Desired properties of ideal PoS economics | Vitalik | ETHTaipei 2024

so um oh there there we go okay so great some desired properties for longer term ethereum staking here we go um so first of all Let's uh you know talk about some successes of ethereum staking over the last one and a half years right so first the merge it happened yeah so uh so who here remembers when the merge was never going to happen Okay um so GL glad to hear you or you all believe the whole time that's uh you know really amazing um over one quarter of um all e approximately is participating or roughly a quarter at this point um so I think it's like yeah we're like basically about about 900 something thousand validators at this point um one and a half years of stable operation the closest instability that we've had is we had an hourong period of blocks not finalized um but even when the blocks were not finalizing blocks were still being created the chain was still progressing the chain basically had exactly the same properties in terms of safety and fality that it did a year before when we were still on proof of work um so actually from a users's point perspective ethereum has been extremely smooth since the merge so I think big success from a technical perspective and just all of the amazing execution and consensus Cent teams that have worked hard to make this happen really big shout out to them uh so a lot of success on the technical side so what are the challenges with ethereum proof of stake design I think uh the main challenge that people are worried about right now is centralization risks right and in the road map diagram that I put out a few months ago that like you know there's a section called The Scourge which is basically about you know Central and Ecom risks that ethereum has to solve longm as you know developers and researchers and the ethereum ecosystem see them and basically yeah you know I had taking I had centralization risks in two categories one of them is specific to this concept of me um which uh you know it could stand for minor extractable value now it stands for money extracted by validators uh but like the basic idea is that it's a revenue that you can get by being a validator that is dependent on you running sophisticated algorithms as opposed to just like you running software out of the box right and so particularly things like reordering transactions being able to sneak in your own transactions at the very beginning of a block uh potentially you know Arbitrage all of the onchain exchanges collect bounties for liquidations collect bounties for fraud proofs whatever whatever there's a long list list but the point is that there's like this collection of things where opportunities to collect money by being the proposer of of the next block and having that special rights to choose basically the first few transactions um and uh it requires sophisticated software and algorithms that are being constantly updated possibly even private information to properly take advantage of those opportunities this is a centralization risk for the last few years there has been this big me movement that has been organized around the basically different versions of the theme of proposer Builder separation so basically the idea that the actor that is formally responsible for proposing a block and so whichever validator gets chosen for that slot can be separated from the actor that is responsible for doing all the sophisticated optimization stuff and you basically allow one to Outsource to the other by creating an onchain open market right and so the idea is basically you split the market up into these two parts where one part is responsible for doing the sophisticated stuff the other Market is not responsible for doing any of the sophisticated stuff and then you just have like an open um Market between the two um so that one F can just contract out to the other and from the proposer perspective it just the optimal algorithm for them to run continues to be simple it's just take the highest bit um now this is I think only partially successful so far um so we have seen first of all centralization in Block Builders we've also seen um centralization in relays which are these intermediary actors that work between proposers and Builders and ensure that neither of them is cheating the other um also another failure is just the fact that these trusted intermediaries um as reays need to exist right so as a proposer you have to choose a list of trusted relays so that choosing already means that you have to have some level of sophistication that's not just following the protocol rules so this is also a problem now these are all M related issues right staking in general um so staking pools in general are a centralization vector and liquid staking tokens are also in particular centralization Vector it is important to not over catastrophize these issues right because I mean first of all on this chart here Lio is 30.6% but Lio is not a monolithic um company there are I think about 31 uh validators internally that they're switching that they're dividing stake between and it is an onchain down um but at the same time you know it does have a governance token and so like in terms of how you evaluate this it's like somewhere in between one actor and 31 actors you know depending on how what your personal views of the thing are right but that's already a problem right because you know the point of the whole trustless concept is that we should not have to of look in the internals of big actors and figure out if they're good guys or not but you know even still right and then another um thing to keep in mind of course is that proof of work was not better right um so back in the dark old you know proof of work era there the chart basically looked like this or even worse than this right actually this chart is a bit misleading like basically this GR should be all the way over here and it probably should be in like some kind of dotted color right because like that gray it's unidentified right so who here is staking with the unidentified Corporation okay good um I am too right so you know who here has met the CEO of the unidentified Corporation see unidentified it's it's the new Anonymous we are all unidentified so the um basically know the top two here 30.6% then 14.1% then smaller ones back in the proof of work era basically the top two already added up to like about 48% and then top three added up to about 60% so you know it was not better um but even still right this is a problem and I know also liquid staking tokens are increasingly a challenge because there is a demand for people to stake and then at the same time use their Stak eth in other appc and there's risk associated with that so let's talk about some of those risks right so there first of all the risk of relay and Builder censorship right so relays can censor um Builders can also censor um then there is the risk of 51% of tax if some actor gets 51% of all stake then they can revert uh transactions and they can also censor individual transactions in a much more robust way right if you're relying on like or if all that's happening is relays and Builders are censoring in their capacity as proposers it's like actually not that bad right because even if 90% of them sensor you just like as a transaction sender you just have to wait 10 slots instead of one and you get included by someone who is not censoring you um but if there's a 51% attack then they can actually reorg away anyone who is trying to include your transactions and so this gets very bad and this basically requires a CommunityWide Fork to fix um risk of milder forms of coercion right so you might ask well is it the whole point of proof of stake economics that attacking is expensive right you know if you revert you get slashed if you stake then the community can do a soft fork and that only contains the the non censoring actors and you get inactivity leaked attacking cost millions of eth and so like shouldn't we just be not worrying and I think a big part of the answer why is basically these Wilder forms of coercion right if you imagine one dominant actor that can draws like 73% of ethereum staking then like they could do things like push for or push against protocol changes they could potentially do soft forms of censorship right like you could imagine them Just DE deniably delaying transactions that they that are not approved by them by like one two or three swats and then maybe it never gets serious enough for the community to feel comfortable coordinating a fork but even still they end up just like conting the market in favor of some proprietary solution more and more all kinds of bad things could happen um rent seeking so if some specific version of Stak e becomes the dominant ethereum wide vertical asset instead of e then that asset gets the liquidity Network effects and that asset gets some level of lock in and whatever the you know token holders ownership structure whatever of that asset is like that's basically rent that's being extracted out of the ethereum ecos system and of course just like loss of perceived credible neutrality of the ethereum protocol right and you know this is key because this is like the key thing that ethereum has right there's lots of replicated State machines out there but you know there's only one ethereum so what might we want out of a better design I think this is a really key question right basically a lot of this discussion has prompted interest in doing a bunch of changes to the ethereum staking economics with a an intention of making something that actually lasts and making that something that actually works and actually is realistic given what we've seen out of staking economics and the way that it's played out in real life so me related issues right so one um thing that we can do is we can Maxim con strain the actors that have stronger um stronger centralizing Tendencies right uh basically no so we talked earlier about how the whole point of proposer Builder separation is you split up the market into proposers which are just validators that are supposed to be very decentralized and Builders where they're doing this very economies of scale dependent stuff that is inherently more centralizing but as we've seen there's lots of centralization in the Builder space there's an increasing number of builders that are censoring transactions um some relays are as well and know this is a problem right so one thing that um the I think ethereum researchers I think both in the ethereum foundation team and outside of it are increasingly um rallying around is this concept of inclusion lists right which are basically lists of transactions that get chosen by the proposer of a block um so the proposer meaning just a regular ethereum Staker choosing them directly and choosing them using a very naive algorithm that is basically just look at the meol and identify things that is and uh the include basically include them in a structure where the next block or some very near future block is like actually required to include those transactions right um so the mindset in inclusionist theory 3 years ago was basically that like inclusionist are this extra thing that's there to provide censorship resistance in emergency right like they were called CR lists three years ago right the idea was that there this like extra emergency functionality where just in case builders start doing bad stuff um you know people have this like extra Channel and like it's fine if that extra channel is inconvenient it's fine if that extra channel is five times more expensive it's fine if that that channel requires you to pay a bunch of L1 gas even for L2 things and uh you know the point is just to kind of protect people from being completely screwed in these exceptional situations I think uh one thing that could be really interesting to look at is the Bas basically have this like big mindset shift in how we approach inclusion lists right which is instead of thinking of an inclusion list as being a censorship resistance appendage we think of an inclusion list as being the block right an inclusion list is a block like you're basically including a whole bunch of transactions and the part that the Builder is responsible for is just the prefix so they get to include some transactions at the front to collect some plus the state root they have to compute a state root and then plus aggregation functions right so that includes um you know potentially Computing Computing a ZK Stark of the block it includes potentially ERC 4337 related aggregations combining together signatures it might include combining together proofs of proofs of different layer tws it's like a whole bunch of these cryptographic operations that are expensive to do but once one actor does them they're easy to verify right so basically the Builder is just responsible for the prefix and all the heavy stuff and choosing transactions like which basically just means choosing What Choosing what goes in the block can be done by the proposer right so with this uh this kind of approach like basically the the Builder actually does become this much more limited actor and even if the Builder Market neiz much more the amount of har that they can do actually actually becomes much lower right so this is this is one possible approach right like basically keep making inclusion list more and more powerful and like really fight to make sure that if a block gets in an inclusion list or if a transaction gets an Equis list it like actually gets executed within the next one or two slots maximally within the next one finally execution tickets so execution tickets are the latest idea in proposer Builder separation the basic idea here is that instead of just auctioning off the right to choose the block contents to a builder and making that auction in real time you do an auction ahead of time and you auction off just the entire right to create the slot so what happens if you do this right if you do this then the basically what you you end up simplifying a lot of the mechanism around PBS um you end up simplifying a lot a lot of the auction mechanics you end up simplifying a lot of the timing gains games and centralization risk and like you're basically saying even if it turns out to be unavoidable that this functionality of I know being the last actor that actually you know chooses comp complex stuff and includes complex stuff is unavoidable that's like fine you just have a different kind of proposer except that this different kind of proposer will be sophisticated actors and you so and then at the same time you you have two kind ofs you have executions which do this and you'd have consensus swats that are responsible for including consensus operations and those continue to be decentralized so this is one category of solutions right now let's talk about the other thing let's talk about staking so why are there not more solo stakers today this is um a bunch of uh a couple of foraster polls that I took a couple of weeks ago um i' actually actually want to repeat these polls here um so what is so the big question is what is currently stopping you from solo staking so who currently is a solo Staker okay if you are not a solo Staker who here is not solo staking because the technical requirements of maintaining a node are just too high and too complicated for whom is that their primary reason for whom is the who here is not solar staking because they don't have the 32 e okay who here is not solo staking because they really care about being able to take their e out instantly instead of waiting like a couple of days okay who here is not solo staking because they're just afraid of of putting their private keys on a hot box where it might be stolen more easily okay who here is not solo staking uh because they want to depit their eth and use it in other protocols okay see so a lot of different reasons here right but I think you know the big one that dominates is that people have less than 32 eth actually it's like the exact same three over here right I think number one was that people have less than 32 e number two is they're running a validator notice to high and then number three is in this case number three in that case it was number two is basically that like you know you want um liquidity right so basically know we fundamentally have to approach some of these issues head on right so first of all Let's uh talk about the 32 e thing right the 32 e thing was originally a compromise between avoiding two kinds of centralization one kind of centralization is avoiding centralization from having too many signatures on chain right if you have too many signatures in every slot on chain then like blocks become super big and like you're going to a crazy data server just to run a node the other kind of centralization to avoid is centralization that consists of solo staking requirements being too high right like being say 5,000 eth instead of 32 now a big unspoken assumption here is that the every participant needs to S needs to make one signature that happen that in every single round of consensus right so today we have epochs one Epoch is 32 swats um and the idea is that like basically there was this kind of three-way compromise that was done between not making a node load too high not making the E requirement too high and not making consensus take too long and we sacrificed on all three dimensions right and on the third dimension we basically said well okay fine we're going to have slots we're going to have Epoch and Epoch is 32 swats on average to finalize for your block to finalize you have to wait like basically 2 and a half Epoch 80 SLS 960 seconds who here has ever cared about waiting for 960 seconds for a block to be finalized before accepting a transaction who here has ever seen someone else care about that regarding their transaction okay so some right but like realistically not too many and I think the reason is just like practically speaking like 15 minutes just is quite a long time right so my view actually is that there's basically two time like two kinds of finality durations that make any sense at all one of them is less than 10 seconds like basically being competitive with credit card tap to pay and then the other one is like 6 hours and the reason why 6 hours is okay is because then what your finality level is also able to cover the possibility of bugs because 6 hours is a long enough time for cord developers to to to step in and make a big stink um so like either one of those finality times make sense but like 15 minutes really doesn't make much sense right um there's like even lots of exchanges that just like wait you know like 10 confirmations or whatever right so here's the uh the mentality right so I've been for a long time pushing for single SW finality right like basically just pushing the equilibrium towards saying okay fine you know we're going to actually finalize every 6 seconds right or 12 seconds but in order for that to happen we have to move away from this idea that every single participant needs to sign in every single right like that just is a requ requirements that we have to give up on now why is that requirement in there because we want to have this requirement that if a block gets reverted then a huge number of people can be slashed right and so the challenge is well maybe we can achieve that that goal in other ways so in addition to this other problems even if solo staking becomes maximally easy so e requirements go down and Tech requirements go down to the lowest possible because we have Merk trees and because we have ZK snarks even still lots of people are not going toist um lstd is they solve demand for this like reusable liquidity goal that a lot of people have also another thing is that like we're already relying on like social pressure and virtue and things other than economic incentives to solve our problems even as they exist today right so you know we've done a lot of yelling at people to not all uh jump into Lio we've done a lot of uh yelling at people to use different clients we've you know there's a lot of people voluntarily doing those things because it's good for the security of the network but it's like it's not healthy to over index on those things right and at the same time it's also something where to the extent that those things are unavoidable it's better to kind of rely on them explicitly and like be very clear that like this is where you're relying on them and this is where you're not as opposed to having this offc thing where you claim to rely on incentives but like actually you know you're totally not and you and you need to do these extra things on top so some challeng so one solution that has been proposed is making liquidity reusable by capping penalties right maximum penalty if you get slashed one8 um basically the idea here is that if penalties are capped to 1/8 then 78 of all stake is reusable and you can use it in like Ry for example right like stable coin protocols defi protocols whatever else um and this also allows for the creation of a kind of neutral Universal liquid staking token so this is interesting but there's this interesting economic argument and like I have a post on this and I think some other people have have talked about this as well basically the argument is that like actually if you do this then you're Bas what's going to happen is that the 78 portion that is not penalized is just going to get turned into a totally liquid to and then people are going to use that token and they're going to know re hypothecate it and like convert like basically borrow e against it and then St the eth again and it actually ends up being economically equivalent to a world where you just massively reduce staking rewards right like you can basically go kind of play bypl you know explore what the equilibrium is and the equilibrium of this kind of cap penalty approach ends up being very similar to an equilibrium where staking yields are reduced still like half a per for example right and so the question then is like well why not just reduce Ys to half a per and just make staking a much more explicitly alistic thing um so one idea that one of our researchers barab has come up with is this concept of rainbow staking right basically the idea here is you like explicitly split up into two kinds of staking and you call it heavy staking and light staking heavy staking is Slash and signs in every slot right so if if you're a heavy Staker and you get sign in every slot and you drop out or you censor or um you revert a finalized block you actually get slashed and if you're a light Staker then basically you only get like called up to sign once in a while like it's a lottery based system you know similar to other forms of non-f finalizing proof of stake and you whatever you do is not slash right and there's different ways of doing this like you could have you could have like two explicit light and heavy staking pools you could also have a system where as in East provider you're just required so like heavy steak 1 E of your eth and light steak the other 78 of your eth there's lots of different ways to do this right and then the idea is we basically try to kind of explicitly separate out those two and potentially require both heavy stakers and and light stakers to sign off on a block in order for the block to get finalized right so you try to add the security of both of those approaches together so this concept of like explicitly introducing unsl slash staking I think is interesting right because uh there are a lot of blockchains that do use unlash staking and proponents of these blockchains often you know say things like you know oh you know if you don't have slashing then basically you know your staked assets continue to become liquid anyone can stake though like there a lot of centralization pressures end up disappearing and like actually you know what you gain by ecomic finality might be you know they say is less than what you lose by um like the financial centralization and that comes with the slash approach right and so the the idea here is basically well let's like have both right let's like explicitly have a heavy pool and a light pool and require both of them to sign off on a block so realistically if you do light slash like if you do light staking a lot of people are going to delegate right and if you delegate then a big question is who do you delegate to right and is this a responsibility for decentralized tools might this be a responsibility for Solo stakers solo stakers could have public reputations people could delegates individual solo stakers people could even automatically delegate to an ment out of some set of solar stakers you know we can do a lot of things like that with cryptography so this is a set of questions right so where to go from here right I think uh I feel like on the me side the longer term future feels like it's a lot clearer than the future on the staking side but it's a you know I think it's good that we have already have a clear picture of one half of the problem but I think here we really need to move toward having a clear picture on the second half of the problem and to me the biggest questions here are not really technical they're even more philosophical right so there are short-term discussions like there have been discussions on E research and other forums of like you know should we try to do a change in staking rewards in like you know Petra or whatever for soon to try to prevent you know excessive staking to try to prevent Stak from going up to 100 million or whatever right and like that's a discussion people submit pros and cons but like anything we do like that is fundamentally short term right long term the key question is basically like there are clearly people who have eth who have lots of e and who are lazy and who want Returns what is the approach for them to participate whatt that we that this areed good e if we don't give a realistic answer then they're just going to like dump all their money into a centralized thing right and so I think the big philosophical question is basically you know what is the intended answer right like what is the strategy that we intend people who are in this category to take in order to participate in the ethereum staking ecosystem and if we have a good answer to this then I think it should be possible to build a very secure like very robust staking economic design around it but I think you know ultimately anything we do is going to be a temporary and short-term thing unless and like and until we get to the point where like we actually have an answer to this key question that people broadly across the ecosystem are right so this is uh yeah the state of uh if the I'm staking as as it is now and it's you know an open Development Area it's an open research area a lot of good discussions happening on ether research a lot of good discussions happening on various e Saker forums and you know I highly encourage more people across the ethereum community to become actively involved in this [Applause] conversation okay