How much security does your restaking protocol really need? by Tarun Chitra | Devcon SEA

[Music] [Music] um so I think uh you know in the in the kind of current ERA there have been a lot of new protocols that are being built on top of ethereum um some of them are rollups as many of you know and some of them are sort of these kind of new kind of amphibious things that are are sort of known as avss or networks or services so natural question you might say is you know what's the difference between these you know when do I need to pay for a rollup security when do I need to pay for something that's less and how do I quantify that so um there's sort of three things we'll talk about we'll talk about reaking sort of being a a a matching Market uh we'll talk about how to think about threat models for determining Economic Security and then finally we'll talk about how do you quantify that and so most of this talk they're bunch of papers that have sort of the formal results but this is sort of going to give a high level description so uh a natural question is is what is a matching market so matching Market uh kind of the most common one people think of is uh in this example sort of matching uh partners and so each person has a preference and based on their preferences you can kind of construct this graph and then try to find a valid uh matching and so it's sort of a a natural thing where you want to match two different types of goods one side that's the supply side and one side that's demand side uh of course I guess in the the dating one it maybe they're both symmetric hopefully uh but you know what is a matching market so matching markets are are sort of things that are studied in economics but also used in practice a lot so uh probably the most famous type of matching Market is the kidney exchange so this is for people who need kidney transplants uh you know maybe maybe I I had some type of accident I need a k kidney transplant but I can't just take any kidney there's some constraints on it it has to be a certain size it has to be the right blood type it has to to have have a bunch of different things uh and so there are people who are donors who are willing to donate kidneys and then people who need kidneys and there's sort of you'd be surprised but there are algorithms for kind of matching them but the main thing to think about is there's a supply of inhomogeneous goods I.E people whose kidneys have some properties uh you know blood type size Etc um the key thing is there there there there's some similarity between them they're all kidneys but they have some special properties and then there's sort of demand which is people who kind of want to to to to receive those so you know in crypto you hear a lot about auctions uh in fact someone yesterday told me they were surprised I went in an hour without saying the word auction which I felt embarrassed about but uh so you might say you know how do how do how do matching markets compared to auctions so matching markets are sort of more focused on stability uh under to perations of uh different kind of mechanisms versus auctions are focused on things like maximizing revenue or maximizing welfare um so for instance a matching may prefer to to to sell all Goods to all people participating even if it's doesn't maximize the amount of money that's transferred and in crypto we have a bunch right we have me auctions for the auction side we have intents and also restak for matching markets so natural place to to kind of formalized matching markets is is using graph Theory using sort of bipartite graphs where the idea is you have one side that is the set of suppliers the different types of supply and the other side is the types of demand um but in most classical matching markets um you this graph is sort of static IE the set of people who want kidneys or need kidneys is fixed and there's usually a Central planner now decentralized matching markets don't have either of these features um because people can join and leave whenever they want they can change their demand whenever they want and this is why uh you know we we need to start a little bit by thinking about reaking in terms of being a decentralized matching market so uh decentralized matching Market you can have the supply side and demand side join and leave at will and so a natural question is you know why are these harder to to to analyze how are they harder to analyze uh first off if people can can join and leave you can get matched and unmatched um which means that you have to consider kind of worst case Dropout from different participants um the second thing is without having a central planner uh without having kind of like the National Kidney registry you rely on how you pay incentives fees token incentives Etc to get people to to figure out the matching and finally you sort of need a explicit adversarial model so um you need to kind of model all the different types of attx so just to to to to kind of explain how restak looks like a matching Market um you know restak is really focused on people who are running ethereum validators who are offering to run extra services so you can kind of think of them as the supply side and the demand side are are services like these abss so you know a natural question that I think is a meme in a lot of ways uh is is Economic Security uh as you can see from from this there's many varying definitions um but we'll take a tiny detour to talk about Economic Security and then after that and sort of how to compare Economic Security between rollups and reaking and then kind of talk about the the kind of risks in reaking so a natural question is is what does it really mean to have Economic Security so you know the classical definition in proof of stake is oh onethird of the total amount of stake is enough to corrupt the network well that's true that's true for a double spend but suppose I want to do an oracle manipulation attack it might be much cheaper so uh defining Economic Security in absolute sense sorry about the font color there um is actually quite difficult um partially because you have things like me uh you have to think about the attack space Sorry all right well I guess we got a little ahead of ourselves um but basically there's there's sort of a bunch of different things you have to consider so so there's a lot of different attacks there's sort of meev there's attacks that come from uh competitive pressures uh between networks um for competing for the same fees um but generally we try to think of the the cost of an attack as sort of something bounded by a sort of linear function of the the the numer I maybe stable coin maybe Bitcoin whatever your your choice of numerar is value of the so in this uh figure we have the amount of asset Stak we have the price of the asset we have a notion of the expected time it takes to execute an attack uh this is sort of a measure of opportunity cost and then we have a sort of fixed constant upfront that's sort of what fraction of the network you need to execute the attack so the natural question is what does economic security look like for reaking so in reaking oh o hopefully this is not uh there are two competing pressures um the first pressure is if people see higher yields from reaking they purchase some fraction of stakes so they increase the uh amount staked by a multiplicative Factor Delta on the other hand uh the slash Stak so if if you know you get slash for a kind of penalty in the AVS the slash stake reduces uh your overall network security so here is something that looks a little more uh mischievous but let's go through the terms so so CR is the the sort of cost uh kind of attack cost for reaking so first we have a risk measure so this is sort of a measure of how much stake what fraction of stake do you expect to be slashed the second is we have a notion of a price impact function so all of these people who are who were not staking in the network but they see the excess yields from restak they actually go and buy stake so they increase the numer value and this sort of abstracts as to to this function G that's sort of a price impact function uh and uh basically the idea here is if we look at this this cost says there's two competing forces one is the risk measure so how much gets slashed and the other stuff is about how you increase the value of the the stake so the natural question ask is when is raking safe um so reaking can be kind of thought of as safe when you have this invariant where like the cost of attack in the reaking network is greater than the cost of attack uh without the reaking network uh if we write out the previous equations we get this condition which says Hey the risk this risk term the amount that has to be slashed the maximum percentage that can be slashed is bounded in terms of this sort of price impact like how much more people are new buying new stake to participate so there's sort of this dependence on on on how how elastic borrowers are to the incentives I.E the new fees so we'll make a tiny detour and make a comparison to rollups um so rollups have a number of sort of natural economic tradeoffs within ethereum um a lot of the execution Revenue now goes to the rollup a lot of the meev revenue goes to the sequencer um again sorry about the the font I didn't expect this um the uh da Revenue which is you know blob space can be dwarfed by execution Revenue so a natural question is when do rollups if I have a a set an L1 with n Roll-Ups when does the does that Network break even with the monolithic L1 so a paper that I have coming out soon kind of shows for n Roll-Ups in under a bunch of kind of generic assumptions you actually need N squared more Revenue so you can kind of think of this as a sort of inverse Metal's law so Metal's law is sort of a kind of heris Network law that says I have n participants in network the total value they they get is sort of Omega of n^ s uh this sort of says that's true for the rollup users but the L1 is sort of paying the the price and that's sort of what this result shows now you might say well how much re how how does the revenue from avss compensate for reaking risk and um it turns out that if you have s s sorry I just say SS's you only need this kind of factor that's decaying in the number of Serv so what this says is reaking actually can provide a lot of value to the L1 and sort of increase it its monetary premium in a way that's very different from rollups so the main thing in this entire line of logic is that the risk this r factor is sufficiently small right you need to not have slashing that Cascades in order for the the value for the reaking network to be higher than the underlying so natural question is how do you model that risk in in the the previous example it sort of relied on this notion of are the incentives high enough for people to buy more stake and and and deposit um and so a natural thing to do is to to now think about how how to model this formally and again this talk has none of the proofs but the you can find them on archive I should have put a QR code my bad so what does this look like abstractly mathematically um so the the basic construct is what's called a reaking graph rest taking graph like the matching Market graphs is a bipartite graph in this bipartite graph one of the bipartitions is the set of node operators that's the set V each of the node operators uh it's a a Vertex label that is stake which is how much stake each of them have there's a set of services s this the avss there's a set of profit from attacking so this is sort of if I attack the network what's the maximum profit I could get there's a set of corruption thresholds so this is you know in in bft protocols one3 is sort of this 1/3 of bft stake needs to be aggregated to do a double spend or in the longest chain this is the 1/2 that's sort of how you can think of these and one key difference between this reaking and proof of stake is you can have the same node operator operate multiple services with the same stake so that is represented by this middle thing so this uh operator labeled V intersection you can think of as taking its five ethereum of stake and operating both Services S1 and S2 too so you might say hey is this thing real like do these graphs exist this is the live I reaking graph from I think May to August and you can see uh basically on the left are the node operators uh who are ethereum validators who are also running these services on the right are the different Services um there's actually far more services now I think it's about double the number so this graph is a lot more dense than uh what you see here so when we talk about risk we need to also talk about what it means to be an attack what does an attack against three saking graph look like so the idea is you a need to be profitable so that means the maximum profit for attacking a set a of services has to be greater than the maximum slashing penalty for a group of validators who are colluding to attack uh so this kind of says even if I get lose my stake from doing the bad action The Profit that I get is higher so this is what it means uh for a profitable attack the second thing is a feasible attack a feasible attack says that for every service that's being attacked the amount of stake that the cartel that's attacking the group of validators who attacking that service have is greater than the threshold times the total stake of that service so it says for instance if there's two services in our previous example one that has Alpha is 1/3 one that has Alpha is 1/2 the attacking cartel has to have at least 1/3 staken uh set one and one half taken set two uh so you can write this in symbols uh using this this way this comes from sort of the IG white paper appendix B uh and then it was sort of cleaned up more by D and rough Gard which sort of lays out the initial version of this so unlike proof of stake the interesting thing here is is to how to think about tax here so here every service is actually over collateralized so service one there's a profit of four uh and stake of six that could be lost um so uh it's not worth attacking and service two uh the same thing however if all the validators collude it's actually profitable to attack both Services simultaneously and so this sort of says that unlike proof of stake where you're isolated proof of stake is sort of a graph with one service when you have multiple services and you share you can have these kind of profitable attacks from from the shared stake so what does this look like what does sort of the bad case that this look like so what we're going to talk about is something known as a cascading attack so a cascading attack is some validator somehow drops out maybe they're dosed maybe they lost their stake maybe they committed a infraction that got themselves slashed and they get knocked out now by them being knocked out they open up an attack against the service that they were validating so in this case you can see the middle node operator attacks the service and then once the middle operator attacks the service they open up an attack on the other service and now you can see that the entire stake has been burnt so this is the wor case this is R equals 1 in the previous example and you can think of this as the proof of stake analog of like a lending liquidation Cascade or Perpetual liquidation Cascade so how do we Define these uh so we take sets of services and operators where each of them is a feasible attack after uh the previous attacks are executed and we Define this quantity RI which is the maximum percentage of stake that can be lost due to initial loss of sign that's how you write it formally but don't worry about that so you might say hey this tells us how much money we have to spend to secure an AVS if we're willing to if we only want we we we choose a sigh such that our sigh is less than some threshold so maybe I want that to be less than 5% maybe I want that to be less than 10% so this gives you a concrete way of computing how much security you need unfortunately there's a a bad news which is uh this this result which says there's an infinite family of restak graphs which you burn the whole stake that have the Cascades like we saw uh in the effort sense of time I won't talk about it but this is sort of what they look like U where the the dots are validators and the boxes or Services uh but there's a slightly less bad news which is uh a theorem from this paper that says uh RI is actually bounded if the system is really over collateralized and we won't talk exactly about what the definition is but this is sort of you can interpret this as the proof of stake analogy of a decentralized coin needs to be sufficiently over collateralized to avoid cascading deegs the problem is this over collateralization condition is so strong that each service needs stake potentially proportional to the sum of all the profits so as an example imagine I have the network with two Services where one of the profits is one eth and one is a million eth well the one e service needs to attract a million and one e to be secured to cascading attacks under this overcloud realization definition that's not good right like if if if I'm a service whose Pro Max profit is one eth there's no way I can attract that much I'm not going to generate that much revenue so you might say okay is this like bad does this mean abss are kind of hard are we never going to be able to control this risk so that we can get this kind of safe cost of attack that we started talking about uh and the key here is to consider the incentives so what we do is we now consider incentives that are paid so think of this as like block rewards that are paid by service to the validators and then we also allow the validators to adjust their stake um in response to the rewards so they can change which services are validating uh and what you can show is this this sort of lets you halt some of these cascading attacks and the key things to know about this are we we kind of include some notion of a cost of attack if an adversary is attacking a bunch of services simultaneously it costs them more than if they were just attacking one um and so so having this cost actually uh we sort of is more realistic than the the ruard model the second thing is we assume the node operators are smart they are looking at the rewards and they're selfish and they're like how do I optimize my payout and if you get this you know our result is basically you can bound this risk this RSI um in in a way that decays in the number of services um and so uh there's also a way to approximate this so the interpretation is if adversaries who are attacking face costs if node operators are smarter and if avss and services can pay sufficiently high rewards the risk is small so that actually means you can you can actually have these things be safely added to your network and they generate Revenue so how do you reduce this in practice uh so IG proposed a new mechanism recently which is uh called unique stake again sorry about my font uh where each service is allowed to say some fraction of any stake that is delegated to to my service only I can slash someone else can't slash it uh which sort of caps the overlap like how much a single validator can share their stake across multiple Services um and if you use this you can sort of get very nice verifiable proofs that the risk is small and you can think of these as sort of verifiable capital requirements and with that I'm ready for questions I think wow thanks for the very informative session ter if I could invite you to stand in the middle sounds good to answer the questions so we have one question so far please feel free to continue submitting more but the first question what's the tldr what's the main takeaway that you want people to know main takeaway is reaking networks generally if you can bound the risk that they create like from this stuff we were analyzing they're actually very good Revenue generators for l1s they generate sort of premium for the L1 token it's a little bit it actually somewhat counterintuitive but the result is that they actually generate more value with a small smaller number of services that generate fees than rollups you actually need way more rollups to generate you we need way more fees from rollups to compensate the L1 um whereas in in in reaking it's it's it's actually a lot lower and so the the point is this is only true if this risk is bounded that's sufficiently small and so you know most of this result is like how do you show that risk is small under what conditions is that risk small and that's that's kind of what we're sh which is basically that validators are need to be active management uh and uh the adversar is face cost all right so we see a couple more questions coming in um let's go to the first one so should we Advocate or enshrine reaking protocols then yeah so this is a great question I uh you know I I I'm not sure about the the the political Liberty on this but I actually think reaking protocols because they generate so much revenue potentially for the L1 it actually does make sense in a lot of ways for them to be Ed um of course you know you also have to keep in mind all of these extra risks you have um and so I think it would take a lot longer for the L1 to really be able to justify it um but yeah okay so we see a couple more that's coming up I'll read the the one so what do you think about asset migration from one reaking protocol to another yeah great question um so I think like in a world where there's no restrictions there no unbonding time where you can immediately move your stake you have a lot of problems where you can open up attacks um but generally if you look at symbiotic igen lay jeto all all of the the major reaking networks are actually giving have have sort of unbonding times and and and sort of friction for you moving between them uh and that friction is actually quite important uh to for their security in a lot of ways um and I think this is one of the reasons it might not make sense to enshrine right now uh it's probably better to see how these different reaking networks work in practice how much revenue they generate and then over time figure out how to internalize them but I think reaking is a little bit different than me in the sense that it's not really parasitic to users unless you have these cascading slashing events uh and so so as long as you limit those it's just more money for the L1 stakers okay um yeah great answer so wait that's a couple more I and we still have time as well so let's talk about can you go over the one e and 1 M example again for sure so yeah imagine have two Services um you know let's let's take two avss let's say one is igen Da and let's say the other one is uh an Oracle and let's suppose that you know I da doesn't have that much in fees right now now and the the the max profit you get from getting the validators to collude to attack it is 1 e on the other hand suppose the Oracle is tied to a perpetuals exchange so if I could manipulate the Oracle I can cause a price to to to move a lot and then I can earn a lot of profit and imagine you could earn one million E from that now if these were two separate proof of stake networks like the da network was its own POS Network and the uh uh Oracle network was its own POS Network then the cost of attack is or the amount of stake you need should somehow be proportional to the profit so for the Oracle I would need a million eth for the uh uh uh da layer I would only need one eth but if they're used in reaking and they have a lot of overlapping validators the one e service the one that has one e of aack profit has to pay has to attract an amount of stake that's equal to 1 million and 1 E so the sum of their profit if they have a lot of shared validators and this is because if the shared validators get slashed it kills both of them at the same time it doesn't just kill one of them and so so this is sort of one of the reasons you in the worst case you have this additive Behavior okay I think we have um short wo um uh I like to thank tun for the questions please give him a round of applause