Ken Smith - Guarding Ethereum: Protecting Staking Pools from MEV Theft in the Upcoming Dencun Era

Transcript

thank you so next up we have Ken Smith and he's going to talk about guarding ethereum helping us from theft thank you very much so this is um this is a presentation that's talking about U some analysis I've been doing and and thought about um the risks of Mev theft uh in ethereum and this is especially uh um especially I guess focused on uh liquid staking pools these are um permissionless staking pools that would use a node deposit to um to bond a node operator to commit to acting honestly in the ethereum network so let's uh let's

take a look at uh at some of the information what I wanted to cover today was a little bit about the ethereum staking Concepts probably speaking to an advanced audience so I'll go quickly over that uh I want to talk a little bit about the problem of Mev theft and some of the strategies used to actually steal Mev and then uh spend the majority of the time talking about possible counter measures or solutions to prevent or mitigate the loss of value to liquid staking token holders um from Mev theft okay so this is um this is the the current staking Rewards or at least a a projected view of of staking rewards right I just looked uh uh prior to coming up here we just a shy of about

900,000 validators in the ethereum network um you know we can all all take estimates as to when we're going to get to a million validators but I've I've written um some modeling code in a in a previous report I did um and uh what we can do is we can kind of predict uh the two rewards that are that validators receive right they receive the consensus layer issuance rewards from the the core protocol uh for a single validator per year it's about 08 eth uh and then we can um predict Mev at least to to some degree and what do I mean by predicting Mev um one of the things we can do there's a there's a great um data set um that's in Mev pic's uh open data that has basically recorded

all of the successful Mev produced blocks uh for Mev boost and the amount of Mev that it's contained in there it keeps track of it for uh the time period between the merge and now I think it's about 470 some odd days worth of of data and one of the things we could do is we could model it using a a Monte Carlo method where we basically say hey let's go ahead and um and and choose a value of proposals based upon the probability that a validator will get and for each one of those predicted proposals in a year it's about maybe I think three proposals a year is what you're likely to get with a validator randomly go ahead and select one of those Mev blocks that was produced in the last 460 days

and let's let's assume that's going to be your Mev for this coming period okay now is that going to be true I don't know I mean as transactions move to layer one there may not be Mev it may be different it could be as people said it depends upon the price action and what day but if you if you say that past performance on Mev is probably indicative of future performance in Mev you can make a a fair modeling uh presumption of it and so what it shows is about 1.2 eth being produced by a a validator about 28% of that that eth and revenue is coming from from Mev it's a it's becoming a a larger significant portion um as I think Mev extraction uh gets more advanced and as more validators get on the amount of

consensus layer rewards generated becomes less and less now there was a recent post here on eth eth Research here um uh um in here that had actually looked back it's uh fairly recent just in this month and took a a look back over a month or so and you could see that it it basically is about that that same rate even even now at about 900,000 it's about you know 25 to 30% of your rewards earned okay now when you start to look at MAV it's it's it's absolutely fascinating this is an updated um uh histogram uh produced uh from this um modeling code from the open uh the Mev boost pick open data and it maybe it

doesn't really show it too well in pictures right but it's it's most of the blocks have very little Mev in it right you know so you win you win the opportunity to propose it's now your time you successfully propose your blocks included in the chain it gets finalized woohoo but the amount of Mev in your block was very small right um and it's it's a really it's it's a longtailed skewed right in fact the if you look over here the um the the median right which means that 50% you know you're in the you're in the middle of the group 50% of all the block proposals had less Mev than you 50% had more me than you you're way down here at about 0.5 eth per block the average is substantially higher it's it's you know

nearly three times higher and the reason for that is there are these substantially Mega large blocks uh of Mev that we've been calling Lottery blocks right these are the 200 eth block that you get right the 150 eth block that's out there and because there's so few of them this only ends at one eth but it continues all the way on to about you know what the highest Med block was 250 300 Mev right um you know it goes a long ways the problem is they're very very rare okay so but there's there's still a strategy that could be um be taken here um and just and just to show how kind of rare this is to look at in a little bit here is um you could see here

that if you're in the 99.9 percentile uh of it um you're getting a Mev block that's seven eth in there I that's a pretty good return on a proposal right uh but still there is 14% of all the Mev that was ever extracted above you right it's just those those Mega Lottery blocks contain more of the Mev than all of the little blocks combined okay so it's substantially longtailed okay this is what makes it um this is what makes it um pretty interesting so we've just heard a talk about proposer Builder separation uh we we know what that is we know what M relays are let me just show one thing that's going to be useful here in a conversation a little bit later

here which is when you register for a Mev relay um not only do you tell it who you are and uh your signature there but you give it a uh they actually call for it in inspect a fee recipient but it's technically the suggested fee recipient it's basically the address that you want your Mev to go to and the one problem in Mev theft is that as you register as the validator you get to control that address however you register with the relay so that's that's one of the areas um for Inception to create the attack now there's there's two attack strategies at least that I could think of and I certainly encourage others to to think about some one of those I call the longc con attack this is one where um the validator basically says you know what I've formed a validator with a

lowcost liquid sticking pool maybe I got an 8 eth mini pool or a 4 eth or now that we're uh just heard in a previous presentation One eth Mini or one eth validators are coming out right um you know very little cost to to put in to go chase one of these things so you could create a a longc con and in a longc con you just immediately start stealing and maybe that protocol has some slashing condition that could take that one eth away from you or that node deposit away from you but you can actually predict the amount of time it takes so these are the amount of returns you earn on a one two three and uh or sorry two 48 and 16 eth um mini pool this is your share of earnings uh and you can see that if you

just start stealing the Mev alone forget the consensus layer Rewards but if you just start sealing the me the Mev Alone um you know in the case of these lower ones like two eth within about 20 years you're you're on average likely to exceed more in stealing these even small bits of Mev um than what the slashing or penalty is for it right so if you're willing to invest I mean 20 years is a long time things can change in the protocol so maybe it's safe maybe it's not but it's at least still still a strategy that's there um another strategy that could be used is something called the the attack strategy or the lottery block attack strategy uh this is one in which they um say I'm going to continue to act um as a honest validator until I win a lottery

Block it's rare but there's a chance that I may win a lottery block and if I do win a lottery block I'm going to redirect that me to my address and not the staking pool's address and you can see here that um you know uh as you put more and more eth down the actual chances of UA getting to propose and B getting to propose when it's a lottery block get to be a very large number right this one's going to be 500 years uh I'd say it's not impossible but you know the likelihood of you actually winning the strategy in your lifetime not going to happen but as you get to smaller and smaller deposits um you know it becomes uh it does become feasible right uh we could see from the data it's better to just start stealing immediately take take your slashing and

continue on but you can make some some predictions like this so well why why does it matter to steal Mev right well in a in a liquid staking pool a large portion of the funds that are generated from staking are really due to the liquid staking holders right they have the largest contribution into the validator you only have a small share to act as a bond to ensure your honest node operating so what are some of the the the approaches that I think are being talked about right now and discussed um one of those is the use of DVT right um again here it takes multiple Noe operators the chance that all of them are in collusion to do this um is going to be less likely but again we have the problem with the Mev relays um when they

sign it was mentioned in the other one there's like this blinded block you are just signing a header to the block and the fee recipient in there is usually not your fee recipient or your uh staking pool's fee recipient it's um per the specification it's the fee recipient of the block Builder you are just promised and trusting of the relay that there going to send it to your suggested fee recipient so a malicious member of a DVT cluster or Squad could simply just submit if they're the elected leader to propose they could slit uh submit a block block header to the folks but have the actual block once it's released send the Mev to their to their address you don't know what you are actually signing

in terms of the block contents um so that that's one area you can actually see this here this is a recent um proposal here right you can see the fee recipient and the execution playload you can actually see though that this is uh my um my fee recipient to a smoothing pool that I participate in and again they don't match up and it's because they're not supposed to under Mev boost right I'm just promised to sell my block I'm promised to receive some funds at the end of it the the Builder can take the the tips on it um another one that we heard about in there is enshrined proposal Builder separation that might have some possibilities um in preventing Mev theft especially uh depending upon how they

how they um how they produce it right there's a lot of talk about Mev burn in there but um you know another way they could do it if they decide to distribute it instead of burning it is they could actually mandate that the fee recipient be the withdrawal credential and that's most likely to ensure that it goes back to the correct liquid staking pool you're not able to select or suggest another fee recipient address to send it to um another another approach to maybe counter Mech to this is we could work with the relays perhaps there could be a coalition of relays that would actually decide to standardize and make that same change no longer could you suggest a fee recipient instead they would just simply look up the 0x01 withdraw credential and send the payment to that address right

that might cause some some problems for existing protocols but it would certainly counteract the ability to redirect the funds um another thought that that came out this is one that um has been kind of flushed out a little bit is when you work in a liquid staking protocol as a node operator you usually paid a commission on that liquid staking uh portion of the validator uh perhaps maybe they pay you 10% as a note operator or 14% as a note operator uh one strategy might be to not pay you at all for that thing but allow you to take all of the Mev for yourself now that's interesting because uh maybe you will win the lottery and get one of those 100 eth blocks but most likely you're going to get three block proposals at about 05

each and that's going to be very little payment you gave up almost one eth right now for the chance of winning you know 100 eth but you're most likely to come out with about 0.15 e so I don't know if there if there be an interest in there uh a countermeasure for that is there could be um we just we just saw that D node has a smoothing pool created um there could be smoothing pools for Mev right that say okay well I may not win that 100 but I'll join a pool of common other node operators that are just um validating for Mev only and we'll smooth our pools because likely somebody in the pool is going to win the lottery over some period of time um a similar approach to that is

one called uh smoothing commitments um that's up here this is one that kind of flips out a little bit here instead of actually registering and taking a 0% commission uh to be a node operator you're you're actually bidding on the right for you will pay the protocol they'll say I'll give you a validator to run for 3 months there's a signed exit message that will kick you out in three months you place a bet or a bid uh maybe you bid half an eath maybe you bid one maybe you bid two in the back there and whoever wins that bid has the right to run that validator for three months and you get to get all of the consensus layer Rewards or all of the me rewards um for that right to to bid on it you can renew your bid if you don't renew it

they'll Force exit you um it's an interesting concept but I think it has some concerns about centralization the folks that will bid successfully on this are large um large people with a lot of eth that can average their their probability of winning um we talked a little bit about using the voluntary uh pre-signed exits um there's a problem with them right now uh in Cancun here and that's that they expire after two forks um this is one of the eips that's slated to be in denb here which is non-expiring messages um the non-expiring messages um will uh no longer allow that um this is a way that somebody a note operator

could sign an ex exit message I'm validator number one two three I quit signed here and you give it to the protocol and the protocol will hold it if you act maliciously they could they could inject that message and X you out of uh the be chain uh the problems there is that it does require a trusted party to store those message and there are security considerations right where do they store them is it just up in Dropbox uh do they have some some secured Enclave to store those who actually gets to decide when they inject those messages um there's a lot of considerations on that but this is one Improvement I think that's that's coming out here um the next one here and this is the one that I really wanted to call the

most attention to because I think it's one of the the more elegant ones and I wanted to create awareness about this is there's an EIP called 7002 which is execution layer triggered exits uh it's an EIP it does seem to have a very positive traction among a lot of staking um staking organizations uh and what it does is it says right now in ethereum only this signing key only the validation key that you sign every out of station with is the one that you can sign that I quit message what this proposes is it says he your withdraw credential that you actually have the wallet where all of your consensus layer funds go to it will be able to also initiate a transaction that says I quit

um it has a couple of benefits outside of Mev theft mainly security right you have a separate uh separate key that doesn't have to be a hot key that's constantly used that could be secured um if you have separate owners you could you could create uh smart contracts with that execution or with that withdrawal credential to allow multi multiple people to execute on that transaction um but more importantly in the in the case of this topic for Mev theft is that it would allow um uh allow staking uh pools um to go ahead and monitor for Mev theft okay and uh once they detect Mev theft um they could go ahead and force exit that that validator and if you noticed on all those probabilities of success

there was some period of time the most likely strategy to use is to immediately start stealing and if you immediately start to steal Mev uh you could be detected within you know a few a few blocks and then you could be forced to exit from the execution layer um creating a a pretty robust layer of security um to prevent Mev theft on there um that was kind of the the the quick overview of uh Mev theft and some of the possible solutions there and I understand we might have a few minutes for questions questions okay yeah clear so thank you very much and let's prepare for the next

speaker