Partnered With:

a16z: In-depth discussion of the encryption economics of PoS Slashing mechanism

Read this article in 35 Minutes

This paper discusses how to raise the cost of bribery so as to raise the network security by Slashing mechanism in the consensus of proof of equity, and discusses the shortcomings and mitigation measures of slashing mechanism.

原文标题：《 The cryptoeconomics of slashing 》

Original article by Sreeram Kannan, a16z; Soubhik Deb, EigenLayer

The DeFi way

None of the mechanisms designed for Slashing the proof-of-interest protocol was as controversial as slashing. Forfeiture provides a way to financially penalize in a targeted manner any particular node that does not take agreed concerted action. It does this by taking away some or all of the verifier pledge interest without imposing externalities on other nodes acting in accordance with the agreement. Slashing is unique to the proof-of-Interest (PoS) protocol because it requires the blockchain to be able to perform the punishment. This kind of enforcement is obviously not feasible in a proof-of-work (PoW) system, which is akin to burning the mining hardware used by misbehaving nodes. This ability to apply punitive incentives opens up a new design space in blockchain mechanism design and therefore deserves careful consideration.

尽管它以「业力」的形式带来了明显的好处，但对罚没的主要反对意见是，由于运行过时的软件等无心之失，节点可能会被过度罚没。因此，很多协议都避免采用 Slashing（罚没），而是依赖于所谓的Token毒性（即如果协议被成功攻击，底层 Token 将失去价值）。很多人认为，质押者会将这种毒性视为对损害协议安全性的威胁。在我们的评估中， Token 毒性不足以阻止某些典型场景中的对抗性攻击。事实上，在这种情况下，对手攻击和破坏协议所产生的成本（称为贿赂成本）基本上为零。

在本文中，我们将展示如何将 Slashing（罚没）纳入 PoS 协议的机制设计中，从而大大增加任何对手可能招致的贿赂成本。在存在贿赂的情况下，对于去中心化协议以及不满足 Token 毒性假设的协议（中心化或去中心化），罚没保证了高且可衡量的贿赂成本。

可能导致贿赂以及缺乏 Token 毒性的情况无处不在。很多 PoS 协议通过拥有一个紧密结合的社区来避免落入这两个类别之一，这只有在规模较小时才可行。

(1) Delegate validation to a small group of well-known and legally regulated node operators by relying on strong leadership to steer them in the right direction;

（2）或者依靠在一个小组内集中质押 Token 。这些解决方案都不能完全令人满意地发展大型和去中心化的验证节点社区。如果 PoS 协议的特点是只有几个验证者（或者，在极端情况下，只有一个验证者），那么最好有一种方法来惩罚这些大型验证者，以防他们参与敌对行为。

In the rest of this paper, we:

A model is proposed to analyze complex bribery attacks.

It shows that PoS agreement without forfeiture mechanism is vulnerable to bribery attack.

It shows that PoS protocol with forfeiture mechanism has quantifiable security against bribery attacks.

Some disadvantages of forfeiture are discussed and mitigation measures are put forward.

I. Model

Before introducing the forfeiture case, we first need a model under which we will conduct our analysis. The two most popular models currently used to analyse PoS protocols (Byzantine and game theory equilibrium) fail to capture some of the most damaging real-world attacks against which forfeiture acts as a powerful deterrent. In this section, we will discuss these existing models to understand their shortcomings and propose a third model (which we call the bribery Analysis model). Although the bribery analysis model can simulate a large number of attacks, it has not been used to analyze many protocols.

Existing model

In this section, we will briefly describe the Byzantine and game theoretic equilibrium models and their shortcomings.

Byzantine model

The Byzantine model states that at most a certain percentage () of nodes can deviate from the protocol-specified action and perform whatever action they choose, while the rest of the nodes still follow the protocol. Proving that a particular PoS protocol can resist Byzantine actions that can be taken by hostile nodes is a very important issue.

For example, consider PoS consensus protocols with the longest chain, where liveness takes precedence over security. Earlier research on longest chain consensus security focused on demonstrating security against a specific type of attack (i.e., the private double flower attack, in which all Byzantine nodes privately collude to build an alternative chain and then disclose it only when it is longer than the longest chain). However, the nothing-at-stake phenomenon provides an opportunity to propose many blocks using the same pledged interest, and to use independent randomness to increase the likelihood of building longer private chains. It was not until much later that extensive research was done to show that some structure of the longest chain PoS consensus protocol could defend against all attacks against some values. (for more details, please refer to "Everything is a Race and Nakamoto Always Wins ‌" and "PoSAT: Proof - of - Work the Availability and Unpredictability, Without the Work ‌)

The entire Byzantine fault-tolerant (BFT) consensus protocol category prioritizes security over reactivity. They also need to assume a Byzantine model to prove that, for the upper limit, these protocols are deterministically safe against any attack. (for more details, please refer to "HotStuff: BFT Consensus in the Lens of Blockchain ‌", "the STREAMLET ‌", "Tendermint ‌".)

Useful as the Byzantine model was, it did not take into account any economic incentives. From a behavioral point of view, some of these nodes are completely adversarial in nature, while some (1-) nodes fully conform to protocol specifications. In contrast, a large proportion of nodes in PoS protocols may be driven by financial gain and run modified versions of the protocol in their own interest, rather than simply following the full protocol specification. As a striking example, consider the case of the Ethereum PoS protocol. Most nodes today do not run the default PoS protocol, but instead run the MeV-Boost modification protocol. This is because participating in the MEV auction market generates additional rewards that are not available for running the exact specification protocol.

Game theory equilibrium model

Game theoretic equilibrium models attempt to address the shortcomings of Byzantine models by using solution concepts such as Nash equilibrium to investigate whether rational nodes have an economic incentive to follow a given strategy when all other nodes follow the same strategy. More specifically, assuming everyone is rational, the model investigates two questions:

If all the other nodes follow the protocol policy, will I benefit the most financially by following the same protocol policy?

If every other node is enforcing the same protocol deviation policy, is it most motivating for me to still follow the protocol policy?

Ideally, agreements should be designed to ensure that the answer to both questions is "yes".

An inherent shortcoming of the equilibrium model of game theory is that it excludes scenarios in which exogenous agents might influence the behaviour of nodes. For example, an external agent can set up a bribe to motivate a rational node to follow its stated strategy. Another limitation is that it assumes that each node has an independent agency that can decide for itself which strategy to pursue, depending on its ideological or economic incentives. But this does not cover scenarios where a set of nodes collude to form a cartel, or where economies of scale encourage the creation of a centralised entity that essentially controls all pledged nodes.

Separate bribery costs from bribery profits

Several researchers have proposed bribery analysis models to analyze the security of any PoS protocol, although no one has used it to go deeper. The model first asks two questions: (1) What is the minimum cost required for any adversary to successfully perform a secure or active attack on the protocol? (2) What is the maximum profit an adversary can gain from successfully executing a protocol security or active attack?

The opponent in question might be:

A node that unilaterally deviates from the agreed policy;

A set of nodes actively cooperating with each other to break the agreement, or

External opponents who try to influence decision-making of many nodes through external behaviors such as bribery;

The calculations involved taking into account any costs incurred in bribery, any financial penalties incurred in carrying out Byzantine tactics, etc. Similarly, calculating profits is all-encompassing, including in-agreement rewards from successful attack protocols, any value gained from DApps that sit on top of PoS protocols, holding derivatives related to the protocols in the secondary market, and profiting from volatility resulting from the attacks, and so on.

Comparing the lower limit of the minimum cost for any opponent to launch an attack (the cost of bribes) to the upper limit of the maximum profit that the opponent can extract (the profit of bribes) shows that the attack protocol is economically profitable (note: This model has been used to analyze Augur and Kleros), which gives us a simple equation:

Bribery profit - bribery cost = total profit

If the total profit is positive, then the opponent has an incentive to attack. In the next section, we will consider how forfeiture can increase the cost of bribery and reduce or eliminate the total profit. (Note that a simple example of a bribe profit cap is the total value of assets protected by a PoS agreement. More complex boundaries can be established to take into account circuit breakers that limit the transfer of assets over a period of time. A detailed study of ways to reduce and limit bribery profits is beyond the scope of this article.)

Ii. Slashing of Confiscation

罚没是 PoS 协议经济惩罚一个节点或一组节点执行可证明与给定协议规范不同的策略的一种方式。通常，要实施任何形式的罚没，每个节点必须事先承诺了一定数量的权益来作为抵押品。在深入分析罚没（Slashing）之前，我们将首先研究具有内生 Token 的 PoS 系统，这些 Token 依赖 Token 毒性作为罚没（Slashing）的替代方案。

We mainly focus on the study of forfeiture mechanism for safety violations, rather than active violations. We propose this restriction for two reasons: (1) Security breaches are entirely attributable to some BFT-based PoS protocol, but activity breaches are not attributable to any protocol, and (2) security breaches are generally more serious than activity breaches, which result in loss of user funds rather than the user being unable to post a transaction.

What's the problem with no forfeiture?

考虑一个由 N 个理性节点（没有拜占庭或利他节点）组成的 PoS 协议。让我们假设，为了计算简单，每个节点都存入了等量的质押权益。我们首先探讨 Token 毒性如何无法保证显著的贿赂成本。为了在整个文档中保持一致，我们还假设所使用的 PoS 协议是一个具有对手阈值的 BFT 协议。

Token 毒性是不够的

一种普遍的观点是， Token 毒性可以保护质押协议免受任何对其安全性的攻击。 Token 毒性暗示这样一个事实，即如果协议被成功攻击，那么用于在协议中质押的基础 Token 将失去价值，从而抑制参与节点攻击协议。考虑 1/3 质押者联手的场景：这些节点可以合作来破坏协议的安全性。但问题是这样做是否可以不受惩罚？

如果已存入权益的 Token 总估值严格取决于协议的安全性，那么任何对协议安全性的攻击，都可能将其总估值降至零。当然，在实践中，它不会直接降至零，而是下降到某个更小的值。但是为了展示 Token 毒性的最强大的可能案例，我们将在这里假设 Token 毒性完美地发挥作用。对协议的任何攻击的贿赂成本，是攻击系统的理性节点持有的 Token ，他们必须愿意失去所有这些价值。

我们现在分析在没有罚没的的情况下具有 Token 毒性的 PoS 系统中勾结和贿赂的动机。假设外部对手设置贿赂条件如下：

If the node follows the strategy indicated by the opponent but the attack on the protocol is unsuccessful, the node receives a reward B1 from the opponent.

If the node follows the strategy indicated by the opponent and the attack on the protocol is successful, the node receives a reward B2 from the opponent.

For the nodes that deposit the equity S, we can get the following return matrix, where R is the reward for participating in the PoS agreement:

假设对手将贿赂收益设置为 B1>R 和 B2>0。在这种情况下，无论其他节点采取何种策略（主导策略），从对手处接受贿赂的回报，都高于该节点可以采取的任何其他策略。如果 1/3 的其他节点最终接受了贿赂，他们就可以攻击协议的安全性（这是因为我们假设我们使用的是 BFT 协议，其对手阈值为 )。现在，即使当前节点不收受贿赂，由于 Token 毒性（矩阵中右上角的单元格）， Token 无论如何都会失去其价值。因此，节点接受 B2 贿赂是激励相容的。如果只有一小部分节点接受贿赂，则 Token 不会失去价值，但节点可以从放弃奖励 R 中获益，取而代之的是获得 B1（矩阵中的左列）。如果 1/3 的节点同意接受贿赂，攻击成功，则对手支付贿赂的总成本至少为 /3 B2，这就是贿赂的代价。然而，B2 的唯一条件是它必须大于零，因此，B2 可以设置为接近于零，这意味着贿赂成本可以忽略不计。这种攻击被称为「P+」攻击‌。

总结这种影响的一种方式是， Token 毒性是不够的，因为不良行为的影响是社会化的： Token 毒性完全贬值 Token 的价值，对好节点和坏节点的影响相同。另一方面，受贿的利益被私有化，并仅限于那些实际受贿的理性节点。对于那些接受贿赂的人来说，没有一对一的后果，也就是说，这个系统没有「业力」的有效版本。

Token 毒性是否始终有效？

生态中流行的另一个误导说法是，每个 PoS 协议都可以通过 Token 毒性获得一定程度的保护。但事实上， Token 毒性的外生激励不能扩展到某些类别的协议，在这些协议中，用作质押面值的 Token 估值不取决于安全运行的协议。一个这样的例子，是像 EigenLayer 这样的重质押（re-staking）协议，其中重新使用以太坊协议使用的 ETH 来保证其他协议的经济安全。考虑使用 EigenLayer 重新质押 10% 的 ETH 以执行新侧链的验证。即使 EigenLayer 中的所有质押者都通过攻击侧链的安全而合作行为不端，ETH 的价格也不太可能下降。因此， Token 毒性不可转移到重质押服务，这意味着贿赂成本为零。

How does forfeiture help?

In this section, we will explain how forfeiture can significantly increase the cost of bribery under two circumstances:

Decentralized agreements under bribery;

Token 毒性不可转移的 PoS 协议；

Prevention of bribery

协议可以使用罚没来大幅增加尝试贿赂攻击的外部对手的腐败成本。为了更好地解释这一点，我们考虑了一个基于 BFT 的 PoS 链的示例，它需要链原生 Token 的质押，并且必须至少破坏总质押的才能对其安全性进行任何成功的攻击（以双重签名的形式）。假设外部对手能够贿赂至少的总质押权益来执行双重签名。双重签名的证据可以提交给规范分叉，该分叉会罚没从对手处接受贿赂并双重签名的节点。假设每个节点质押 S 个 Token 并且所有被罚没的 Token 都被销毁，我们得到以下收益矩阵：

With forfeitures, if the node agrees to accept a bribe and the attack is unsuccessful, then its pledge interest S is forfeited in the canonical fork (the cell at the bottom left of the matrix), in contrast to the previous bribery scenario where there is no forfeitures mechanism. On the other hand, even if the attack is successful, the node does not lose its pledged interest S (the cell in the upper right corner of the matrix) in the canonical fork. If the total equity required is bribed for the attack to succeed, the cost of the bribe must be at least /3 S, which is significantly higher than the cost of the bribe without the forfeiture mechanism.

Aim at Token Protection in cases where toxicity is not transferable

在一些 Token 估值不受协议安全性影响的 PoS 协议中， Token 毒性是不可转移的。在很多此类系统中，PoS 协议位于另一个基础协议之上。然后，基础协议通过在基础协议上部署争议解决机制来解决争议，并赋予基础协议代理权，以可证明的方式罚没与 PoS 协议相关的节点，从而与 PoS 协议共享安全性。

例如，如果 PoS 协议中的拜占庭动作在基础协议中客观地归因于敌对节点，那么它在 PoS 协议中的权益将在基础协议中被罚没。这种 PoS 协议的一个例子是 EigenLayer，它的特点是重质押（restaking），使不同的验证任务能够从以太坊基础协议中获得安全性。如果在 EigenLayer 上的验证任务中，节点重质押采用了拜占庭策略，其中拜占庭行为可以被客观地归因，那么可以证明该节点在以太坊上是敌对的，其质押权益将被罚没（无论质押有多大）。假设每个节点重质押 S, 所有被罚没的 Token 都被销毁，并从参与中获得奖励 R，我们构建了如下的回报矩阵：

Since we are considering verification tasks where any Byzantine behavior can be objectively attributed, even if the node acts honestly but the attack is successful, the node will not be penalized on Ethereum (the upper right cell in the matrix). On the other hand, a node that agrees to accept a bribe and exhibits hostile behavior will be objectively penalized on Ethereum (the bottom row in the matrix). If the total equity required is bribed for the attack to succeed, then the cost of the bribe is at least /3 S.

我们还考虑了极端情况，即 PoS 协议的所有质押权益都集中在一个节点手中。这是一个重要的场景，因为它预示着权益最终会集中化。考虑到我们的假设，即对重质押的 Token 没有 Token 毒性，如果不存在罚没，中心化节点可以以拜占庭方式运行而不会受到惩罚。但有了罚没，这个拜占庭式的中心化节点可以在基础协议中受到惩罚。

Forfeiture for attributive attacks vs. forfeiture for non-attributive attacks

There is an important subtle difference between forfeiting attributive attacks and forfeiting non-attributive attacks. Consider a security failure in a Byzantine fault-tolerant protocol. Often, they stem from the Byzantine behavior of double-signing and are designed to weaken the security of the blockchain - an example of an attributional attack, as we can pinpoint which nodes have attacked the security of the system. On the other hand, the Byzantine act of reviewing transactions to weaken the blockchain's activity is an example of an unattributable attack. In the former case, forfeiture can be achieved algorithmically by providing evidence of a double signature to the blockchain's state machine.

In contrast, there is no algorithmic way to complete the forfeiture used to review the transaction because there is no algorithmic way to prove whether the node is actively reviewing. In this case, the agreement may have to rely on social consensus to enforce the forfeiture. A percentage of nodes can perform a hard fork to specify forfeiture for those accused of participating in the review. This hard fork is only considered a normative fork when a social consensus emerges.

We define the bribery cost as the minimum cost of executing a security attack. However, we need an attribute of the PoS protocol called accountability, which means that if the protocol loses security, there should be a way to blame a small number of nodes (the nodes of the BFT protocol). , it turns out, on the analysis of which protocol is responsible for is subtle of BFT agreement (see the forensics paper ‌). In addition, it has been proved that the dynamic of the available longest chain agreement (such as PoSAT ‌) is not to be accountability (about the dynamic tradeoff between usability and accountability system, and some methods to solve these basic balance, please refer to this paper ‌.)

The traps and mitigation measures of forfeiture

As with any technology, forfeiture poses its own risks if not implemented carefully:

1. The client configuration is incorrect or the key is lost. One of the pitfalls of forfeiture is that innocent nodes can be disproportionately penalized for unintentional errors, such as misconfigured keys or lost keys. To address concerns about excessive forfeiture of honest nodes due to negligent errors, the agreement could adopt certain forfeiture curves that would impose lenient penalties when actions with only a small amount of pledge interest were inconsistent with the agreement, but would impose severe penalties when the pledge interest executed on strategies that conflict with the agreement exceeded the threshold percentage. Ethereum 2.0, for example, takes this approach.

2. Credible forfeiture threats as a lightweight alternative. If a PoS protocol does not implement algorithmic forfeiture, it can instead rely on the threat of social forfeiture, that is, in the event of a security failure, the node will agree to point to a hard fork, where misbehaving nodes lose funding. This does require significant social coordination compared to algorithmic forfeiture, but as long as the threat of social forfeiture is credible, the game theory analysis presented above continues to apply to agreements that rely on promised social forfeiture without algorithmic forfeiture.

3. Social penalties for active faults are fragile. Social forfeiture is necessary to punish unattributable attacks, such as active failures such as censorship. Although it is theoretically possible to impose social penalties on unattributable failures, it is difficult for newly added nodes to verify whether such social penalties occurred for the right reason (review) or because the node was falsely accused. When social forfeits are used for attributable failures, there is no such ambiguity, even if there is no software implementation of the forfeit. Newly added nodes can continue to verify that the forfeiture is legitimate because they can check their double signature, even if only manually.

Iv. What about the confiscated funds?

There are two possible ways to deal with confiscated funds: destruction and insurance.

1、销毁：处理被罚没资金的直接方法是简单地销毁它们。假设 Token 的总价值没有因为攻击而改变，那么每个 Token 的价值都会按比例增加，并且会比以前更有价值。销毁不会识别因安全故障而受到伤害的各方，并仅对其进行补偿，而是不分青红皂白地惠及所有非攻击 Token 持有者。

2. Insurance: A more complex mechanism for distributing forfeiture funds that has not been studied involves insurance bonds issued against forfeiture. Customers transacting on the blockchain may obtain these insurance bonds in the blockchain beforehand to protect themselves from potential security attacks to insure their digital assets. In the event of a security-compromising attack, the algorithmic forfeiture of the pledge generates a sum of money that can then be distributed to the insurer in proportion to the bond.

V. Current situation of confiscation in ecology

As far as we know, Vitalik ‌ in 2014, this article first discusses the benefits of confiscated. Cosmos Ecology built the first effective forfeiture implementation in its BFT Consensus protocol, which enforces forfeiture when a verifier does not participate in a proposed block or double-signs an ambiguous block.

Ethereum 2.0 has also incorporated forfeiture into its PoS protocol, and validators in Ethereum 2.0 May be penalized for making ambiguous proofs or proposing ambiguous blocks. Confiscating misbehaving verifiers is Ethereum 2.0's way of achieving economic finality. The verifier may also receive a relatively mild penalty for lack of proof, or if it fails to present the block when it should.

* * *

PoS agreements without forfeiture mechanism are vulnerable to bribery attacks. We use a new model (bribery analysis model) to analyze complex bribery attacks and then use it to show that PoS protocols with forfeiture mechanisms have quantifiable anti-bribery security. While there are drawbacks to incorporating forfeiture into PoS agreements, we suggest some possible ways to mitigate them. We hope that PoS protocols will use this analysis to evaluate the benefits of forfeiture in certain situations -- potentially improving the safety of the entire ecosystem.