detail on how to make this how to make this work what are some future research directions to follow I would also point out that this is a starting point so long as we have the right

economic incentives in uh in the mechanism we talked about before the game theory would lead us would lead us to believe that the right people are going to come up and start doing this for profit right and this is Our intention with uh having a mechanism that allows people to once again uh make a profit by identifying the white labeling cases just to start wrapping it up some future research directions uh Beyond this phase two and going back to to the things that we alluded to at the beginning of the talk civil resistance it would be nice for us to have an economic analysis of how does a civil attack look like for our dispute

resolution mechanism and what kind of economic uh restrictions we need to impose to add civil resistance to the validator set state-of-the-art approaches to achieve civil resistance in our operator set we would like some more time to or go deep more deeply into the literature and come up with some ideas for civil resistance that work here and and protecting the juror set for civil attacks is also important reputation systems how can you connect these things with reputation so that you're incentivizing the correct behavior of jurors not just with capital but also with reputation um reputation for The Operators themselves and how all these things what's the big picture of these things put together so that would be it um I thank

you very much for your time and attention today we are NE mind research if I managed to convince you to have a look of our at our deliverable then here's the QR code again thank you very much [Applause] guys so if anybody has any questions they can raise their hands no okay um well thank you very much for coming and speaking uh this is actually the last Talk of the conference so thank you very much for coming to the [Applause] conference