The Game of Reorgs in PoS Ethereum

Transcript

so welcome um today i'm going to talk about the uh reorgs um that are possible in east 2 don't call it e2 proof of stake ethereum um don't be me i send in the talk with the title e2 danny will punish you for it don't do it i recently joined the ethereum foundation in particular i joined the robust incentives group and uh basically we're a research team focused on anything incentives i'm going to keep this short this talk is packed and you can find most of our work on on github.com ethereum today i want to talk about reorgs

and in particular um before i dive in i want to kind of sketch out two different types of reorgs that are possible in the realm of proof-of-stake ethereum so on the one hand we have x-pos three-orcs and on the other hand x-arm to re-orgs forgive me this slightly pretentious latin naming but it does the trick and so exposed reorgs are kind of what we usually think of when we talk about the adversary sees a block if it's valuable they might want to try and re-org it so on the diagram here we see that n plus one is the block that the

attacker wants to re-org out and by building on the same parent and if it works block n plus three is then built on block n plus two great that's business as usual and now x anti reorgs are slightly different um the idea is basically the attacker needs to start the attack before even knowing what block they're going to re-org out so how does that roughly work on a very high level block n plus one here is built on top of n but not immediately released so what happens is the honest guys don't even know that n plus one exists and so they will keep building on n and then with through some magic n plus one gets

released and uh n plus three may see n plus one is leading and build on top of it such that n plus two is actually re-org out um you may wonder why would you even wanna do this kind of re-org well there's still mev to be captured um if you're lucky in n plus two as the attacker um has a lot of mev you can capture that by just copy pasting whatever that block is and worst case you have basically two slots worth of transactions to listen to and so it's weekly better always now before diving into ex-anteriorx which is um the the main topic of this talk let me

briefly recap exposed reorgs and especially start with the proof-of-work context basically it's a recap of the blog post by the usual suspects georgios and vitalik just go ahead and read it it's great but in a nutshell in proof of work ethereum exposed reorgs are hard but they're not unfeasible basically meaning that a 10 miner has a relatively good chance of mining some blocks in a row and if the incentive is high enough think there's one block 100 worth of mev to capture from then maybe a one percent success rate may actually be enough to make it worth while trying

to reorganize um in proof of stake the it's a completely different ball game we're talking absurd an amount of stake required i'm gonna walk you through how one might go about it to just emphasize how ridiculously difficult it is maybe some basics first time in proof-of-stake ethereum progresses in slots each slot is 12 seconds long and in each slot there's two roles you have a proposer it's exactly one proposal and the committee of thousands of attesters that are supposed to attest to the blocks they hear on the p2p layer and they determine the head of the chain by

running this fork choice which is basically a function that takes in the block tree as input and gives you the head of the chain and you're supposed to attest to these blocks if you hear a valid block or four seconds into a slot so whatever comes first so if for example for some reason block n plus one the proposal is offline there's no block four seconds into the slot you attest to it um you don't attest to n plus one in that case because it doesn't exist you test to block n um if you hear it on time on the other hand you attest to block n plus one simple um and basically all these attestations uh what they do is they give weight to

the blocks um and this weight is basically used by the fork choice to determine what the latest hat is now let's walk through this diagram quickly to to see how uh how one would pull off a one block reorg within this within these like three blocks so at the beginning everything business as usual everyone attests to block n even the attacker then n plus one is built on top of n and uh because the attacker doesn't want to give way to the block that they try to re-org out they instead attest to block n now block n is gaining a lot of weight with the two third attacker so i forgot to say that we're

assuming here that the attacker has two thirds of the committee which basically means he needs to control roughly speaking two thirds of the entire stake on proof of stake ethereum um right so one third of the honest people attached to n plus one two thirds to n so now it comes block n plus two obviously the attacker builds it on n and again obviously the attacker tests to their own block from the view of the honest validators however n plus one is still leading as opposed to n plus two in terms of weight it has more weight because um both n plus one and n plus two inherit in the entire weight of block n but n plus one also has this one

third of attestations which n plus two is lacking at this moment so um if we tally this up now block n plus one has attestations worth one third plus one third gives you what two thirds and block n plus two gives you has also two threads and for simplicity let's just assume the the this tie breaks in favor of the attacker um then n plus three will see n plus two as leading and will build on top of it and to give you an idea of how how ridiculous this ridiculous this um these assumptions are even if you had a 65 percent staker controlling 65 of the entire proof of stake ethereum state then to control two thirds in any given slot

you have probability of point zero five percent using current numbers so basically this goes to show that the power of parallel at the stations is real and basically x reorgs are incredibly difficult if not virtually impossible in proof-of-stake next i'm gonna ask to talk about ex-anteriorx and first up it's this attack is based on a paper by noida and others we've recently improved this attack significantly also wrote up a paper on it and managed to upload it on archive just in time you'll find the link soon and also up front don't worry there's

mitigations they will be merged before the merge and um right let's let's get into it how does an x under reorg attack work well um initially can we get the slides yeah initially um block n business as usual everyone attests to it even if you're the attacker you would attach to it um now you're the proposer of n plus one you propose it you attest to it privately with a single valid data importantly you keep it private you don't release it you don't propagate it on the p2p layer so what happens is in the local view of the honest people they don't see block n plus one and so

they will attest to block n and that's the trick so basically that means you inherit that weight and you don't have to actually fight it um and now let's assume zero latency for the moment and assume that we will relax that assumption in the moment if in slot n plus two what we do as the attacker is um we release block n plus two and the private attestation all at the same time i mean i said the adversary releases n plus two obviously that that's not what i meant um it's just with zero latency all of this happens at once so n plus

two n plus one and the private attestation all get released at the same time and now let's put ourselves into the shoes of the honest validators in slot n plus two that now need to attest to a block so from their view they see block n plus two and they see block n plus one with this one private uh with this one at the station now if they run the fork choice they will find that block n plus one has more weight than block n plus two why because block n plus one inherits all the weight from block n n plus two as well but n plus one has this private attestation which n plus two does not have so what happens is even all the honest validators will

actually attest to block n plus one when and then obviously in n plus three trivially uh n plus one will be viewed as the head of the chain i've assumed zero latency which obviously is uh not it's not how it works there is latency it takes time to propagate your blocks and messages on the p2p layer and the way an attacker can still pull off this kind of attack is the following instead of having just one note on the p2p layer what you would want to have is a lot of notes on different locations on the p2p topology such that when the honest guy

in slot n plus two proposes that block you hear about it very early on in the propagation process and as a result of that you can then uh release your private block from all these different locations on the p2p layer such that a majority will hear about block n plus one before they hear about block n plus two meaning they see that block n plus one is leading in weight and will actually attest to it this is basically just what i told you now there's even a more fancy way of doing these acts under reorgs maybe just to re-emphasize what's happening here we have a proposal with

the singular tester managing to pull off one block reorg not ideal to say the least um if you want to go fancy you can you can pull off longer reorgs if uh you do some sort of balancing strategy the the idea of balancing strategies is the following you want to split the honest committee into different views of the chain what does that mean it means that you release your private block in such a way that roughly speaking half of the honest guys hear about your private block and private attestation before they hear about block

n plus two which means they will attest to your block and the other half you want them to not hear your block before they attest to n plus two which means now you have half of the honest committee attesting to block n plus one and the other half of the committee attesting to n plus two how does that help you well it helps because basically the honest committee now cancels each other out and you as the attacker don't even have to fight them which is basically as the attacker dream come true now let's walk through the diagram quickly block n business as usual block n plus one again same story you don't release

it um and so the honest validators will attest to block n now block n plus two comes up you hear about it early on in the um what i said earlier the attacker what they do now is they release that block n plus one and one attestation only one and release it in such a way that half of the honest committee c block n plus one before and half after this so-called sway vote this attestation we call sway vote um with the effect that half vote for

does this thing work no no anyways and half vote for n plus one the other half for n plus two so now actually you wanna have an off by one split such that n plus two has one attestation more such that n plus three actually builds on n plus two because you wanna keep the reorg going and now let's say we just want to do a two block v hawk we bring it to an end what happens is um block n plus three is uh proposed um as the attacker now you you hear it early you release block n plus one and your two remaining attestations which then uh you release in such a way

that you flood the p2p layer a majority of the honest people should then vote for your block n plus one such that it has more weight than block n plus three and n plus four is built on top of n plus one this i hope this wasn't too confusing um i mean yeah if you think about it it's relatively cheap to do these reorgs if we're assuming what we're assuming you can lighten up some of the assumptions right now i'm assuming perfect splits but even if you don't do that because the p2p layer is so big you have a probability distribution that

you can target such that even then the attack cost is growing in like square root of the committee size anyways let's talk a bit about the mitigation um what's the basic idea the idea is we're going to give the proposer a bit more power how well let's say if the valid blocks on time let's boost the weight of this block for the duration of the slot after that slots done we we just resume to the usual lmg score and business as usual um and so we have a valid block let's go back here so let's say block n

plus two is proposed on time valid people see it on time etc now what happens is uh this block will have a boost let's say 80 of the committee size whatever um now this cute little n plus one at the station from the attacker is not going to do the trick no way and basically none of this balancing stuff either also doesn't work because you have a 50 50 split but it always gets like thrown into one or the other direction there's no way you can keep that 50 50 split the idea basically is that now with this mitigation in place the adversary's have to compete with the boost to

convince honest validators to vote um according to their liking and yeah as i said this breaks balancing strategies and prohibits basically all riocks altogether and good news is there's an open pr so basically when merged um yeah that's it um some key takeaways maybe um i've talked about like the differences between xpos and x until reorgs um briefly sketched out the different landscapes for reorgs and proof of work versus proof of stake i showed you guys how to pull off the axon to re-org but also importantly how to fix it right if if you're interested in this

there's a paper much more detailed more nuanced slides will be uploaded come talk to me if you're interested and yeah you can you can also find me on twitter i hope this was interesting to you thanks very much thank you