Analyzing The Security Of Casper by Ryuya Nakamura (Devcon5)

Andrea from Leia x-ray X is a Brockton startup based on Tokyo and working on Casper research and its positive power its own Foundation grant so today I will talk about my research on the security of Casper so you know Casper what consensus protocol has two property safety and aliveness so the talk is divided into two parts and safety part and the Lebanese border so first I want to introduce Casper is not that different from traditional protocols and Casper FFG and the shippi she is not that different also so first pbft tender mint and Casper Fuji and Shiva are all categorized into a synchronous resaved consensus protocol so I mean safety does not require any timing assumptions so basically in these protocols minority comes when sufficient number of our data's is locked on a block so let's start with his tender meat so in tandem int a Brock is called notarized when to F plus one birthday that is brought on the block so here F is with an chain for treasure and the Brock is finalized when it's directed child Brock is notarized and then when birth data its bottle for notarized block that VAR data is locked on a Brock so he cannot vote for a conflicting Brock so in this case the past Brock is finalized and here the boards must be collected in own chain this is very important point so here the reason why we can say the post Brock is finalized is we know that these validated vote for the second Brock knows we know that this value tie is locked because we know that the posts are on chain right this is why on sham voting is very important for this bro what it's protocols the reason why minority comes around only when it's direct Brock it's it's notarized there might be some another drop in the middle and you know we discussed locking is necessary for safety but you know if locking is too much too much strong does not create some liveness property so here we have some unlocking condition so in tandem ain't a validator locked on the brock is unlocked when he see a higher notarized Brock so in his picture I was taught to but I'm unlocked because I see that new notarized abroad clear so let's start with the next is Casper a refugee the cash point of G is fundamentally similar to tandem it but it's more like chain based leader s tandem it so in Casper refugee we don't use not finalized block we finalize checkpoints so in this picture we have Brock chained but we finalized on say every 50 blocks or every fifty strötzbach right so yeah and again foods a steer on chain the difference between tandem it is the fork choice itself is doing the similar role of leader so in tandem ain't everybody that bought for Brock which decided to buy the leader of that round but in class by 50 G it's a folk choice that decides of you and unlocking and locking it's super similar to tender meat so in every case they are unlocked when they see higher notarized what just justify the checkpoint so finally she Misha Casper is also locking abased consider protocol but the log king and the unlocking is purely by the fortress itself so in shabby chic as per every message boats rock must follow the folk choice and in tandem int or FFG we included supports on chain but in Shiva she weeken the same thing but more for x-ray we can allow the message to point to the every all front boats were broke so in this picture the block P is pointing to open block but the reason is um okay so yeah additional explanation so in this case this proc is invalid because they know that the different chain is more heavier so this is inverted and unlocking condition it's super obstructed into equivocation condition that every vote must include is the previous message in its message so in this picture this block is invalid because he has previous message here but is not including on chain in message so the similarity of she be she and FFG is that the boss is chain based so every vote Brock is voting was supporting for the same ancestor right so in FFG what 2.0 they include all from boats in own shame because they are supporting for the same checkpoints this is also same force revision Kasper but it's more flexible way so exact finality condition is something like I do not do not talk in this talk but we finally finished our formal education in elaboration it more than half a year but you know it's great job I think so yeah pretty much summary is ten demand cashback refugee and ceviche is based basically based on some locking idea and you know the difference comes from where the locking is based on the notarized checkpoint of rock or folk choice itself so to me I want to move to ravenous but ravenous has a lot of design strategies so I do not cannot talk in this 20 minutes so today I want to focus on 2.0 ravenous so basically in 2.0 Lebanon strategy is super simple it's just a remedy ghost press just by refugee so remedy ghost is a variant of ghost in which where the latest message is only counted so in this picture the traditional longest chain rule this chain that is ahead in normal ghost this chain is head-butting aromatic ghost we only count the latest message so the the third chain is ahead so to talk about the liveness based on our MD goals we need to define when the chain converges and in a remedy ghost a block is not opened when the chain is supported by modern majority of honest supports so in this example say says 100 total bar details and the brew chain is supported by more than 51 votes in this case whatever the what I do the top chain does not orbit reorganised so this is a convergence condition of aromatic ghost but it cannot be observed by you know protocol boring part data's this is why we want Casper to detect finality but for revenue analysis this is the convergence condition yeah so before I introduce attack on elementary ghosts I want to introduce some very nice property on folk trees so in basically in any constant protocol we want some property called fairness so I mean any player cannot increase the power against the stake or hash power but the something break this property called saving strategy so the bursary can skip their votes and the later use their votes to free prop this not work in the longest chain because so say we divided into climbing the slots six-second the ten seconds and every three block were vote is but otherwise for the battery and in this case adversary with horde was save every block but in longest chain we can add some validity conditions that every block wall vote cannot extend the future rock so here after some network failure they cannot use the save the board to prevent the revenues here but in ghost every vote does not expired so here there is a huge to fog from rock from early days and but you can use the save save the bro save the boat in ghost using ghost the fog choice is based on every per student election on each height so every word has not expired so this turns into creating a new attack on a remedy ghost which I call decoy flip flop attack so basically what I want to do is to flip every roads into another chain and go back to another chain and continue the friends the big difference in normal ghosts and error Emily ghost is the flip of volts decreases the score in longest chain what normal ghost some squirrel chain monotonically increasing and every Raven is proof is based on that property but in a remedy ghost you cannot have that property this is the situation I have so imagine that to chain that chain brew chain and we continuously flip-flop just before the chain converges and the desert is the necessary saving which that the battery needs to prepare exponential disgraces against the adversary power and for some parameter 33% attacker can prevent ripeness for 100 epic it's like a few hours or 10 hours by 5 epochs of savings now for more big adversary it takes much longer to the chain for the chain wineries yeah small might occasion of this attack is FMOD ghost it's a variant of a remedy ghost to mitigating saving strategy so in aromatic ghost we count every vote every old abroad if it is greatest but in affinity ghost we only count a vote from the current epoch was a previous block someone say that it's kind of introduce a new synchronous function on consensus but it's not that true because in 2.0 case the effigy is decoupled from the chain so the synchronous sumption does not change but here still the coil flip-flop is possible because we can have one epoch of savings so this starts a pretty much a new question that why a remedy goes in the first place compared to non aromatic parental ghosts especially there's no sheepish Casper in 2.

0 for now so it's a bit easy to manipulate the factories the another interesting topic which I don't cannot talk today is flip-flopping a remedy ghost in sheepish Casper it was in sheepish Casper every message is imposed to follow the folk choice so the analysis gets a bit complicated but basically it's mighty gated free flow of strategy so a bit not incentives so you might say savings can be detected and rushed but basically to punish driving this failure is as I explained in the bicep italic in this morning is defined a difficult to distinguish between no malicious failure because it just might honest no just get down so in 2.0 has some incentive mechanism to punish driving this failure called in activity link but it's just kind mild punishment so the current parameterization with develop robotic 33% attacker attacker can prevent finality for a few days with 1% cost of the stake and you know ravenous attack sometimes has a lot of the world because there's a layer two solutions in which they had some challenge period and if they can not if they can sense a shape on the fraud proof in plasma and writing otherwise so you can get a bunch of money from the layer two construction so I think it's a new question to how to nourish this incentive compatibility enlivens failure so I think I have a time so I quickly introduced some attack on class by refugee which is funded by last year so in FFG so originally effigy removing the leader in kinds of bad way because so these squares are not rocks it's checkpoints and remember that unlocking lure in Casper effigy is observation of high year notarized checkpoint and so in this case imagine that 104 letters and this checkpoint it's close to two swords that is not notarized yet but the bursary can justify this checkpoint arbitrary any time so in this situation the folk choice favors this side of a chain so creating a new checkpoint which is close to the notarization but exactly the same that at the time at the grocery flip the head of the folk choice that in that way and in high synchrony Network other words so you can continue this attack whoever so why this does not happen in tandem and it's simply because leader decides the view of the current around so what we should do is to have some sort of thickness property in effigy so there's a lot of construction to prevent this attack it's one idea is to not allow the change was a view in the middle of the epoch for example we do not allow any new justified checkpoint if it's in the middle of the epoch yes I think it's finish thank you