diff --git a/docs/Events.md b/docs/Events.md new file mode 100644 index 00000000..e369171b --- /dev/null +++ b/docs/Events.md @@ -0,0 +1,12 @@ +--- +title: Events +--- +**Conferences 2025** + +[CRYPTO](https://crypto.iacr.org/2025/) (August 17-21) + +Participants: Chen-Da Liu-Zhang, Elizabeth Crites, and Alistair Stewart + +[ACNS](https://acns2025.fordaysec.de/) (June 23-26) + +Participants: Jeff Burdges, Elizabeth Crites, Alistair Stewart, and Sergey Vasilyev \ No newline at end of file diff --git a/docs/Polkadot/Polkadot-Crypto.png b/docs/Polkadot/Polkadot-Crypto.png new file mode 100644 index 00000000..3cce4204 Binary files /dev/null and b/docs/Polkadot/Polkadot-Crypto.png differ diff --git a/docs/Polkadot/economics/1-validator-selection.md b/docs/Polkadot/economics/1-validator-selection.md index c63a442a..6ca4ff76 100644 --- a/docs/Polkadot/economics/1-validator-selection.md +++ b/docs/Polkadot/economics/1-validator-selection.md @@ -2,100 +2,94 @@ title: Validator selection --- -**Authors**: [Jonas Gehrlein](/team_members/Jonas.md) + -**Last updated**: 07.12.2020 +Validator elections play a critical role in securing the network, placing nominators in charge of selecting the most trustworthy and competent validators. This responsibility is both complex and demanding. The vast amount of validator data, constantly growing, requires significant technical expertise and sustained engagement. As a result, the process can become overly cumbersome, leading many nominators to either avoid staking altogether or refrain from investing the time needed to evaluate the data thoroughly. In this context, effective tools are essential, not only to support nominators in making informed selections, but also to help ensure the network's long-term health and resilience. -## Introduction +This entry outlines several potential steps to support nominators while preserving their freedom of choice. As a starting point, it is important to highlight why recommendations should consider individual user preferences rather than attempting to make them universal. -The validator elections are essential for the security of the network, where nominators have the important task to evaluate and select the most trustworthy and competent validators. However, in reality this task is quite challenging and comes with significant effort. The vast amount of data on validators (which is constantly increasing) requires a substantial technical expertise and engagement. Currently, the process is too cumbersome and many nominators are either not staking or avoiding spending too much time to go through the large amount of data. Therefore, we need to provide tools, which both aid nominators in the selection process, while still ensuring that the outcome is beneficial for the network. +**Problem.** Providing an exogenous recommendation for a set of validators is not advisable, as user preferences, particularly risk preferences, vary significantly. Comparing metrics accross different scales, such as self-stake in DOT versus performance in percentage, is not feasible in an exogenous framework. Moreover, even when considering a single dimension, the shape of marginal utility functions remains unclear and is inherently tied to individual preferences. Determining the trade-offs involved in the selection process on behalf of nominators lies beyond the scope of this note. Yet, to illustrate this issue, consider the following simple example: -The following write-up provides an overview of several potential steps, which benefit the nominators while maintaining their freedom of choice. As a first step, it is helpful to illustrate why recommendations should be based on user's preferences and cannot be universal for all individuals. - -### Problem -It is not desirable to provide an exogenous recommendation of a set of validators, because user's preferences (especially risk-preferences) are quite different. Therefore, a comparison between metrics on different scales (e.g., self-stake in DOTs vs. performance in %) is not exogenously not possible. In addition, the shape of the marginal utility functions even within one dimension is unclear and based on individual's preferences. It is outside our competence to decide on various trade-offs of the selection process on behalf of nominators. To illustrate this issue, consider the following simple example: | | Commission | Self-Stake | Identity | Era-Points | | -------- | -------- | -------- | -------- | -------- | -| Validator 1 | 4% | 26 DOTs | Yes | Average | -| Validator 2 | 7% | 280 DOTs | No | Average - 1%| +| Validator 1 | 4% | 26 DOT | Yes | Average | +| Validator 2 | 7% | 280 DOT | No | Average - 1%| | Validator 3 | 1% | 1 DOT | No | Average + 5% | -All validators in the table have different profiles, where none is dominated. Validator 3 potentially yield high profits but does not have much self-stake (skin-in-the-game) and is without registered identity. Validator 1 charges a higher fee for their service but might leverage a reputable identity. Validator 2 requires substantial fees but has the most self-stake. One could easily think of different preferences of users, who would prefer any one of those validators. While probably every user could make a choice from that selection, the problem gets increasingly difficult for a set of 200-1000 validators. + +The table above presents validators with diverse profiles, none of which clearly dominate. Validator 3 may offer high potential profits but lacks significant self-stake (skin in the game) and does not have a registered identity. Validator 1 charges a higher service fee, yet may benefit from a reputable identity. Validator 2 has the highest self-stake, but also demands substantial fees. Clearly, user preferences can vary, some may favor one validator over another depending on their priorities. While most users could reasonably make a choice from this small set, the complexity increases when faced with a selection of 200 to 1,000 validators. -### Code of conduct for recommendations -As mentioned before, we cannot and do not want to give an exogenous recommendation to the users. We prefer methods, which values this insight and generates a recommendation based on their stated preferences. While valuing the preferences of the users, we still can *nudge* their decisions in a direction beneficial for the network (e.g., to promote decentralization). Nevertheless, the recommendation should be as objective as possible and should not discriminate against any specific validator. +**Code of conduct for recommendations.** As previously mentioned, the goal is not to provide exogenous recommendations to users, but rather to offer strategies that respect their insight and generate suggestions aligned with their stated preferences. While valuing individual preferences, recommendations may nudge decisions toward outcomes beneficial for the network, such as promoting decentralization. These recommendations should remain as objective as possible and must not discriminate against any specific validator. -### Organization -Validator selection is divided into several chapters. In the sections "Underlying dataset" (Link), we illustrate which data might be useful and how additional metrics can be generated. Afterwards, we can apply a simple concept from economics to significantly reduce the size of potentially intresting validators. Afterwards, This is the first step to give users a way to choose at hand. Then, we discuss some ideas to further curate the set of validators to promote goals of the network. As a last section the UTAStar method illustrates a sophisticated approach to estimate the individual marginal preference functions of the user and make a more precise recommendation. +**Organization.** This entry is divided into several sections. "Underlying data" presents potentially useful data and explains how to derive additional metrics. "Filtering phase" demonstrates how a simple concept from economics can significantly reduce the number of potentially interesting validators, providing users with a more manageable set of choices. The third section explores ideas to further curate the validator set in support of the network's goals. Lastly, the "UTAStar" section outlines a sophisticated approach for estimating each user's individual marginal preference functions, enabling more precise recommendations. -# Underlying Data -This section explains which data can be gathered about validators in Polkadot and Kusama and are relevant for a selection process. Those metrics indicated with a * are used in the final data-set, the other variables are used to generate additional metrics. Currently, we focus on quantitative on-chain data as those are verifiable and easy to process. This purely quantitative approach should be regarded as complementary to a selection process based on qualitative data, where nominators are e.g., voting for validators based on their identity or influence / engagement in the community. +# 1. Underlying data +Collectible data from Polkadot and Kusama validators is extremely relevant to the selection process. Metrics marked with an asterisk (*) are included in the final data set, while other variables are used to derive additional metrics. The primary focus is on quantitative on-chain data, as it is verifiable and straightforward to process. This purely quantitative approach intends to complement a selection process that incorporates qualitative factors, such as a validator’s identity, reputation, or community engagement, which often influence how nominators cast their votes. ## Retrievable data | Name | Historical | On-Chain | Description | |- |- |- |- | -| Public Address* | No | Yes | The public identifier of the validator. | +| Public address* | No | Yes | The public identifier of the validator. | | Identity* | No | Yes | Is there a verified on-chain identity? | -| Self-stake* | No | Yes | The amount of tokens used to self-elect. Can be seen as skin-in-the-game. | -| Other-Stake | No | Yes | The amount of allocated stake (potentially) by other nominators. | -| Total-Stake | No | Yes | The sum of self-stake and other-stake. | -| Commission | Maybe | Yes | The amount of commission in % which is taken by the validator for their service. | -| Era-Points | Yes | Yes | The amount of points gathered per era. | -| Number of Nominators* | No | Yes | The amount of nominators allocated to a validator. | - -**Era-Points**: The era-points are awarded to a validator for performing beneficial action for the network. Currently this is mainly driven by block production. In general, the distribution of era-points should be uniformly distributed in the long run. However, this can vary if validators operates on a superior setup (stronger machine, more robust internet connection). In addition, there is significant statistical noise from randomness in the short-term, which can create deviations from the uniform distribution. +| Self stake* | No | Yes | Tokens used for self-election represent a form of "skin in the game". | +| Other stake | No | Yes | The amount of stake (potentially) allocated by other nominators. | +| Total stake | No | Yes | The combined total of self stake and other stake. | +| Commission | Maybe | Yes | Percentage of commission charged by the validator for providing their service. | +| Era points | Yes | Yes | The number of points accumulated per era. | +| Number of nominators* | No | Yes | The number of nominators assigned to a validator. | +**Era Points** are awarded to validators for performing beneficial actions that support the network, primarily driven by block production. Over time, these points should be uniformly distributed, although distribution may vary if validators operate on superior setups, like more powerful hardware or more reliable internet connections. In addition, randomness may introduce significant statistical noise in the short term, leading to deviations from a uniform distribution. ## Generated metrics -Some of the retrieved on-chain data might be not very useful for nominators or can serve some additional metrics, which help in the selection process. +Some of the retrieved on-chain data might not be particularly useful for nominators, but it can still provide additional metrics that help in the selection process. | Name | Historical | On-Chain | Description | |- |- |- |- | -| Average Adjusted Era-Points | Yes | Yes | The average adjusted era-points from previous eras. | -| Performance | Yes | Yes | The performance of a validator determined by era-points and commission. | -| Relative Performance* | Yes | Yes | The performance normalized to the set of validators. | -| Outperforming MLE | Yes | Yes | An indicator how often a validator has outperformed the average era-points. Should be 0.5 for an average validator. | -| Average Performer* | - | Yes | A statistical test of the outperforming MLE against the uniform distribution. Indicates if a validator statistically over- or underperforms. | -| Active Eras* | Yes | Yes | The number of active eras. | -| Relative total stake* | No | Yes | The total stake normalized to the set of validators. | -| Operator Size* | No | Yes | The number of validators which share a similar on-chain identity. | +| Average adjusted era-points | Yes | Yes | The average adjusted era points from previous eras. | +| Performance | Yes | Yes | Validator performance is determined by era points and commission. | +| Relative performance* | Yes | Yes | This represents performance normalized across the set of validators. | +| Outperforming MLE | Yes | Yes | An indicator of how frequently a validator has outperformed the average era points. A typical validator should score around 0.5. | +| Average performer* | - | Yes | A statistical test of the MLE for outperformance against a uniform distribution. It indicates whether a validator statistically overperforms or underperforms. | +| Active eras* | Yes | Yes | The number of active eras. | +| Relative total stake* | No | Yes | Total stake normalized across the validator set. | +| Operator size* | No | Yes | The number of validators that share a similar on-chain identity. | -**Average Adjusted Era-Points** -To get a more robust estimate of the era-points, additional data from previous eras should be gathered. Since the total era-points are distributed among all active validators, and the set of active validators might change, it could bias the results. To counter that, we can adjust the era-points of each era by the active set size of that era. As this is the only biasing factor on the theoretical per-capita era-points, we can thereby make the historic data comparable. +**Average adjusted era points.** +To obtain a more robust estimate of the era points, additional data from previous eras should be collected. Since the total era points are distributed among all active validators, and the validator set may vary over time, this could introduce bias into the results. To correct for this, era points from each era can be adjusted based on the active set size during that period. As this is the sole factor influencing theoretical per-capita era points, such normalization enables meaningful comparison across historical data. -It is unclear how many previous eras should be used as having a too long history might bias the results towards the average while too short of a history diminishes the robustness of the metric. One idea could be to use the average of $active-eras$. +The optimal number of previous eras to include remains uncertain. Using too long a history may bias results toward the average, while too short a history can weaken the metric’s robustness. One possible approach is to use the average number of $active-eras$. -**Performance**: The performance of a validator from the point of view of a nominator is determined by the amount of era-points gathered by that validator, the nominator's share of the total stake and the commission a validator is charging. In addition, the performance level is linear in the bond of the nominator and is thereby independent from that. We can combine those metrics into one: +**Performance.** From a nominator's perspective, validator performance is determined by three main factors: the number of era points earned, the nominator's share of the total stake, and the commission charged by the validator. Since performance scales linearly with the nominator's bond, it can be considered independent of the bond amount. These metrics can be combined into a single performance indicator: $$ performance = \frac{averageEraPoints \times (1 - commission)}{totalStake} $$ -The **relative performance** is then simply defined by: +The **relative performance** is then defined as follows: $$ \frac{performance - min(performance)}{max(performance) - min(performance)} $$ -This gives a more understandable measure as the performance is normalized between 0 and 1. Additionally, it is robust to potential changes within the network (e.g. with a larger number of validators the era-points are reduced per era) and prevents false anchoring effects. +These calculations offer a more intuitive measure, as the performance is normalized between 0 and 1. The measure remains robust against potential changes within the network. For instance, when the number of validators increases, the era points per validator tend to decrease. The metric also avoids false anchoring effects. -**Outperforming MLE**: By gathering the historic era-points per validator during past eras, we can calculate how often a validator outperformed the average. As era-points should be distributed uniformly, a validator should outperform the average 50% of times. However, as mentioned before, in reality additional factors as hardware-setup and internet connection can influence this. This helps nominators to select the best performing validators while creating incentives for validators to optimize their setup. +**Outperforming MLE.** By collecting historical era points per validator accross previous eras, one can determine how frequently a validator outperforms the average. Assuming a uniform distribution of era points, a validator is expected to outperform the average approximately 50% of the time. In practice, other factors like hardware-setup and internet connectivity, can influence this performance metric. These insights not only help nominators identify top-performing validators but also encourage validators to optimize their setup. -**Significance MLE**: As the expected value of the outperforming MLE is 0.5 and the distribution should be uniformly, we can calculate whether a validator significantly over- or underperforms by: +**Significance MLE.** Given that the expected value of the outperforming MLE is 0.5 under a presumably uniform distribution, a statistical test may help assess whether a validator significantly overperforms or underperforms relative to this benchmark: $$ z = \frac{outperformingMLE - 0.5}{\sqrt{\frac{0.5 \times (1-0.5)}{numberActive}}} $$ -If $z > 1.645$ we can say that the respective validator outperforms significantly (10% significance level), while $z < -1.645$ indicates significant underperformance. +If $z > 1.645$, the corresponding validator significantly outperforms at the 10% significance level, while $z < -1.645$ indicates significant underperformance. -**Operator Size**: Based on the identity of a validator, we can estimate how many validators are run by the same entity. It is both in the interest of users and the network that there are not too many operators and that those operators are not too large. Selecting validators of larger operators might increase the risk of superlinear slashing, because it is reasonable to assume that those operators follow similar security practices. A failure of one validator might mean a failure of several of those validators which increases the punishment superlinearly. A counter-argument to this might be that larger operators are much more sophisticated with their setup and processes. Therefore, this objective measure should be left to the user to judge. +**Operator size.** Based on the identity of a validator, it is possible to estimate how many validators are operated by the same entity. For both users and the network, a reduced number of moderately sized operators is often more convenient. Selecting validators from larger operators may increase the risk of superlinear slashing, as these entities likely follow similar security practices. The failure of one validator could therefore imply the failure of several others, increasing superlinearly the likelihood of punishment. On the other hand, larger operators may have more sophisticated setups and processes, which could mitigate such risks. This metric should ultimately be considered an objective measure, leaving the final judgment to the user. -# Filtering Phase +# 2. Filtering phase -## Dominance-Filtering -After constructing the dataset as elaborated in the section "underlying data", we can start reducing the set of validators to reduce the amount of information a nominator has to process. One concept is to remove dominated validators. As we do not make qualitative judgements e.g., which "identity" is better or worse than another, we can remove validators who are inferior to another, since there is no rational reason to nominate them. A validator is dominated by another validator if all her properties are equal and at least one property is worse. Consider the following example: +## Dominance-filtering +After shaping the dataset elaborated in the section "Underlying data," it is time to begin reducing the set of validators to ease the information load for nominators. One approach is to eliminate dominated validators. Since qualitative judgements remain out of the picture, such as determining whether one "identity" is better or worse than another, it is reasonable to remove validators that are objectively inferior, as there is no rational basis for nominating them. A validator is said to dominate another when all properties are equal and at least one is strictly better. Consider the following example: ## Example: | Number | Public Address | Identity | Self-stake | Nominators | Relative Performance | Outperformer | Active Eras | Operator Size | @@ -105,72 +99,71 @@ After constructing the dataset as elaborated in the section "underlying data", w | 3 | 1xgFnMhdOui | 1 | 100 | 89 | 0.3 | 0 | 16 | 3 | | 4 | 1vO7JLtSm4F | 1 | 5000 | 89 | 1 | 1 | 29 | 3 | -Validator 1 is dominated by Validator 2, which means that it is worse in every dimension (note, as mentioned above a user might prefer larger operators in which case this would not be true). Validator 3 is dominated by Validator 3 and therefore can be removed from the set. By this process the set can be reduced to two validators. In practice, this shows to be quite powerful to vastly reduce the set size. +Validator 2 dominates Validator 1, meaning the latter is strictly worse in every dimension[^1]. Validator 3 also dominates Validator 1, so it can be removed from the set. Through this process, the validator set can be reduced to two. In practice, this method proves to be a powerful tool for significantly shrinking the set size. ## Further curation -Here we have the opportunity to do additional cleanup to the remaining set. As mentioned in the code of conduct, those should be optional but we can suggest default values for users. -* Include at least 1 inactive validator. (we might suggest some inactive nodes based on some other processes.) -* Reduce risk of super-linear slashing (i.e., remove validators from operators). -* Remove validators who run on the same machine (some analysis of IP addresses possible?). +Additional cleanup can still be performed on the remaining set. As stated in the code of conduct, this step is optional, yet here are some suggested default actions for users: +* Include at least one inactive validator. A suggestion would be inactive nodes based on separate processes. +* Reduce the risk of super-linear slashing, for instance by removing multiple validators run by the same operator. +* Remove validators running on the same machine (perhaps some analysis of IP addresses). -# Manual selection -After the set has been reduced by removing dominated validators and giving some filter option the user can easily select preferred validators manually. In this step, the selection is purely based on personal preferences and for example a nominator might order the validators by their relative performance and select those who also satisfy some requirements on a minimum self-stake. +# 3. Manual selection +After reducing the set by removing dominated validators and applying some filtering options, the user can easily select preferred validators manually. In this step, the selection is purely based on personal preferences. For example, a nominator might order the validators by their relative performance, and select those who also meet certain minimum self-stake requirements. +# 4. UTAStar +As input, this method uses the filtered table from Section LINK and can be considered a natural extension of the previous method. +### Overview + UTilité Additive (UTA) is a preference disaggregation method introduced by [Jacquet-Lagrèze & Siskos (1982)](https://www.sciencedirect.com/science/article/abs/pii/0377221782901552). UTAStar is an enhanced version of the original algorithm. The core idea is that the marginal utility functions of a decision maker (DM), defined over each dimension of a given criterion, can be inferred from a previous ranked list of alternatives. The method employs linear programming to indentify utility functions that respect the DM's initial ranking while incorporating additional properties, such as normalizing the maximum utility to 1. -# UTAStar -This method takes the filtered table from section LINK as input and therefore can be seen as a natural extension to the method before. -## Overview -UTA (UTilité Additive) belongs to the methods of preference disaggregation ([Jacquet-Lagrèze & Siskos, 1982](https://www.sciencedirect.com/science/article/abs/pii/0377221782901552)). UTAStar is an improvement on the original algorithm. The general idea is that the marginal utility functions of a decision makers (DM) on each dimension of an alternative (i.e. criterion) can be deduced from a-priori ranked lists of alternatives. It uses linear programming to search for utility functions which satisfy the initial ranking of the DM while giving other properties (such as the maximum utility is normalized to 1). +### Some notation [^2] -### Some notation: -**This writeup relies strongly on [Siskos et al., 2005](https://www.researchgate.net/publication/226057347_UTA_methods)** -* $u_i$: marginal utility function of criteria i. +* $u_i$: Marginal utility function of criterion i. * $g_1,g_2,...g_n$: Criteria. -* $g_i(x)$: Evaluation of alternative x on the $i^{th}$ crterion. -* $\textbf{g}(x)$: Vector of performances of alternative $x$ on $n$ criteria. -* $x_1, x_2, ..., x_m \in X_L:$ Learning set which contain alternatives presented to the DM to give a ranking on. Note, that the index on the alternative is dropped. +* $g_i(x)$: Evaluation of alternative x on the $i^{th}$ criterion. +* $\textbf{g}(x)$: Performance vector of alternative $x$ across $n$ criteria. +* $x_1, x_2, ..., x_m \in X_L:$ Learning set containing alternatives presented to the decision maker (DM) for ranking. Note that the index on the alternative is dropped. ### Model -The UTAStar method infers an unweighted additive utility function: +The UTAStar method infers an additive utility function with equal weighting across criteria: $$ u(\textbf{g}) = \sum_{i=1}^{n} u_i(g_i) $$ -where $\textbf{g}$ is a vector of performances. with the following constraints: +where $\textbf{g}$ is a performance vector, subject to the following constraints: $$ \sum_{i=1}^{n} u_i(g^\star) = 1 \; \text{and} \; u_i(g_{i\star}) = 0 \; \forall i = 1,2,...,n $$ -where $u_i, i=1,2...,n$ are non decreasing valued functions which are normalized between 0 and 1 (also called utility functions). +Each $u_i, i=1,2...,n$ is a non-decreasing function normalized between 0 and 1, also referred to as a utility function. -Thereby the value of each alternative $x \in X_L$: +The estimated utility of each alternative $x \in X_L$ is given by: $$ u'[\textbf{g}(x)]=\sum_{i=1}^{n}u_i[g_i(x)])+ \sigma^{+}(x) + \sigma^{-}(x) \forall x \in X_L $$ -where $\sigma^{+}(x)$ and $\sigma^{-}(x)$ are the under- and overestimation error. is a potential error relative to $u'[\textbf{g}(x)]$ +where $\sigma^{+}(x)$ and $\sigma^{-}(x)$ represent the underestimation and overestimation errors, each reflecting potential deviation in the estimation of $u'[\textbf{g}(x)]$ -The corresponding utility functions are defined in a piecewise linear form to be estimated by linear interpolation. For each criterion, the interval $[g_{i\star}, g_i^\star]$ is cut into $(\alpha_i - 1)$ intervals and the endpoints $g_i^j$ are given by: +The utility functions are approximated in piecewise linear form using linear interpolation. For each criterion, the interval $[g_{i\star}, g_i^\star]$ is divided into $(\alpha_i - 1)$ subintervals, and the endpoints $g_i^j$ are defined as: $$ g_i^j = g_{i\star} + \frac{j - 1}{\alpha_i - 1} (g_i^\star - g_{i\star}) \forall j = 1,2,...\alpha_i $$ -The marginal utility function of x is approximated by linear interpolation and thus for $g_i(x) \in [g_i^j - g_i^{j+1}]$ +The marginal utility function of x is approximated by linear interpolation. Thus, for $g_i(x) \in [g_i^j - g_i^{j+1}]$, the result is: $$ u_i[g_i(x)]= u_i(g_i^j) + \frac{g_i(x)-g_i^j}{g_i^{j+1}-g_i^j}[u_i(g_i^{j+1}) - u_i(g_i^j)] $$ -The learning set $X_L$ is rearranged such that $x_1$ (best) is the head and $x_m$ is the tail (worst). This ranking is given by the user. +The learning set $X_L$ is rearranged such that $x_1$ (the best alternative) is placed at the head and $x_m$ is the tail. The user provides this ranking. The utility difference between two consecutive alternatives is defined as: $$ \Delta(x_k, x_{k+1}) = u'[\textbf{g}(x_k)] - u'(\textbf{g}(x_{k+1})) $$ -then we can be sure that the following holds: +then the following holds: $$ \Delta(x_k, a_{k+1}) \geq \delta \; \textrm{iff} \; x_k > x_{k+1} @@ -182,15 +175,15 @@ $$ \Delta(x_k, x_{k+1}) = \delta \; \textrm{iff} \; x_k \backsim x_{k+1} $$ -where $\delta$ is a small and positive number which is an exogenous parameter set as the minimum discrepancy between the utilities of two consecutive options. -In order to ensure monotonicity we further transform the utility differences between two consecutive interval endpoints: +Here, $\delta$ is a small, positive, exogenous parameter representing the minimum acceptable discrepancy between the utilities of two consecutive options. +Reinforcing monotonicity involves further transforming the utility differences between two consecutive interval endpoints: $$ w_{ij} = u_i(g_i^{j+1}) - u_i(g_i^j) \geq 0 \forall i=1,...n \; and \; j = 1,... \alpha_i -1 $$ ### Algorithm -**Step 1**: Express the global value of the alternatives in the learning set $u[g(x_k)], k=1,2,...m$ in terms of marginal values $u_i(g_i)$ and then transform to $w_{ij}$ according to the above mentioned formula and by means of +**Step 1.** Express the global utility of the alternatives in the learning set $u[g(x_k)], k=1,2,...m$, in terms of marginal utility functions $u_i(g_i)$. Transform these into coefficients $w_{ij}$ according to the formula provided, using the following constraints: $$ u_i(g_i^1) = 0 \; \forall i = 1,2...n @@ -202,13 +195,13 @@ $$ u_i(g_i^j) = \sum^{j-1}_{i=1}w_{ij} \; \forall i = 1,2..N \; and \; j=2,3,...\alpha_i - 1 $$ -**Step 2**: Introduce two error functions $\sigma^{+}$ and $\sigma^{-}$ on $X_L$ by writing each pair of consecutive alternatives as: +**Step 2.** Introduce two error functions, $\sigma^{+}$ and $\sigma^{-}$, on the learning set $X_L$. Represent each pair of consecutive alternatives as: $$ \Delta(x_k,x_k+1) = u[\textbf{g}(x_k)] - \sigma^{+}(x_k) + \sigma^{-}(x_k) - u[\textbf{g}(x_{k+1})] + \sigma^{+}(x_{k+1}) - \sigma^{-}(x_{k+1}) $$ -**Step 3**: Solve the linear problem: +**Step 3.** Solve the following linear optimization problem: $$ [min] z = \sum_{k=1}^{m}[\sigma^{+}(x_k) + \sigma^{-}(x_k)] \\ @@ -219,25 +212,30 @@ $$ w_{ij} \geq 0, \sigma^{+}(x_k)\geq 0, \sigma^{-}(x_k)\geq 0 \forall i,j,k $$ -**Step 4**: Robustness analysis to find find suitable solutions for the above LP. +**Step 4.** Perform a robustness analysis to identify suitable solutions for the linear program (LP) described above. -**Step 5**: Apply utility functions to the full set of validators and return the 16 best scoring ones. +**Step 5.** Apply the derived utility functions to the full set of validators and select the 16 highest-scoring ones. -**Step 6**: Make some ad hoc adjustments to the final set (based on input of the user). For example: -* include favorites -* at most one validator per operator -* at least X inactive validators -* etc. +**Step 6.** Introduce ad hoc adjustments to the final set based on user-defined preferences. For example: +* Include user-designated favorites +* Ensure no more than one validator per operator +* Require at least X inactive validators +* Additional custom constraints as needed ### Remaining Challenges -There remain a few challenges when we want to apply the theory to our validator selection problem. +Several challenges remain in applying the theoretical framework to the validator selection problem: + +1. **Constructing the learning set.** The algorithm requires sufficient information to generate the marginal utility functions. Key subchallenges include: + - Developing methods that ensure performance dispersion across criteria. + - Applying machine learning techniques to iteratively construct smaller learning sets to gradually improve the collected information. + - Using simulations to generate a wide number of learning sets and corresponding rankings, enabling evaluation of which configurations most effectively improve utility estimation. +2. **Limitations of UTAStar.** UTAStar assumes piecewise linear and monotonic marginal utility functions. While alternative methods offer improvements in this regard, they may introduce additional implementation complexity. + -1. One challenge is how to construct the learning set. The algorithm needs sufficient information to generate the marginal utility functions. - - Find methods to guarantee performance dispersion of the different criteria. - - Use machine learning approaches to iteratively provide smaller learning sets which gradually improve the information gathered. - - Potentially use simulations to simulate a wide number of learning sets and all potential rankings on them to measure which learning set improves the information the most. -2. UTAStar assumes piece-wise linear monotone marginal utility functions. Other, methods improve on that but might be more difficult to implement. +[^1] As mentioned above, a user might prefer larger operators in which case the statement would not be true. +[^2] This write-up relies heavily on [Siskos et al., 2005](https://www.researchgate.net/publication/226057347_UTA_methods). +**For inquieries or questions, please contact** [Jonas Gehrlein](/team_members/Jonas.md) diff --git a/docs/Polkadot/economics/2-parachain-theory.md b/docs/Polkadot/economics/2-parachain-theory.md index f9fa8c23..649dc9d5 100644 --- a/docs/Polkadot/economics/2-parachain-theory.md +++ b/docs/Polkadot/economics/2-parachain-theory.md @@ -2,15 +2,17 @@ title: Theoretical Analysis of Parachain Auctions --- -**Authors**: Samuel Häfner and [Alistair Stewart](team_members/alistair.md) + -**Last updated**: April 17, 2021 +Polkadot uses a [candle auction format](https://wiki.polkadot.network/docs/en/learn-auction) to allocate parachain slots. A candle auction is a dynamic auction mechanism characterized by a randomly ending time. Such a random-closing rule affects equilibrium behavior, particularly in scenarios where bidders have front-running opportunities. -As explained [here](/Polkadot/overview/3-parachain-allocation.md) and [here](https://wiki.polkadot.network/docs/en/learn-auction) Polkadot uses a candle auction format to allocate parachain slots. A candle auction is a dynamic auction with the distinguishing feature that the ending time is random. In this project, we analyze the effects of such a random-closing rule on equilibrium play when some bidders have front-running opportunities. +Front-running opportunities can arise on blockchains when upcoming transactions become visible to network participants before they are included in new blocks. In the context of blockchain auction implementations, this allows certain bidders to observe and potentially respond to others' bids before those bids take effect, such as when they are recorded on-chain and incorporated into the auction mechanism. In first-price auctions, this enables tech-savvy bidders to outbid competitors at will. In second-price auctions, an auctioneer could increase the payment of the winning bidder at no cost by registering their own (pseudonymous) bidder. -Front-running opportunities emerge on blockchains because upcoming transaction become known among the network participants before they are included in new blocks. For blockchain implementations of auctions, this means that some bidders can see and potentially react to other bidders' bids before they come into effect; i.e., are recorded on the chain and are thus taken into account by the auction mechanism. In first-price auctions, this gives tech-savvy bidders the possibility to outbid other bidders as they please. In second-price auctions, the auctioneer could raise the payment of the winning bidder at no cost by registering his own (pseudonymous) bidder. +While cryptographic solutions to these problems exist, they are either computationally intensive or require multiple actions by the bidders. In the presence of smart contracts, such approaches fail altogether, as smart contract actions are fully predictable. -Whereas cryptographic solutions to these problems exist, they are either very computing intensive or require multiple actions by the bidders. In the presence of smart contracts, they do not work at all, because the actions of smart contracts are perfectly anticipatable. As an alternative that works without encrypting bids, this project analyzes a dynamic single-unit first-price auction with a random ending time. Time is discrete and in every round two bidders move sequentially in a fixed order. We show that a random-closing rule both revenue-dominates a hard-closing rule and makes participation for the bidder being front-run more attractive. In particular, under a uniform ending time distribution both the utility of the disadvantaged bidder and total revenues approach that of a second-price auction as the number of rounds grows large. Furthermore, the good is allocated efficiently. +An alternative to encrypted bidding is the use of a dynamic, single-unit first-price auction with a random ending time. Time is modeled discretely, and in each round, two bidders move sequentially in a fixed order. A random-closing rule not only revenue-dominates a hard-closing rule but also makes participation more attractive for bidders subject to front-running. In particular, under a uniform ending time distribution, both the utility of the disadvantaged bidder and the total revenue converge toward those of a second-price auction as the number of rounds increases. Furthermore, the good is allocated efficiently. Reference: Samuel Häfner and Alistair Stewart (2021): Blockchains, Front-Running, and Candle Auctions. Working Paper. [SSRN](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3846363) + +**For inquiries or questions please contact:** [Alistair Stewart](team_members/alistair.md) diff --git a/docs/Polkadot/economics/3-parachain-experiment.md b/docs/Polkadot/economics/3-parachain-experiment.md index 022f11ca..e70b6483 100644 --- a/docs/Polkadot/economics/3-parachain-experiment.md +++ b/docs/Polkadot/economics/3-parachain-experiment.md @@ -2,136 +2,138 @@ title: Experimental Investigation of Parachain Auctions --- -**Authors**: [Jonas Gehrlein](/team_members/Jonas.md), Samuel Häfner + -**Last updated**: 16.08.2021 +This entry focuses on experimentally examining the combinatorial candle auction as implemented in the Polkadot and Kusama protocol. Specifically, it compares its outcome with those of more traditional dynamic combinatorial auction formats currently in use. -## Overview -The goal of this project is to experimentally test the combinatorial candle auction as it is used in the Polkadot and Kusama protocol. In particular, we want to compare its outcome with those of more traditional, dynamic combinatorial auction formats employed today. +What distinguishes the candle auction apart from other dynamic auctions formats is its randomly determined ending time. This closing rule enables auctions to operate on blockchains by mitigating several practical issues that more common formats often encounter (cf. Häfner & Stewart, 2021, for an analysis of the sinlge-unit case). -What sets the candle auction apart from other dynamic auctions is that it has a random ending time. Such a closing-rule is important for auctions run on blockchains, because it mitigates several practical problems that other, more common auction formats suffer from (cf. Häfner & Stewart, 2021, for an analysis of the sinlge-unit case). +Since the combinatorial candle auction has not yet been studied, either theoretically or empirically, this analysis aims to fill that gap in the literature. The central hypothesis suggests that the candle format performs on par with, or even surpasses, the performance of dynamic combinatorial auctions that rely on specfic activity rules. These rules restrict feasible bids and close the auction when no further bids are submitted, thereby exerting early and serious pressure on bidders. The random ending time is expected to create a similar effect. In particular, this pressure to act may lead to more efficient outcomes, comparable to those generated by activity rules, when contrasted with auctions that use a simple hard-closing rule, such as fixed ending time. -The combinatorial candle auction has never been studied theoretically and empirically. Therefore, this project fills a gap in the literature. We hypothesize that the candle format is at par with, or even outperforms, dynamic combinatorial auctions that use specfic activity rules. Activity rules specify the feasible bids and close the auction when no more bids are entered in the system. Thus, they put pressure on the bidders to bid seriously early on. We expect a similar effect from the random ending time. In particular, we expect that the pressure to act induces - akin to activity rules - more efficient outcomes than in an auction with a simple hard-closing rule (i.e., a fixed ending time). +The design of the experimental investigation mirrors the core mechanism of the Polkadot parachain auction. The experiment takes place in a setting where bidders can freely communicate and share non-binding strategies before the auction. It is conducted off-chain and follows standard experimental economics procedures. Insights from the experiment can enhance understanding of bidding behavior and enable comparisons of efficiency across auction formats. -We will conduct an experimental investigation with a design that mimics the basic mechanism of the Polkadot parachain auction. In particular, we conduct the experiment in a context where bidders can freely communicate and share their non-binding strategies before the auction. The implementation is off-chain and follows standard experimental economics procedures. Insights from the experiment can be used to gain an understanding of the bidding behavior and to compare efficiency across formats. +## Dynamic combinatorial auctions -## Dynamic Combinatorial Auctions +The first point of discussion is the current use of combinatorial auctions. Second, it is important to present the combinatorial candle auction as implemented on Polkadot, highlighting the appeal of this format, and discussing its expected performance relative to more conventional combinatorial auction models. -In this section, we first discuss how combinatorial auctions are currently used. Second, we describe the combinatorial candle auction as it used on Polkadot, explain why we use this format, and what we expect about its performance vis-a-vis more standard combinatorial auction formats. +### Currently used combinatorial auctions +Combinatorial auctions have emerged as successors to multi-unit auctions, primarily due to their ability to solve the so-called exposure problem that arises in the presence of complementarities (Porter and Smith, 2006; Cramton, 2013). In multi-unit auctions, bidders compete for each unit individually. As a consequence, bidders seeking specific combinations of items may end up acquiring only a subset, which may hold significanlty less value than the complete bundle. Combinatorial auctions resolve this issue by allowing bids on item packages directly. In other words, a bidder either wins the entire package or nothing at all. -### Currently used Combinatorial Auctions -Historically, combinatorial auctions have emerged as successors of multi-unit auctions. Combinatorial auctions solve the so-called exposure problem from which multi-unit auctions suffer in the presence of complementarities (Porter and Smith, 2006; Cramton, 2013). In a multi-unit auction, the bidders compete for every unit separately. As a consequence, bidders aiming (and bidding) for a certain combination of items might suddenly find themselves in a situation of obtaining only a subset thereof, which has substantially lower value to them than the whole package. Combinatorial auctions allow bidders to place bids on packages directly and thus avoid this problem. That is, if you bid on a package then you either get the whole package, or nothing. +Today, combinatorial auctions are applied in a wide range of contexts. Among the most well-known examples are radio spectrum auctions (Porter and Smith, 2006; Cramton, 2013). Additional applications include electricity markets (Meeus et al., 2009), bus routes allocations, and industrial procurement (cf. Cramton et al., 2006, for an overview). -Today, combinatorial auctions are employed in many contexts. The most well known applications of combinatorial auctions are radio spectrum auctions (Porter and Smith, 2006; Cramton, 2013). Other applications include electricity (Meeus et al., 2009), bus routes, and industrial procurement (cf. Cramton et al., 2006, for an overview). +Many combinatorial auctions are dynamic, typically employing one of two distinct formats: -Many combinatorial auctions are dynamic. There are two distinct formats: +1. *Ascending format*: While the auction remains open, bidders can submit progressively higher bids for the different packages (see Bichler et al., 2017 for an experimental study). +2. *Clock format*: The auctioneer incrementally raises the prices of individual items or packages, and in each round, bidders must submit their demand for the different packages. In some versions, bidders are allowed to place final bids in an additional round of simultaneous bidding after the clock phase concludes (originally proposed by Ausubel et al., 2006; further discussed in Cramton, 2013). -1. *Ascending format*: As long as the auction is open, bidders can submit increasing bids for the different packages (experimentally studied Bichler et al. 2017). -2. *Clock format*: The auctioneer raises the prices on the individual items or packages and in every round, the bidders have to submit their demand for the different packages. In some formats, bidders can submit last bids in one additional round of simultaneous bidding once the clock phase is over (initially suggested by Ausubel et al. 2006; further discussed in Cramton, 2013). +U.S. radio spectrum auctions employed simple ascending multi-unit auctions for the first time. In 2006 and 2008, among other instances, the FCC introduced package bidding on predefined licenses using an ascending format (Porter and Smith, 2006; Cramton, 2013). The transition to clock auctions occurred later (Levin and Skrzypacz, 2016). -For example, in the case of US radio spectrum auctions, simple, ascending multi-unit auctions were used first. Then, in 2006 and 2008 among others, the FCC allowed bidding on pre-defined packages of licences in an ascending format (Porter and Smith, 2006; Cramton, 2013). The switch to clock auctions occurred later on (Levin and Skrzypacz, 2016). +An important design feature of any dynamic combinatorial auction is the activity rule. Its primary role is to encourage serious bidding from the outset and to prevent sniping or jump bidding. -An important design feature of any dynamic combinatorial auction is its so-called activity rule. The primary role of the activity rules is to encourage serious bidding from the start and to prevent sniping or jump-bidding. +During the auction phase, the activity rule determines which bids are feasible for each bidder. In the ascending bid format, the rule tipically specifies a minimum and a maximum increment that a new bid must have on a given item or package relative to a previous bid (Scheffel et al., 2012). In clock auctions, the activity rule may prevent bidders from switching to packages they ignored in earlier rounds; that is, bidders may reduce demand but not increase it (Levin and Skrzypacz, 2016). In both ascending and clock auctions, the rule may also restrict bidders to packages that are weakly smaller than those previously bid on (Cramton, 2013). -During the auction phase, the activity rule determines what kind of bids are feasible for any given bidder. In the case of the ascending bid format, the rule usually defines a minimum and a maximum increment that a new bid on a given item or package can have over an older bid (Scheffel et al., 2012). In the clock auction, the activity rule may prevent bidders from jumping onto a given package that they have ignored in earlier rounds; i.e., bidders may reduce demand but not increase it (Levin and Skrzypacz, 2016). In both the ascending auction and the clock auction, the rule sometimes also restricts bidders to bid on packages that are weakly smaller than the ones previously bid on (Cramton, 2013). +The activity rule also determines when the auction ends based on all previously submitted bids. In an ascending auction, the auction closes once no new bids are placed in a given round (Scheffel et al., 2012). In an clock auction, prices for individual packages are raised simultaneously until there is no excess demand for any package, which is when the auction concludes (Bichler et al., 2013). -Second, the activity rule determines when the auctions end based on all previously entered bids. In the ascending auction, the activity rule closes the auction when no new bids are entered in a round (Scheffel et al., 2012). In the clock auction, the prices on the individual packages are (simultaneously) raised until there is no excess demand for a package and the auction concludes when there is no excess demand for any of the packages (Bichler et al., 2013). +### The Combinatorial candle auction +In the combinatorial candle auction employed in Polkadot, bidders can submit bids within a predefined time window. Bids must increase, without further restrictions imposed by an activitiy rule. After the window closes, the actual ending time is retroactively determined at random. -### The Combinatorial Candle Auction -In the combinatorial candle auction employed in Polkadot, bidders can submit bids in a pre-defined time window. Bids have to be increasinge but they are otherwise not restricted by an activitiy rule. After the window closes, the ending time is retroactively determined in a random fashion. +Originated in medieval Europe, the name "candle auctions" derive from the way they were conducted. The auctioneer would light a candle in view of all the bidders and accept bids until the flame extinguished. The highest bidder at the moment the candle went out was declared the winner (cf., e.g., Hobson, 1971). The earliest accounts of this kind of auction date back to 14th-century France, where they were used to sell chattels and leases. In England, furs were sold via candle auctions up to the 18th century (cf. Füllbrunn and Sadrieh, 2012, for more details and references). -Candle auctions are believed to have originated in medieval Europe and they derive their name from the particular way they were conducted. The auctioneer lights a candle in sight of all the bidders and accepts bids until the candle goes out. The highest bidder at the time the candle goes out is declared the winner (cf., e.g., Hobson, 1971). Earliest accounts of this kind of auction date back to 14th century France where they were used to sell chattels and leases. In England, furs were sold in candle auction up to the 18th century (cf. Füllbrunn and Sadrieh, 2012, for more details and references). +Candle auctions have become rare. Possible reasons include the technical difficulty of generating generic randomness and the challenge of verifying commitment to a random device. Recent advances in cryptography help circumvent these issues and have brought candle auctions back into consideration. For example, Google held a patent for a dynamic auction with a random ending time, which expired in 2020 (Patent No. US6665649B1). -Candle auctions have become rare today. A possible reason is that generic randomness is technically hard to achieve and that the commitment to a random device hard to verify. Recent cryptographic advances allow to circumvent these problems and put the candle auction back on the scene. For example, For example, Google held a patent on a dynamic auction with a random ending time that expired in 2020 (Patent No. US6665649B1). +Front-running is a significant challenge in blockchain-based auction implementations. To mitigate this issue, the Polkadot protocol employs a candle auction mechanism. Since block production occurs at discrete intervals and all pending transactions are stored in the chain's mempool, tech-savvy bidders can, in principle, inspect and react to upcoming bids. This raises concerns that such behavior may reduce overall incentives to bid, thereby lowering both revenue and potential efficiency. As Häfner & Stewart (2021) argue, while cryptographic solutions to front-running do exist, they are not feasible within Polkadot's automated setting, primarily because smart contracts among bidders are expected. -The main reason why the Polkadot protocol employs a candle mechnism is that it mitigates some of the problems associated with front-running in auctions. Front-running is a major problem of blockchain implementations of auctions. Because block production only happens at discrete intervals but all upcoming transactions are stored in the chain's mempool, tech-savvy bidders can in principle inspect and react to upcoming bids. The general worry is that this reduces the overall incentives to bid, thus reducing revenue and possibly efficiency. As argued in Häfner & Stewart (2021) cryptographic solutions to the problem -- though they exist -- are not feasible for the automated setting of Polkadot, primarily because we expect smart contracts among bidders. +As far as existing literature indicates, Füllbrunn and Sadrieh (2012) is the only experimental study to examine a candle auction format. Unlike the planned experiment, their study focuses on a single-unit auction with a second-price payment rule. In a second-price auction, bidding one's true value is a weakly dominant strategy whenever there is a positive probability that the current round will be the terminal round. The experimental evidence largely supports this prediction. In contrast to first-price auctions, where equilibrium bidding depends on termination probabilities, expected revenue in second-price auctions is independent of those probabilities. -To the best of our knowledge, Füllbrunn and Sadrieh (2012) is the only experimental paper to also study a candle format. Other than in our planned experiment, they consider a single-unit auction with a second-price payment rule. In the second price auction, it is a weakly dominant strategy to bid the true value whenever there is a positive probability that the current round will be the terminal round. The experimental evidence largely confirms such a prediction. Other than in the first-price auction, where equilibrium bidding depends on the termination probabilities, expected revenue is independent of the termination probabilities. +## Experimental design -## Experimental Design +The aim is to examine an ascending combinatorial auction with discrete rounds $t$, during which bids can be placed. Each auction involves three bidders. After every round, which lasts $6$ seconds, all newly submitted bids are revealed. -We want to look at an ascending combinatorial auction with discrete rounds $t$ in which bids can be placed. There will be three bidders in every auction. After every round, all new bids are revealed. A round lasts for $6$ seconds. +The set of items is $X = \{1,2\}$, resulting in three possible packages $\{\{1\},\{2\},\{1,2\}\}$. Bidders may submit bids, where a bid $b=(p,x)$ consists of a price $p$ and a package $x \subseteq X$. Prices must increase and lie on a finite (fine) grid. Winning bids are selected to maximize total payment. The payment rule is pay-as-bid; that is, winning bidders must pay the amount they bid. -The set of items is $X = \{1,2\}$ giving us three packages $\{\{1\},\{2\},\{1,2\}\}$ on which bidders can submit bids. A bid $b=(p,x)$ consists of a price $p$ and any package $x \subseteq X$. Prices have to be increasing and must lie in a finite (fine) grid. The winning bids are selected to maximize total payment. The payment rule is pay-as-bid; i.e., winning bids have to be paid. +### The three ending formats -### The Three Ending Formats -We want to compare three ending formats: a candle format, a hard-closing rule, and an activity rule. +As mentioned in the introduction, one main objective is to compare three auction-ending formats: the candle format, the hard-closing rule, and the activity rule. -| | Communication | -|----------------|------------------| -| Candle Auction | CA | -| Hard-Close | HC | -| Activity Rule | AR | +| Auction Format | Abbreviation | +|------------------|--------------| +| Candle Auction | CA | +| Hard-Close | HC | +| Activity Rule | AR | -**Candle Format** In the candle auction, bidders can freely submit increasing bids during the auction phase, and the auction is terminated at random. In the specification that we consider, the ending time is determined retroactively; i.e, bids on packages are accepted in a predefined number of rounds, $\bar T$, after which the auctioneer announces the ending time $T \in \{1,...,\bar T\}$. The ending time $T$ is random, the probability that the auction ends in round $t$ is publicly known and given by $q_t \in (0,1)$, where $\sum_{t=1}^{\bar T}q_t=1$. +**Candle Format.** In a candle auction, bidders can freely submit increasing bids during the auction phase, and the auction terminates at a random time. In this specification, the ending time is determined retroactively: bids on packages are accepted for a predefined number of rounds, denoted by $\bar T$, after which the auctioneer announces the actual ending time $T \in \{1,...,\bar T\}$. The ending time $T$ is random, and the probability that the auction ends in round $t$ is publicly known and given by $q_t \in (0,1)$, where $\sum_{t=1}^{\bar T}q_t=1$. -**Hard-Close Rule** In the hard-close auction, bidders can also freely submit increasing bids yet the auction ends at a fixed end time, $\bar T$. +**Hard-Close Rule.** In a hard-close auction, bidders can freely submit increasing bids, yet the auction ends at a fixed time, denoted by $\bar T$. -**Activity Rule** In the activity rule format, the ending time is determined by the activity rule. Specifically, bids have to be increasing and if no new bid is entered for $\tau$ rounds, then the auction concludes. For the experiment, we propose $\tau=5$ (corresponding to $30$ seconds). +**Activity Rule.** In an activity rule format, bidder activity determines the ending time. Specifically, bids must increase, and if no new bid is submitted for $\tau$ consecutive rounds, the auction concludes. In this experiment, $\tau$ is set to 5, corresponding to $30$ seconds. ### Communication -Communication is ubiquitous in the blockchain setting. The different bidders are teams that work on similar technical problems, share communication channels, post on social media, etc. +Communication is ubiquitous in blockchain environments. Different bidders often operate as teams working on similar technical problems, sharing communication channels, posting on social media, and more. -Consequently, we will allow our experimental subjects to communicate in a chat before each auction and discuss non-binding strategies. Specifically, the bidders will have both an open chat as well as closed bilateral chat channels available. The chats will be open prior to the auction start and close thereafter. +Consequently, experimental subjects are allowed to communicate via chat before each auction to discuss non-binding strategies. Specifically, both an open group chat and closed bilateral chats are available. These channels are accessible prior to the auction and close once it begins. ### Valuations -In every auction, three bidders will be active. Bidders can have one of two roles that are commonly known when entering the auction: (1) global bidder, (2) local bidder. There will be one global bidder and two local bidders in every auction. +In each auction, three bidders participate. Bidders are assigned one of two roles, global bidder or local bidder, which are known prior to the start of the auction. Each auction features one global bidder and two local bidders. -The global bidder has a positive valuation only for the grand package, $\{1,2\}$. The local bidders hold valuations for the individual packages that add up in case they win the grand package. Specifically, we will assume +The global bidder has a positive valuation only for the grand package, denoted as $\{1,2\}$. Local bidders, on the other hand, hold valuations for individual packages, which are added up if they win the grand package. Specifically, it is assumed that + +
(2,4,5,3,1) +**Slot assignment via "Outside-in" sorting.** Ticket values $out'_{m,k}$ are assigned to slots using an outside-in ordering: -In the unlikely event that $K < s$, there will be some unassigned slots in the middle of the epoch, and for these we use AuRa. +- The lowest value $out'_{m,1}$ maps the last slot +- The second lowest $out'_{m,2}$ maps the first slot +- The third $out'_{m,3}$ maps the penultimate slot +- The fourth $out'_{m,4}$ maps to the second slot, and so on. -Concretely, for the algorithm for assiging lots that uses outside-in sorting, we take lists of even and odd numbered elements, reverse the list of odd elements, then concatenate the list of even elements, the list of aura slots and the reversed list of odd elements. +Example of outside-in ordering: Given the input (1,2,3,4,5), the resulting output is (2,4,5,3,1). + +In the unlikely event that $K < s$, some slots will remain unassigned in the middle of the epoch. These gaps are filled using the AuRa protocol. + +To assign slots using outside-in sorting, split the list of outputs into even- and odd-numbered elements, reverse the list of odd elements, then concatenate the even elements, followed by the Aura-assigned slots, and finally the reversed odd elements. ### 6) Claiming the slots -To produce a block in the assigned slot, the validator needs to include the ticket, a VRF output $out_{m,v,i}$, that corresponds to the slot together with a non-anonymous proof that this is the output of their VRF. +To produce a block in the assigned slot, a validator needs to include a ticket, specifically a VRF output $out_{m,v,i}$, corresponding to the slot, along with a non-anonymous proof that this output is the result of their VRF. + +Introducing the following functions facilitates this: -Thus we introduce $\texttt{Reveal}_{RVRF}: sk_v, out\mapsto \tau$ -and the corresponding + $\texttt{Check}_{RVRF}: \tau, out\mapsto true/false$ -calls that are basically Schnorr knowledge of exponent proofs (PoKE). -When validating the block nodes verify these proofs. -The validator must also include a never before seen VRF output, called the BABE VRF above. This may be done with the existing (non-jubjub) key on the same input (r_m || i). +These are esssentially Schnorr-style proofs of knowledge of exponent (PoKE). +When validating a block, nodes must verify these proofs. Additionally, the validator must include a previously unseen VRF output-referred to as the BABE VRF above, which can be generated using the existing (non-jubjub) key on the same input (r_m || i). -## Probabilities and parameters. +## Probabilities and parameters -The first parameter we consider is $x$. We need that there is a very small probability of their being less than $s$ winning tickets, even if up to $1/3$ of validators are offline. The probability of a ticket winning is $T=xs/a|V|$. -Let $n$ be the number of validators who actually participate and so $2|V|/3 \leq n \leq |V|$. These $n$ validators make $a$ attempts each for a total of $an$ attempts. -Let $X$ be the nimber of winning tickets. +The first parameter under consideration is $x$. The goal is to ensure a very low probability of having fewer than $s$ winning tickets, even if up to $1/3$ of validators are offline. The probability that any given attempt yields a winning ticket is $T=xs/a|V|$. +Let $n$ be the number of validators who actually participate such that $2|V|/3 \leq n \leq |V|$. Each of the $n$ validators makes $a$ attempts, resulting in a total of $an$ attempts. +Let $X$ be the number of winning tickets. Its expected value is -Then it's expectation has $E[X] = Tan = xsn/|V|$. If we set $x=2$, this is $\geq 4s/3$. In this case, $Var[X] = anT(1-T) \leq anT = xsn/|V| = 2sn/|V| \leq 2s$. +$$ +E[X] = Tan = xsn/|V| +$$ + +Setting $x=2$ yields $\geq 4s/3$. In this case, the variance is + +$$ +Var[X] = anT(1-T) \leq anT = xsn/|V| = 2sn/|V| \leq 2s +$$ Using Bernstein's inequality: $$ @@ -159,9 +190,11 @@ $$ \end{align*} $$ -For $s=600$, this gives under $4 * 10^{-13}$, which is certainly small enough. We only need the Aura fallback to deal with censorship. On the other hand, we couldn't make $x$ smaller than $3/2$ and still have tolerance against validators going offline. So $x=2$ is a sensible choice, and we should never need the Aura fallback. +For $s=600$, this yields a probability below $4 * 10^{-13}$, which is sufficiently small. The Aura fallback mechanism is needed only as a safeguard against censorship. It is not feasible to reduce $x$ below $3/2$ while retaining tolerance for offline validators, making $x=2$ a prudent choice. Under this configuration, the Aura fallback should remain unused. + +The next parameter to configure is $a$. A challenge arises in that if a validator $v$ receives $a$ winning tickets during an epoch, an adversary observing this will deduce that no additional blocks will be produced by $v$. -The next parameter we should set is $a$. The problem here is that if a validator $v$ gets $a$ winning tickets in an epoch, then when the adversary sees these, they now know that there will be no more blocks from $v$. +**For inquieries or questions, please contact** [Jeff Burdges](/team_members/JBurdges.md) diff --git a/docs/Polkadot/protocols/block-production/Sassafras-Part-1.md b/docs/Polkadot/protocols/block-production/Sassafras-Part-1.md deleted file mode 100644 index c8957508..00000000 --- a/docs/Polkadot/protocols/block-production/Sassafras-Part-1.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: 'Sassafras Part 1: A Novel Single Secret Leader Election Protocol' - ---- - -# Sassafras Part 1: A Novel Single Secret Leader Election Protocol - -Authors: Armando Caracheo, Elizabeth Crites, and Fatemeh Shirazi - -Polkadot is set to replace the [BABE](https://wiki.polkadot.network/docs/learn-consensus#block-production-babe)+[Aura](https://openethereum.github.io/Aura.html) consensus protocol with a new one: *Sassafras*. Sassafras will be used to generate blocks on Polkadot's relay chain, but can be used in other proof-of-stake (PoS) blockchains as well. So, what key advantages does this new protocol bring to the blockchain ecosystem? - -Imagine a bread factory where loaves are produced at random time intervals and multiple conveyor belts may release bread simultaneously, but only one loaf can be packaged at once. Clearly, this is not the most efficient way to process as much bread as possible. In a way, what happens in this factory resembles the current state of block production in Polkadot, as well as in other PoS blockchains. - -Classical proof-of-stake protocols for block generation create new blocks at unpredictable intervals, due to having multiple eligible block producers at once, or none at all. [BABE](https://wiki.polkadot.network/docs/learn-consensus#block-production-babe) similarly relies on randomized block generation and therefore inherits these traits. - -Just like in the bread factory, where the system could benefit from fixed-time production and a single conveyor belt, allowing loaves to be packaged one after another, an optimized block generation mechanism should rely on constant-time intervals and a single block producer per block. These improvements increase the number of loaves that can be produced, and analogously the number of blocks added to the chain. - -Production changes often introduce new challenges, and shifting to constant-time intervals within blockchain systems is no exception. Randomized block generation helps protect block producers from attacks, as adversaries are unable to predict the producer of the next block. For this reason, randomized block production has been considered a viable solution. - -But what if a protocol could ensure secrecy of block producers, protecting them from a looming adversary, while realizing non-randomized block generation to improve efficiency? Centered on the concept of *single secret leader election* (SSLE) (see [Part 2](https://hackmd.io/@W3F64sDIRkudVylsBHxi4Q/Bkr59i7ekg)), the Sassafras block producer selection protocol achieves exactly that. - -Curious to know how Sassafras works? Then keep reading. - -## Randomized block production: the root of multiple producers and empty blocks - -On Polkadot, [BABE](https://wiki.polkadot.network/docs/learn-consensus#block-production-babe) selects block producers through a process known as *probabilistic leader election* (PLE), which is common in many modern PoS blockchains. Since leader selection is based on a randomized algorithm, the following outcomes may occur: multiple block producers may be eligible to add a block to the chain, or no block producer may be eligible when the block is expected. - -Both outcomes have a negative impact on throughput (data processed per unit time), which is crucial to the scalability of blockchain consensus protocols. The absence of eligible block producers results in random time intervals between blocks. This can lead to a decrease in the overall throughput (i.e., fewer blocks in the final chain) and longer time intervals that lower the average block production rate. - -One way to mitigate low throughput is to simply reduce the time between produced blocks. Such a reduction, however, introduces the likelihood of certain risks. For instance, block producers who generate new blocks without first seeing the previous one may create forks. - -## Consistent timing from the core - -Constant-time block generation helps eliminate these potential risks and can be achieved by assigning a single block producer whenever a new block is expected. For example, in a fixed block producer rotation using a round-robin style, each validator takes turns and generates a block in a predefined order. [Aura](https://openethereum.github.io/Aura.html) is a good example of this block production mechanism. - -Unfortunately, this simple approach using a non-randomized algorithm for leader selection leaves the door open to attacks. If block producers are designated non-randomly and at fixed time intervals, the chain becomes vulnerable to forking and denial-of-service attacks. - -One way to counter these vulnerabilities is to implement an SSLE protocol. In the literature, there are several proposed SSLE protocols for block producer elections (see [Part 3](https://hackmd.io/I8VSv8c6Rfizi9JWmzX25w)). SSLE boasts many desirable features, which make it an attractive option for integration into PoS blockchains. However, existing protocols have various drawbacks, particularly in terms of efficiency. Indeed, none have been deployed to date. - -## Sassafras’s innovative approach - -Sassafras is a consensus protocol designed to randomly select the next block producer. Its main aim is to efficiently select a unique block producer and release blocks at constant time intervals. To achieve definite finality of blocks, the protocol may be combined with another protocol, such as [Grandpa](https://docs.polkadot.com/polkadot-protocol/architecture/polkadot-chain/pos-consensus/#). - -Sassafras operates as an SSLE protocol rather than a PLE protocol. Its novelty lies in using a [ring verifiable random function (VRF)](https://eprint.iacr.org/2023/002) to select a single block producer per block, while maintaining sufficient block producer secrecy within a “ring” of all participants. This design reduces on-chain communication and computation, enhances block production as well as leader selection efficiency, and conceals the identities of a sufficient number of honest block producers (enough to stay secure) until the moment they create blocks. - -We are now ready to describe the Sassafras protocol. - -## An overview of how Sassafras works, step-by-step - -At a high level, Sassafras works as follows. First, every validator generates a ticket, which they publish on-chain in a private manner. These tickets are sorted into a list. The first validator in that list reveals their identity and produces the next block. Tickets are kept private until the moment blocks are produced to protect validators from attacks. - -In terms of timing, during an epoch of the blockchain, blocks are generated according to the election results of the previous epoch, and new leaders are elected for the next epoch. - -The figure below illustrates the protocol in more detail. - - - -**Phase A)** Each validator generates a ticket $(y_i, \sigma_i)$ consisting of the ring VRF outputs, and encrypts it using the encryption key of a randomly chosen validator. This validator, called a repeater, acts as an identity guard. Each validator then sends their ciphertext to all validators. Both the ticket and its repeater remain hidden. - -**Phase B)** Each repeater receives all tickets and decrypts those for which it holds the decryption key. Repeaters then publish the tickets they have received on-chain. - -**Phase C)** All tickets are sorted and recorded on-chain. - -**Phase D)** When validator identities leak in Phase B, adversarial repeaters can decrypt their tickets (orange dots) and launch attacks (orange dots with a cross). The figure illustrates the worst-case scenario, in which all validators with leaked identities have been attacked. Even in this situation, the first honest validator on the sorted list (one who has not been attacked) is able to submit proof that they hold the winning ticket and become the next block producer. - -**Phase E)** The selected validator then generates the next block. - -With these five phases in place, and since all block producers for an epoch are determined in the previous epoch, blocks can be generated seamlessly in constant time (e.g., every 6 seconds on Polkadot). Moreover, Sassafras achieves the highest efficiency among SSLE protocols while maintaining sufficient anonymity to ensure the security of a blockchain that deploys it. - - -Striking this balance is what makes Sassafras an ideal candidate for real-world deployment. In fact, a specification of Sassafras, called Safrole, has already been integrated into the architecture of the upcoming [JAM protocol](https://graypaper.com/). - -## Eager to learn more about Sassafras? - -So far, we have presented a concise introduction to Sassafras, accessible to readers with a basic understanding of blockchains. We have also outlined the motivation behind the protocol and provided a clear overview of how it works. But this is only the beginning. The Web3 Foundation team has prepared two additional blog posts that explore Sassafras in greater detail. - -Our next blog post, [Part 2 - Deep Dive](https://hackmd.io/@W3F64sDIRkudVylsBHxi4Q/Bkr59i7ekg), will explain the concept of an SSLE protocol and delve into the technical details of Sassafras. The final chapter, [Part 3 - Compare and Convince](https://hackmd.io/I8VSv8c6Rfizi9JWmzX25w), will demonstrate how Sassafras achieves unparalleled efficiency in block production and provide readers with a comparison of similar protocols, highlighting its value. The upcoming blog posts aim to describe how Sassafras offers a practical solution for achieving better throughput while maintaining security. - -So stay tuned, brave reader. There's much more to discover in our upcoming Sassafras series, which is packed with valuable insights! diff --git a/docs/Polkadot/protocols/block-production/Sassafras.png b/docs/Polkadot/protocols/block-production/Sassafras.png new file mode 100644 index 00000000..3e8f6f94 Binary files /dev/null and b/docs/Polkadot/protocols/block-production/Sassafras.png differ diff --git a/docs/Polkadot/protocols/block-production/index.md b/docs/Polkadot/protocols/block-production/index.md index 046b1718..69a7d7ea 100644 --- a/docs/Polkadot/protocols/block-production/index.md +++ b/docs/Polkadot/protocols/block-production/index.md @@ -4,10 +4,19 @@ title: Block production import DocCardList from '@theme/DocCardList'; -The relay chain in Polkadot is built with the underlying proof-of-stake (POS) block production mechanism by validators. The currently deployed mechanism is a hybrid of BABE and Aura. We plan to replace BABE+Aura with Sassafras in the future. -**BABE:** A PoS protocol provides a way to elect validators to produce a block in the corresponding time slot. BABE's election is based on verifiable random function (VRF) of validators invented by David et al. for [Ouroboros Praos](https://eprint.iacr.org/2017/573.pdf) i.e., if a VRF output of a validator is less than a pre-defined threshold, then the validator is legitimate to produce a block. So, one validator or more than one validator or no validator can be elected. This election mechanism is completely private. In other words, no one can guess who is elected until the elected validator publishes a block. The privacy property is very critical for the blockchain security because it is indispensable for achieving security against an adaptive adversary who can corrupt any validator at any time. The drawback of this election mechanism is that no validator will be elected in a significant amount of time. So, validators waste these times by doing nothing which causes slightly worse (and uneven) throughput. Therefore, we fill the empty slots with blocks generated by validators who are deterministically selected by [Aura](https://eprint.iacr.org/2018/1079.pdf). Aura's election mechanism is not private so it is not secure against an adaptive adversary. For example, the adversary can prepare a DDOS attack on the elected validator by Aura to prevent him to publish his block because the adversary knows who is elected beforehand. Therefore, filling the empty slots with Aura blocks is not a solution in the adaptive adversarial model to prevent empty slots. Nevertheless we note that BABE+Aura is secure (safe and live) in the adaptive adversarial model - the security reduces to the BABE's security. It just does not prevent theoretically to have empty slots that we need to have a better throughput in the adaptive adversarial model. +The Polkadot relay chain, built by validators through a Proof-of-Stake (PoS) block production mechanism, operates with a hybrid system that combines BABE and Aura. The plan is to eventually replace this with Sassafras. -**Sassafras:** We construct Sassafras to obtain both security and non-empty slot property in the relay chain in the adaptive adversarial model. The election mechanism is based on the new primitive 'ring-VRF' that we define. Ring-VRF has the same properties as VRF e.g. randomness, verifiability of the output but also has verifiability property without knowing the public key of the validator who generated the output. In short, all validators generate a good amount of ring VRF outputs. Then, these outputs are sorted after verification by all validators to determine the order of the validators in the block production. Since a ring-VRF output does not reveal the identity of the validators for the verification, the privacy is preserved. Another good property of Sassafras is that there is only **one** validator is selected for a specified time interval. This property is useful to have fewer forks which is better for the parachain performance. + + +**BABE:** A Proof-of-Stake (PoS) protocol provides a mechanism for electing validators to produce blocks in designated time slots. BABE's election is based on a verifiable random function (VRF), originally introduced by David et al. in [Ouroboros Praos](https://eprint.iacr.org/2017/573.pdf). Specifically, a validator is elligible to produce a block if its VRF output falls below a pre-defined threshold. As a result, a round may yield one, multiple, or no elected validators. This election mechanism is completely private. Until an elected validator publishes a block, no one can know who was selected. Such privacy property is crucial for blockchain security, as it provides resilience against adaptive adversaries capable of corrupting validators at any time. + +One limitation of BABE's approach is that blocks may not be produced for extended periods if no validator meets the threshold. These empty slots degrade throughput and create uneven performance. To mitigate this, empty slots are filled using blocks generated by validators deterministically selected by [Aura](https://eprint.iacr.org/2018/1079.pdf). This ensures that the chain continues producing blocks during otherwise idle slots, though it comes with a tradeoff. + +Aura's selection process is not private, making it vulnerable to adaptive adversaries. For instance, knowing in advance which validator will be chosen allows an attacker to launch targeted denial-of-service (DDoS) attacks to block publication. Relying solely on Aura is unsuitable under adaptive adversarial conditions. Nevertheless, the BABE+Aura hybrid protocol remains secure and live under such model, since overall security relies on BABE. The only drawback is that empty slots are not prevented in theory, meaning throughput improvements are limited in the adaptive adversarial setting. + +**Sassafras:** Sassafras aims to achieve both security and non-empty slot property on the relay chain under an adaptive adversarial model. Its election mechanism is built on a novel primitive called 'ring-VRF.' Like standard VRFs, ring-VRF provides randomness and output verifiability, but it also allows verification without requiring knowledge of the public key of the validator who generated the output. + +In essence, all validators generate a sufficient number of ring VRF outputs. These outputs are then verified and sorted to determine the validator order for block production. Because ring-VRF outputs do not disclose the validator's identity during verification, the mechanism preserves privacy. Sassafras limits block production to a **single** validator per time interval. This approach reduces the likelihood of forks, thereby improving parachain performance.diff --git a/docs/Polkadot/protocols/finality.md b/docs/Polkadot/protocols/finality.md index eecb7c2f..ade6a332 100644 --- a/docs/Polkadot/protocols/finality.md +++ b/docs/Polkadot/protocols/finality.md @@ -4,20 +4,11 @@ title: Finality import useBaseUrl from '@docusaurus/useBaseUrl'; -Owner: [Alistair Stewart](/team_members/alistair.md) + -GRANDPA is the finality (consensus) algorithm for Polkadot. Here we first -present a high-level overview, as an "extended abstract". Details are presented -in the full paper directly below that. +GRANDPA is the finality (consensus) algorithm used in Polkadot. To get started, you can read our "extended abstract," which provides a high-level overview. If you're eager to dive deeper into the technical details, feel free to skip ahead to the full paper just below. And as a bonus, there is a more polished and slightly shorter version of the full paper available on [arxiv](https://arxiv.org/abs/2007.01560). -We also have an [alternative version](https://arxiv.org/abs/2007.01560) of the -full paper available on arxiv, which is more polished and a bit shorter. - -What is implemented in the Polkadot software and deployed in practise, we refer -to as "Polite GRANDPA" which includes optimisations required for efficient -real-world performance in practise. These are not covered in the papers below -for brevity, but we go into [the details](#polite-grandpa) later here on this -page. The high-level concepts and design principles remain the same as GRANDPA. +"Polite GRANDPA" is the implementation of GRANDPA used in the Polkadot software and deployed in practice. It includes optimizations tailored for efficient real-world performance in practice, which are not covered in the papers below for the sake of brevity, You can find the [details](#polite-grandpa) later on this page. The high-level concepts and design principles remain consistent with GRANDPA. ## GRANDPA Abstract paper @@ -27,4 +18,7 @@ page. The high-level concepts and design principles remain the same as GRANDPA. ## Polite GRANDPA +**Looking for answers to your questions, feel free to contact:** [Alistair Stewart](/team_members/alistair.md) + + diff --git a/docs/Polkadot/protocols/index.md b/docs/Polkadot/protocols/index.md index 96d7864c..fc04b9d0 100644 --- a/docs/Polkadot/protocols/index.md +++ b/docs/Polkadot/protocols/index.md @@ -4,6 +4,8 @@ title: Protocols import DocCardList from '@theme/DocCardList'; -This chapter goes into full detail about each of the subprotocols that make up Polkadot. It focuses largely on end-to-end mechanics and the properties relevant at this layer; for point-to-point mechanics see `networking`. +This section provides a detailed description of some of the subprotocols that comprise Polkadot. The focus is largely on end-to-end mechanics and the properties relevant at this layer; for point-to-point mechanics, see `networking`. + + diff --git a/docs/Polkadot/protocols/secure-and-efficient-bridges.png b/docs/Polkadot/protocols/secure-and-efficient-bridges.png new file mode 100644 index 00000000..ff83fb7b Binary files /dev/null and b/docs/Polkadot/protocols/secure-and-efficient-bridges.png differ diff --git a/docs/Polkadot/protocols/secure-andefficient-bridges.jpeg b/docs/Polkadot/protocols/secure-andefficient-bridges.jpeg new file mode 100644 index 00000000..4014731e Binary files /dev/null and b/docs/Polkadot/protocols/secure-andefficient-bridges.jpeg differ diff --git a/docs/Polkadot/security/Security.png b/docs/Polkadot/security/Security.png new file mode 100644 index 00000000..dc84b502 Binary files /dev/null and b/docs/Polkadot/security/Security.png differ diff --git a/docs/Polkadot/security/index.md b/docs/Polkadot/security/index.md index d44f3df1..70d4be91 100644 --- a/docs/Polkadot/security/index.md +++ b/docs/Polkadot/security/index.md @@ -4,6 +4,7 @@ title: Security import DocCardList from '@theme/DocCardList'; -This chapter talks about general security concerns, that cut across many (if not all) `subprotocols ` of Polkadot. + +This section addresses general security concerns that span many, if not all, Polkadot `subprotocols `. diff --git a/docs/Polkadot/security/keys/1-accounts-more.md b/docs/Polkadot/security/keys/1-accounts-more.md index 77603265..d92bc326 100644 --- a/docs/Polkadot/security/keys/1-accounts-more.md +++ b/docs/Polkadot/security/keys/1-accounts-more.md @@ -2,64 +2,69 @@ title: Account signatures and keys in Polkadot --- -We believe Polkadot accounts should primarily use Schnorr signatures with both public keys and the `R` point in the signature encoded using the [Ristretto](https://ristretto.group) point compression for the Ed25519 curve. We should collaborate with the [dalek ecosystem](https://github.com/dalek-cryptography) for which Ristretto was developed, but provide a simpler signature crate, for which [schnorr-dalek](https://github.com/w3f/schnorr-dalek) provides a first step. + +Polkadot accounts should primarily use Schnorr signatures, with both the public key and the `R` point in the signature encoded using the [Ristretto](https://ristretto.group) point compression for the Ed25519 curve. It is recommended to collaborate with the [dalek ecosystem](https://github.com/dalek-cryptography), for which Ristretto was developed, while providing a simpler signature crate. The [Schnorr-dalek](https://github.com/w3f/schnorr-dalek) library offers a first step in that direction. ## Schnorr signatures -We prefer Schnorr signatures because they satisfy the [Bitcoin Schnorr wishlist](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki) and work fine with extremely secure curves, like the Ed25519 curve or secp256k1. +Despite Schnorr signatures satisfying the [Bitcoin Schnorr wishlist](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki) and performing well on highly secure curves such as Ed25519 and secp256k1, this wishlist arguably overstates the capabilities of Schnorr-based multi-signatures. In practice, these schemes typically require three round trips, which, while suitable for industrial applications, introduce additional complexity and latency. -We observe the Bitcoin Schnorr wishlist oversells the promise of schnorr multi-signatures because they actually require three round trips, which works for industrial usage, but complicates. Another scheme call mBCJ from pages 21 and 22 of https://eprint.iacr.org/2018/417.pdf provides a two round trip multi-signature, but we require a delinearized variant of mBCJ for accounts https://github.com/w3f/schnorrkel/issues/15 and mBCJ is not actually a Schnorr signatures. +An alternative scheme, call mBCJ, described on pages 21-22 of this [paper](https://eprint.iacr.org/2018/417.pdf), offers a two-round multi-signature protocol. That said, a delinearized variant of mBCJ is required for account-based systems, as discussed in this [GitHub issue](https://github.com/w3f/schnorrkel/issues/15). It is also important to note that mBCJ is not a true Schnorr signature scheme, as it uses a different verification model and structural assumptions. -You could do fancier tricks, including like aggregation, with a pairing based curve like BLS12-381 and the BLS signature scheme. These curves are slower for single verifications, and worse accounts should last decades while pairing friendly curves should be expected become less secure as number theory advances. +More advanced techniques, such as signature aggregation using a pairing-based curve like BLS12-381 and the BLS signature scheme, are also possible. These curves tend to be slower for single verifications. Moreover, account systems are expected to remain secure for decades, while pairing-friendly curves may become less secure over time as number theory advances. -There is one sacrifice we make by choosing Schnorr signatures over ECDSA signatures for account keys: Both require 64 bytes, but only [ECDSA signatures communicate their public key](https://crypto.stackexchange.com/questions/18105/how-does-recovering-the-public-key-from-an-ecdsa-signature-work). There are obsolete Schnorr variants that [support recovering the public key from a signature](https://crypto.stackexchange.com/questions/60825/schnorr-pubkey-recovery), but -they break important functionality like [hierarchical deterministic key derivation](https://www.deadalnix.me/2017/02/17/schnorr-signatures-for-not-so-dummies/). In consequence, Schnorr signatures often take an extra 32 bytes for the public key. +Choosing Schnorr signatures over ECDSA for account keys involves a trade-off: Both signature types are 64 bytes in size, but only [ECDSA signatures allow public key recovery](https://crypto.stackexchange.com/questions/18105/how-does-recovering-the-public-key-from-an-ecdsa-signature-work). While there are obsolete Schnorr variants that [support public key recovery](https://crypto.stackexchange.com/questions/60825/schnorr-pubkey-recovery), they compromise important features such as [hierarchical deterministic (HD) key derivation](https://www.deadalnix.me/2017/02/17/schnorr-signatures-for-not-so-dummies/). In consequence, Schnorr signatures often require an additional 32 bytes to transmit the public key. -In exchange, we gain a slightly faster signature scheme with far simpler batch verification than [ECDSA batch verification](http://cse.iitkgp.ac.in/~abhij/publications/ECDSA-SP-ACNS2014.pdf) and more natural threshold and multi-signatures, as well as tricks used by payment channels. I also foresee the presence of this public key data may improve locality in block verification, possibly openning up larger optimisations. +In return, the signature scheme becomes slightly faster and enables much simpler batch verification compared to [ECDSA](http://cse.iitkgp.ac.in/~abhij/publications/ECDSA-SP-ACNS2014.pdf). It also supports more natural implementation of threshold signatures, multi-signatures, and techniques used in payment channels. Additionaly, the inclusion of public key data may improve locality during block verification, potentially unlocking optimization opportunities. -Yet most importantly, we can protect Schnorr signatures using both the derandomization tricks of EdDSA along with a random number generator, which gives us stronger side-channel protections than conventional ECDSA schemes provide. If we ever do want to support ECDSA as well, then we would first explore improvements in side-channel protections like [rfc6979](https://tools.ietf.org/html/rfc6979), along with concerns like batch verification, etc. +Most importantly, by combining the derandomization techniques of ECDSA with a secure random number generator, Schnorr signatures offer enhanced protection. This results in stronger side-channel resistance compared to conventional ECDSA schemes. To improve ECDSA in this regard, the first step would be to explore side-channel mitigation strategies such as [rfc6979](https://tools.ietf.org/html/rfc6979), along with considerations like batch verification and other optimizations. ## Curves -There are two normal curve choices for accounts on a blockchain system, either secp256k1 or the Ed25519 curve, so we confine our discussion to them. If you wanted slightly more speed, you might choose FourQ, but it sounds excessive for blockchains, implementations are rare, and it appears covered by older but not quite expired patents. Also, you might choose Zcash's JubJub if you wanted fast signature verification in zkSNARKs, but that's not on our roadmap for Polkadot, and Jubjub also lacks many implementations. +secp256k1 and Ed25519 are two elliptic curves commonly used for account keys in blockchain systems. For slightly more speed, FourQ is a viable alternative, though it may be excessive for blockchain use, as implementations are rare and it appears to be covered by older, though not fully expired, patents. Additionally, for fast signature verification in zkSNARKs a relevant choice is Zcash's JubJub. However, JubJub is not part of Polkadot's roadmap and also lacks widespread implementation support. ### How much secp256k1 support? -We need some minimal support for secp256k1 keys because token sale accounts are tied to secp256k1 keys on Ethereum, so some "account" type must necessarily use secp256k1 keys. At the same time, we should not encourage using the same private keys on Ethereum and Polkadot. We might pressure users into switching key types in numerous ways, like secp256k1 accounts need not support balance increases, or might not support anything but replacing themselves with an ed25519 key. There are conceivable reasons for fuller secp256k1 support though, like wanting ethereum smart contracts to verify some signatures on Polkadot. We might support secp256k1 accounts with limited functionality, but consider expanding that functionality if such use cases arise. +secp256k1 keys require minimal support, primarily because token sale accounts on Ethereum are tied to secp256k1 keys. As a result, some "account" type must necessarily support secp256k1. Using the same private keys across Ethereum and Polkadot is discouraged. And since secp256k1 accounts may not support balance increases or may only allow replacement with an ed25519 key, employing multiple key types is adivisable. + +That said, there are valid reasons to consider broader support for secp256k1. For example, enabling Ethereum smart contracts to verify signatures originated from Polkadot. While secp256k1 accounts can be supported with limited functionality, it may be worth expanding that functionality if such cross-chain use cases become relevant. ### Is secp256k1 risky? -There are two theoretical reasons for preferring an twisted Edwards curve over secp256k1: First, secp256k1 has a [small CM field discriminant](https://safecurves.cr.yp.to/disc.html), which might yield better attacks in the distant future. Second, secp256k1 has fairly rigid paramater choices but [not the absolute best](https://safecurves.cr.yp.to/rigid.html). I do not believe either to be serious cause for concern. Among more practical curve weaknesses, secp256k1 does have [twist security](https://safecurves.cr.yp.to/twist.html) which eliminates many attack classes. +Two theoretical arguments support the preference for a twisted Edwards curve over secp256k1: First, secp256k1 has a [small CM field discriminant](https://safecurves.cr.yp.to/disc.html), which could potentially enable more effective attacks in the distant future. Second, secp256k1 uses fairly rigid paramater choices that are [not optimal](https://safecurves.cr.yp.to/rigid.html). Neither of these concerns is currently regarded as critical. + +From a more practical standpoint, secp256k1 does offer [twist security](https://safecurves.cr.yp.to/twist.html), which helps eliminate several classes of attacks and strengthens its overall resilience. -I foresee only one substancial reason for avoiding secp256k1: All short Weierstrass curves like secp256k1 have [incomplete addition formulas](https://safecurves.cr.yp.to/complete.html), meaning certain curve points cannot be added to other curve points. As a result, addition code must check for failures, but these checks make writing constant time code harder. We could examine any secp256k1 library we use in Polkadot to ensure it both does these checks and has constant-time code. We cannot however ensure that all implementations used by third party wallet software does so. +The most substantial reason to avoid secp256k1 is that all short Weierstrass curves, including secp256k1, have [incomplete addition formulas](https://safecurves.cr.yp.to/complete.html). This means certain curve points cannot be added to others without special handling. As a result, the addition code must include checks for failures, which complicates writing constant-time implementations. -I believe incomplete addition formulas looks relatively harmless when used for simple Schnorr signatures, although forgery attacks might exist. I'd worry more however if we began using secp256k1 for less well explored protocols, like multi-signaturtes and key derivation. We ware about such use cases however, especially those listed in the [Bitcoin Schnorr wishlist](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki). +Reviewing any secp256k1 library used in Polkadot is essential to ensure it performs these checks and maintains constant-time execution. Still, it is not possible to ensure that every third-party wallet software does the same. + +Incomplete addition formulas are relatively harmless when used for basic Schnorr signatures, though forgery attacks may sill be possible. A greater concern arises when secp256k1 is used in less well-explored protocols, such as multi-signatures and key derivation. Awareness of such use cases exists, especially those outlined in the [Bitcoin Schnorr wishlist](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki). ### Is Ed25519 risky? Aka use Ristretto -Any elliptic curve used in cryptography has order h*l where l is a big prime, normally close to a power of two, and h is some very small number called the cofactor. Almost all protocol implementations are complicated by these cofactors, so implementing complex protocols is safer on curves with cofactor h=1 like secp256k1. +Any elliptic curve used in cryptography has an order of h*l, where h is a small number known as the cofactor, and l is a large prime, typically close to a power of two. Cofactors complicate almost all protocol implementations, which is why implementing complex protocols is generally safer on curves with a cofactor of h=1, such as secp256k1. -The Ed25519 curve has cofactor 8 but a simple convention called "clamping" that makes two particularly common protocols secure. We must restrict or drop "clamping" for more complex protocols, like multi-signaturtes and key derivation, or anything else in the [Bitcoin Schnorr wishlist](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki). +The cofactor of the Ed25519 curve is 8, but a simple convention known as "clamping" helps secure two particularly common protocols. For more complex protocols, such as multi-signatures, key derivation, or other advanced constructions listed in the [Bitcoin Schnorr wishlist](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki), "clamping" must be restricted or avoided altogether. -If we simple dropped "clamping" then we'd make implementing protocols harder, but luckily the [Ristretto](https://ristretto.group) encoding for the Ed25519 curve ensures we avoid any curve points with 2-torsion. I thus recommend: - - our secret key continue being Ed25519 "expanded" secret keys, while - - our on-chain encoding, aka "point compression" becomes Ristretto for both public keys and the `R` component of Schnorr signatures. +Simply dropping "clamping" makes protocol implemention more difficult. Fortunately, the [Ristretto](https://ristretto.group) encoding for the Ed25519 curve ensures that no curve points with 2-torsion are used, effectively eliminating cofactor-related issues. Reecommendations are as follows: + - The secret key remains an Ed25519 "expanded" secret key. + - The on-chain encoding, aka known as "point compression", should use Ristretto for both public keys and the `R` component of Schnorr signatures. -In principle, we could use the usual Ed25519 "mini" secret keys for simple use cases, but not when doing key derivation. We could thus easily verify standrad Ed25519 signatures with Ristretto encoded public keys. We should ideally use Ristretto throughout instead of the standard Ed25519 point compression. +In principle, simple use cases can rely on standard Ed25519 "mini" secret keys, except when requiring key derivation. Ristretto-encoded public keys can still verify standard Ed25519 signatures with ease. Ideally, Ristretto should be used throughout in place of the standard Ed25519 point compression, as it eliminates cofactor-related issues and enables safer protocol design. -In fact, we can import standard Ed25519 compressed points like I do [here](https://github.com/w3f/schnorr-dalek/blob/master/src/ristretto.rs#L877) but this requires the scalar exponentiation done in the [`is_torsion_free` method](https://doc.dalek.rs/curve25519_dalek/edwards/struct.EdwardsPoint.html#method.is_torsion_free), which runs slower than normal signature verification. We might ideally do this only for key migration between PoCs. +It is indeed possible to import standard Ed25519 compressed points, as this [example](https://github.com/w3f/schnorr-dalek/blob/master/src/ristretto.rs#L877) shows. This requires scalar exponentiation via the [`is_torsion_free` method](https://doc.dalek.rs/curve25519_dalek/edwards/struct.EdwardsPoint.html#method.is_torsion_free), which is significantly slower than standard signature verification. Ideally, this process should be reserved for key migration between PoCs implementations. -Ristretto is far simpler than the Ed25519 curve itself, so Ristretto can be added to Ed25519 implementations, but the [curve25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) crate already provides a highly optimised rust implementation. +Ristretto is conceptually simpler than the Ed25519 curve itself, making it easy to integrate into existing Ed25519 implementations. The [curve25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) crate already offers a highly optimized pure-rust implementation of both Ristretto and Curve25519 group operations. ### Zero-knowledge proofs in the dalek ecosystem -In fact, the [dalek ecosystem](https://github.com/dalek-cryptography) has an remarkably well designed infrastructure for zero-knowledge proofs without pairings. See: - https://medium.com/interstellar/bulletproofs-pre-release-fcb1feb36d4b - https://medium.com/interstellar/programmable-constraint-systems-for-bulletproofs-365b9feb92f7 - -All these crates use Ristretto points so using Ristretto for account public keys ourselves gives us the most advanced tools for building protocols not based on pairings, meaning that use our account keys. In principle, these tools might be abstracted for twisted Edwards curves like FourQ and Zcash's Jubjub, but yu might loose some batching operations in abstracting them for short Weierstrass curves like secp256k1. +The [dalek ecosystem](https://github.com/dalek-cryptography) offers a remarkably well-designed infrastructure for zero-knowledge proofs without relying on pairings. For deeper insights, see these two foundational articles on bulletproofs and programmable constraint systems: + [Bulletproofs Pre-release](https://medium.com/interstellar/bulletproofs-pre-release-fcb1feb36d4b) and [Programmable Constrait Systems for Bulletproofs](https://medium.com/interstellar/programmable-constraint-systems-for-bulletproofs-365b9feb92f7) +All these crates use Ristretto points, so adopting Ristretto for account public keys provides access to advanced tools for building protocols that avoid pairings and operate directly on account keys. In principle, these tools could be abstracted to support other twisted Edwards curves, such as FourQ and Zcash's Jubjub. Abstracting them for short Weierstrass curves, like secp256k1, may result in the loss of certain batching optimizations, though. +**For further inquieries or questions please contact**: [Jeff Burdges](/team_members/jeff.md) diff --git a/docs/Polkadot/security/keys/1-accounts.md b/docs/Polkadot/security/keys/1-accounts.md index 31f38e62..ac90b3a1 100644 --- a/docs/Polkadot/security/keys/1-accounts.md +++ b/docs/Polkadot/security/keys/1-accounts.md @@ -2,50 +2,55 @@ title: Account signatures and keys --- -## Ristretto + -We believe Polkadot accounts should primarily use Schnorr signatures with both public keys and the `R` point in the signature encoded using the [Ristretto](https://ristretto.group) point compression for the Ed25519 curve. We should collaborate with the [dalek ecosystem](https://github.com/dalek-cryptography) for which Ristretto was developed, but provide a simpler signature crate, for which [schnorr-dalek](https://github.com/w3f/schnorr-dalek) provides a first step. +## Ristretto -I'll write a another comment giving more details behind this choice, but the high level summary goes: +Polkadot accounts should primarily use Schnorr signatures, with both the public key and the `R` point in the signature encoded using the [Ristretto](https://ristretto.group) point compression for the Ed25519 curve. It is recommended to collaborate with the [dalek ecosystem](https://github.com/dalek-cryptography), for which Ristretto was developed, while providing a simpler signature crate. The [Schnorr-dalek](https://github.com/w3f/schnorr-dalek) library offers a first step in that direction. +Account keys must support the diverse functionality expected of account systems like Ethereum and Bitcoin. To that end, Polkadot keys use Schnorr signatures, which enable fast batch verification and hierarchical deterministic key derivation, as outlined in [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Child_key_derivation_CKD_functions). Features from the [Bitcoin Schnorr wishlist](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki) further highlight the advantages of Schnorr signatures, including: -Account keys must support the diverse functionality desired of account keys on other systems like Ethereum and Bitcoin. As such, our account keys shall use Schnorr signatures because these support fast batch verification and hierarchical deterministic key derivation ala [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Child_key_derivation_CKD_functions). All features from the [Bitcoin Schnorr wishlist](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki) provides a case for Schnorr signatures matter too, like + - Interactive threshold and multi-signatures + - Adaptor signatures, and potentionally blind signatures, for swaps and payment channels. - - interactive threshold and multi-signatures, as well as - - adaptor, and perhaps even blind, signatures for swaps and payment channels. +Since account keys are expected to remain valid for decades, conservative curve choices are essential. In particular, pairing-based cryptography and BLS signatures should be avoided for account-level operations. This comes at the cost of true aggregation when verifying blocks, and reduces support for highly interactive threshold and multi-signature schemes.[^1] -We make conservative curve choices here because account keys must live for decades. In particular, we avoid pairing-based cryptography and BLS signatures for accounts, at the cost of true aggregation of the signatures in a block when verifying blocks, and less interactive threshold and multi-signaturtes. [1]. +In the past, choosing between more secure elliptic curves involved a subtle trade-off: -In the past, there was a tricky choice between the more secure curves: + - Misimplementation resistance is stronger with Edwards curves, such as Ed25519 + - Misuse resistance is stronger with curves that have a cofactor of 1, such as secp256k1 - - miss-implementation resistance is stronger with Edwards curves, including the Ed25519 curve, but - - miss-use resistance in stronger when curves have cofactor 1, like secp256k1. +Historically, misuse resistance was a major selling point for Ed25519, which is itself a Schnorr variant. This resistance applies only to the basic properties of the signature scheme. Advanced signature functionalities, beyond batch verification, tend to break precisely because of Ed25519's misuse resistance. -In fact, miss-use resistance was historically a major selling point for Ed25519, which itself is a Schnorr variant, but this miss-use resistance extends only so far as the rudimentary signature scheme properties it provided. Yet, any advanced signature scheme functions, beyond batch verification, break precisely due to Ed25519's miss-use resistance. In fact, there are tricks for doing at least hierarchical deterministic key derivation on Ed25519, as implemented in [hd-ed25519](https://github.com/w3f/hd-ed25519), but almost all previous efforts [produced insecure results](https://forum.web3.foundation/t/key-recovery-attack-on-bip32-ed25519/44). +There are tricks for implementing hierarchical deterministic key derivation (HDKD) on Ed25519, such as those used in [hd-ed25519](https://github.com/w3f/hd-ed25519). Yet, most prior attempts [resulted in insecure designs](https://forum.web3.foundation/t/key-recovery-attack-on-bip32-ed25519/44). -We observe that secp256k1 provides a good curve choice from among the curves of cofactor 1, which simplify make implementing fancier protocols. We do worry that such curves appear at least slightly weaker than Edwards curves. We worry much more than such curves tend to be harder to implement well, due to having incomplete addition formulas, and thus require more review (see [safecurves.cr.yp.to](https://safecurves.cr.yp.to)). We could select only solid implementations for Polkadot itself, but we cannot control the implementations selected elsewhere in our ecosystem, especially by wallet software. +secp256k1 is a strong candidate among cofactor-1 curves, which simplify the implementation of advanced cryptographic protocols. Concerns remain, as such curves appear at least slightly weaker than Edwards curves and are generally more difficult to implement securely due to their incomplete addition formulas, which require more rigorous review (see [safecurves.cr.yp.to](https://safecurves.cr.yp.to)). While it is possible to ensure solid implementations within Polkadot itself, controlling the choices elsewhere in the ecosystem, particularly by wallet software, is far more challenging. -In short, we want an Edwards curve but without the cofactor, which do not exist, except.. +In short, the ideal would be an Edwards curve without a cofactor, though such a curve does not exist. A practical alternative is an Edwards curve with cofactor 4, combined with [Mike Hamburg's Decaf point compression](https://www.shiftleft.org/papers/decaf/), which enables serialising and deserialising points on the subgroup of order $l$, offering a robust solution. -In Edwards curve of with cofactor 4, [Mike Hamburg's Decaf point compression](https://www.shiftleft.org/papers/decaf/) only permits serialising and deserialising points on the subgroup of order $l$, which provides a perfect solution. [Ristretto](https://ristretto.group) pushes this point compression to cofactor 8, making it applicable to the Ed25519 curve. Implementations exist in both [Rust](https://doc.dalek.rs/curve25519_dalek/ristretto/index.html) and [C](https://github.com/Ristretto/libristretto255). If required in another language, the compression and decompression functions are reasonable to implement using an existing field implementation, and fairly easy to audit. +[Ristretto](https://ristretto.group) extends this compression technique to cofactor 8, making it compatible with the Ed25519 curve. Implementations are available in both [Rust](https://doc.dalek.rs/curve25519_dalek/ristretto/index.html) and [C](https://github.com/Ristretto/libristretto255). If needed in another language, the compression and decompression functions can be implemented using an existing field arithmetic library, and are relatively easy to audit. -In the author's words, "Rather than bit-twiddling, point mangling, or otherwise kludged-in ad-hoc fixes, Ristretto is a thin layer that provides protocol implementors with the correct abstraction: a prime-order group." +In plain words, "Rather than relying on bit-twiddling, point mangling, or other kludged ad-hoc fixes, Ristretto offers a thin layer abstraction that provides protocol implementors with a clean, prime-order group." ## Additional signature types -We could support multiple signature schemes for accounts, preferably with each account supporting only one single signature scheme, and possessing only one public key. There are at least three or four additional signature types worth considering: +It is possible to support multiple signature schemes for accounts, ideally with each account using only a single signature scheme and possessing just one public key. In fact, there are at least three or four additional signature types worth considering. -We could support Ed25519 itself so as to improve support for HSMs, etc. It's security is no different from Ristretto Schnorr signatures for normal use cases. We've provided a secure HDKD solution, but users might encounter problems from existing tools that provide HDKD solutions. +By supporting Ed25519, compatibility with HSMs and similar hardware may be improved. It's security is equivalent to Ristretto-based Schnorr signatures for typical use cases. Although a secure HDKD solution exists, users may encounter issues with existing tools that implement HDKD in less secure ways. -At least initially, we have allocated dots to secp256k1 keys compatible with ECDSA signatures on Ethereum. We could use Schnorr / EdDSA signatures with these same keys instead. We could however restrict these keys to doing only outgoing transfers, with the hope that they disappear completely without the first six months. We might alternatively keep secp256k1 key support long term in the hopes that either the secp vs secq duality proves useful, or that parties with legacy infrastructure like exchanges benefit. +secp256k1 keys were initially used to allocate DOT, as they are compatible with ECDSA signatures on Ethereum. These same keys can alternatively be used with Schnorr or EdDSA signatures and restricted to outgoing transfers only, with the expectation that they will be phased out within the first six months. Alternatively, long term support for secp256k1 keys may be retained, either to leverage the secp vs secq duality or to accommodate legacy infrastructure, such as exchanges. -We might develop a delinearized variant of the proof-of-possesion based mBCJ signatures from pages 21 and 22 of https://eprint.iacr.org/2018/417.pdf which provide two-round trip multi-signatures. All current Schnorr multi-signature schemes require three round trips. See https://github.com/w3f/schnorrkel/issues/15 I'd expect such a delinearized variant of mBCJ to use Ristretto keys too, but the signature scheme differs. +One possibility is to develop a delinearized variant of the proof-of-possesion-based mBCJ signatures described on pages 21 and 22 of [this paper](https://eprint.iacr.org/2018/417.pdf), which enables two-round trip multi-signatures. In contrast, all current Schnorr multi-signature schemes require three round trips (see [this issue](https://github.com/w3f/schnorrkel/issues/15)). Such a delinearized variant of mBCJ would likely use Ristretto keys as well, though it would involve a different signature scheme. -We could support BLS12-381 signatures to provide true signature aggregation. We could even integrate these with how session keys appear on-chain, but we've currently no argument for doing this. +Supporting BLS12-381 signatures enables true aggregation. These could also be integrated with how session keys appear on-chain, though no compelling argument currently justifies doing so. --- -[1] Aggregation can dramatically reduce signed message size when applying numerous signatures, but if performance is the only goal then batch verification techniques similar results, and exist for mny signature schemes, including Schnorr. There are clear advantages to reducing interactiveness in threshold and multi-signaturtes, but parachains can always provide these on Polkadot. Importantly, there are numerous weaknesses in all known curves that support pairings, but the single most damning weakness is the pairing $e : G_1 \times G_2 \to G_T$ itself. In essence, we use elliptic curves in the first palce because they insulate us somewhat from mathematicians ever advancing understanding of number theory. Yet, any known pairing maps into a group $G_T$ that re-exposes us, so attacks based on index-calculus, etc. improve more quickly. As a real world example, there were weaknesses found in BN curve of the sort used by ZCash during development, so after launch they needed to develop and migrate to a [new curve](https://z.cash/blog/new-snark-curve/). We expect this to happen again for roughly the same reasons that RSA key sizes increase slowly over time. +[^1] Aggregation can significantly reduce signed message size when applying numerous signatures. If performance is the sole objective, batch verification techniques offer similar benefits and are available for many signature schemes, including Schnorr. Reducing interactivity in threshold and multi-signaturtes presents clear advantages, though parachains on Polkadot can always provide these features. + +Importantly, all known pairing-friendly elliptic curves suffer from various weaknesses, and the most fundamental issue lies in pairing itself: $e : G_1 \times G_2 \to G_T$. Elliptic curves are used precisely because they offer some insulation from advances in number theory. Yet, any known pairing maps into a target group $G_T$, which reintroduces vulnerabilities and enables faster attacks based on index calculus and related techniques. +A real world example is the BN curve used during ZCash development, which was later found to have weaknesses. After launch, the team had to design and migrate to a [new curve](https://z.cash/blog/new-snark-curve/) to restore security margins. Similar transitions are expected in the future, for much the same reason that RSA key sizes gradually increase over time. +**For further inquieries or questions please contact**: [Jeff Burdges](/team_members/jeff.md) diff --git a/docs/Polkadot/security/keys/2-staking.md b/docs/Polkadot/security/keys/2-staking.md index 94864551..0a526cc4 100644 --- a/docs/Polkadot/security/keys/2-staking.md +++ b/docs/Polkadot/security/keys/2-staking.md @@ -1,46 +1,50 @@ --- title: Nomination --- + -In some sense, all public keys derive their authority from some combination of ceremonies and certificates, with certificate root keys deriving their authority entirely from ceremonies. As an example, trust-on-first-use schemes might be considered a pair of cerimonies, the key being associated to an identity first, and the threat of other comparing keys fingerprints. +In a sense, all public keys derive their authority from some combination of ceremonies and certificates, with certificate root keys relying entirely on ceremonies for their authority. For example, trust-on-first-use schemes can be viewed as a pair of ceremonies: first, the key is associated with an identity, and second, its fingerprint is compared against others to detect potential threats. -We apply this perspective to a consensus algorithm for a proof-of-stake blockchains like polkadot by regarding the chain itself as one large ceremony and treating the staked/bonded account as the root of trust. We then have certificates issued by these staked account keys that authenticate both the session keys used by Polkadot validators and block producers, as well as the long-term transport layer authentication keys required by TLS or Noise (see concerns about libp2p's secio). +This perspective can be applied to consensus algorithms in proof-of-stake blockchains, like Polkadot, by viewing the chain itself as a large, ongoing ceremony and treating the staked or bonded account as the root of trust. Certificates issued by these staked account keys authenticate both the session keys used by Polkadot validators and block producers, as well as the long-term transport layer authentication keys required by protocols like TLS or Noise (see concerns about libp2p's secio). ## Stash account keys -In polkadot, these staked or bonded account keys are called "stash account keys" to help disambiguate them from other key roles discussed below. We currently describe `unbond`, `withdraw_unbonded`, and `bond_extra` transactions in [2]. There are several ways to implement these, or related operations, but if accounts are not too constrained in size then one extremely flexible approach goes: +In Polkadot, these staked or bonded account keys are referred to as "stash account keys" to distinguish them from other key roles discussed below. The transactions `unbond`, `withdraw_unbonded`, and `bond_extra` are examples described in this [GitHub entry](https://github.com/paritytech/substrate/blob/1a2ec9eec1fe9b3cc2677bac629fd7e9b0f6cf8e/srml/staking/Staking.md).[^2] There are several ways to implement these or related operations, but if account size is not overly constrained, a highly flexible approach can be considered. -These stash accounts has an unstaked balance $u \ge 0$ and a list of pending unstaking dates and balances $T = { (t,v) }$ with $v>0$, one of which lack any unstaking date, meaning $t = \infty$. An unstaking operation splits $(\infty,v) \in T$ into $(\infty,v - v')$ and $(t,v')$. Any payment out of a staked account completes any pending unstaking operations by moving their value into the unstaked balance $u$. In other words, at block height $h$, a payment of value $v'$ with fees $f$ out of a stash account is valid if +Each stash account maintains an unstaked balance $u \ge 0$ and a list of pending unstaking dates and balances $T = { (t,v) }$ with $v>0$, where one entry lacks a specific unstaking date, i.e., $t = \infty$. An unstaking operation splits $(\infty,v) \in T$ into $(\infty,v - v')$ and $(t,v')$. Any payment from a staked account completes pending unstaking operations by transferring their value into the unstaked balance $u$. In other words, at block height $h$, a payment of value $v'$ with fees $f$ from a stash account is valid if: - $T_1 = \{ (t,v) \in T_0 : t > h \}$, - $u_1 := u_0 + \sum \{ (t,v) \in T_0 : t \le h \} - h - f$ remains positive. -We might require additional metadata in $T$ so that delayed slashing cannot impact more recently added stake, but this resembles the above discussion. +Additional metadata in $T$ may be required to ensure that delayed slashing does not affect more recently added stake. This concern closely resembles the discussion above. ## Stake controller account keys -We must support, or may even require, that these session keys and TLS keys rotate periodically. At the same time, we must support stash account keys being air gapped, which prevents them from signing anything regularly. In consequence, we require another layer, called "stake controller account keys", that lies strictly between, and control the nomination of or delegation from stash account keys to session keys. +Session keys and TLS keys must rotate periodically. At the same time, stash account keys should remain air-gapped, preventing them from being used for regular signing. In consequence, an additional layer, called "stake controller account keys", is required. These keys act as intermediaries, managing the nomination or delegation from stash account keys to session keys. -As we require small transactions associated to staking, these "stake controller account keys" are actual account keys with their own separate balance, usually much smaller than the "stash account key" for which they manage nomination/delegation. +Since staking involves small, frequent transactions, "stake controller account keys" are actual account keys with their own separate balances, typically much smaller than the "stash account key" they represent. -In future, we might permit the certificate from the stash account key to limit the actions of a controller keys, which improves our stakers' security when certain functions permit less slashing. In particular, we might admit modes for fishermen and block producers that prohibit nominating or running a validator. +In the future, it may be possible to allow certificates issued by stash account keys to restrict the actions of controller keys. This would enhance staker security, especially when certain functions involve reduced slashing risk. For example, enabling modes for fishermen or block producers could explicitly prohibit nominating or running a validator. -At the moment however, we only support one such slashing level, so all mode transitions are functions of the controller key itself, as described in [2]. +Currently, however, only one slashing level is supported. As such, all mode transitions are determined by the controller key itself, as described in the already mentioned [GitHub entry](https://github.com/paritytech/substrate/blob/1a2ec9eec1fe9b3cc2677bac629fd7e9b0f6cf8e/srml/staking/Staking.md).[^2] ## Certificate location -We could either store certificates with account data, or else provide certificates in protocol interactions, but almost surely the certificate delegating from the staked account to the nominator key belongs in the account data. +Certificates can either be stored with account data or provided during protocol interactions. In most cases, the certificate delegating authority, from the staked account to the nominator key, should be stored within the account data. -We should take care with the certificates from the controller key to the session key because the session key requires a proof-of-possesion. If we place them into the controller account, then there is a temptation to trust them and not check the proof-of-possesion ourselves. We cannot necessarily trust the chain for proofs-of-possesion because doing so might provides escalation for attackers who succeed in posting any invalid data. If we provide them in interactions then there is a temptation to check the proof-of-possesion repeatedly. We should evaluate either attaching a self-checked flag to the staked account database vs storing session keys in some self-checked account database separate from the account database for which nodes trust the chain. +Special attention must be given to certificates issued from the controller key to the session key, as the session key requires a proof of possesion. If these certificates are stored in the controller account, there may be a temptation to trust them without verifying the proof of possesion. However, the proof-of-possesion chain cannot be inherently trusted, as doing so could allow attackers to escalate privileges by submitting invalid data. On the other hand, if certificates are provided through interactions, there may be a tendency to verify the proof of possesion repeatedly. This trade-off should be carefully evaluated, either attaching a self-checked flag to the staked account database or by storing session keys in a separate, self-checked account database distinct from the one nodes rely on via the chain. ## Certificate size -We could save some space by using implicit certificates to issue nominator keys, but we consider our initial implementation in [`schnorr-dalek/src/cert.rs`](https://github.com/w3f/schnorr-dalek/blob/master/src/cert.rs#L181) insufficient, so we'd require another implicit certificate scheme for this. In essence, an accounts nominator key could be defined by an additional 32 bytes attached to the account, along with any associated data. Actually doing this requires understanding (a) what form this associated data should take, and (b) if the space savings are worth the complexity of an implicit certificates scheme, mostly [reviewing the literature](https://github.com/w3f/schnorr-dalek/issues/4). We favor simplicity by avoiding implicit certificates currently. +It is possible to save space by using implicit certificates to issue nominator keys. Yet, the initial implementation in [`schnorr-dalek/src/cert.rs`](https://github.com/w3f/schnorr-dalek/blob/master/src/cert.rs#L181) proved insufficient, so a different implicit certificate scheme would be required for this purpose. + +In essence, an account's nominator key could be defined by appending an additional 32 bytes to the account, along with any associated data. Implementing this approach requires a clear understanding of a) the appropriate structure for the associated data, and b) whether the space savings justify the added complexity of an implicit certificate scheme, primarily through [reviewing the literature](https://github.com/w3f/schnorr-dalek/issues/4). For now, simplicity is favored by avoiding implicit certificates. ## Implementation -[1] https://github.com/paritytech/substrate/pull/1782#discussion_r260265815 -[2] https://github.com/paritytech/substrate/blob/1a2ec9eec1fe9b3cc2677bac629fd7e9b0f6cf8e/srml/staking/Staking.md aka https://github.com/paritytech/substrate/commit/1a2ec9eec1fe9b3cc2677bac629fd7e9b0f6cf8e +[^1] https://github.com/paritytech/substrate/pull/1782#discussion_r260265815 +[^2] aka https://github.com/paritytech/substrate/commit/1a2ec9eec1fe9b3cc2677bac629fd7e9b0f6cf8e +**For further inquieries or questions please contact**: [Jeff Burdges](/team_members/jeff.md) diff --git a/docs/Polkadot/security/keys/3-session.md b/docs/Polkadot/security/keys/3-session.md index 873b0991..5d266a2b 100644 --- a/docs/Polkadot/security/keys/3-session.md +++ b/docs/Polkadot/security/keys/3-session.md @@ -1,33 +1,37 @@ --- title: Session keys --- + -A session public key should consist of three or four public keys types: +A session public key should consist of three or four types of public keys: - - Ristretto Schnorr public key (32 bytes public keys, 64 byte signatures, 96 byte VRFs) + - Ristretto Schnorr public key (32-byte public keys, 64-byte signatures, 96-byte VRFs) - We issue these from the nominator keys acting as validator operators. We might use an implicit certificate but doing so either restricts us to one validator operator, or else increases code complexity and forces a primary validator operator. Implicit certificates also make session key records impossible to authenticate without the nominator account, but this sounds desirable. + These are issued from the nominator keys acting as validator operators. Using an implicit certificate either restricts the setup to a single validator operator or increases code complexity by requiring a designated primary operator. Implicit certificates also make session key records impossible to authenticate without access to the nominator account, though this may be a desirable property. - We know signers can easily batch numerous VRF outputs into a single proof with these, ala CloudFlare's Privacy Pass. If we employ these VRFs for block production then signers could periodically publish a "sync digest" that consolidated thousands of their past block production VRFs into a single check, which improves syncing speed. There is also an avenue to batch verify these VRFs by multiply signers, but it requires enlarging the VRF output and proofs from from 96 to 128 bytes. + Signers can efficiently batch numerous VRF outputs into a single proof using these keys, similar to CloudFlare's Privacy Pass. If these VRFs are employed for block production, signers could periodically publish a "sync digest" to consolidate thousands of past block production VRFs into a single verification, significantly improving syncing speed. Additionally, there is a pathway to batch-verify these VRFs across multiple signers, which would require enlarging the VRF output and proof size from 96 to 128 bytes. - - Small curve of BLS12-381 (48 byte public keys, 96 byte signatures) + - Small curve of BLS12-381 (48-byte public keys, 96-byte signatures) - Aggregated signatures verify can faster when using this key if the signer set for a particular message is large but irregularly composed, as in GRANDPA. Actual signatures are slower than the opposite orientation, and non-constant time extension field arithmetic makes them even slower, or more risky. Aggregating signatures on the same message like this incurs malleability risks too. We also envision using this scheme in some fishermen schemes. + Aggregated signatures can be verified more efficiently with this key if the signer set for a particular message is large but irregularly composed, as in GRANDPA. Individual signature generation is slower compared to the the reverse orientation, and the use of non-constant-time extension field arithmetic further increases latency and introduces potential security risks. Aggregating signatures on the same message also introduces malleability risks. This scheme may be applicable in certain fishermen protocols. - We should consider [slothful reduction](https://eprint.iacr.org/2017/437) as discussed in https://github.com/zkcrypto/pairing/issues/98 for these eventually, but initially key splitting should provide solid protection against timing attacks, but with even slower signature speed. + [Slothful reduction](https://eprint.iacr.org/2017/437), as discussed in [this GitHub issue](https://github.com/zkcrypto/pairing/issues/98), may eventually be considered for these keys. For now, key splitting offers solid protection against timing attacks, but with even slower signature speed. - - Big curve of BLS12-381 (96 bytes public keys, 48 byte signatures) (optional) + - Big curve of BLS12-381 (96-byte public keys, 48-byte signatures) (optional) - Aggregated signatures in which we verify many messages by the same signer verify considerably faster when using this key. We might use these for block production VRFs because they aggregating over the same signer sounds useful for syncing. Initially, we envisioned aggregation being useful for some VRF non-winner proofs designs, but our new non-winner proof design mostly avoids this requirement. Right now, we favor the Ristretto Schnorr VRF for block production because individual instances verify faster and it provides rather extreme batching over the same signer already. + This key type can verify aggregated signatures, where the same signer authorizes many messages, considerably faster. This makes them a potential fit for block production VRFs, as aggregation over the same signer could aid syncing. Initially, aggregation may be useful for certain VRF non-winner proof designs, but the updated design largerly avoids that dependency. At present, the Ristretto Schnorr VRF appears to be a stronger candidate for block production, offering faster individual verification and highly efficient batching for repeated signers. - We also expect faster aggregate verification from these when signer sets get repeated frequently, so conceivably these make sense for some settings in which small curve keys initially sound optimal. We envision signature aggregation being "wild" in GRANDPA, so the small curve key still sounds best there. + Faster aggregate verification is expected when signer sets are frequently reused, making this scheme suitable for contexts where small-curve keys might initially seem optimal. Signature aggregation is expected to be "wild" in GRANDPA, making the small-curve key a better fit in that setting. - Authentication key for the transport layer. - We might ideally include node identity form libp2p, but secio handles authentication poorly ([see the secio discussion](https://forum.web3.foundation/t/transport-layer-authentication-libp2ps-secio/69)). + Including node identity from libp2p is ideal, although secio handles authentication poorly ([see the secio discussion](https://forum.web3.foundation/t/transport-layer-authentication-libp2ps-secio/69)). -A session public key record has a prefix consisting of the above three keys, along with a certificate from the validator operator on the Ristretto Schnorr public key and some previous block hash and height. We follow this prefix with a first signature block consisting two BLS signatures on the prefix, one by each the BLS keys. We close the session public key record with a second signature block consisting of a Ristretto Schnorr signature on both the prefix and first signature block. In this way, we may rotate our BLS12-381 keys without rotating our Ristretto Schnorr public key, possibly buying us some forward security. +A session public key record begins with a prefix consisting of the three keys mentioned above, along with a certificate from the validator operator on the Ristretto Schnorr public key, and a recent block hash and height. This prefix is followed by a first signature block containing two BLS signatures on the prefix, one from each BLS key. The record is finalized with a second signature block containing a Ristretto Schnorr signature over both, the prefix and the first signature block. This structure allows the BLS12-381 keys to be rotated independently of the Ristretto Schnorr public key, possibly enhancing forward security. -We include the recent block hash in the certificate, so that if the chain were trusted for proofs-of-possession then attackers cannot place rogue keys that attack honestly created session keys created after their fork. We recommend against trusting the chain for proofs-of-possession however because including some recent block hash like this only helps against longer range attacks. +The recent block hash is included in the certificate to prevent attacks from inserting rogue keys that could compromise session keys after a fork, assuming the chain is trusted for proofs-of-possession. It is generally advisable not to trust the chain for such proofs, as including a recent block hash only mitigates long-range attacks. -We still lack any wonderful aggregation strategy for block production VRFs, so they may default to Ristretto Schnorr VRFs. In this case, the Ristretto Schnorr session key component living longer also help minimize attacks on our random beacon. +Currently, there is no aggregation strategy for block production VRFs, so Ristretto Schnorr VRFs may remain the default. In this case, the longer-lived Ristretto Schnorr session key component may help reduce attacks on the random beacon. + + +**For further inquieries or questions please contact**: [Jeff Burdges](/team_members/jeff.md) \ No newline at end of file diff --git a/docs/Polkadot/security/keys/Nomination.png b/docs/Polkadot/security/keys/Nomination.png new file mode 100644 index 00000000..2541c41a Binary files /dev/null and b/docs/Polkadot/security/keys/Nomination.png differ diff --git a/docs/Polkadot/security/keys/Session-keys.png b/docs/Polkadot/security/keys/Session-keys.png new file mode 100644 index 00000000..aa015634 Binary files /dev/null and b/docs/Polkadot/security/keys/Session-keys.png differ diff --git a/docs/Polkadot/security/keys/account-signatures-and-keys.png b/docs/Polkadot/security/keys/account-signatures-and-keys.png new file mode 100644 index 00000000..897b1443 Binary files /dev/null and b/docs/Polkadot/security/keys/account-signatures-and-keys.png differ diff --git a/docs/Polkadot/security/keys/account-signatures.png b/docs/Polkadot/security/keys/account-signatures.png new file mode 100644 index 00000000..c0608143 Binary files /dev/null and b/docs/Polkadot/security/keys/account-signatures.png differ diff --git a/docs/Polkadot/security/keys/creation.md b/docs/Polkadot/security/keys/creation.md index 696fbbcd..b3a08214 100644 --- a/docs/Polkadot/security/keys/creation.md +++ b/docs/Polkadot/security/keys/creation.md @@ -2,18 +2,18 @@ title: Account key creation ideas for Polkadot --- -https://forum.web3.foundation/t/account-key-creation-ideas-for-polkadot/68 + -We found a trick for using Ed25519 "mini" private keys in [schnorr-dalek](https://github.com/w3f/schnorr-dalek/blob/master/src/keys.rs), meaning users' "mini" private key consists of 32 bytes of unstructured entropy. +There's a trick for using Ed25519 "mini" private keys in [Schnorr-Dalek](https://github.com/w3f/schnorr-dalek/blob/master/src/keys.rs), where a user's "mini" private key consists of 32 bytes of unstructured entropy. -There are no serious problems with [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) so we suggest a similar strategy for deriving secret keys in Polkadot. We could however modernize BIP39 in a couple small but straightforward ways: +Since [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) doesn't present any serious issue, one suggestion is to adopt a similar strategy for deriving secret keys in Polkadot. Alternatively, BIP39 could be modernized in a few small but straightforward ways: - - *Argon2id should replace PBKDF2.* Adam Langely sugests [using time=2 and 64mb of memopry](https://github.com/golang/crypto/commit/d9133f5469342136e669e85192a26056b587f503) for interactive scenarios like this. In principle, one might question if this scenario should truly be considered interactive, but conversely one could imagine running this on relatively constrained devices. We might also improve the [argone2rs](https://github.com/bryant/argon2rs/issues) crate too, especially to [ensure we use at least v1.3 since v1.2.1 got weaker](https://crypto.stackexchange.com/a/40000). - - *Rejection sampling to support larger wordlists.* We could employ rejection sampling from the initial entropy stream to avoid tying ourselves to the list size being a power of two, as BIP39 seemingly requires. We can provide roughly the existing error correction from BIP32, even working in a ring of this order. - - *Actually provide a larger wordlist.* We're discussing enough entropy that users might benefit form using diceware-like word lists with 12.9 bits of entropy per word, as opposed to BIP32's 11 bits of entropy per word. It's possible some diceware word lists contained confusable words, but reviews exists at least for English. We might worry that larger wordlists might simply not exist for some languges. It's also easier to quickly curate shorter lists. + - *Argon2id should replace PBKDF2.* Adam Langely suggests [using time=2 and 64mb of memory](https://github.com/golang/crypto/commit/d9133f5469342136e669e85192a26056b587f503) for interactive scenarios like this. While one might question whether this scenario is truly interactive, it's reasonable to consider constrained devices as a target. The [argone2rs](https://github.com/bryant/argon2rs/issues) crate could also be improved, especially to [ensure the use of at least v1.3, since v1.2.1 was found to be weaker](https://crypto.stackexchange.com/a/40000). + - *Rejection sampling to support larger wordlists.* One possibility is to apply rejection sampling to the initial entropy stream, avoiding the constraint that the wordlist size must be a power of two, as BIP39 seemingly requires. It's feasible to retain roughly the same level of error correction as BIP32, even when working in a ring of this order. + - *Actually provide a larger wordlist.* There's been discussion around increasing entropy per word. Users might benefit from diceware-style wordlists, which offer 12.9 bits of entropy per word compared to BIP32's 11 bits. While some diceware lists may contain confusable words, reviewed versions are available (at least for English). Larger wordlists may not be available for some languages, and shorter lists are easier to curate quickly. -There are also more speculative directions for possible improvements: +More speculative directions for improvement includes: - - *Improve error correction.* Right now BIP39 has only a basic checksum for error correction. We could design schemes that corrected errors by choosing the words using Reed-Solomon, meaning non-systematic word list creation with code words, except naively this limits our word list sizes to finite field sizes, meaning prime powers. We would instead likely run Reed-Solomon separately on each prime power divisor of the word list's order. We should however evaluate alternatives like other [generalisations of Reed-Solomon codes to rings](https://hal.inria.fr/hal-00670004/file/article.pdf), or even working in a field of slightly larger order and reject choices that fall outside the wordlist. - - *Support multiple Argon2id configurations.* We might conceivably support multiple argon2id configurations, if small device constraints become a serious concern. We could select among a few argon2id configuration options using yet another output from the Reed-Solomon code. We'd simply use rejection sampling to choose the user's desired configuration. + - *Enhanced error correction.* BIP39 currently uses only a basic checksum. One idea is to design schemes that correct errors by selecting words via Reed-Solomon. This would involve non-systematic wordlist creation using codewords. Naively, this limits wordlist sizes to finite field sizes (i,e., prime powers), but a workaround could be to run Reed-Solomon separately on each prime power divisor of the wordlist's order. Alternatives such as [generalizations of Reed-Solomon codes to rings](https://hal.inria.fr/hal-00670004/file/article.pdf) could also be explored, or even using a field of slightly larger order and rejecting choices that fall outside the wordlist. + - *Support multiple Argon2id configurations.* If small device constraints become a serious concern, it may be useful to support multiple Argon2id configurations. The idea would be to select among a few predefined configurations using an additional output from the Reed-Solomon code. The user's desired configuration could then be chosen via rejection sampling. diff --git a/docs/Polkadot/security/keys/ideas-for-account-key-creation.jpeg b/docs/Polkadot/security/keys/ideas-for-account-key-creation.jpeg new file mode 100644 index 00000000..62a899dc Binary files /dev/null and b/docs/Polkadot/security/keys/ideas-for-account-key-creation.jpeg differ diff --git a/docs/Polkadot/security/keys/ideas-for-account-key-creation.png b/docs/Polkadot/security/keys/ideas-for-account-key-creation.png new file mode 100644 index 00000000..cddddbbb Binary files /dev/null and b/docs/Polkadot/security/keys/ideas-for-account-key-creation.png differ diff --git a/docs/Polkadot/security/keys/index.md b/docs/Polkadot/security/keys/index.md index 4709115c..d3dd6ccf 100644 --- a/docs/Polkadot/security/keys/index.md +++ b/docs/Polkadot/security/keys/index.md @@ -2,60 +2,66 @@ title: Polkadot's keys --- -**Authors**: [Jeff Burdges](/team_members/jeff.md) + -In polkadot, we necessarily distinguish among different permissions and functionalities with different keys and key types, respectively. We roughly categories these into account keys with which users interact and session keys that nodes manage without operator intervention beyond the certification process. +In Polkadot, different keys and key types grant access to essential permissions and functionalities. Roughly, categories are: account keys, which users interact with directly, and session keys, which nodes manage without operator intervention beyond the certification process. ## Account keys -Account keys have an associated balance of which portions can be _locked_ to play roles in staking, resource rental, and governance, including waiting out some unlocking period. We allow several locks of varying durations, both because these roles impose different restrictions, and for multiple unlocking periods running concurrently. +Account keys have an associated balance, portions of which can be _locked_ to participate in staking, resource rental, and governance. These locks may include a waiting period before funds are fully unlocked. The system supports multiple locks with varying durations to accommodate the different restrictions of each role and to enable concurrent unlocking periods. -We encourage active participation in all these roles, but they all require occasional signatures from accounts. At the same time, account keys have better physical security when kept in inconvenient locations, like safety deposit boxes, which makes signing arduous. We avoid this friction for users as follows. +Active participation in these roles is encouraged, though they all occasionally require signatures from account holders. At the same time, account keys benefit from stronger physical security when stored in inconvenient locations, like safety deposit boxes, making signing arduous. This friction for users can be mitigated as follows. -Accounts declare themselves to be _stash accounts_ when locking funds for staking. All stash accounts register a certificate on-chain that delegates all validator operation and nomination powers to some _controller account_, and also designates some _proxy key_ for governance votes. In this state, the controller and proxy accounts can sign for the stash account in staking and governance functions, respectively, but not transfer fund. +Accounts become _stash accounts_ when locking funds for staking. Each stash account registers an on-chain certificate that delegates all validator operations and nomination powers to a designated _controller account_, and also assigns a _proxy key_ for governance voting. In this state, the controller and proxy accounts can sign on behalf of the stash account for staking and governance functions, respectively, but cannot transfer funds. -As a result, the stash account's locked funds can benefit from maximum physical security, while still actively participating via signatures from their controller or proxy account keys. At anytime the stash account can replace its controller or proxy account keys, such as if operational security mistakes might've compromised either. +The locked funds in the stash account benefit from enhanced physical security, while still actively participating (via signatures) through their controller or proxy account keys. At any time, the stash account can replace its controller or proxy keys, for instance, if operational security mistakes may have compromised either. -At present, we suport both ed25519 and schnorrkel/sr25519 for account keys. These are both Schnorr-like signatures implemented using the Ed25519 curve, so both offer extremely similar security. We recommend ed25519 keys for users who require HSM support or other external key management solution, while schnorrkel/sr25519 provides more blockchain-friendly functionality like HDKD and multi-signatures. +At present, account keys are supported by both Ed25519 and schnorrkel/Sr25519. These are Schnorr-like signatures implemented using the Ed25519 curve that offer very similar levels of security. For users who require HSM support or other external key management solution, Ed25519 keys are a suitable choice. Meanwhile, schnorrkel/Sr25519 provides more blockchain-friendly features like HDKD and multi-signature capabilities. -In particular, schnorrkel/sr25519 uses the [Ristretto](https://doc.dalek.rs/curve25519_dalek/ristretto/index.html) implementation of section 7 of Mike Hamburg's [Decaf](https://eprint.iacr.org/2015/673.pdf) paper, which provide the 2-torsion free points of the Ed25519 curve as a prime order group. Avoiding the cofactor like this means Ristretto makes implementing more complex protocols significantly safer. We employ Blake2b for most conventional hashing in polkadot, but schnorrkel/sr25519 itself uses the [merlin](https://doc.dalek.rs/merlin/index.html) limited implementation of Mike Hamberg's [STROBE](http://strobe.sourceforge.io/), which is based on Keccak-f(1600) and provides a hashing interface well suited to signatures and NIZKs. See https://github.com/w3f/schnorrkel/blob/master/annoucement.md for more detailed design notes. +In particular, schnorrkel/Sr25519 uses the [Ristretto](https://doc.dalek.rs/curve25519_dalek/ristretto/index.html) implementation described in section 7 of Mike Hamburg's [Decaf](https://eprint.iacr.org/2015/673.pdf) paper. Ristretto provides the 2-torsion free points of the Ed25519 curve as a prime-order group. By avoiding the cofactor, Ristretto makes the implementation of more complex cryptographic protocols significantly safer. + +Blake2b is used for most conventional hashing operations in Polkadot, but schnorrkel/sr25519 itself relies on the [merlin](https://doc.dalek.rs/merlin/index.html) limited implementation of Mike Hamberg's [STROBE](http://strobe.sourceforge.io/), which is based on Keccak-f(1600) and offers a hashing interface well suited for signatures and non-interactive zero knowledge (NIZKs). + +For more detailed design notes, see the [announcement on GitHub](https://github.com/w3f/schnorrkel/blob/master/annoucement.md). ## Session keys -Session keys each fill roughly one particular role in consensus or security. All session keys gain their authority from a session certificate that is signed by some controller key and that delegates appropriate stake. +All session keys gain their authority from a session certificate, which is signed by a controller key who delegates the appropriate stake. Roughly, each session key fills a particular role either in consensus or security. -At any time, the controller key can pause or revoke this session certificate and/or issue replacement with new session keys. All new session keys can be registered in advance, and some must be, so validators can cleanly transition to new hardware by issuing session certificates that only become valid after some future session. We suggest using pause for emergency maintenance and using revocation if a session key might be compromised. +The controller key can pause or revoke this session certificate and/or issue a replacement with new session keys at any time. New session keys can be registered in advance, and some must be, so validators can smoothly transition to new hardware by issuing session certificates that become valid in a future session. It is recommended to use "pause" for emergency maintenance and "revocation" in case a session key may have been compromised. -We suggest session keys remain tied to one physical machine, so validator operators issue the session certificate using the RPC protocol, not handle the session secret keys themselves. In particular, we caution against duplicating session secret keys across machines because such "high availability" designs invariably gets validator operators slashed. Anytime new validator hardware must be started quickly the operator should first start the new node, and then certify the new session keys it creates using the RPC protocol. +As a suggestion, session keys should remain tied to a single physical machine. Validator operators should issue the session certificate using the RPC protocol, without handling the session secret keys. In particular, duplicating session secret keys across machines is strongly discouraged, as such "high availability" designs almost always result in validator slashing. Whenever new validator hardware needs to be started quickly, the operator should first launch the new node and then certify the newly generated session keys using the RPC protocol. -We impose no prior restrictions on the cryptography employed by specific substrate modules or associated session keys types. +No prior restrictions are imposed on the cryptographic algorithms used by specific substrate modules or the associated session keys types. -In BABE, validators use schnorrkel/sr25519 keys both for a verifiable random function (VRF) based on on [NSEC5](https://eprint.iacr.org/2017/099.pdf), as well as for regular Schnorr signatures. +In BABE, validators use Schnorrkel/sr25519 keys both for a verifiable random function (VRF) based on [NSEC5](https://eprint.iacr.org/2017/099.pdf), as well as for standard Schnorr signatures. -A VRF is the public-key analog of a pseudo-random function (PRF), aka cryptographic hash function with a distinguished key, such as many MACs. We award block productions slots when the block producer scores a low enough VRF output $\mathtt{VRF}(r_e || \mathtt{slot_number} )$, so anyone with the VRF public keys can verify that blocks were produced in the correct slot, but only the block producers know their slots in advance via their VRF secret key. +A VRF is a public-key analog of a pseudo-random function (PRF), that is, a cryptographic hash function with a distinguished key, as seen in many MAC constructions. Block production slots are awarded when a block producer generates a sufficiently low VRF output, denoted as $\mathtt{VRF}(r_e || \mathtt{slot_number} )$. This allows anyone with the corresponding VRF public keys to verify that blocks were produced in the correct slot, while only block producers, using their VRF secret keys, can determine their slots in advance. -As in [Ouroboros Praos](https://eprint.iacr.org/2017/573.pdf), we provide a source of randomness $r_e$ for the VRF inputs by hashing together all VRF outputs form the previous session, which requires that BABE keys be registered at least one full session before being used. +As in [Ouroboros Praos](https://eprint.iacr.org/2017/573.pdf), a source of randomness $r_e$ for the VRF inputs is provided by hashing together all VRF outputs from the previous session. This approach requires the registration of BABE keys at least one full session before they are used. -We reduce VRF output malleability by hashing the signer's public key along side the input, which dramatically improves security when used with HDKD. We also hash the VRF input and output together when providing output used elsewhere, which improves compossibility in security proofs. See the 2Hash-DH construction from Theorem 2 on page 32 in appendix C of ["Ouroboros Praos: An adaptively-secure, semi-synchronous proof-of-stake blockchain"](https://eprint.iacr.org/2017/573.pdf). +Hashing the signer's public key alongside the input helps reduce VRF output malleability, significantly improving security when used with HDKD. Additionally, hashing the VRF input and output together when producing output for use elsewhere, improves compossibility in security proofs. For reference, see the 2Hash-DH construction in Theorem 2 on page 32, Appendix C of ["Ouroboros Praos: An adaptively-secure, semi-synchronous proof-of-stake blockchain"](https://eprint.iacr.org/2017/573.pdf). -In GRANDPA, validators shall vote using BLS signatures, which supports convenient signature aggregation and select ZCash's BLS12-381 curve for performance. There is a risk that BLS12-381 might drops significantly below 128 bits of security, due to number field sieve advancements. If and when this happens, we expect upgrading GRANDPA to another curve to be straightforward. See also https://mailarchive.ietf.org/arch/msg/cfrg/eAn3_8XpcG4R2VFhDtE_pomPo2Q +In GRANDPA, validators vote using BLS signatures, which support efficient signature aggregation and utilize ZCash's BLS12-381 curve for performance. However, there is a risk that BLS12-381 could fall significantly below 128-bit security due to potential advancements in the number field sieve algorithm. If and when this occurs, upgrading GRANDPA to another curve is expected to be straightforward. For further discussion, see this [CFRG mailing list thread](https://mailarchive.ietf.org/arch/msg/cfrg/eAn3_8XpcG4R2VFhDtE_pomPo2Q) -We treat libp2p's transport keys roughly like session keys too, but they include the transport keys for sentry nodes, not just for the validator itself. As such, the operator interacts slightly more with these. +Libp2p transport keys are treated similarly to session keys, but they also encompass the transport keys for sentry nodes, not just for the validator. As a result, operators interact with them more frequently. ## old -In this post, we shall first give a high level view of the various signing keys planned for use in Polkadot. We then turn the discussion towards the certificate chain that stretches between staked account keys and the session keys used for our proof-of-stake design. In other words, we aim to lay out the important questions on the "glue" between keys rolls here, but first this requires introducing the full spectrum of key rolls. +First, a high-level view of the signing keys planned for use in Polkadot would be helpful. The discussion can then shift toward the certificate chain that links staked account keys to the session keys used for the proof-of-stake design. In other words, the goal is to lay out the key questions surrounding the "glue" between keys roles, but this first requires introducing the full spectrum of those roles. + +There are roughly four cryptographic layers in Polkadot: -We have roughly four cryptographic layers in Polkadot: + - [*Account keys*](1-accounts.md) are owned by users and tied to a single DOT-denominated account on Polkadot. Accounts may be staked/bonded, unstaked/unbonded, or in the process of unstaking/unbonding. However, only an unstaked/unbonded account key can transfer DOT between accounts ([more](1-accounts-more.md)). + - [*Nomination*](2-staking.md) establishes a certificate chain between staked (or bonded) account keys and the session keys used by nodes for block production and validation. Since nominator keys cannot transfer DOT, they serve to insulate account keys that may remain air-gapped from the nodes actively operating on the internet. + - [*Session keys*](3-session.md) consist of multiple keys grouped together to provide the various signing functions required by validators. These include several types of VRF keys. + - [*Transport layer static keys*](https://forum.web3.foundation/t/transport-layer-authentication-libp2ps-secio/69) are used by libp2p to authenticate connections between nodes. These should either be certified by the session key or potentially incorporated directly into the session key. - - [*Account keys*](1-accounts.md) are owned by users and tied to one actual dot denominated account on Polkadot. Accounts could be staked/bonded, unstaked/unbonded, or unstaking/unbonding, but only an unstaked/unbonded account key can transfer dots from one account to another. ([more](1-accounts-more.md)) - - [*Nomination*](2-staking.md) provide a certificate chain between staked/bonded account keys and the session keys used by nodes in block production or validating. As nominator keys cannot transfer dots, they insulate account keys, which may remain air gapped, from nodes actually running on the internet. - - [*Session keys*](3-session.md) are actually several keys kept together that provide the various signing functions required by validators, including a couple types of verifiable random function (VRF) keys. - - [*Transport layer static keys*](https://forum.web3.foundation/t/transport-layer-authentication-libp2ps-secio/69) are used by libp2p to authenticate connections between nodes. We shall either certify these with the session key or perhaps include them directly in the session key. +**For further inquieries or questions please contact**: [Jeff Burdges](/team_members/jeff.md) diff --git a/docs/Polkadot/security/keys/polkadot-keys.png b/docs/Polkadot/security/keys/polkadot-keys.png new file mode 100644 index 00000000..6d0604ca Binary files /dev/null and b/docs/Polkadot/security/keys/polkadot-keys.png differ diff --git a/docs/Polkadot/security/slashing/Slashing-mechanisms.jpeg b/docs/Polkadot/security/slashing/Slashing-mechanisms.jpeg new file mode 100644 index 00000000..17a20a2c Binary files /dev/null and b/docs/Polkadot/security/slashing/Slashing-mechanisms.jpeg differ diff --git a/docs/Polkadot/security/slashing/Slashing-with-NPoS.png b/docs/Polkadot/security/slashing/Slashing-with-NPoS.png new file mode 100644 index 00000000..b1f60e1c Binary files /dev/null and b/docs/Polkadot/security/slashing/Slashing-with-NPoS.png differ diff --git a/docs/Polkadot/security/slashing/Slashing.png b/docs/Polkadot/security/slashing/Slashing.png new file mode 100644 index 00000000..1b748a34 Binary files /dev/null and b/docs/Polkadot/security/slashing/Slashing.png differ diff --git a/docs/Polkadot/security/slashing/amounts.md b/docs/Polkadot/security/slashing/amounts.md index 797416a3..726bf86b 100644 --- a/docs/Polkadot/security/slashing/amounts.md +++ b/docs/Polkadot/security/slashing/amounts.md @@ -2,91 +2,98 @@ title: Slashing mechanisms --- -**Authors**: [Alfonso Cevallos](/team_members/alfonso.md) + ## General principles -**Security threat levels.** The yearly interest rate of a validator pool is between 10% and 20%. So, slashing 1% of their stake is already a strong punishment (worth many weeks of work). With this in mind, we define the following security threat levels and corresponding punishments. Besides the security risk, here we also consider factors like likelihood of the misconduct happening in good faith, level of coordination/correlation among validators, and computational costs for the system. +To define appropriate slashing amounts, it is important to understand the annual earnings of validators. Validator pool interest rates typically range between 10% and 20%. Therefore, slashing just 1% of a validator's stake already represents a significant penalty, roughly equivalent to several weeks of earnings. -* Level 1. Misconducts that are likely to happen eventually to most validators, such as isolated cases of unresponsiveness. We slash up to 0.1% of the stake in the validator slot, or exercise non-slashing punishments only like kicking out the validator. +**Security threat levels.** With this in mind, it is necessary to define security threat levels and corresponding punishments. In addition to assessing the severity of the security risk, it is also important to consider factors such as the likelihood of the misconduct occurring in good faith, the degree of coordination or correlation among validators, and the computational costs imposed on the system. -* Level 2. Misconducts that can occur in good faith, but show bad practices. Examples are concurrent cases of unresponsiveness, and isolated cases of equivocation. We want culprits to seriously re-consider their practices, and we slash up to 1%. +* Level 1: Misconduct likely to eventually occur among most validators, for example isolated cases of unresponsiveness. The penalty involves slashing up to 0.1% of the stake in the validator slot, or applying non-slashing punishments such as removing the validator from the set. -* Level 3. Misconducts that are unlikely to happen in good faith or by accident, but do not lead to serious security risks or resource use. They show i) a concerning level of coordination/correlation among validators, ii) that the software of the validator node has been modified, iii) that a validator account has been hacked, or iv) that there is a bug in the software (if this last case is confirmed we would reimburse any slashings). Examples are concurrent cases of equivocation, or isolated cases of unjustified voting in Grandpa. We want culprits to lose a considerable amount of power, meaning both stake and reputation, and we want the punishment to work as a deterrent. We slash up to 10%. +* Level 2: Misconduct that may occur in good faith but reflects poor practices. Examples include concurrent cases of unresponsiveness and isolated instances of equivocation. The goal is to promt culprits to seriously reconsider their behavior, so the slashing amount can be up to 1%. -* Level 4. Misconducts that a) pose a serious security risk to the system, b) show large levels of collusion among validators, and/or c) force the system to spend a large amount of resources to deal with them. We want the punishment to work as the worst possible deterrent, so we slash up to 100%. +* Level 3: Misconduct unlikely to happen in good faith or by accident, yet not serious enough to pose security risks or consume significant system resources. Such cases may indicate i) a concerning level of coordination or correlation among validators, ii) modification of the validator node software, iii) a compromised validator account, or iv) a bug in the software (if confirmed, any slashing is reimbursed). Examples include concurrent cases of equivocation, or isolated instances of unjustified voting in Grandpa. In such cases, validators should lose a substantial amount of both stake and reputation, with punishments designed as a deterrent. The slashing amount can be up to 10%. -**Details on how we slash validators and nominators.** When a validator is found guilty of a misconduct, we slash the corresponding validator slot (validator plus nominators) a fixed percentage of their stake (and NOT a fixed amount of DOTs). This means that validator slots with more stake will be slashed more DOTs. We do this to encourage nominators to gradually shift their support to less popular validators. +* Level 4: Misconduct that: a) poses a serious security risk to the system, b) involves significant collusion among validators, and/or c) requires the system to expend considerable resources to address. Punishments at this level should serve as the strongest possible deterrent, with slashing amounts of up to 100%. -*(Q. Should we slash the validator more than his nominators? How much more? We should be careful not to bankrupt him for misconducts of levels 1 and 2).* +**Details on slashing validators and nominators.** When a validator is found guilty of misconduct, the corresponding validator slot (which includes the validator and their nominators) is slashed by a fixed percentage of their stake, not a fixed amount of DOT. This means that validator slots with larger stakes will incur greater losses in DOT. The goal is to incentivize nominators to gradually shift their support to less popular validators. -**Kicking out.** *Context: There is an NPoS election of candidates at the beginning of each era. Under normal circumstances, current validators are automatically considered as candidates in the next election (unless they state otherwise), and we keep the nominators' lists of trusted candidates unmodified (unless nominators state otherwise). On the other hand, unelected candidates need to re-confirm their candidacy in each era, to make sure they are online.* +:::note Question +Should the validator be slashed more heavily than their nominators? If so, by how much? Care must be taken to avoid bankrupting validators for Level 1 and Level 2 misconducts.* +::: -When a validator is found guilty of a misconduct: +**Kicking out.** *Context: At the beginning of each era, an NPoS election is held to select validator candidates. Under normal circumstances, current validators are automatically considered candidates for the next election (unless they opt out), and nominators' lists of trusted candidates remain unchanged unless explicitly modified. In contrast, unelected candidates must reconfirm their candidacy in each era to ensure they are online and active.* -a) We remove them from the list of candidates in the next NPoS validator election (for all misconducts). +When a validator is found guilty of misconduct: -b) We immediately mark them as inactive in the current era (for misconducts of levels 2 and up). +a) They are removed from the list of candidates in the next NPoS validator election. This applies to all levels of misconduct. -c) We remove them from all the nominators' lists of trusted candidates (for misconduct of levels 3 and up). +b) They are marked as inactive for the current era. This applies to level 2 misconduct and beyond. -The reasons to do this are the following: +c) They are removed from all nominators' lists of trusted candidates. This applies to level 3 misconduct and above. -* As a punishment to the validator, as he won't be able to perform payable actions, and won't get paid while he is kicked out. +Rationale for these actions: -* As a safeguard to protect the system and the validator himself. If a validator node has committed a misconduct, chances are that it will do it again soon. To err on the side of security, we assume that the validator node remains unreliable until the validator gives confirmation that the necessary checks are in place and he's ready to continue operating. Furthermore, if the validator has been heavily slashed, he may decide to stop being a validator immediately, and we shouldn't assume otherwise. +* **Punishment for the validator.** The validator loses the ability to perform payable actions and will not receive rewards while excluded. -* As a safeguard for nominators. If a validator is heavily slashed, we should ensure that his backing nominators are aware of this. We should wait for them to give consent that they still want to back him in the future, and not assume it. +* **System and validator protection.** If a validator node has committed misconduct, there is a high likelihood it may do so again. To err on the side of caution, it's prudent to assume the node remains unreliable until the validator confirms that all necessary checks have been completed and they are ready to resume operations. Additionaly, if the validator has been heavily slashed, they may choose to exit the role immediately; no further assumptions should be made about their continued participation. -To avoid operational issues, when a validator is kicked out we modify schemes as little as possible. The duration of the current epoch is not shortened, and for the remainder of the epoch this validator is still assigned to parachains as before, etc. In other words, kicking someone out just means marking him as inactive; we act as if that validator was non-responsive and we ignore his messages. +* **Protection for nominators.** In cases of heavy slashing, nominators should be aware. Their continued support should not be assumed; instead, explicit consent should be obtained before allowing them to back the validator again. -If a large number of validators are kicked out, or simply unresponsive, we can optionally end the era early, after the completion of an epoch, so that we can elect new validators. Or, we just wait for the end of the era; during this time finality may stop but Babe should continue going, and Grandpa will catch up at the beginning of the next era. +To minimize disruption, validator removal should involve minimal changes to existing schemes. The duration of the current epoch remains unchanged, and the validator continues to be assigned to parachains for the rest of the epoch. In practice, being "kicked out" simply means that the validator is marked as inactive, treated as non-responsive, and their messages would be ignored. -**Database of validators.** We need to keep a database of the current validators and previous validators. In this database, we register +If a large number of validators are kicked out, or become unresponsive, the era may end early, after the completion of an epoch, to allow for the election of new validators. Alternatively, the system may wait until the end of the era. During this time, Finality may pause, while BABE continues producing blocks. Grandpa can catch up at the beginning of the next era. +**Validators database.** This off-chain database tracks both current and past validators and should include: -* if a validator is active or inactive (kicked out), -* the misconducts that each validator has been found guilty of, -* any rewards for reporting a misconduct, -* the (weighted) nominators supporting each validator (to know who to slash/reward), -* the number of payable actions of each validator so far in the current era, -* whether that validator is the target of an ongoing challenge (for unjustified votes in Grandpa), etc. +* Whether a validator is active or inactive (i.e., kicked out) +* The misconduct each validator has been found guilty of +* Any rewards issued for reporting a misconduct +* The (weighted) nominators supporting each validator, to determine who should be slashed or rewarded +* The number of payable actions performed by each validator in the current era +* Whether a validator is the target of an ongoing challenge (e.g., for unjustified votes in Grandpa) +* And other relevant metadata -This database should be off-chain and should *resist chain reversions*. Moreover, we should be able to see who the validators were, up to 8 weeks in the past, so that we can slash the culprits of a misconduct that is detected late (this is the same period that we freeze the nominators and validators' stake). We will also use this database to ensure that a validator is not slashed twice for the same misconduct. + This database must be off-chain and designed to *resist chain reversions*. It should retain visibility into validator history for up to eight weeks, enabling slashing of validators for misconduct detected after the fact. This retention period aligns with the freeze duration for nominators' and validators' stakes. Additionally, the database must ensure that a validator is not slashed more than once for the same misconduct. -Finally, we can also use this database to run an extra protocol where, if a validator has had a cumulative slashing of more than 1% for whatever reason, then we remove him from all the nominators' lists (example: if a validator is unresponsive in one era, we won't remove him from the nominators' lists, but if he is unresponsive in several eras, then we should remove him, as a safeguard to nominators.) +Finally, the database should support an auxiliary protocol: if a validator accumulates more than 1% slashing, regardless of the reason, they should be removed from all the nominators' lists. For example, a validator who is unresponsive in a single era may not be removed, but repeated unresponsiveness over several eras should trigger removals as a safeguard for nominators. -*(Q. How to maintain such database? How to keep it memory efficient?)* +:::note Question +How can such a database be efficiently maintained while keeping memory usage low? +::: +**Detection mechanisms.** To slash a validator, an objective on-chain "attestation of misconduct" is required. This must be short, *valid on all forks*, and remain valid even in the event of a *chain reversion*. Two attestations for the same misconduct cannot be valid simultaneously, preventing double punishment for a single offense. The previously mentioned database plays a key role in supporting this logic. +There are two types of detection mechanisms: -**Detection mechanisms.** In order to slash somebody, we want to have an on-chain "attestation of misconduct" that is objective, short, and *valid on all forks*. Moreover it should remain valid in case of *chain reversion*. We also need to ensure that two attestations for the same misconduct cannot both be valid simultaneously, so that we don't punish twice for the same crime. We take care of this by using the above mentioned database. +* **Proof of misconduct.** This is the straighforward case, where a concise proof of misconduct can be submitted on-chain as a transaction. Its validity can be quickly verified by the block producer, making both the generation and verification of the proof efficient. A typical example is equivocation in Grandpa, where the proof consists of two signed votes by the same validator in the same round. -We identify two types of detection mechanisms. +* **Voting certificate.** When no direct proof is available, a collecting voting mechanism is used. Validators vote off-chain, and a certificate of the final decision (containing the signed votes) is issued and submitted on-chain as the attestation of misconduct. This procedure is resource-intensive, hence it is reserved for level 4 misconduct and avoided whenever possible. -* **Proof of misconduct.** The easy case is when there is a short proof of misconduct, which can be inserted on-chain as a transaction, and whose validity can be quickly verified by the block producer (hence both producing and verifying the proof can be done efficiently). An example is equivocation in Grandpa, where a proof consists of two signed votes by the same validator in the same round. +**Reporters and their rewards.** In general, rewards are available for actors who execute the protocols necessary to detect misconduct. These rewards are capped at 10% of the total amount slashed, with the rest allocated to the treasury. Should the council choose to reimburse a slashing event, sufficient DOT is typically available in the treasury, and only a small portion may need to be minted to cover the reward payout. Depending on the detection mechanism and the security level, three reward scenarios are considered: -* **Voting certificate.** When there is no proof of misconduct, we resort to a mechanism where all validators vote. At the end, we can issue a certificate of the voting decision, with the signed votes, and this can be used as an attestation of misconduct. All the mechanism occurs off-chain, with only the final certificate added on-chain. This procedure is resource expensive, so we avoid it whenever possible and use it only for level 4 misconducts. +* **Levels 1 and 2.** A reward of approximately 10% of the slashed amount is granted to the first party who submits a valid transaction with proof of misconduct. The reward is intentionally modest, just enough to discourage a "no-snitch code of honor" among validators. -**Reporters and their rewards.** In general we give a reward to the actor(s) who run the protocols necessary to detect the culprits. We usually limit rewards to 10% of the total amount slashed, with the remainder going to treasury. So, if the council ever decides to reimburse a slashing event, most of the DOTS are readily available in treasury, and we only need to mint new DOTS to make up for the part that went to rewards. We consider three cases, depending on the detection mechanism and the security level. +* **Levels 3 and 4 (with proof of misconduct).** The same procedure applies, but only *validators* are allowed to submit reports. The reward must be shared among all nominators in the corresponding validator slot to prevent wealth concentration. Multiple culprits and reporters may be involved in a single case (e.g., rejecting a set of Grandpa votes). Regardless, total rewards must not exceed 10% of the total slashed amount, nor exceed 100% of the slashed validators' self-stake. This cap prevents an attack scenario where a validator intentionally fails to benefit at the expense of their nominators. For example, if an entity runs Validator A with 1% self-stake and Validator B with 100%, it might be tempted to have B report A if the potential reward exceeds A's self-stake. Additionally, each validator reporter may receive a reward no greater than 20% of their own stake, roughly equivalent to their annual interest rate, ensuring the incentive remains meaningful but not excessive. -* For levels 1 and 2, we reward around 10% of the slashed amount to whoever first submits a transaction with the proof of misconduct. The reward is expected to be pretty low, just large enough to disincentivize a "no-snitch code of honor" among validators. +* **Level 4 misconduct requiring voting.** In this case **fishermen**, staked actors who anonymously monitor the system, play a critical role. At some point, a fisherman may submit a **report** as a transaction, detailing suspected misconduct, but without providing direct proof. Along with the report the fisherman bonds a portion of their stake, referred to as the "bait". This report initiates an **inspection phase**, during which a subset of validators conduct an investigation. Depending on the outcome, this may escalate into a full **voting phase** involving all validators. If the vote confirms the fisherman's report, the fisherman is rewarded with a substantial amount of DOT. If the report is rejected, the fisherman forfeits their bait. This penalty discourages spam reports, which would otherwise waste system resources. At the same time, the reward must be high enough to justify the risk and the ongoing cost of running system checks. Multiple fishermen may report the same misconduct. In such cases, the seriousness of the threat is gauged by the total amount of bait bonded. The higher the total bait, the more resources are allocated during the inspection phase. Rewards are distributed among all fishermen who submited reports before the voting phase begins. Therefore, if a single fisherman detects misconducts, it is in their interest to quickly rally other fishermen or validators to join the inspection. Fishermen rewards are capped at: + * no more than 10% of all the total slashed amount + * no more than 100% of the slashed validators' self-stake + * no more than 10 times the fisherman's own bait. -* For misconducts of levels 3 and 4 that admit a proof of misconduct, we do as above, except that we only allow for *validators* to submit reports, and we require that the reward be shared among all nominators in the corresponding validator slot. We do this to dilute the reward and not let a single actor claim it, to avoid compounding wealth to a few. There may be several culprits and several reporters involved in the same mechanism (e.g. for rejecting set of votes in Grandpa); in any case, the total rewards are no more than 10% of the total slashings, and also no more than 100% of the slashed validators' self-stake. This last bound is to discourage an attack where a validator fails on purpose to have a personal gain at the expense of his nominators (e.g. if the same organization runs a validator A with 1% of self-stake and a validator B with 100% of sef-stake, it may be tempted to make B report A, if the reward is higher than A's self-stake). Finally, each validator reporter gets a reward no more than 20% of her own stake (an amount equal to her yearly interest rate), as this should be a large enough incentive. - -* For level 4 misconducts that require voting, we need **fishermen**. A fisherman is any staked actor which is running checks on the system anonymously, and at some point posts a **report** as a transaction, with some details of a suspected misconduct, but without proof. In this transaction, it also bonds some stake -- the "bait". The report starts an **inspection phase** which engages some of the validators, and which may or may not lead to a full blown **voting phase** by all validators. If there is a vote and the voting decision confirms the fisherman report, the latter gets rewarded a large amount of DOTs. Otherwise, the fisherman loses all of its bait. This last possibility discourages spamming by fisherman reports, which would lead to a lot of wasted resources. On the other hand, the reward should be large enough so that it is worth the inherent risk and the cost of constantly running checks on the system. There can be several fishermen reporting the same misconduct, and we weigh the seriousness of the threat by the total amount of bait. The higher this value, the more resources are assigned in the inspection phase. The reward is shared by all the fishermen that provided reports early on, before the start of the voting phase; thus, if a single fisherman detects a misconduct, it is in its interest to convince other fishermen or validators to join in asap to inspect it. We pay fishermen: no more than 10% of all the slashings, and no more than 100% of the slashed validators' self-stake; and we pay each fisherman no more than 10 times its own bait. - -## Network Protocol +## Network protocol ### Unresponsiveness -We propose two different methods to detect unresponsiveness. +Two types of detection mechanisms are in place for identifying unresponsiveness. -**Method 1.** Validators have an "I'm online" heartbeat, which is a signed message submitted on-chain every session. If a validator takes too long to send this message, we can mark them as inactive. +**Method 1.** Validators submit an "I'm online" heartbeat, a signed message posted on-chain every session. If a validator takes too long to submit this message, they are marked as inactive. -The advantage of this method is that we can detect unresponsive validators very quickly, and act upon this information, for instance by ending the current era early. A disadvantage is that it only detects validators that are accidentally off-line, and not those who are purposely unresponsive as part of an attack on the system. +The advantage of this method is that it enables rapid detection of unresponsive validators, allowing the system to act quickly, for example by ending the current era early. A disadvantage is that it only identifies validators who are accidentally offline, not those who are deliberately unresponsive as part of a coodinated attack. -**Method 2.** Recall that we keep counters of all the payable actions performed by each validator (blocks produced in Babe, uncle references, validity statements), and we use these counters to compute the payouts at the end of each era. In particular, validators should be able to sign validity statements of parachain blocks consistently. Thus, we can use this counter as a measure of responsiveness. Let $c_v$ be the number of validity statements signed by validator $v$ during an era. Our proposal is to consider $v$ unresponsive if +**Method 2.** The system tracks counters for all payable actions performed by each validator (e.g., blocks produced in BABE, uncle references, validity statements, etc.). These counters are used to calculate payouts at the end of each era. In particular, validators are expected to consistently sign validity statements for each parachain block. This counter serves as a measure of responsiveness. Let $c_v$ be the number of validity statements signed by validator $v$ during an era. A validator $v$ is considered unresponsive if: $$ c_v < \frac{1}{4}\cdot \max_{v'} c_{v'} @@ -96,120 +103,141 @@ where the maximum is taken over all validators in the same era. **Lemma.** *No validator will be wrongfully considered unresponsive in a billion years.* -*Proof.* (We critically assume in this proof that validators are shuffled among parachains often enough so that, in every era, any two validators have the opportunity to validate a similar amount of parachain blocks, even if some parachains have a higher block production rate than others. If this assumption is incorrect, the threshold of $1/4$ can be lowered and the analysis can be adjusted accordingly.) +:::note Assumption +Validators are shuffled among parachains frequently enough that, in every era, any two validators have the opportunity to validate a similar number of parachain blocks, even if some parachains produce blocks at a higher rate than others. If this assumption does not hold, the threshold of $1/4$ can be lowered, and the analysis adjusted accordingly. +::: -Fix an era, and let $n$ be the total number of parachain blocks that a validator can *potentially* validate. Being conservative, we have $n\geq 1000$ (3 blocks per minute, 60 min per hour, 6 hours per era). Now fix a responsive validator $v$, and let $p$ be the probability that $v$ successfully issues a validity statement for any of these blocks. The value of $p$ will depend on many factors, but it should be the case that $p\geq 1/2$ if $v$ is responsive. Therefore, the number $c_v$ of validity statements produced by $v$ follows a binomial distribution with expected value $p\cdot n \geq 500$. +**Proof.** Fix an era, and let $n$ be the total number of parachain blocks that a validator can *potentially* validate. Conservatively, take $n\geq 1000$, based on 3 blocks per minute, 60 minutes per hour, and 6 hours per era. Consider a responsive validator $v$, and let $p$ be the probability that $v$ successfully issues a validity statement for any given block. Although $p$ depends on many factors, assume $p\geq 1/2$ for a responsive validator. Then the number $c_v$ of validity statements produced by $v$ follows a binomial distribution with expected value $p\cdot n \geq 500$. -The crux of the argument is that this distribution is highly concentrated around its expectation. Notice that the maximum number of validity statements over all validators in this era is at most $n$. Hence, $v$ would be wrongfully considered unresponsive only if it produces $c_v < n/4\leq p\cdot n/2$ validity statements. Using Chernoff's inequality to bound the tail of the binomial distribution, we get that the probability of this occurence is at most +This distribution is tightly concentrated around its expectation. The maximum number of validity statements across all validators in the era is at most $n$. Hence, validator $v$ would be wrongfully considered unresponsive only if it produces fewer than $c_v < n/4\leq p\cdot n/2$ validity statements. Applying Chernoff's inequality to bound the tail of the binomial distribution yields: $$ e^{-\frac{(p\cdot n - c_v)^2}{2p\cdot n}} \leq e^{- \frac{(p\cdot n/2)^2}{2p\cdot n}} = e^{-\frac{p\cdot n}{8}}\leq e^{-\frac{500}{8}}\approx 7\cdot 10^{-28} $$ -This probability is negligible. +This probability is negligible, confirming the claim. $$ \tag{$\blacksquare$} $$
-We use the following slashing mechanism, which has no reporters. If at the end of an era we find that $k$ out of $n$ validators are unresponsive, then we slash a fraction +The following slashing mechanism operates without reporters. If, at the end of an era, $k$ out of $n$ validators are unresponsive, then a fraction $$ 0.05\cdot \min\{\frac{3(k-1)}{n}, 1\} $$ -from each one of them. Notice that this fraction is zero for isolated cases, less than one third of a percent for two concurrent cases (assuming $n\geq 50$), growing to 5% for the critical case when around 1/3 of all validators are unresponsive (we don't want to punish too harshly for concurrent unresponsiveness, as it could potentially happen in good faith. The parameter of 5% can be adjusted). We consider it a misconduct of level 2 if the slashing fraction is at most 1%, and of level 3 otherwise. However, we do not immediately remove unresponsive validators from the current era, as removing a validator is equivalent to marking it as unresponsive (so the cure would not be better than the disease), and because it is algorithmically simpler to just check at the end of each era. +is slashed from each of them. This fraction is zero in isolated cases, less than one-third of a percent for two concurrent cases (assuming $n\geq 50$), and increases to 5% in the critical scenario where approximately one-third of all validators are unresponsive. The intention is to avoid overly harsh penalties for concurrent unresponsiveness, which may occur in good faith. The 5% parameter can be adjusted as needed. Misconduct is classified as Level 2 if the slashing fraction is at most 1%, and as Level 3 otherwise. However, unresponsive validators are not removed immediately during the current era. Removing a validator is equivalent to marking them as unresponsive, which would not improve the situation. Additionally, it is algorithmically simpler to perform these checks at the end of each era. ## Grandpa ### Unjustified vote -Relative to a block $B$ that was finalized in Grandpa round $r_B$, an unjustified vote is either a pre-vote or a pre-commit signed by a validator $v$ in some round $r_v>r_B$, for a chain that does not contain $B$. Simply put, it means voting for a chain that is incompatible with the current chain of finalized blocks. +Relative to a block $B$ finalized in Grandpa round $r_B$, an unjustified vote is defined as either a prevote or a precommit signed by a validator $v$ in some round $r_v>r_B$, for a chain that does not include $B$. Simply put, it refers to voting for a chain that is incompatible with the current chain of finalized blocks. + +According to the Grandpa paper, this behavior can only occur under two conditions: either the validator $v$ is not following the standard protocol (classified as level 3 misconduct), or $v$ has observed a *rejecting set of votes* (defined further below) for block $B$ in a prior round. The detection mechanism thus operates as follows. It begins when another validator $v'$ submits a transaction $T$. This transaction includes a reference to block $B$, proof that $B$ is finalized, and the unjustified vote (or a collection of votes, in case of concurrence) associated with $B$. -It follows from Grandpa paper that this can only occur if either the validator $v$ is not following the standard protocol (level 3 misconduct), or $v$ observed a *rejecting set of votes* (defined further below) for $B$ in a prior round. The detection mechanism thus works as follows. It starts when another validator $v'$ submits a transaction $T$ containing a reference to block $B$ with a proof that it is finalized, and the unjustified vote (or collection or votes in case of concurrence) relative to $B$. This transaction raises a public time-bound challenge. If the challenge goes unanswered for some time (to be defined), we slash 10% from the signer(s) of the unjustified vote(s), and reward $v'$ 10% of the slashings (as the signer(s) should be in capacity to answer the challenge if they are honest). Otherwise, any validator $v''$ can answer the challenge by, in turn, starting a detection mechanism for a *rejecting set of votes* (defined below). In that case, we finalize the current mechanism without penalizing anybody, and we keep a register of all the validators that have raised or answered challenges so far (i.e. $v'$ and $v''$), as they will all be rewarded when the culprits are eventually found. +This transaction initiates a public, time-bound challenge. If the challenge goes unanswered within a specified time frame, 10% of the stake from the signer(s) of the unjustified vote(s) is slashed, and validator $v'$ is rewarded with 10% of the slashed amount, on the assumption that honest signers should be capable of responding to the challenge. Alternatively, any validator $v''$ may respond to the challenge by initiating a detection mechanism for a *rejecting set of votes* (defined below). In this case, the current mechanism is finalized without penalizing anyone, and a record is kept of all validators who have raised or answered challenges (i.e., $v'$ and $v''$). These validators will be rewarded once the actual culprits are identified. -As mentioned before, we slash 10% if a single validator is guilty of an unjustified vote. We will say more about slashing concurrent cases of unjustified votes by several validators further below. We ignore any further unjustified votes by the same validator in the same era (we will ignore all messages from that validator in the remainder of the era anyway). +As previously mentioned, a 10% slash is applied if a single validator is found guilty of an unjustified vote. Additionaly, below you can find details about slashing in cases of concurrent unjustified votes by multiple validators. Any further unjustified votes by the same validator in the same era are ignored, and all subsequent messages from that validator during the rest of the era are disregarded. -### Rejecting set of votes +### Rejecting a set of votes -*Context: Recall from the Grandpa paper that a set $S$ of votes has supermajority for a block $B$ if there are $>2/3$ validators who vote in $S$ for chains that contain $B$. Similarly, we say that it is impossible for set $S$ to have supermajority for block $B$ if there are $>2/3$ validators who vote in $S$ for chains that don't contain $B$. It follows that a set $S$ has both of these properties simultaneously only when there are $>1/3$ validators that equivocate in $S$. Recall also that if block $B$ is finalized in a round $r_B$, then (assuming honest behaviors) there must be a set $V_B$ of pre-votes and a set $C_B$ of pre-commits on that round, so that both sets have supermajority for $B$. Finally, a validator $v$ considers block $B$ as finalized iff $v$ can see such a set $C_B$ of pre-commits, even if it does not yet see sufficiently many pre-votes.* +:::note Context +According to the Grandpa paper, a set $S$ of votes has supermajority for a block $B$ if more than $2/3$ of validators in $S$ vote for chains that contain $B$. Similarly, it is impossible for set $S$ to have supermajority for $B$ if more than $2/3$ of validators vote for chains that don't contain $B$. Therefore, a set $S$ can exhibit both properties simultaneously only if more than $1/3$ of validators equivocate within $S$. + +If block $B$ is finalized in a round $r_B$, and assuming honest behavior, there must exist a set $V_B$ of prevotes and a set $C_B$ of precommits in that round, both forming a supermajority for $B$. A validator $v$ considers block $B$ finalized if it can observe such a set $C_B$ of precommits, even if it has not yet seen a sufficient number of prevotes. +::: -Relative to a block $B$ finalized in round $r_B$, a rejecting set of votes is a set $S$ of votes of the same type (either pre-votes or pre-commits) and on the same round $r_S\geq r_B$, for which it is impossible to have a supermajority for $B$. +Relative to a block $B$ finalized in round $r_B$, a rejecting set of votes is defined as a set $S$ of votes of the same type (either prevotes or precommits), cast in the same round $r_S\geq r_B$, for which it is impossible to achieve a supermajority for $B$. -Such a set implies the collusion of $>1/3$ of validators, and is one of the most dangerous attacks on the system as it can lead to finalizing blocks in different chains (see Section 4.1 in Grandpa paper). We consider it of level 4 and slash 100% from all culprits. +Such a set implies collusion among more than $1/3$ of validators and represents one of the most dangerous attacks on the system, as it can lead to the finalization of blocks on conflicting chains (see Section 4.1 of the Grandpa paper). This is classified as a Level 4 misconduct, with a 100% slash applied to all culprits. -The detection mechanism is somewhat involved. It starts when a validator $v$ submits a transaction $T$ containing a) the rejecting set of votes $S$ in round $r_S$, b) a reference to block $B$ together with a set $C_B$ of pre-commit votes in round $r_B$ having supermajority for $B$ (proving that $B$ was finalized), and c) a reference to a previous challenge, if the current transaction is an answer to it. We now explain how to process this transaction, depending on the value of $(r_S-r_B)$ and the type of votes in $S$. +The detection mechanism begins when a validator $v$ submits a transaction $T$ containing: a) the rejecting set of votes $S$ from round $r_S$, b) a reference to block $B$, along with a set $C_B$ of precommit votes from round $r_B$ demonstrating supermajority for $B$ (proving its finalization), and c) a reference to a previous challenge, if the current transaction is a response to one. -If $r_S=r_B$ and $S$ is a set of pre-commits, then $S\cup C_B$ is a set of pre-commits which simultaneously has supermajority for $B$, and for which it is impossible to have supermajority for $B$; hence there must be $>1/3$ validators that equivocate in $S\cup C_B$, and transaction $T$ has enough information to identify them quickly. We slash 100% from all equivocators. +The next step is to explain how this transaction should be processed, depending on the value of $(r_S-r_B)$ and the type of votes contained in $S$. If $r_S=r_B$ and $S$ is a set of precommits, then $S\cup C_B$ forms a set of precommits that has supermajority for block $B$, yet for which it is impossible to have supermajority for $B$. This contradiction implies that more than $1/3$ of validators must have equivocated within $S\cup C_B$, and transaction $T$ contains sufficient information to identify them efficiently. All equivocators will be slashed 100%. If $r_S=r_B$ and $S$ is a set of prevotes, transaction $T$ initiates a time-bound challenge that any validator may respond to. A valid answer consists of a new transaction $T'$ containing: a) a set $V_B$ of prevotes from round $r_B$ with supermajority for $B$, and b) a reference to $T$. -If $r_S=r_B$ and $S$ is a set of pre-votes, transaction $T$ raises a time-bound challenge which can be answered by any validator, and where a valid answer consists of a new transaction $T'$ containing a) a set $V_B$ of pre-votes in round $r_B$ which has supermajority for $B$, and b) a reference to $T$. If a validator $v'$ provides such answer, then $S\cup V_B$ is a set of pre-votes which simultaneously has supermajority for $B$, and for which it is impossible to have supermajority for $B$. As before, there must be $>1/3$ validators that equivocate in this set, and we slash all of them 100%. If nobody answers the challenge within a specified period of time, we slash 100% from all the validators that voted in set $C_B$, because each one of them should be in capacity to answer the challenge immediately (and be rewarded if they are the first to do so) if they are honest. +If a validator $v'$ submits such a response, then the combined set $S\cup V_B$ simultaneously satisfies two contradictory conditions: it has a supermajority for $B$, and it is impossible to have a supermajority for $B$. This implies that more than $1/3$ of validators must have equivocated within the set, and all such validators are slashed 100%. -Finally, if $r_s>r_B$, transaction $T$ raises a time-bound challenge which can be answered by any validator, and where a valid answer consists of a new transaction $T'$ containing a) set $C_B$ and a reference to block $B$, b) a set $S'$ of votes of the same type (either pre-votes or pre-commits) and on the same round $r_{S'}$ for some $r_B\leq r_{S'}r_B$, transaction $T$ raises a time-bound challenge that any validator may answer. A valid response consists of a new transaction $T'$ containing: a) the set $C_B$ and a reference to block $B$, b) a set $S'$ of votes of the same type (either prevotes or precommits), cast in the same round $r_{S'}$ for some $r_B\leq r_{S'} n/3$ (where $n$ is the number of validators), and the other is not, we take the plurality vote as official. If it is decided that the blob is invalid, we slash all validators that stated otherwise and we reward all fishermen; if it is decided that the blob is valid, we slash fishermen and all validators that stated otherwise. +* If the blob is deemed valid, both the fishermen and the validators who stated otherwise are slashed. -If it happens that both the number of statements of validity and the number of statements of invalidity are $>n/3$, we unfortunately don't know who the culprits are (this should never happen). In this case we slash no-one (and reimburse any slashing done), and consider the blob as invalid to err on the safe side. +If both the number of validity statements and the number of invalidity statements exceed $n/3$, there is unfortunately no way to determine who the culprits are. In such a case, which by the way should never occur, no one is slashed, any prior slashing is reimbursed, and the blob is considered invalid to err on the side of caution. +**For further questions and inquiries please contact**: diff --git a/docs/Polkadot/security/slashing/index.md b/docs/Polkadot/security/slashing/index.md new file mode 100644 index 00000000..249962f2 --- /dev/null +++ b/docs/Polkadot/security/slashing/index.md @@ -0,0 +1,11 @@ +--- +title: Slashing +--- + +import DocCardList from '@theme/DocCardList'; + +This section intends to explain slashing, with a focus on its mechanics and its application across eras under NPoS. + + + + diff --git a/docs/Polkadot/security/slashing/npos.md b/docs/Polkadot/security/slashing/npos.md index ea2727b9..9be359cd 100644 --- a/docs/Polkadot/security/slashing/npos.md +++ b/docs/Polkadot/security/slashing/npos.md @@ -1,149 +1,192 @@ --- title: Slashing across eras with NPoS --- + -**Authors**: [Jeffrey Burdges](/team_members/jeff.md) - -**Other authors**: Robert Habermeier, [Alfonso Cevallos](/team_members/alfonso.md) - -We need our slashing algorithm to be fair and effective. We discuss how this means slashing must respect nominators' exposure, be anti-Sibel, and be monotonic. +The slashing algorithm must be both fair and effective. To achieve this, slashing should respect nominators' exposure, be resistant to Sybil attacks, and maintain monotonicity. ## Reduced rewards ## Slashing within one era -In any era $e$, there is a fixed amount of stake aka base exposure $x_{\eta,\nu,e}$ assigned by any nominator $\eta$ to any validator $\nu$. We demand that slashing never exceeds nominators' exposure because doing so creates an incentive to break up stash keys. We avoid encouraging such Sibel-ish behavior in Polkadot because doing so makes Polkadot less fair and harms our information about nominator behavior. +In any era $e$, a fixed amount of stake, also referred to as base exposure, denoted by $x_{\eta,\nu,e}$, is assigned by a nominator $\eta$ to a validator $\nu$. Slashing should never exceed a nominators' exposure, as doing so incentivizes fragmentation of stash keys. Encouraging such Sybil-like behavior within Polkadot undermines fairness and distorts insights into nominator behavior. -We immediately remove any validator $\nu$ whenever they gets slashed, which prevents repeated slashing after that block height. There is however an inconsistency in that $\nu$ might commit multiple violations before the chain acknowledges the slash and kicks $\nu$. We fear this introduces significant randomness into our slashing penalties, which increases governance workload and makes the slashing less fair. We also worry that $\nu$ might equivocate retroactively, perhaps to extort their own nominators. As a counter measure, if era $e$ sees validator $\nu$ slashed for several distinct proportions $p_i$, then we define $p_{\nu,e} := \max_i p_i$ and slash their nominator $\eta$ only $p_{\nu,e} x_{\eta,\nu,e}$. +The first step is to remove any validator $\nu$ immediately upon being slashed, which prevents repeated slashing beyond that block height. However, an inconsistency arises when $\nu$ commits multiple violations before the chain acknowledges the slash and removes them. This can introduce significant randomness into slashing penalties, increasing the governance workload and reducing slashing fairness. Additionaly, $\nu$ might equivocate retroactively, potentially to extort their own nominators. As a countermeasure, if validator $\nu$ is slashed in era $e$ for several distinct proportions $p_i$, then $p_{\nu,e} := \max_i p_i$ can ensure that nominator $\eta$ is only slashed by $p_{\nu,e} x_{\eta,\nu,e}$. -As an aside, we could write $p_{\eta,\nu,e}$ throughout if we wanted to slash different nominators differently, like by slashing the validator themselves more, i.e. $p_{\nu,\nu,e} > p_{\eta,\nu,e}$ for $\nu \ne \eta$. We abandoned this idea because validators could always be their own nominators. +As an aside, one could define $p_{\eta,\nu,e}$ throughout to allow different slashing rates across nominators. For example, slashing the validator more heavily, i.e., $p_{\nu,\nu,e} > p_{\eta,\nu,e}$ for $\nu \ne \eta$. This approach, however, is problematic as validators can always nominate themselves. -We actually have only minimal concerns about multiple miss-behaviours from the same validator $\nu$ in one era, but if we discover some in future then the slashing lock could combine them before producing these $p_i$. In other words, $p_{\nu,e} \ge \max_i p_i$ with equality by default, but a strict inequality remains possible for some $p_i$ combinations. We expect this would complicate cross era logic, but such issues should be addressed by considering the specific miss-behaviour. +Although there are minimal concerns about multiple misbehaviors by the same validator $\nu$ within a single era, in such cases, the slashing mechanism could combine them before computing the individual slashing proportions $p_i$. In other words, $p_{\nu,e} \ge \max_i p_i$ with equality by default. Yet, strict inequality may occur for certain combinations of $p_i$. This could complicate cross-era logic, although such issues can be addressed by considering the specific nature of each misbehavior. -In essence, this $p_{\nu,e} := \max_i p_i$ definition provides default mechanism for combining slashes within one era that is simple, fair, and commutative, but alternative logic remains possible so long as we slash the same regardless of the order in which offenses are detected. We emphasise that future slashing logic might take numerous factors into consideration, so doing $\max_i p_i$ here retains the most flexibility for future slashing logic. +In essence, the definition $p_{\nu,e} := \max_i p_i$ provides a default mechanism that is simple, fair, and commutative for combining slashes within a single era. Alternative logic remains possible, as long as the resulting slash is independent of the order in which offenses are detected. Future slashing logic may incorporate additional factors, so using $\max_i p_i$ here retains flexibility for future enhancements. -We do however worry about miss-behaviours from different validators $\nu \ne \nu'$ both because nomination must restrict Sibels and also because correlated slashing need not necessarily involve the same validators. We therefore let $N_{\eta,e}$ denote the validators nominated by $\eta$ in era $e$ and slash $\sum_{\nu \in N_e} p_{\nu,e} x_{\eta,\nu,e}$ from $\eta$ when multiple validators $\nu \in N_{\eta,e}$ get slashed. +Misbehaviors from different validators $\nu \ne \nu'$ present a separate concern. This is both because nomination must be resistant to Sybil attacks and because correlated slashing events may involve multiple validators. Therefore, if $N_{\eta,e}$ denotes the set of validators nominated by $\eta$ in era $e$, then the total slash applied to $\eta$ when multiple validators $\nu \in N_{\eta,e}$ are slashed is: + +$$ +\sum_{\nu \in N_e} p_{\nu,e} x_{\eta,\nu,e} +$$ ## Slashing in past eras -As hinted above, we cannot assume that all events that warrant slashing a particular stash account get detected early or occur within the same era. If $e$ and $e'$ are distinct eras then we expect $x_{\eta,\nu_j,e} \ne x_{\eta,\nu_j,e'}$ so the above arguments fail. Indeed, we cannot even sum slashes applied to different validators because doing so could quickly exceeds nominators exposure $x_{\eta,\nu,e}$. +As hinted above, it would be misleading to assume that all events warranting the slashing of a particular stash account are detected early or occur within the same era. If $e$ and $e'$ are distinct eras, then $x_{\eta,\nu_j,e} \ne x_{\eta,\nu_j,e'}$, and thus the previous arguments no longer hold. In fact, summing slashes applied to different validators could quickly exceed the nominators exposure $x_{\eta,\nu,e}$. -We might assume $\min \{ x_{\eta,\nu_j,e}, x_{\eta,\nu_j,e'} \}$ to be the "same" stake, but this does not obviously buy us much. We therefore suggest slashing $\eta$ the amount +One might assume that $\min \{ x_{\eta,\nu_j,e}, x_{\eta,\nu_j,e'} \}$ represents the "same" stake across eras, but this assumption offers limited practical benefit. The suggestion, therefore, is to slash $\eta$ the amount $$ \max_e \sum_{\nu \in N_e} p_{\nu,e} x_{\eta,\nu,e} $$ -where again $N_e$ is the validators nominated by $\eta$ in era $e$ +where $N_e$ denotes the set of validators nominated by $\eta$ in era $e$ -In particular, there is still an extortion attack in which someone runs many poorly staked validators, receives nominations, and then threatens their nominators with being slashed. We cannot prevent such attacks entirely, but this outer $\max_e$ reduces the damage over formula that add slashing from different eras. +An extortion attack remains plausible: an adversary could run many poorly staked validators, attract nominations, and then threaten nominators with slashing. While such attacks cannot be entirely prevented, the outer $\max_e$ helps mitigate the impact of compounded slashing across different eras. ## Slashing spans -We thus far kept our slashing relatively simple and fixed some fairness issues with the outer maximum $\max_e \cdots$, but created another problem: If $\nu$ gets slashed once, then $\nu$ could thereafter commit similar offenses with impunity, which is neither fair nor effective. As noted above, we accept this within a single era because validators get removed when they get slashed, but across eras nominators can support multiple validators. We therefore need another mechanism that removes this impunity to minimize any further risks to the network going forwards. +Hitherto, slashing has been kept relatively simple, addressing some fairness concerns through the outer maximum $\max_e \cdots$. This simplicity introduces another issue: If $\nu$ is slashed once, they may subsequently commit similar offenses without further consequences, an outcome neither fair nor effective. As previously noted, this can occur within a single era due to validator removal upon slashing. Yet, nominators may continue to support multiple validators across eras. To eliminate this impunity and reduce ongoing risk to the network, an additional mechanism is required. -We propose to limit the eras spanned by this outer maximum to an explicit spans $\bar{e}$ that end after an eras $e \in \bar{e}$ in which any slashing events for that span $\bar{e}$ gets detected. In concrete terms, we partition the eras of some nominator $\eta$ into _slashing spans_ which are maximal contiguous sequence of eras $\bar{e} = \left[ e_1, \ldots, e_n \right]$ such that $e_n$ is the least era in which $\eta$ gets slashed for actions in one of the $e_i \in \bar{e}$. +The problem may be resolved by limiting the eras spanned by the outer maximum to explicit ranges $\bar{e}$. Termination occurs following an era $e \in \bar{e}$ in which any slashing events for that span $\bar{e}$ are detected. Concretely, the eras associated with a nominator $\eta$ are divided into _slashing spans_, maximal contiguous sequence of eras $\bar{e} = \left[ e_1, \ldots, e_n \right]$ such that $e_n$ is the earliest era in which $\eta$ is slashed for actions commited in one of the $e_i \in \bar{e}$. -We shall sum offences across slashing spans. In other words, if we $\bar{e}$ range over the slashing spans for $\eta$ then we have slashed $\eta$ in total +Offences are then summed across slashing spans. In other words, if $\bar{e}$ ranges over the slashing spans for $\eta$, then the total amount slashed from $\eta$ is: $$ \sum_{\bar{e} \in \bar{E}} \max_{e \in \bar{e}} \sum_{\nu \in N_e} p_{\nu,e} x_{\eta,\nu,e} \tag{\dag} $$ -In particular, if $\eta$ gets slashed in epoch 1 with the detection occurring in epoch 2, then resumes nomination in epoch 3, and only then gets slashed again for actions in epoch 1 and 2, then these later slashes are counted as part of the same slashing span as $\eta$'s first slash from epoch 1, but any slash in epoch 3 count afresh in a new span that gets added. +In particular, if $\eta$ is slashed in epoch 1 with the detection occurring in epoch 2, nomination resumes in epoch 3, and only then is $\eta$ slashed again for actions commited in epoch 1 and 2. These later slashes are counted as part of the same slashing span, originating from $\eta$'s initial slash in epoch 1. Any slash occurring in epoch 3 is treated as a new event and initiates a fresh slashing span. + +Slashing Span Lemma. Any slashing span-like construction must terminate whenever slash is detected. -Slashing Span Lemma. Any slashing span-like construction must end whenever we detect some slash. +Proof. Let $x'$ be the validators' minimum self-exposure, and let $y$ be the total stake required to become a validator. Suppose a nominator $\eta_1$ nominates validators $\nu_e$ for $e=1\ldots$, using their account with stake $y-x'$. In epoch $e-1$, each $\nu_i$ stakes enough to become a validator in epoch $e$, with $\nu_1$ staking only $x'$ and $\nu_i$ for $i>1$ slightly more. -Proof. Let $x'$ be the validators' minimum self exposure and let $y$ be the stake to become a validator. Some nominator $\eta_1$ nominates validators $\nu_e$ for $e=1\ldots$ with her account of $y-x'$ stake. In epoch $e-1$, $\nu_i$ stakes enough to become a validator in epoch $e$, so $\nu_1$ stakes only $x'$ and $\nu_i$ for $i>1$ stakes somewhat more. In epoch $i$, $\nu_i$ commits a violation. If we did not end $\eta_1$'s slashing span $\bar{e}$ then then $max_{e \in \bar{e}}$ rule would prevent these slashes from actually slashing $\eta_1$ further. In this way, a planned series of violations causing slashes across epochs only actually slashes $x' / y$ of the desired slash value. +Now, suppose $\nu_i$ commits a violation in epoch $i$. If the system does not end $\eta_1$'s slashing span $\bar{e}$, then the rule $max_{e \in \bar{e}}$ would prevent subsequent slashing events from further penalizing $\eta_1$. As a result, a planned series of violations across epochs would only slash a fraction $x' / y$ of the intended penalty, undermining the effectiveness of the slashing mechanism. $$ \tag{$\blacksquare$} $$
-There are many design choices that restrain this lemma somewhat, but they make our slashing fragile, which harms our analysis and compossibility. +Many design choices constrain this lemma to some extent, but they also make slashing fragile, complicating analysis and reducing composability. ## Actions -We now detail several additional actions taken whenever some validator $\nu$ causes the slashing of some nominator $\eta$. Among other concerns, these help mitigate reenlistment mistakes that nominators would occasionally make. +Several additional mechanisms are triggered whenever a validator $\nu$ causes the slashing of a nominator $\eta$. Among other considerations, these mechanisms help mitigate reenlistment mistakes that nominators may occasionally make. -We first post a slashing transaction to the chain, which drops the offending validator $\nu$ from the active validator list by invalidating their controller key, or maybe just their session keys. In consequence, all nodes ignore $\nu$ for the remainder of the era. It invalidates any future blocks that do not ignore $\nu$ too. We also remove all nomination approval votes by any nominator for $\nu$, even those who currently allocate $\nu$ zero stake. +The first step then is to post a slashing transaction to the chain, which removes the offending validator $\nu$ from the active validator set by invalidating either their controller key or, maybe potentionally, just their session keys. As a result, all nodes ignore $\nu$ for the rest of the era. Any future blocks that fail to ignore $\nu$ are considered invalid. All nomination approval votes by any nominator for $\nu$ are also removed, including those currently allocating $\nu$ zero stake. -We handle the nominator $\eta$ less speedily though. We merely update the slashing accounting below when the offense occurred in some past slashing span for $\eta$, meaning we need not end their current slashing span. We go further assuming the usual case that the offense occurred in $\eta$'s currently running slashing span though: We terminate $\eta$'s current slashing span at the end of the current era, which should then start a new slashing span for $\eta$. +Nominator $\eta$ is handled with less urgency. The slashing accounting is updated only when the offense occurred in a past slashing span for $\eta$, meaning it is not necessary to terminate their current span. In the more typical case, where the offense occurrs during $\eta$'s currently active slashing span, that span is terminated at the end of the current era, and a new slashing span begins for $\eta$. -We also mark $\eta$ _suppressed_ which partially _suppresses_ all of $\eta$'s nomination approval votes for future eras. We do not suppress or remove $\eta$'s current nominations for the current era or reduce the stake currently backing other validators. In principle, we could suppresses $\eta$'s nomination approval votes somewhat whenever $\eta$ gets slashed in previous slashing spans, but doing so appears unnecessary because suppression really comes only as part of ending a slashing span. +Nominator $\eta$ is then _suppressed_, which partially suppresses all of $\eta$'s nomination approval votes for future eras. $\eta$'s current nominations for the ongoing era are not suppressed or removed, and the stake currently backing other validators remains unaffected. In principle, it is possible to suppress $\eta$'s nomination approval votes whenever they are slashed in a previous slashing span. This seems to be unnecessary, as suppression is primarily tied to the termination of a slashing span. -Also, we permit $\eta$ to update their nomination approval votes for future eras during the current or future era, but doing so removes them from the aka suppressed state. We also notify $\eta$ that $\nu$ cause them to be slashed and suppressed. +Additionally, $\eta$ can update their nomination approval votes for future eras during the current or any subsequent era. Doing so removes them from the suppressed state. $\eta$ also receives a notification indicating that validator $\nu$ caused them to be slashed and suppressed. -These state alterations reduce the risks of unintentional reenlistment of any nominator, while also balancing risks to the network. In particular, these measures provide justification for treating any future nominations by $\eta$ separately from any that happen in the current era or before. +These state changes help reduce the risk of unintentional reenlistment by nominators, while also balancing systemic risks to the network. In particular, they provide justification for treating any future nominations by $\eta$ separately from those made in the current or previous eras. ## Accounting -We cannot slash for anything beyond the unbonding period and must expire slashing records when they go past the unbonding period. We address this easily thanks to slashing spans: We track the maximum slash $s_{\eta}$ within each slashing span, which we update anytime a slash raises the slashing span's maximum slash. We shall use $s_{\eta}$ again below in rewards computations. +Slashing is not permitted for any events occurring beyond the unbonding period, and slashing records must expire once this period has elapsed. Slashing spans help address this requirement by tracking the maximum slash $s_{\eta}$ within each span. This value can be updated whenever a new slash increases the span's maximum. The $s_{\eta}$ is referenced again below in reward computations. + +As an aside, consider an alternative accounting strategy. By recording all slashing events along with a value $s_{\eta,\nu,e}$, it is possible to represent the amount actually slashed at time $e$. If $e'>e$, then the initial slash is recorded as -As an aside, there was another accounting strategy here: Record all slash events along with some value $s_{\eta,\nu,e}$ recording the amount actually slashed at that time. If $e'$ is later than $e$ then we record the initial slash $s_{\eta,\nu,e} := p_{\nu,e} x_{\eta,\nu_j,e}$ at $e$ and record a lesser slash $s_{\eta,\nu,e'} := p_{\nu,e'} x_{\eta,\nu_j,e'} - p_{\nu,e} x_{\eta,\nu_j,e}$ at the later $e'$. These $s_{\eta,\nu,e}$ values permit slashes to expire without unfairly increasing other slashes. We believe this extra complexity and storage, does not improve network security, and strengthens extortion attacks on nominators. +$$ +s_{\eta,\nu,e} := p_{\nu,e} x_{\eta,\nu_j,e} +$$ + +at time $e$. A subsequent lesser slash is then recorded as + +$$ +s_{\eta,\nu,e'} := p_{\nu,e'} x_{\eta,\nu_j,e'} - p_{\nu,e} x_{\eta,\nu_j,e} +$$ + +at time $e'$. These $s_{\eta,\nu,e}$ values allow slashes to expire without unfairly increasing future slashes. The added complexity and storage overhead does not enhance network security and may exacerbate extortion attacks against nominators. ## Monotonicity -We ask that slashing be monotonic increasing for all parties so that validators cannot reduce any nominator's slash by additional miss-behavior. In other words, the amount any nominator gets slashed can only increase with more slashings events, even ones involving the same validator but not the same nominator. +Slashing must be monotonically increasing for all parties, ensuring that validators cannot reduce a nominator's penalty through additional misbehavior. In other words, the amount any nominator is slashed can only increase with more slashing events, even those involving the same validator but different nominators. -We think fairness imposes this condition because otherwise validators can reduce the slash of their favoured nominators, normally by making other nominators be slashed more. We know trusted computing environments (TEE) avoid this issue, but we do not currently foresee requiring that all validators use them. +Fairness demands this condition; otherwise, validators could manipulate slashing to benefit favored nominators, typically by increasing the penalties applied to others. Trusted Execution Environments (TEE) can help prevent such manipulation, but not all validators are expected to use them. -We have achieved monotonicity with ($\dag$) because summation and maximums are monotonically increasing over the positive real numbers, assuming any logic that adjusts the $p_{\nu,e}$ also adheres to monotonicity. +Monotonicity can be achieved with ($\dag$), since both summation and maximum operations are monotonically increasing over the positive real numbers, assuming that any logic to adjust $p_{\nu,e}$ also preserves monotonicity. -There are no meaningful limits on the diversity of nominators who nominated a particular validator within the unbonding period. As a direct consequence of monotonicity, almost every nominators can be slashed simultaneously, even if only one validator gets slashed. In particular, there are "rage quit attacks" in which one widely trusted validator adds past equivocations that cover many nominators. We therefore cannot bound the total stake destroyed by a combined slashing event much below the slash applied to the total stake of the network. +There are no meaningful limits on the diversity of nominators who may nominate a particular validator during the unbonding period. As a direct consequence of monotonicity, nearly all nominators can be slashed simultaneously, even if only one validator is penalized. This opens the door to "rage quit attacks", where a widely trusted validator retroactively introduces equivocations that implicate many nominators. As a result, the total stake destroyed by a combined slashing event, though far below the total stake of the network, cannot be reliably bounded. -In particular, we cannot prevent validators from retroactively validating invalid blocks, which causes a 100% slash. We could reduce these high slashes from old offenses if truly uncorrelated, but if correlated then only governance could interveen by searching historical logs for the invalid block hash. +Moreover, validators can retroactively validate invalid blocks, which results in a 100% slash. While it may be possible to reduce the severity of slashes for older offenses if they are truly uncorrelated, in case of correlation, only governance can intervene by searching historical logs to identify the invalid block hash. ## Suppressed nominators in Phragmen -Above, we defined a slashing span $\bar{e}$ for a nominator $\eta$ to end after the era $e$ during which a slashing event during $\bar{e}$ gets detected and acknowledged by the chain. We asked above that all $\eta$'s nomination approval votes, for any validator, should be _suppressed_ after the era $e$ that ends a slashing span $\bar{e}$, but never defined suppressed. +The slashing span $\bar{e}$ for a nominator $\eta$ is defined to end in the era $e$ during which a slashing event within $\bar{e}$ is detected and acknowledged by the chain. Under this definition all of $\eta$'s nomination approval votes, for any validator, should be _suppressed_ after the era $e$ that concludes a slashing span $\bar{e}$. The notion of suppression itself has not been formally defined, though. + +Let $\xi$ be the _suppression factor_, a recently introduced network parameter. Let $s_{\eta,\bar{e}}$ denote the amount slashed from nominator $\eta$ during slashing span $\bar{e}$, and let $E$ represent the set of slashing spans $\eta$ within the unbonding period during which $\eta$ has not updated their nominations. When $\eta$ is marked as suppressed, a portion of their stake in Phragmen, specifically $\xi \sum_{\bar{e} \in E} s_{\eta,\bar{e}}$ of $\eta$'s, is ignored. -We introduce a network paramater $\xi$ called the _suppression factor_. We let $s_{\eta,\bar{e}}$ denote the value slashed from nominator $\eta$ in slashing span $\bar{e}$. We also let $E$ denote the slashing spans of $\eta$ within the unbonding period for which $\eta$ has not updated their nominations. We now ignore $\xi \sum_{\bar{e} \in E} s_{\eta,\bar{e}}$ of $\eta$'s stake in Phragmen when $\eta$ is marked as suppressed. +If suppression has no effect ($\xi = 0$), then at the next epoch, $\eta$ enters a new slashing span by the Slashing Span Lemma, risking additive slashing. This is problematic for several reasons: -If suppression does nothing ($\xi = 0$), then at the next epoch $\eta$ enters a fresh slashing span by the Slashing Span Lemma, and risks additive slashing. We consider this problematic for several reasons: First, we consider $\eta$'s judgement flawed, so they should reevaluate their votes' risks, both for themselves and the network's good. Second, $\eta$ could easily be slashed several times if reports are prompt, but only once if reports are delayed, which incentivizes delaying reports. Also, slashes could be caused by intermittent bugs. +* First, $\eta$'s judgement is flawed, and they should reassess the risks associated with their vote, for both their own sake and the network's integrity. +* Second, $\eta$ could be slashed multiple times if reports are prompt, but only once if reports are delayed, creating a perverse incentive to delay reporting. +* Additionally, intermittent bugs could trigger slashes. -If suppression removes all $\eta$'s nominations ($\xi = \infty$), then $\eta$ remains completely safe, but widespread slashing could remove massive amounts of stake from the system if many nominators get slashed nearly simultaneously, perhaps only by some small amount. If these fail to renominate quickly, then much of the total stake invested by nominators becomes suppressed, not unlike the "rage quit attacks" enabled by monotonicity. We consider this problematic because an adversary might suddenly control more than one third of the stake. +If suppression removes all $\eta$'s nominations ($\xi = \infty$), then $\eta$ remains completely safe. However, widespread slashing could eliminate large amounts of stake from the system if many nominators are slashed nearly simultaneously, even by small amounts. If these nominators fail to renominate quickly, a significant portion of the total stake becomes suppressed, unlike the "rage quit attacks" enabled by monotonicity. This poses a risk, as an adversary could suddenly control more than one-third of the stake. -We think $\xi = 1$ or $2$ sounds reasonable. We suspect $\xi > 2$ meshes poorly with our 2/3rds honest assumption elsewhere. At some point $\xi < 0.5$ creates similar issues to $\xi = 0$, but no intuitive arguments present themselves. +A suppression factor of $\xi = 1$ or $2$ sounds reasonable, as values of $\xi > 2$ may conflict with the protocol's assumption of two-thirds honest participation. Conversely, when $\xi < 0.5$, issues similar to those at $\xi = 0$ arise, though no intuitive arguments currently support this threshold. -We have intentionally kept the above computation $\xi \sum_{\bar{e} \in E} s_{\eta,\bar{e}}$ extremely simple so that $\xi$ can dynamically be changed by governance to reintroduce suppressed stake in an emergency. We code could change $\xi$ automatically but doing so appears pointless. +The computation $\xi \sum_{\bar{e} \in E} s_{\eta,\bar{e}}$ is intentionally simple, allowing $\xi$ to be dynamically adjusted by governance to reintroduce suppressed stake in the event of an emergency. While the code could theoretically modify $\xi$ automatically, this appears unnecessary and offers little practical benefit. -TODO: Import any discussion from Alfonso's text ## Rewards for slashable offense reports -Interestingly, we find that monotonicity also constrains our rewards for offense reports that result in slashing: If a validator $\nu$ gets slashed, then they could freely equivocate more and report upon themselves to earn back some of the slashed value. It follows that slashes should always slash the validator's self stake more than the reward for the slash. +Interestingly, monotonicity also places constraints on the reward structure for offense reports that lead to slashing. For example, if a validator $\nu$ is slashed, they could freely equivocate again and report themselves in an attempt to recover some of the slashed value. To prevent this exploit, slashing must always penalize the validator's self-stake by an amount greater than any reward granted for the report. ### Rewards based on slashing nominators -We quickly give an inefficient straw-man that describes issuing rewards based upon slashing nominators. +An inefficient straw-man proposal describes issuing rewards based upon slashing nominators. -We define $f_\infty$ to be the maximum proportion of a slash that ever gets paid out, presumably $f_\infty < 0.1$. We also define $f_1 \le {1\over2}$ to be the proportion of $f_\infty$ paid out initially on the first offence detection. So a fresh slash of value $s$ results in a payout of $f_\infty f_1 s$. Set $f_0 := {1-f_1 \over f_1} f_\infty$ so that $f_\infty = {f_1 \over 1-f_1} f_0$. +Let $f_\infty$ be the maximum proportion of a slash that can ever be paid out, presumably with $f_\infty < 0.1$. Let $f_1 \le {1\over2}$ represent the proportion of $f_\infty$ paid out initially upon first offence detection. A fresh slash of value $s$ then results in a payout of $f_\infty f_1 s$. Define $f_0 := {1-f_1 \over f_1} f_\infty$ so that $f_\infty = {f_1 \over 1-f_1} f_0$. -We consider a slash of value $s := p_{\nu,e} x_{\eta,\nu,e}$ being applied to the nominator $\eta$. We let $s_{\eta,i}$ and $s_{\eta,i+1}$ denote $\eta$'s actual slash in slashing span $\bar{e}$ given by $\max_{e \in \bar{e}} \sum_{\nu \in N_e} p_{\nu,e} x_{\eta,\nu,e}$ before and after applying the new slash, respectively, so when $\eta$'s slash increases by $s_{\eta,i+1} - s_{\eta,i}$. +Consider a slash of value $s := p_{\nu,e} x_{\eta,\nu,e}$ applied to the nominator $\eta$. Let $s_{\eta,i}$ and $s_{\eta,i+1}$ denote $\eta$'s actual slash in slashing span $\bar{e}$, given by -We track the value $s_{\eta,i}$ in $\eta$'s slashing span record, but we also track another value $t_{\eta,i} < s_{\eta,i}$ that represents the total amount paid out so far. If $s_{\eta,i+1} > s_{\eta,i}$ then we pay out $r := f_1 (f_0 s_{\eta,i+1} - t_{\eta,i})$ and increase $t_{\eta,i}$ by this amount. If $s_{\eta,i+1} = s_{\eta,i}$ then we pay out $r := f_1 \max(f_0 s - t_{\eta,i},0)$. In either case, we store $t_{\eta,i+1} := t_{\eta,i} + r$. +$$ +\max_{e \in \bar{e}} \sum_{\nu \in N_e} p_{\nu,e} x_{\eta,\nu,e} +$$ + +before and after applying the new slash, respectively. Thus, $\eta$'s slash increases by $s_{\eta,i+1} - s_{\eta,i}$. + +Track the value $s_{\eta,i}$ in $\eta$'s slashing span record, along with another value $t_{\eta,i} < s_{\eta,i}$ representing the total amount paid out so far. If $s_{\eta,i+1} > s_{\eta,i}$, then the pay out is + +$$ +r := f_1 (f_0 s_{\eta,i+1} - t_{\eta,i}), +$$ + +increasing $t_{\eta,i}$ by this amount. If $s_{\eta,i+1} = s_{\eta,i}$, then the payout is $r := f_1 \max(f_0 s - t_{\eta,i},0)$. + +In either case, the updated value stored is $t_{\eta,i+1} := t_{\eta,i} + r$. -In this way, our validator $\nu$ cannot reclaim more than $f_{\infty} f_1 s$ from a slash of value $s$, even by repeatedly equivocations, so $f_{\infty} f_1$ should remain below the required self stake. Any slash of size $s_{\eta,i}$ always results in some payout, but slashes less than $t_{\eta,i}$ never pay out. +In this way, validator $\nu$ cannot reclaim more than $f_{\infty} f_1 s$ from a slash of value $s$, even through repeated equivocations. For this reason, the product $f_{\infty} f_1$ should remain below the required self-stake. Any slash of size $s_{\eta,i}$ always results in some payout, yet slashes smaller than $t_{\eta,i}$ never trigger a payout. ### Rewards based on slashing only validators -We dislike that the above reward scheme requires both considering all impacted $\eta$ when doing payouts, and imposing the bound that $f_{\infty} f_1$ remain below the self stake remains tricky. +Since the above reward scheme requires both accounting for all impacted nominators $\eta$ during payouts and enforcing the constraint that $f_{\infty} f_1$ remains below the valitor's self-stake, the proposal is to compute rewards only for validators who are directly slashed. This approach requires that validators are always slashed whenever their nominators are slashed, meaning a validator cannot be slashed 100% unless all of their nominators are also slashed 100%. -We therefore propose to compute rewards only for validators being slashed instead. We shall require that validators always get slashed whenever their nominators get slashed, which means validators cannot be slashed 100% without their nominators all also being slashed 100%. +Let $x'$ denote the minimum self-exposure (i.e., stake) that validator operators must provide, such that $x_{\nu,\nu,e} \ge x'$. As a simplifying assumption, $f_\infty$ should be kept small enough to ensure that rewards are always covered by validators' self-exposure, i.e., -We have some minimum exposure aka stake $x'$ that validator operators must provide themselves, meaning $x_{\nu,\nu,e} \ge x'$. As a simplifying assumption, we ask that $f_\infty$ be kept small enough that rewards can always be covered by the validators' exposure, meaning $x' \ge f_{\infty} \sum_\eta x_{\eta,\nu,e}$. We do not explore any cases where this fails here, but doing so requires a subtle definition of some $x' > x_{\nu,\nu,e}$ such that rewards still cannot create inflation. +$$ +x' \ge f_{\infty} \sum_\eta x_{\eta,\nu,e} +$$ + +Cases where this condition fails are not explored further here. Addressing such scenarios would require a more nuanced definition of $x' > x_{\nu,\nu,e}$ to ensure that reward payouts do not introduce inflationary pressure. + +Define $f' > f_0$ such that $f' x' = {1-f_1 \over f_1} f_{\infty} x_{\min}$ where $x_{\min} = \sum_\eta x_{\eta,\nu,e}$ represents the required minimum total stake for any validator. In the revised scheme, replace $f_{\infty}$ with $f'$, and apply payouts to slashes against the validator operator's minimum exposure $x'$. This means replacing the slash value $p_{\nu,e} x_{\eta,\nu,e}$ with $\max_{e \in \bar{e}} p_{\nu,e} x'$. + +A slash of value $s := p_{\nu,e} x_{\nu,\nu,e}$ is applied to validator $\nu$. The _minimum validator adjusted slash_ value $s' := p_{\nu,e} x'$ represents the fraction of this slash applied to the minimum validator stake $x'$. The _total minimum validator-adjusted slash_, given by $\max_{e \in \bar{e}} p_{\nu,e} x'$, serves as an analog to total regular slashes, but considers only the validator's own exposure. -We now define $f' > f_0$ such that $f' x' = {1-f_1 \over f_1} f_{\infty} x_{\min}$ where $x_{\min} = \sum_\eta x_{\eta,\nu,e}$ is our required minimum total stake for any validator. In the above scheme, we shall replace $f_{\infty}$ by $f'$ and only apply the payouts to slashes against validator operators minimum exposure $x'$, meaning replace the slash value $p_{\nu,e} x_{\eta,\nu,e}$ by $\max_{e \in \bar{e}} p_{\nu,e} x'$. +The next step is to let $s^\prime_{\nu,i}$ and $s^\prime_{\nu,i+1}$ denote validator $\nu$'s total validator-adjusted slash within their slashing span $\bar{e}$, before and after applying the new slash, respectively. When the total validator-adjusted slash increases, the change is given by + +$$ +s^\prime_{\nu,i+1} - s^\prime_{\nu,i} = \max(s^\prime - s^\prime_{\nu,i},0). +$$ -We consider a slash of value $s := p_{\nu,e} x_{\nu,\nu,e}$ being applied to the validator $\nu$. We define the _minimum validator adjusted slash_ value $s' := p_{\nu,e} x'$ to be the fraction of this slash applied to the minimum validator stake $x'$. We have a _total minimum validator adjusted slash_ given by $\max_{e \in \bar{e}} p_{\nu,e} x'$, which provides an analog of total regular slashes but only considering the validator themselves. +Now, track the value $s^\prime_{\nu,i}$ in validator $\nu$'s slashing span record, along with another value $t_{\nu,i} < s^\prime_{\nu,i}$, which represents the total payout issued so far. If $s^\prime_{\nu,i+1} > s^\prime_{\nu,i}$, then the payout is $r := f_1 (f' s^\prime_{\nu,i+1} - t_{\nu,i})$ and $t_{\eta,i}$ increases by this amount. If $s^\prime_{\nu,i+1} = s^\prime_{\nu,i}$, then the payout is $r := f_1 \max(f' s' - t_{\nu,i},0)$. In both cases, the updated value $t_{\nu,i+1} := t_{\nu,i} + r$ is stored. -We next let $s^\prime_{\nu,i}$ and $s^\prime_{\nu,i+1}$ denote $\nu$'s total validator adjusted slash in their slashing span $\bar{e}$ before and after applying the new slash, respectively, so when $\nu$'s total validator adjusted slash increases by $s^\prime_{\nu,i+1} - s^\prime_{\nu,i} = \max(s^\prime - s^\prime_{\nu,i},0)$. +In this way, validator $\nu$ cannot reclaim more than $f' f_1 s$ from a slash of value $s$, even through repeated equivocations. Any slash of size $s_{\nu,i}$ always results in some payout, but slashes smaller than $t_{\nu,i}$ do not trigger additional rewards. -We track the value $s^\prime_{\nu,i}$ in the validator $\nu$'s slashing span record, but we also track another value $t_{\nu,i} < s^\prime_{\nu,i}$ that represents the total amount paid out so far. If $s^\prime_{\nu,i+1} > s^\prime_{\nu,i}$ then we pay out $r := f_1 (f' s^\prime_{\nu,i+1} - t_{\nu,i})$ and increase $t_{\eta,i}$ by this amount. If $s^\prime_{\nu,i+1} = s^\prime_{\nu,i}$ then we pay out $r := f_1 \max(f' s' - t_{\nu,i},0)$. In either case, we store $t_{\nu,i+1} := t_{\nu,i} + r$. +Both schemes yield similar payouts initially, but the second scheme, where rewards are based only on validator slashes, results in smaller payouts when cross-era slashing logic is applied. For instance, if validator $\nu$ receives similar slashes across multiple epochs, the $r_1$ factor reduces the total reward under the validator-only scheme. Still, if $\nu$ has disjoint nominators in each epoch, the impact of the $r_1$ factor is minimal. -In this way, our validator $\nu$ cannot reclaim more than $f' f_1 s$ from a slash of value $s$, even by repeatedly equivocations. Any slash of size $s_{\nu,i}$ always results in some payout, but slashes less than $t_{\nu,i}$ never pay out. -In both scheme, we have similar payouts initially, but our second scheme with payouts based only on the validator slashes results in smaller reward payouts when cross era slashing logic kicks in. As an example, if a validator $\nu$ gets similar slashes for different epochs, then the $r_1$ factor would reduce the entire reward if payouts are based only on the validator slashes, but if $\nu$ has disjoin nominators in every epoch then the $r_1$ factor makes only a minimal appearance. +**For further questions and inquieries, please contact**: [Jeffrey Burdges](/team_members/jeff.md) diff --git a/docs/Polkadot/token-economics/Polkadot-Crypto.png b/docs/Polkadot/token-economics/Polkadot-Crypto.png new file mode 100644 index 00000000..ba7437c7 Binary files /dev/null and b/docs/Polkadot/token-economics/Polkadot-Crypto.png differ diff --git a/docs/Polkadot/token-economics/Polkadot.png b/docs/Polkadot/token-economics/Polkadot.png new file mode 100644 index 00000000..212209c1 Binary files /dev/null and b/docs/Polkadot/token-economics/Polkadot.png differ diff --git a/docs/Polkadot/token-economics/Transaction-fees.png b/docs/Polkadot/token-economics/Transaction-fees.png new file mode 100644 index 00000000..a5abd9b8 Binary files /dev/null and b/docs/Polkadot/token-economics/Transaction-fees.png differ diff --git a/docs/Polkadot/token-economics/Treasury.md b/docs/Polkadot/token-economics/Treasury.md new file mode 100644 index 00000000..2618aba4 --- /dev/null +++ b/docs/Polkadot/token-economics/Treasury.md @@ -0,0 +1,25 @@ +--- +title: Treasury +--- + + + +Treasury refers to the system's continuous need to raise funds. These funds compensate developers for delivering software updates, implementing changes approved through referenda, adjusting parameters, and maintaining overall system stability. + +Treasury funds can be raised through two mechanisms: + +1. Minting new tokens, which contributes to inflation + +2. Redirecting tokens from transaction fees and slashings that would otherwise be burned. + +These mechanisms mirror traditional methods used by governments to raise funds: minting coins, which leads to controlled inflation, and collecting taxes and fines. + +While raising funds solely by minting new tokens is possible, it is more sensible to redirect tokens from transaction fees and slashings, otherwise destined to be burned, into the treasury. + +- By redirecting tokens in this manner, the amount of actual stake burning is reduced, resulting in better control over the inflation rate. It is worth noting that stake burning leads to deflation, and the events that trigger it are unpredictable. + +- Following an event that results in significant stake slashing, governance may opt to partially reimburse the affected stake. In the event of a code bug or other extenuating circumstances, having DOT readily available in the treasury is advantageous, as it eliminates the need to burn and later mint new tokens. + +- Periods marked by unusually high levels of stake burning, whether caused by misconduct or excessive transaction fees, indicate systemic issues that require resolution. To cover the development costs associated with fixing such problems, additional treasury funds are needed during these times. + +**For any inquiries or questions, please contact** [Jonas Gehrlein](/team_members/Jonas.md) diff --git a/docs/Polkadot/token-economics/Treasury.png b/docs/Polkadot/token-economics/Treasury.png new file mode 100644 index 00000000..97c5490e Binary files /dev/null and b/docs/Polkadot/token-economics/Treasury.png differ diff --git a/docs/Polkadot/token-economics/index.md b/docs/Polkadot/token-economics/index.md new file mode 100644 index 00000000..e0e47557 --- /dev/null +++ b/docs/Polkadot/token-economics/index.md @@ -0,0 +1,24 @@ +--- +title: Token Economics +--- + +import DocCardList from '@theme/DocCardList'; + + + + + +Polkadot is a proof-of-stake–based platform in which a set of validators, who have staked DOT[^1], produce blocks and reach consensus. Polkadot validators are rewarded roughly in proportion to their staked amount, unless they deviate from the protocol, in which case a portion of their DOT is slashed. + +On this platform, the set of nodes elected as validators changes constantly in each era, approximately once a day, although their total number remains limited. Any number of DOT holders can participate indirectly in the decision-making processes as *nominators*, under a system known as *nominated proof-of-stake*. A nominator selects validator candidates they trust and stakes DOT to support their nomination. If one or more of their nominated candidates are elected as validators in an era, the nominator shares with them any economic reward or penalty, proportional to their stake. + +Being a nominator is a way to invest one's DOT while contributing to the security of the system. The greater the total amount of DOT staked by nominators and validators, the higher the system’s security—since an adversary would require significantly more stake, or nominators' trust, to succeed in getting nodes elected as validators. + +The aim, therefore, is for validators and nominators to stake a considerable percentage of the total DOT supply. Another significant portion of the DOT supply will be locked as deposits by commercial blockchains that secure parachain slots. + +The following sections focus on three key topics. **NPoS payment and inflation** explains how well-behaved validators and nominators are rewarded under Polkadot’s nominated proof-of-stake system. **Transaction fees** examines optimal fee structures on the relay chain to cover operational costs, mitigate harmful behavior, and manage periods of high activity or delayed transaction inclusion. Finally, **Treasury** discusses how and when may DOT be raised to support ongoing network maintenance. The closing paragraph provides links to further resources related to the Polkadot protocol. + +[^1]: DOT are Polkadot's native token and their main functions are: 1) Economics: Polkadot mints or burns DOT to reward the nodes that run the consensus protocol, fund the treasury, control the inflation rate, and support other economics mechanisms. 2) Slashing: DOT also play a role in slashing protocols designed to desincentivize attacks or adversarial behaviors. 3) Governance: DOT function as voting power, allowing DOT holders to express their opinion in governance decisions via referenda. 4) Parachain allocation: Finally, DOT are used to decide which projects receive parachain slots, through auctions and deposits. This section focuses on the first function, while the remaining three are explored in subsequent sections. + + +diff --git a/docs/Polkadot/token-economics/payments-and-inflation.md b/docs/Polkadot/token-economics/payments-and-inflation.md new file mode 100644 index 00000000..0da21c12 --- /dev/null +++ b/docs/Polkadot/token-economics/payments-and-inflation.md @@ -0,0 +1,163 @@ +--- +title: NPoS payments and inflation +--- + + +Payments to validators and nominators for their participation in block production (BABE) and finality (GRANDPA), as well as on payments arising from routine token minting, are among the core pillars of the Polkadot NPoS system. While other forms of compensation, including slashing penalties, rewards to misconduct reporters and fishermen, or distributions from transaction fees, are also of main relevance, they are discussed in separate sections. + +Since these payments are the primary driver of inflation in the system, the first step is to outline the inflation model. Two sets of adjustable parameters are under consideration: one for the eventual scenario in which parachains are fully launched, and another for the interim period, during which liquidity is not constrained by parachain bonds. + +### Inflation model + +Let $x$ be the *staking rate* in NPoS at a particular point in time, that is, the total amount of tokens staked by nominators and validators divided by the total token supply. The value of $x$ always lies between 0 and 1. + +__Adjustable parameter:__ $\chi_{ideal}$ represents the desired long-term staking rate. A drop below this rate compromises security, making it necessary to give strong incentives for DOT holders to increase their stakes. Conversely, a rise above this threshold reduces liquidity, which is also undesirable, making it neccesary to sharply reduce incentives. + +Let $i=i(x)$ denote the yearly *interest rate* in NPoS. In other words, $i=i(x)$ represents the total annual amount of tokens minted to compensate all validators and nominators for block production (BABE) and finality (GRANDPA), divided by the total amount of tokens staked by them. Intuitively, $i(x)$ represents the incentive offered to participants for staking. Hence, $i(x)$ should be a monotonically decreasing function of $x$, since less incentive is required as the staking rate increases. + +* For ease of comprehension, the focus is placed on the annual interest rate rather than the rate per block or per epoch. Accordingly, $i(x)$ represents the total payout received by someone who continuously stakes one DOT over the course of a year. It's easy to derive the interest rate per block from this annual rate. +* The function $i(x)$ serves only as an indicator of the average interest rate, as not every staked participant is compensated strictly in proportion to their stake. For instance, a validator may receive higher rewards than a nominator with an equal stake, and a validator who produces a block may temporarily earn more than one who does not. + +__Adjustable parameter:__ Let $i_{ideal}:=i(\chi_{ideal})$ denote the interest rate paid in the ideal scenario where $x=\chi_{ideal}$. This rate is indirectly determined by the system's overall inflation. + +Let $I$ denote the yearly *inflation rate*, defined as: + +$$ +I=\frac{\text{token supply at end of year} - \text{token supply at beginning of year}}{\text{token supply at beginning of year}} +$$ + +The inflation rate is given by + +$$ +I=I_{NPoS}+I_{treasury}-I_{slashing} - I_{tx-fees} +$$ + +where: +* $I_{NPoS}$ represents the inflation resulting from token minting to reward nominators and validators. +* $I_{treasury}$ accounts for the inflation due to minting for treasury funding. +* $I_{slashing}$ reflects the deflation caused by token burning following validator or nominator misconduct. +* $I_{tx-fees}$ corresponds to the deflation resulting from the burning of transaction fees.[^1] + +$I_{NPoS}$ should be by far the largest of these components, making it the main driver of overall inflation. Redirecting all tokens originally destined for burning, whether from slashing or transaction fees, into the treasury, reduces the magnitude of the deflationary terms in the formula (see the section on treasury). If $I_{NPoS}$ is a function of the staking rate $x$, the relationship between $I_{NPoS}(x)$ and $i(x)$ is clearly given by + +$$ +I_{NPoS}(x)=x\cdot i(x) +$$ + +From previous analysis one can observe that $I_{NPoS}(\chi_{ideal})=\chi_{ideal}\cdot i_{ideal}$. Since the goal is to steer the market toward a staking rate of $x=\chi_{ideal}$, it is reasonable for the inflation rate $I_{NPoS}(x)$ to reach its **maximum at this target value**. + +__Adjustable parameter:__ Let $I_0$ denote the limit of $I_{NPoS}(x)$ as $x$ approaches zero, that is, when neither validators nor nominators are staking any DOT. This value shoud be close to zero but not exactly zero, since it is important to ensure that validators' operational costs are always covered, even if nominators receive no compensation. Accordingly, $I_0$ represents an estimate of the total operational costs of all validators, expressed as a fraction of the total token supply. $I_{NPoS}(x)$ should remain strictly greater than $I_0$ for all values of $x$, including in the limit as $x$ approaches 1. + +For simplicity, the inflation function increases linearly between $x=0$ and $x=\chi_{ideal}$, and decreases exponentially between $x=\chi_{ideal}$ and $x=1$. The exponential decay for $I_{NPoS}(x)$ induces a corresponding exponential decline in $i(x)$, allowing the interest rate to drop sharply beyond $\chi_{ideal}$ to help prevent illiquidity. At the same time, this formulation enables controlled changes in the rate, expressed by the ratio $i(x+\varepsilon)/i(x)$, where $\varepsilon$ is a small increment in $x$. Bounding the rate of change is important for ensuring predictability and stability for nominators and validators. + +__Adjustable parameter:__ The *decay rate* $d$ is defined so that the inflation rate decreases by no more than 50% when $x$ increases by $d$ units beyond $\chi_{ideal}$; that is, $I_{NPoS}(\chi_{ideal} + d) \geq I_{NPoS}/2$. A recommended value for $d$ is 0.05. + +The previous discussion leads to the proposal of the following interest rate and inflation rate functions, which depend on the parameters $\chi_{ideal}$, $i_{ideal}$, $I_0$, and $d$. Let + +$$ +\begin{align} +I_{NPoS}(x) &= \begin{cases} +I_0 + \Big(I_{NPoS}(\chi_{ideal}) - I_0\Big)\frac{x}{\chi_{ideal}} +&\text{for } 0 + + + +Note that the curves shift depending on the value of $\chi_{ideal}$. Alternative parameter configurations are available [here](https://www.desmos.com/calculator/2om7wkewhr). + + + +### Payment details + +Honest validators participate in several protocols, and the system either rewards their successful involvement or penalize their absence—depending on which is easier to detect. From this perspective, rewards are directed specifically toward validators (and their nominators) for *validity checking* and *block production*, as these activities are the most reliably observable. + +In the validity checking branch, the system rewards: + +* A parachain validator for each validity statement it issues for a parachain block. + +In the block production branch, the system rewards: + +* A block producer for producing a non-uncle block on the relay chain +* A block producer for referencing a previously unreferenced uncle block +* The original producer of each referenced uncle block + +These are thus considered payable actions. The protocol defines a point system in which a validator earns a fixed number of points for each payable action executed. At the end of each era, validators receive compensation proportional to the total points they have earned.[^2] + +__Adjustable parameters:__ The proposal outlines the following point system: + +* 20 points for each validity statement issued, +* 20 points for each (non-uncle) block produced, +* 2 points awarded to the block producer for referencing a previously unreferenced uncle, +* 1 point awarded to the original producer of each referenced uncle.[^3] + +In each era $e$, and for each validator $v$, the system maintains a counter $c_v^e$ that tracks the number of points earned by $v$. Let $c^e = +\sum_{\text{validators } v} c_v^e$ be the total number of points earned by all validators in era $e$, and let $P^e_{NPoS}$ denote the target total payout to all validators and their nominators for that era (see the previous section on the inflation model for details on how $P^e_{NPoS}$ is determined). Then, at the end of era $e$, the payout to validator $v$ and their nominators is given by + +$$ +\frac{c_v^e}{c^e} \cdot P^e_{NPoS} +$$ + +The counters can also be used to discourage unresponsiveness: if a validator earns close to zero points from payable actions during an era, or any other defined time period, they may be removed from the active set. See the note on Slashings for further details. + +### Distribution of payment within a validator slot + +In any given era, the stake of a nominator $n$ is typically distributed accross multiple validators, for example, 70% to validator 1, 20% to validator 2, and 10% to validator 3. This distribution is determined automatically by the NPoS validator election mechanism, which runs at the beginning of each era (see the notes on NPoS for further details). + +If there are $m$ validators, the stake distribution partitions the global stake pool into $m$ slots, one per validator. The stake in each validator slot consists of 100% of that validator's stake, along with a fraction (possibly zero) of the stake from each nominator who supported that validator. A validator's stake is sometimes referred to as "self-stake" to distinguish it from the *validator slot's stake*, which is typically much larger. + +The previous subsection describes how payouts are assigned to each validator slot during a given era, while this subsection explains how each slot's payout is further distributed among the validator and their nominators. Ultimately, a nominator's payout for a given era equals the sum of their payouts from all slots in which they hold a stake. + +Since neither nominators nor validators can individually control the stake partitioning into validator slots, which is determined automatically by the validator election mechanism, nor the exact payouts, which depend on global parameters such as the staking rate, participants cannot know in advance the exact reward they will receive during an era. In the future, nominators may be able to specify their desired interest rates. This feature is currently disabled to simplify the optimization problem solved by the validator election mechanism. + +The mechanism utilizes as much of a nominator's available stake as possible. That is, if at least one of their approved validators is elected, their entire available stake will be used. The rationale is that greater stake contributes to stronger security. + +In contrast, validator slots are compensated equally for equal work, and NOT in proportion to their stake levels. If a validator slot A has less stake than validator slot B, the participants in slot A receive higher rewards per staked DOT. This design encourages nominators to adjust their preferences in subsequent eras to support less popular validators, thereby promoting a more balanced stake distribution across validator slots, one of the core objectives of the validator election mechanism (see notes on NPoS for more details). This also increases the likelihood that new validator candidates can be elected, supporting decentralization within systems. + +Within a validator slot, payments are handled as follows: First, validator $v$ receives a "commission fee", an amount entirely set by $v$ and publicly announced prior to the era, before nominators submit their votes. This fee is intended to cover $v$'s operational costs. The remaining payout is then distributed among all participants in the slot, including $v$ and nominators, in proportion to their stake. In other words, validator $v$ is considered as two entities for the purpose of payment: a non-staked entity that receives a fixed commission, and a staked entity treated like any other nominator and rewarded pro rata based on stake. A higher commission fee increases $v$'s total payout while reducing returns for nominators; however, since the fee is announced in advance, nominators tend to support validators with lower fees (assuming other factors are equal). + +Under this scheme, the market regulates itself. A validator candidate who sets a high commission fee risks failling to attract sufficient votes for election, while validators with strong reputations for reliability and performance may justify charging higher fees, an outcome that is considered fair. For nominators, backing less popular or riskier validators may result in higher relative rewards, which aligns with expected risk-reward dynamics. + +:::note Additional notes + +Finality gadget [GRANDPA](https://github.com/w3f/consensus/blob/master/pdf/grandpa.pdf) + +Block production protocol [BABE](Polkadot/protocols/block-production/Babe.md) + +The [NPoS scheme](Polkadot/protocols/NPoS/index.md) for selecting validators +::: + +**For any inquiries or questions, please contact** [Jonas Gehrlein](/team_members/Jonas.md) + + +[^1]: The rewards perceived by block producers from transaction fees (and tips) do not come from minting, but from tx senders. Similarly, the rewards perceived by reporters and fishermen for detecting a misconduct do not come from minting but from the slashed party. This is why these terms do not appear in the formula above. + +[^2]: The exact DOT value of each point is not known in advance, as it depends on the total number of points earned by all validators during that era. This design ensures that the total payout per era aligns with the inflation model defined above, rather than being directly tied to the number of payable actions executed. + +[^3]: Note that what matters here is not the absolute number of points, but rather the point ratios, which determine the relative rewards for each payable action. These point values are parameters subject to adjustment by governance. \ No newline at end of file diff --git a/docs/Polkadot/token-economics/payments-and-inflation.png b/docs/Polkadot/token-economics/payments-and-inflation.png new file mode 100644 index 00000000..d00e36b7 Binary files /dev/null and b/docs/Polkadot/token-economics/payments-and-inflation.png differ diff --git a/docs/Polkadot/token-economics/polkadot-token.png b/docs/Polkadot/token-economics/polkadot-token.png new file mode 100644 index 00000000..e0385118 Binary files /dev/null and b/docs/Polkadot/token-economics/polkadot-token.png differ diff --git a/docs/Polkadot/token-economics/transaction-fees.md b/docs/Polkadot/token-economics/transaction-fees.md new file mode 100644 index 00000000..33b26362 --- /dev/null +++ b/docs/Polkadot/token-economics/transaction-fees.md @@ -0,0 +1,124 @@ +--- +title: Transaction Fees +--- + +## Relay-chain transaction fees and per-block transaction limits + +With a clearer understanding of how payments and inflation occur, the next step is to discuss the desired properties of relay-chain transactions. + + + +1. Each relay-chain block should be processed efficiently, even on less powerful nodes, to prevent delays in block production. +2. The growth rate of the relay-chain state is bounded. 2′. Ideally, the absolute size of the relay-chain state is also bounded. +3. Each block *guarantees availability* for a fixed amount of operational, high-priority transactions, such as misconduct reports. +4. Blocks are typically underfilled, which helps handle sudden spikes in activity and minimize long inclusion times. +5. Fees evolve gradually enough, allowing the cost of a particular transaction to be predicted accurately within a few minutes. +6. For any transaction, its fee must be strictly higher than the reward perceived by the block producer for processing it. Otherwise, the block producer may be incentivized to fill blocks with fake transactions. +7. For any transaction, the processing reward perceived by the block producer should be high enough to incentivize its inclusion, yet low enough to discourage the creation of a fork to capture transactions from a previous block. In practice, this means the marginal reward for including an additional transaction must exceed its marginal processing cost, while the total reward for producing a full block remains only slightly greater than that for an empty block, even when tips are taken into account. + +For now, the focus is on satisfying properties 1 through 6 (excluding 2′), with plans to revisit properties 2′ and 7 in a future update. Further analysis of property 2 is also among upcoming steps. + +The number of transactions processed in a relay-chain block can be regulated in two ways: by imposing resource limits and by adjusting transaction fees. Properties 1 through 3 are satisfied through strict resource limits, while properties 4 through 6 are addressed via fee adjustments. The following subsections present these two techniques in detail. + +### Limits on resource usage + +When processing a transaction, four types of resources may be consumed: length, time, memory, and state. Length refers to the size of the transaction data in bytes within the relay-chain block. Time represents the duration required to import the transaction, including both I/O operations and CPU usage. Memory indicates the amount of memory utilized during transaction execution, while state refers to the increase in on-chain storage due to the transaction. + +Since state storage imposes a permanent cost on the network, unlike the other three resources consumed only once, it makes sense to apply rent or other Runtime mechanisms to better align fees with the true cost of a transaction and help keep the state size bounded. An alternative approach is to regulate state growth via fees rather than enforcing a hard limit. Still, implementing a strict cap remains a sensible safeguard against edge cases where the state might expand uncontrollably. + +**Adjustable parameters.** For now, the following limits on resource usage apply when processing a block. These parameters may be refined through governance based on real-world data or more advanced mechanisms. + +* Length: 5MB +* Time: 2 seconds +* Memory: 10 GB +* State: 1 MB increase + +A transaction consumes varying amounts of the last three resources depending on its length, type, input arguments, and the current state. For simplicity, each transaction type is evaluated in its worst-case state, focusing only on the byte length of its input arguments. This allows transactions to be classified by length, type, and argument size, enabling tests (based on worst-case state assumptions) to assess their typical resource usage. + +In this model, transactions within a block are processed sequentially. To maintain the overall memory bound, it is sufficient that each transaction respects its individual memory limit. This constraint is currently met, though parallel processing may be considered in future developments. + +To further simplify the model, the transaction *weight* serves as a parameter that reflects both time usage and state growth. Specifically, a transaction’s weight is defined as the *max* of its typical time and state usage, each expressed as a fraction of the corresponding block limit. Given a collection of transactions, sum the lengths and weights separately, and include them in the same block only if both constraints are satisfied. This constitutes a strict resource usage limit that must be upheld for every block. + +There is an additional constraint on resource usage—a distinction between 'normal' and 'operational' transactions. The latter category includes high-priority transactions, such as fisherman reports. A group of normal transactions is permitted within a block only if the combined total of their lengths and weights remains below 75% of the respective limits. This ensures that each block reserves at least 25% of resources for operational transactions. + +**Details on establishing typical resource usage for transactions.** Length is easy to determine through inspection. To evaluate time and memory usage, prepare the chain with a worst-case state, a state in which importing the given transaction type demands the highest time and memory. For each transaction type, generate 10,000 transactions with inputs selected to maximize import time under that state, then measure the mean and standard deviation of resource usage in the Wasm environment. If the standard deviation exceeds 10% of the mean, expand the sample size beyond 10,000. Finally, the state increase is estimated by inspecting worst-case scenarios across a large transaction sample. + + +### Setting transaction fees + +The model described above sets the fee for a transaction based on three parameters: transaction type, length, and weight (as defined in the previous subsection). This fee differentiation reflects the varying resource costs associated with each transaction and is designed to incentivize or discourage specific market behaviors. + +A portion of the transaction fee is allocated to the block producer to incentivize inclusion, though not the entire amount. This helps to discourage the inclusion of bogus transactions. The initial proposal assigns 20% of each transaction fee to the block producer, with the remaining 80% directed to the treasury. While burning a portion can help reduce inflation, it is preferable to avoid this in order to maintain better control over the inflation rate. This percentage may be adjusted in the future and could vary depending on the transaction type. In this way, block producers are incentivized to include certain transaction types without needing to adjust the base fee. + +A transaction fee (tx) is computed as follows: + +$$ +fee(tx) = base\_fee + type(tx) \cdot length(tx) + c_{traffic} \cdot weight(tx) +$$ + +Here, $c_{traffic}$ is a transaction-independent parameter that evolves over time according to network traffic. You can find an explanation of this parameter in the following subsection. The parameter $type(tx)$ depends solely on the transaction type; currently, $type(tx)$ is set to zero for operational transactions. + +The term $weight(tx)$ represents the processing cost incurred by the block producer, while the term $type(tx) \cdot length(tx)$ captures the opportunity cost of including one transaction over another within a block. + +### Adjustment of fees over time + +Transaction demand on blockchains is typically irregular. There may be short-term spikes in activity, ranging from hours within a day to days within a month, as well as longer-term trends. To account for these fluctuations, a mechanism automatically adjusts transaction fees over time. According to the law of supply and demand, increasing fees should reduce demand, while decreasing fees should encourage it. + +To manage activity peaks, a trade-off must be made between rapidly raising transaction fees and risking long transaction inclusion times. Two mechanisms help mitigate these effects. The first adjusts fees dynamically in response to short-term fluctuations. The second mechanism adjusts gradually, in line with long-term trends, and incorporates tipping to give users control over waiting times during peak hours. While the slower, tip-enabled approach appears to offer a more balanced solution, both mechanisms warrant close consideration. + +#### 1. Fast adjusting mechanism + +Transaction fees are fixed for all users within each block (tipping is not supported), although fee levels fluctuate significantly over time. Recall that there is a hard limit on the total length and weight of all transactions in a block, along with a secondary hard limit for 'normal' transactions (i.e., non-operational), equal to 75% of the primary block limit. + +**Definition.** A block's saturation level with respect to normal transactions is a fraction $s$ ranging from 0 to 1, that indicates how close the block is to reaching its limit for normal transactions. The saturation level of a block $B$ is defined as: + +$$ +s(B):=\max\{\frac{\sum_{\text{normal } tx \in B} length(tx)}{\text{normal length limit}}, \frac{\sum_{\text{normal } tx \in B} weight(tx)}{\text{normal weight limit}}\} +$$ + +Here, the normal length limit, that is, the block length limit for normal transactions, is set at 75% of the overall length limit. Likewise, the normal weight limit is 75% of the overall weight limit. + +**Adjustable parameter** Let $s^*$ denote the target block saturation level, the intended long-term average for saturation with respect to normal transactions. By proposing $s^*=0.25$, blocks are 25% full on average, allowing the system to handle sudden spikes of up to four times the typical volume of normal transactions. This parameter may be adjusted in response to observed spike behavior relative to average volume. It typically reflects a trade-off between higher average fees and longer transaction inclusion times during periods of elevated activity. + +As previously mentioned, a transaction fee is computed as $fee(tx) = base\_fee + type(tx) \cdot length(tx) + c_{traffic} \cdot weight(tx)$, where $c_{traffic}$ is an transaction-independent parameter. Let $s$ denote the saturation level of the current block. If $s>s^*$, then $c_{traffic}$ is slightly increased; if $s
-Web3 Foundation Research is being done in an in-house [research team](team_members), mostly located in Zug (Switzerland), as well as in collaboration with industrial projects and academic research groups. + -Our research focuses on a number of areas that are relevant to decentralised systems: +Web3 Foundation's research focuses on several areas relevant to decentralized systems, including: (1) networking, (2) cryptoeconomics and game theory, (3) provable security, cryptography, and privacy, (4) behavioral economics and usability, and (5) decentralized algorithms for consensus and optimization. -- (Proveable) Security, Cryptography, and Privacy -- Decentralised Algorithms: Consensus and Optimization -- Cryptoeconomics and Game Theory -- Networking -- Behavioral Economics and Useability +The [research team](team_members) collaborates closely with development groups to ensure its work is practical and impactful for Web3 technologies. One of its key priorities is to analyze existing protocols, design new ones, and provide formal specifications. -We analyze existing protocols, come up with new ones and specify them. We work closely with development teams to make sure our work is practical and useful in context of Web3 technologies. +The core research team is based in Zug, Switzerland, with research efforts carried out in collaboration with both industrial initiatives and academic institutions. Talk to us on Element at #w3f:matrix.org. diff --git a/docs/team_members/Alistair.jpg b/docs/team_members/Alistair.jpg new file mode 100644 index 00000000..bed70000 Binary files /dev/null and b/docs/team_members/Alistair.jpg differ diff --git a/docs/team_members/Andrew.md b/docs/team_members/Andrew.md index 9aec1e9d..797e308b 100644 --- a/docs/team_members/Andrew.md +++ b/docs/team_members/Andrew.md @@ -1,13 +1,14 @@ # Andrew Burger -+ andrew@web3.foundation -Andrew joined Web3 Foundation in August 2023 as a Researcher who assists in implementation of schemes and protocols in the Polkadot-SDK Substrate framework.He gives lectures and works as an educator for the Polkadot Blockchain Academy. Andrews current work has been focused on the implementation and prototyping of the XCMP protocol as well as the latest Threshold Cryptography features of Polkadot. His biggest areas of interest in research are Blockchain Bridging protocols, Threshold Cryptography, Elliptic Curves, and Consensus protocols. +Andrew joined Web3 Foundation as a researcher in August 2023 and has since supported the implementation of schemes and protocols within the Polkadot-SDK Substrate framework. His current work focuses on the development and prototyping of the XCMP protocol, along with the latest threshold cryptography features in Polkadot. Andrew also lectures and serves as an educator at the Polkadot Blockchain Academy. + +**Research Areas.** His main research interests include blockchain bridging protocols, threshold cryptography, elliptic curves, and consensus mechanisms. -**Short Biography**: -Before joining W3F Andrew has worked on W3F grants project Tuxedo as one of the two core designers of the substrate based UTXO framework. As well he attended as a student at the first Polkadot Blockchain Academy at Corpus Christi University of Cambridge. Since he has been a lecturer and content creator at the Academy since. He enjoys time with Family, Friends, Squash and Traveling. Favorite programming language Rust. Least favorite language C++ +**Short Bio.** Before joining W3F, Andrew worked on the W3F Grants project Tuxedo as one of the two core designers of its Substrate-based UTXO framework. He was also a student at the first Polkadot Blockchain Academy, held at Corpus Christi College, University of Cambridge. Since then, he has served as a lecturer and content creator at the Academy. Outside of work, Andrew enjoys spending time with family and friends, playing squash, and traveling. His favorite programming language is Rust; his least favorite is C++. **Related Works** @@ -17,3 +18,5 @@ Before joining W3F Andrew has worked on W3F grants project Tuxedo as one of the * [Lecture UTXO vs Accounts UBA](https://www.youtube.com/watch?v=cI75Je1Nvk8) * [UTXO Tuxedo Framework](https://github.com/Off-Narrative-Labs/Tuxedo) * [PBA content](https://github.com/Polkadot-Blockchain-Academy/pba-content) + +
diff --git a/docs/team_members/Andrew.png b/docs/team_members/Andrew.png new file mode 100644 index 00000000..e2255e74 Binary files /dev/null and b/docs/team_members/Andrew.png differ diff --git a/docs/team_members/Bhargav.md b/docs/team_members/Bhargav.md index 2418358f..0857d4c0 100644 --- a/docs/team_members/Bhargav.md +++ b/docs/team_members/Bhargav.md @@ -2,12 +2,12 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; -
+ bhargav@web3.foundation -**Bio:** I am researcher focussing on security at the Web3 Foundation. I am also the maintainer of the Polkadot Protocol [Specifications](https://spec.polkadot.network/). I have an research background in Formal Verification and previously worked at ETH Zurich, USI Lugano, Microsoft Research, working on topics like Model Checking, Runtime Verification and Static Analysis. At W3F, i have worked on security analysis of Cross-chain Bridges and Light-Clients, and also on tooling for security and reliability of the Polkadot SDK. +Bhargav is a researcher at the Web3 Foundation specializing in security. He has contributed to security analysis of cross-chain bridges and light clients, as well as to tooling that strengthens the security and reliability of the Polkadot SDK. He also maintains the Polkadot Protocol [Specifications](https://spec.polkadot.network/). **Research Areas** @@ -15,6 +15,8 @@ bhargav@web3.foundation * Formal Verification and Static Analysis * Security Tooling +**Short Bio.** Bhargav has a research background in formal verification, with previous experience at ETH Zurich, USI Lugano, and Microsoft Research, where he worked on topics such as model checking, runtime verification, and static analysis. + **Links to selected paper and talks** * [New Paper](https://eprint.iacr.org/2025/057.pdf):Trustless Bridges via Random Sampling Light Clients @@ -22,4 +24,5 @@ bhargav@web3.foundation * Bhargav Nagaraja Bhatt. "Experience Report: Formally Verifying Critical Blockchain Network Component", ETAPS Industry Day, 2024, Luxembourg. * [Automated repair of resource leaks in Android applications](https://www.sciencedirect.com/science/article/pii/S0164121222001273?via%3Dihub), Journal of Systems and Software, 2022. * [Almost event-rate independent monitoring](https://link.springer.com/article/10.1007/s10703-018-00328-3), Formal Methods and System Design, 2022. -* [Formal Methods for Rust](https://polkadot-blockchain-academy.github.io/pba-content/berkeley-2023/syllabus/0-Miscellaneous/1-Formal-Methods/1-intro_formal_methods_slides.html#/), PBA 2023 Berkeley \ No newline at end of file +* [Formal Methods for Rust](https://polkadot-blockchain-academy.github.io/pba-content/berkeley-2023/syllabus/0-Miscellaneous/1-Formal-Methods/1-intro_formal_methods_slides.html#/), PBA 2023 Berkeley +
\ No newline at end of file diff --git a/docs/team_members/Bhargav.png b/docs/team_members/Bhargav.png new file mode 100644 index 00000000..abc76bd9 Binary files /dev/null and b/docs/team_members/Bhargav.png differ diff --git a/docs/team_members/Chen-Da.png b/docs/team_members/Chen-Da.png new file mode 100644 index 00000000..4e97fe4d Binary files /dev/null and b/docs/team_members/Chen-Da.png differ diff --git a/docs/team_members/Elizabeth.png b/docs/team_members/Elizabeth.png new file mode 100644 index 00000000..0ad956e2 Binary files /dev/null and b/docs/team_members/Elizabeth.png differ diff --git a/docs/team_members/Jeffrey.png b/docs/team_members/Jeffrey.png new file mode 100644 index 00000000..49d67ecb Binary files /dev/null and b/docs/team_members/Jeffrey.png differ diff --git a/docs/team_members/Jonas.md b/docs/team_members/Jonas.md index 9d730b21..58c6308d 100644 --- a/docs/team_members/Jonas.md +++ b/docs/team_members/Jonas.md @@ -1,14 +1,16 @@ # Jonas Gehrlein -
+ jonas@web3.foundation PGP Fingerprint: 16C2 2CBD 92E4 E7A1 7D79 D0D0 1F79 CDDC 0A5F FC5B -Jonas has joined the team of the Web3 Foundation at the beginning of July 2020 as a research scientist, where he focuses on economic questions regarding the Polkadot and Kusama ecosystem. In particular, he analyzes and optimizes the interplay between human behavior and the protocol. By doing so, he applied insights from Psychology and Behavioral Economics. For his studies, he uses empirical and experimental data. +Jonas joined the Web3 Foundation as a research scientist in July 2020. His work focuses on economic questions related to the Polkadot and Kusama ecosystem. -**Short Biography**: Before joining W3F, Jonas earned his Ph.D. in Behavioral and Experimental Economics from the University of Bern, where he investigated human behavior in markets and organizations. Before that, he obtained an MSc degree in Quantitative Economics at the University of Konstanz. +**Research Areas.** In particular, Jonas analyzes and optimizes the interplay between human behavior and protocol dynamics, applying insights from psychology and behavioral economics. His research incorporate both empirical and experimental data. + +**Short Bio.** Before joining W3F, Jonas earned a Ph.D. in Behavioral and Experimental Economics from the University of Bern, where he investigated human behavior in markets and organizations. He also holds an MSc in Quantitative Economics from the University of Konstanz. **Polkadot-related Publications** @@ -32,3 +34,4 @@ Jonas has joined the team of the Web3 Foundation at the beginning of July 2020 a * von Bieberstein, Frauke and Crede, Ann-Kathrin and Dietrich, Jan and Gehrlein, Jonas and Neumann, Oliver and Stürmer, Matthias, Otree: Implementing Websockets to Allow for Real-Time Interactions – a Continuous Double Auction Market as First Application (April 29, 2019). Available at SSRN: https://ssrn.com/abstract=3631680. (Working Paper) +
\ No newline at end of file diff --git a/docs/team_members/Jonas.png b/docs/team_members/Jonas.png new file mode 100644 index 00000000..7603230a Binary files /dev/null and b/docs/team_members/Jonas.png differ diff --git a/docs/team_members/ResearchTeam.jpg b/docs/team_members/ResearchTeam.jpg new file mode 100644 index 00000000..4ab01ec5 Binary files /dev/null and b/docs/team_members/ResearchTeam.jpg differ diff --git a/docs/team_members/Sergey.md b/docs/team_members/Sergey.md index 27ebf2ce..ca8b946b 100644 --- a/docs/team_members/Sergey.md +++ b/docs/team_members/Sergey.md @@ -2,8 +2,10 @@ sergey@web3.foundation -Sergey is research engineer at Web3 Foundation working on implementations of cryptographic primitives such as zero-knowledge-proof. He has previously done consulting work. +Sergey is a research engineer at the Web3 Foundation. He works on implementing cryptographic primitives, such as zero-knowledge proofs. -Currently his work focuses on investigating constant-time block production using ring-VRFs and the design for succinct parachains using ZK-rollups. +**Research Areas.** His current work focuses on investigating constant-time block production using ring-VRFs and designing succinct parachains with ZK-rollups. + +**Short Bio**. Sergey has prior experience in consulting. diff --git a/docs/team_members/Syed.png b/docs/team_members/Syed.png new file mode 100644 index 00000000..41b214f6 Binary files /dev/null and b/docs/team_members/Syed.png differ diff --git a/docs/team_members/Web3-Foundation-research-team.jpg b/docs/team_members/Web3-Foundation-research-team.jpg new file mode 100644 index 00000000..bd689deb Binary files /dev/null and b/docs/team_members/Web3-Foundation-research-team.jpg differ diff --git a/docs/team_members/alistair.md b/docs/team_members/alistair.md index 2a0f7633..098809ca 100644 --- a/docs/team_members/alistair.md +++ b/docs/team_members/alistair.md @@ -2,11 +2,11 @@ title: Alistair Stewart --- -
+ alistair@web3.foundation -Alistair is lead researcher at Web3 Foundation mainly working on protocol design. Alistair is the architect behind GRANDPA, Polkadot’s novel finality gadget. Moreover, he has worked on the validator selection scheme NPoS and designed Polkadot’s availability and validity scheme. +Alistair is lead researcher at Web3 Foundation mainly working on protocol design. He is the architect behind GRANDPA, Polkadot’s novel finality gadget. Moreover, he has worked on the validator selection scheme NPoS and designed Polkadot’s availability and validity scheme. **Research Areas** @@ -14,7 +14,7 @@ Alistair is lead researcher at Web3 Foundation mainly working on protocol design * Learning theory * Stochatsic models -**Short Bio**. Alistair has been a postdoc in theoretical Computer Science at University of Southern California working with Professor Ilias Diakonikolas, where he worked in learning theory with breakthrough results in high-dimensional robust statistics. Prior to that, in 2015 he obtained a PhD in Informatics from the University of Edinburgh on infinite-state stochastic models. Alistair holds a masters degree in Informatics from the University of Edinburgh and an undergraduate degree from Oxford University. +**Short Bio.** Alistair has been a postdoc in theoretical Computer Science at University of Southern California working with Professor Ilias Diakonikolas, where he worked in learning theory with breakthrough results in high-dimensional robust statistics. Prior to that, in 2015 he obtained a PhD in Informatics from the University of Edinburgh on infinite-state stochastic models. Alistair holds a masters degree in Informatics from the University of Edinburgh and an undergraduate degree from Oxford University. **Selected Publication** @@ -23,3 +23,5 @@ Alistair is lead researcher at Web3 Foundation mainly working on protocol design * I. Diakonikolas, D. Kane, A. Stewart. "The Fourier Transform of Poisson Multinomial Distributions and its Algorithmic Applications", the 48th Annual ACM Symposium on Theory of Computing (STOC 2016). * K. Etessami, A. Stewart, M. Yannakakis. "Polynomial-time Algorithms for Multi-type Branching Processes and Stochastic Context-Free Grammars", ACM Symposium on Theory of Computing (STOC'12). + +
diff --git a/docs/team_members/chenda.md b/docs/team_members/chenda.md index fb3d2505..3ac25aa7 100644 --- a/docs/team_members/chenda.md +++ b/docs/team_members/chenda.md @@ -1,10 +1,14 @@ # Chen-Da Liu-Zhang + + chenda@web3.foundation -Chen-Da has joined the Web3 Foundation team in July 2023 as a research scientist. His area of expertise encompasses both Cryptography and Distributed Systems, with a broad focus on the theory and practice of multi-party computation, consensus, peer-to-peer network, data availability, provable composable security and many others. His research has led to more than 25 publications at top international venues. +Chen-Da joined the Web3 Foundation as a research scientist in July 2023. His areas of expertise span both cryptography and distributed systems, with a broad focus on theory and practice. + +**Research Areas.** Chen-Da's research areas include multi-party computation, consensus mechanisms, peer-to-peer networking, data availability, provable composable security, and more. His research has resulted in over 25 publications at top international venues. -**Short Bio.** Prior to joining W3F, Chen-Da spent two years as a Post Doctoral Fellow in the Computer Science Department at Carnegie Mellon University (Pennsylvania) and in the Cryptography and Information Security (CIS) Laboratory at NTT Research (California). Chen-Da completed his Ph.D. in the Cryptography and Information Security group at ETH Zurich. Before that, he obtained a master's degree in computer science from ETH Zurich, and two bachelor degrees in computer science and mathematics from Universidad Autónoma Madrid. +**Short Bio.** Prior to joining W3F, Chen-Da spent two years as a postdoctoral fellow in the Computer Science Department at Carnegie Mellon University (Pennsylvania) and at the Cryptography and Information Security (CIS) Laboratory at NTT Research (California). He completed his Ph.D. in the Cryptography and Information Security group at ETH Zurich, where he had previously earned a master’s degree in computer science. He also holds bachelor’s degrees in computer science and mathematics from Universidad Autónoma de Madrid. **Selected Publications** diff --git a/docs/team_members/elizabeth.md b/docs/team_members/elizabeth.md index f8793167..05b1b833 100644 --- a/docs/team_members/elizabeth.md +++ b/docs/team_members/elizabeth.md @@ -5,18 +5,15 @@ title: Elizabeth Crites # Elizabeth C. Crites -
+ elizabeth@web3.foundation -I am a Research Scientist in Cryptography at Web3 Foundation. Currently, my main area of research is threshold cryptography. My contributions in this area include the development of novel multi-signature and threshold signature schemes, such as Sparkle (CRYPTO’23, Best Early Career Paper Award), Snowblind (CRYPTO’23), FROST2 (CRYPTO’22), TSPS (ASIACRYPT'23), and SpeedyMuSig (an optimized version of MuSig2). Multi-party signatures are used in blockchains in myriad ways. They are also the subject of an upcoming call from the U.S. National Institute of Standards and Technology (NIST). I am a team member submitting FROST. +Elizabeth is a research scientist in cryptography at Web3 Foundation. She works on protocol design and provable security for core cryptographic primitives in Polkadot. Currently, her work focuses on verifiable random functions (VRFs) with advanced functionalities, which are implemented in leader election protocols and in the distributed generation of public randomness. -<<<<<<< HEAD -======= -I work on protocol design and provable security for core cryptographic primitives in Polkadot. Currently, my work focuses on verifiable random functions (VRFs) with advanced functionalities, which are implemented in leader election protocols and in the distributed generation of public randomness. +**Research Areas.** Currently, her main area of research is threshold cryptography. Her contributions in this area include the development of novel multi-signature and threshold signature schemes, such as Sparkle (CRYPTO’23, Best Early Career Paper Award), Snowblind (CRYPTO’23), FROST2 (CRYPTO’22), TSPS (ASIACRYPT'23), and SpeedyMuSig (an optimized version of MuSig2). Multi-party signatures are used in blockchains in myriad ways. They are also the subject of an upcoming call from the U.S. National Institute of Standards and Technology (NIST). I am a team member submitting FROST. ->>>>>>> 8ccd6f0b05c514faa2c700fb50a5d1cac078ac2f -**Short Bio.** I hold a PhD in Mathematics from Brown University, a master's degree in Applied Mathematics from Columbia University and a bachelor's degree in Honours Mathematics from The University of Western Ontario. +**Short Bio.** Elizabeth holds a PhD in Mathematics from Brown University, a master's degree in Applied Mathematics from Columbia University, and a bachelor's degree in Honours Mathematics from the University of Western Ontario. **Selected Publications** @@ -28,3 +25,4 @@ I work on protocol design and provable security for core cryptographic primitive * **Better than Advertised Security for Non-Interactive Threshold Signatures**. Mihir Bellare, Elizabeth Crites, Chelsea Komlo, Mary Maller, Stefano Tessaro, and Chenzhi Zhu. CRYPTO 2022. *Security analysis for the FROST and BLS threshold signature schemes.* https://crypto.iacr.org/2022/papers/538806_1_En_18_Chapter_OnlinePDF.pdf +
\ No newline at end of file diff --git a/docs/team_members/index.md b/docs/team_members/index.md index 9e6827a2..e218802f 100644 --- a/docs/team_members/index.md +++ b/docs/team_members/index.md @@ -4,6 +4,8 @@ title: Team Members import DocCardList from '@theme/DocCardList'; -The core Web3 Foundation research team working on various areas relevant to decentralised systems. +Alistair Stewart, Fateme Shirazi, Andrew Burger, Elizabeth Crites, Jeff Burdges, Jonas Gehrlein, Sergey Vasilyev, Syed Hosseini, Chen-Da Liu-Zhang, and Bhargav Nagaraja Bhatt form the Web3 Foundation’s research dream team. They are the driving force behind its research efforts, contributing to a broad spectrum of topics related to decentralized systems. Explore the links provided to learn more about their individual areas of interest and personal journeys. + +
diff --git a/docs/team_members/jeff.md b/docs/team_members/jeff.md index 69e52c57..14bb76aa 100644 --- a/docs/team_members/jeff.md +++ b/docs/team_members/jeff.md @@ -2,15 +2,16 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; - + jeff@web3.foundation -Jeff Burdges is an applied cryptography researcher working with Web3 foundation, where he works on cryptography for decentralized and/or privacy preserving protocols. +Jeff Burdges is an applied cryptography researcher at the Web3 Foundation, where he focuses on cryptographic solutions for decentralized and privacy-preserving protocols. -Jeff's work often involves collaborative randomness, specialized signature schemes like verifiable random functions (VRFs) or anonymous credentials, and increasingly both zero-knowledge proofs and incentives or mechanism design using VRFs. He is also researching a peer-to-peer private messaging service that will use mix networks. +**Research Areas.** Jeff's work includes collaborative randomness, specialized signature schemes such as verifiable random functions (VRFs) or anonymous credentials, as well as increasing exploration into zero-knowledge proofs and incentive or mechanism design using VRFs. He also researches peer-to-peer private messaging systems that utilize mix networks. -Jeff has ocasionally finds vulnerabilities, most recently the BIP32-Ed25519 proposal, but previously in blind signature deployments, and mix network designs, including broad limitations on the post-quantum kety exchanges suitable for mix networks. +Jeff occasionally discovers vulnerabilities, most recently in the BIP32-Ed25519 proposal, and previously in blind signature deployments and mix network designs, including broad limitations in post-quantum key exchanges suitable for mix networks. -**Short Bio**. Jeff previously worked on [Taler](https://taler.net/en/) and [GNUNet](https://gnunet.org/en/) as a postdoc for Christian Grothoff at Inria, Rennes, where he worked on anonymity protocols primarily mix networks, blind signatures, security proofs, distributed authentication, forward-secure ratchets, and pairing-based protocols. Jeff holds a PhD degree in Mathematics from Rutgers University in New Jersey. +**Short Bio.** Jeff previously worked on [Taler](https://taler.net/en/) and [GNUNet](https://gnunet.org/en/) as a postdoctoral researcher under Christian Grothoff at Inria in Rennes, France. His contributions focused on anonymity protocols, including mix networks, blind signatures, security proofs, distributed authentication, forward-secure ratchets, and pairing-based protocols. Jeff holds a Ph.D. in Mathematics from Rutgers University in New Jersey. +
\ No newline at end of file diff --git a/docs/team_members/syed.md b/docs/team_members/syed.md index b5ca27c9..64c50a3f 100644 --- a/docs/team_members/syed.md +++ b/docs/team_members/syed.md @@ -1,7 +1,11 @@ # Syed Hosseini + + syed@web3.foundation -Seyed is a Web3 Foundation researcher writing the Polkadot Runtime Environment (PRE) specification. He is also researching some of PRE’s primitives to see if they can be improved or simplified and helping with the implementation of various Algebraic and cryptographic primitives. +Seyed is a researcher at the Web3 Foundation, where he works on the specification of the Polkadot Runtime Environment (PRE). + +**Research Areas.** Seyed investigates ways to improve or simplify the primitives of the Polkadot Runtime Environment (PRE) and contributes to the implementation of various algebraic and cryptographic components. -**Short Bio**. As a mathematician studying for his PhD, Seyed focused on curve based cryptography, specifically geometric structures that offer richer mathematical properties than elliptic curves. He has studied and designed provably secure messaging protocols. He has been involved in the development of various network protocols, ML-based attack mitigation and analysis and distributed and cooperative network solutions. +**Short Bio**. As a mathematician pursuing his Ph.D., Seyed focused on curve-based cryptography, particularly geometric structures that offer richer mathematical properties than elliptic curves. He studied and designed provably secure messaging protocols and contributed to the development of various machine learning–based attack mitigation and analysis techniques, network protocols, and distributed and cooperative network solutions. \ No newline at end of file diff --git a/docusaurus.config.js b/docusaurus.config.js index e1ac1af6..4325a3c4 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -80,7 +80,7 @@ const config = { items: [ { type: 'doc', - docId: 'Polkadot/overview/index', + docId: 'Polkadot/index', position: 'right', label: 'Polkadot', }, diff --git a/sidebars.js b/sidebars.js index 5e2f6666..624dcde0 100644 --- a/sidebars.js +++ b/sidebars.js @@ -25,14 +25,29 @@ const sidebars = { { type: 'category', label: 'Polkadot', + link: {type:'doc', id:'Polkadot/index'}, collapsed: false, items: [ { type: 'category', - label: 'Overview', - link: {type:'doc', id:'Polkadot/overview/index'}, + label: 'Economics', + link: {type:'doc', id:'Polkadot/economics/index'}, + items: [ + { + type: 'category', + label: 'Token Economics', + link: {type:'doc', id:'Polkadot/token-economics/index'}, items: [ - 'Polkadot/overview/token-economics', + 'Polkadot/token-economics/payments-and-inflation', + 'Polkadot/token-economics/transaction-fees', + 'Polkadot/token-economics/Treasury', + 'Polkadot/economics/utilitytokendesign', + ], + }, + 'Polkadot/economics/validator-selection', + 'Polkadot/economics/parachain-theory', + 'Polkadot/economics/parachain-experiment', + 'Polkadot/economics/gamification', ], }, { @@ -57,11 +72,9 @@ const sidebars = { items: [ 'Polkadot/protocols/block-production/Babe', 'Polkadot/protocols/block-production/SASSAFRAS', - ], - }, - { + { type: 'category', - label: 'Sassafras', + label: 'Understanding Sassafras', description: 'Understanding Sassafras', link: {type:'doc', id:'Polkadot/protocols/Sassafras/index'}, items: [ @@ -70,22 +83,13 @@ const sidebars = { 'Polkadot/protocols/Sassafras/Sassafras-part-3', ], }, + ], + }, + 'Polkadot/protocols/finality', 'Polkadot/protocols/LightClientsBridges', ], }, - { - type: 'category', - label: 'Economics', - link: {type:'doc', id:'Polkadot/economics/index'}, - items: [ - 'Polkadot/economics/validator-selection', - 'Polkadot/economics/parachain-theory', - 'Polkadot/economics/parachain-experiment', - 'Polkadot/economics/gamification', - 'Polkadot/economics/utilitytokendesign', - ], - }, { type: 'category', label: 'Security', @@ -106,6 +110,7 @@ const sidebars = { { type: 'category', label: 'Slashing', + link: {type:'doc', id:'Polkadot/security/slashing/index'}, items: [ 'Polkadot/security/slashing/amounts', 'Polkadot/security/slashing/npos', @@ -135,6 +140,10 @@ const sidebars = { type: 'doc', id: 'Publications', }, + { + type: 'doc', + id: 'Events', + }, ], };