The Limits of Cryptoeconomics - Phil Daian

so today we are going to talk about the limits of crypto economics and how to build anti-fragile med-based systems uh next slide um all right so kind of a brief intro of this talk uh this is not going to be kind of my usual like very kind of in-depth uh researchy deep dive instead i kind of want to be a little bit more provocative for this event because we have a lot of panels and a lot of discussions i think we have a real chance to kind of influence the future of how we build systems and marketplaces for mev extraction so this morning i was driving to kind of a piece of land i'm trying to build a home on to fight with the government over permits here's a picture of me and my truck and honestly i had no idea what i was going to talk about in this talk beyond like some vague stuff about sgx and the title uh so that's kind of the backstory hope you're not expecting too much but uh you know please be be prepared to kind of open your mind and challenge your preconceptions and have some discussion because that's what i would really love to happen uh next slide great um so first things first uh because this is going to be kind of a very specific talk i'm specifically going to be talking about uh sgx and crypto economics and the interplay between the two uh and kind of the synergy between the two um if you want a more general talk if you want a more high level talk about what we do about med in general and you haven't attended scaling ethereum specifically the mev rose session that happened last may may 6th i highly recommend you just pause this talk and spend the rest of my time here watching uh mev what do talk which is much more kind of prescriptive and higher level here we're kind of going to focus on a more specific question assuming mev is present and assuming that it can't be reduced to zero uh how can we build the best systems and the best marketplaces around it um so what's the problem so the first thing is that we want to avoid the centralization of mev at flash pots uh we want to avoid a case where miners and exchanges and large validators are kind of centralizing mev to themselves and we feel that the only way to do this is through a fair real-time marketplace what do we mean by fare well we consider a few different properties kind of key to keeping mev decentralized lowering barriers to entry and making sure that anyone can kind of engage in the muv ecosystem to get data to run bots to participate or to see what's going on if they're an app developer or user so in order to have such a marketplace here's a few of the properties that we kind of think are fundamental one of them is pre-trade privacy so the idea that as a bot or a submitter to this marketplace your trade stays private until it's unrevertable by miners uh this is to stop things like payment for order flow of the bundles um otherwise we kind of enter a very wall street style uh hierarchical situation we also need spam resistance this is to prevent miners from getting dos and taken off the network which would threaten overall system stability and we also want to maintain the stability of the overall protocol as well as alignment with the incentives of all its actors so where do we stand today flashbot's alpha has two properties which are currently pretty sub-optimal the first one is that pre-trade privacy relies on trust in both miners and flash mobs so both of these entities right now in the alpha are able to kind of see bundle flow and uh and and front run it mess with it and otherwise manipulate it um so we do kind of actively monitor for behavior like this in the ecosystem uh and we do stay on top of um sorry for the motorcycle we do stay on top of this kind of thing um however that's a lot of trust in us as a centralized entity and we don't think that's a long-term solution also spam resistance uh currently relies on trust in flashbacks so miners have to trust that flashbots won't spam them dealers their endpoints or otherwise expose sensitive infrastructure which is sub-optimal for miners as well uh next slide great so how do we upgrade this how do we get out of this world into a better world so to move forward the first thing we have to do is remove all these elements of miners and flashbots trust in the system so it's obvious that we need decentralized and secure spam resistance and privacy um but what is good enough decentralization uh for us and what is good enough fairness well there are a few properties that are that are obviously additional on top of this that we also need to be suitable for use in eth and in a kind of financial context the first one is that the the the marketplace has to be robust to system shocks what do we mean by this we mean things like large price events uh attacks on the network uh downtime of large validators and other kind of unexpected events in the system and in the world also if we're not building a system that's robust to system shock system shots are going to pose a massive vulnerability and we want it to be robust from miners bots and users so we don't want system shocks to advantage any of these one parties over the other we also want a system that's suitable for byzantine operation up to thresholds so up to a certain percentage of the actors in the system can be blatantly malicious without the system falling over as high of a threshold as we can achieve and we also want a system that's suitable for rational operation up to a higher threshold so we don't want the rational action to be attacking uh the system up to a pretty high threshold of hash power and validation to achieve our kind of goals of decentralization great so how do we get there next slide um so again to get there our task is to remove all elements of miner and flashbots trust in the system otherwise i would personally consider that flashbots in mev has failed why has why is that why is this such a failure point well if we're not robust to system shocks we risk a trust collapse or a spiral and that could erode trust in all blockchains and all the financial ecosystems we're building there's also a cat and mouse game so a lot of the attacks on bundle flow or payment for order flow may not be visible you may not be able to tell if a miner's front running bundles to insert their own transactions if they don't directly alter bundles and there's a wide class of behavior in the system that's not detectable or falsifiable or policeable and that creates a cat and mouse game where flash boss has to constantly monitor and try to stay a step ahead of people who are trying to kind of uh take personally advantaged actions in this marketplace providing kind of a constant need for data and policing also it creates major centralization in the east stack so uh uh we don't want a case where we're actually responsible for kind of policing all these functions because that puts us in a centralized position and it makes us a kind of risk and a point of failure for all of ethereum which would be absolutely terrible um we also uh we also don't want vampire tokens so what do i mean by this well there's a risk that in a in a world of centralized mev you'll get tokens that that come up that kind of claim to handle mev that are not actually aligned with ethereum itself and with the broader ecosystem which is also a major centralization risk all right next slide um all right so what can we do about this so one proposal and this is a proposal by vitalik um and also kind of very similar to several kind of internal areas of research that we've been engaging in at flashpots is to use economics to solve this problem so to decentralize us using economic incentives that kind of secure spam resistance and also uh privacy so i encourage you i'm not going to dive too deep in these ideas i'm more going to talk about the high level kind of content here but i do encourage you to check out this e3 research post and comment and kind of bring your feedback in your comments what these proposals all have in common is there's some economic incentives to behave honestly so either you want to behave honestly to maximize your revenue or because you'll lose revenue otherwise or there are some slashing conditions that force you to behave honestly that's kind of a common theme in crypto economics next slide um okay so what else can we do other than crypto economics kind of exploring the the trade-off space uh so i called this slide voldemort and this is kind of the more provocative part um i wanted to kind of talk today about why we're working on sgx based solutions at flashbots and why we think economic solutions alone aren't enough to build the robustness of the marketplace that we really need to handle mev um so on the left kind of shows you my mental model of how to think about mev in various distributed protocols so on the top you have some code that's running of the distributed protocol it might be an eth validator a cosmos validator it might be a uh i don't know centralized exchange service uh whatever kind of distributed system or cryptographic system that's ultimately being exposed to the public and the system has a bunch of outputs that it sends as messages across the internet here it's labeled out one out two out three um and there are users and observers and auditors who look at these outputs um and try to define like what is the code that's running is it the right code and is it kind of doing what it says on tin so in this kind of picture there's something i call the wiggle room which is kind of how i think about approaching protocols at first blush which is like looking at the code that the validators run and the outputs it produces and seeing what other outputs can be produced by code kind of other than the prescribed protocol so what other messages can validators send um and what does that mean about the state of the world that's inferred by these kind of people at the bottom uh are they able to detect that the validators have kind of changed the code and what are they able to detect about that so without sgx in the ideal world this wiggle room consists of the code plus the network input and output and with sgx the code is removed because you can attest that you're running a particular codebase so the wiggle room is kind of limited to the network so if code is not in the wiggle room that actually simplifies the analysis a lot of security you don't need to define these economic slashing conditions like we saw before of like inferring what is the code security property from these messages we see on the internet um these pro these conditions are also prone to introduce additional assumptions right so like you might need to assume that a certain number of validators are honest to see the truth and figure out who's actually taking liberty in this wiggle room and these conditions kind of also introduce fragility into the system so what i'm going to propose is defense in depth which is adding an ideal sgx construction to the stack doesn't mean we don't have the economic incentives it means we also have these other systems next slide so i think these are complementary for mev and this table is kind of the one takeaway i want everyone to have from this talk why well let's look at both so first of all how much capital is required to break the security model of these two systems with sgx it's hard to say it's hard to say how expensive it would be to attack and break sgx for a miner so i've put that as an unknown with economics the capital requirements are likely pretty high if you're designing slashing conditions properly however the security outside of the design so outside of these assumptions you've chosen in economics is zero because you haven't really analyzed the space outside of these assumptions whereas with sgx the fact that you have some guarantee that the correct code is running may give you some assurances you know even even if you kind of look outside the specific code paths you've reasoned about so what i mean by that is it just removes the wiggle room it removes enough wiggle room that it just fundamentally simplifies uh the analysis of how much capital is required outside your design space the next column is the engineering expertise required so this is a big barrier to people actually pulling off a taxes like getting the engineers together in the room and doing the attack so with sgx to get together kind of ten engineers to do this attack you need a pretty high um kind of level of engineering expertise you need people who are familiar with either kind of uh extracting keys from from secured memory through kind of molecular level analysis or or specific side channels or kind of very specialized technical attacks so that's a pretty high level of skill with economics violating the economic assumption requires capital usually and not much coding ability uh you can usually violate the assumptions pretty easily that also brings me to this next row which is how many people do you need to get together right generally larger conspiracies are more likely to fail um so my personal heuristic is like you probably need at least 10 people together in a room to break sgx uh with at least one month of lead time whereas the coding level to kind of code a malicious validator is almost trivial when you're modifying the stock software so the point here is that these approaches are complementary and not mutually exclusive uh that sgx adds barriers uh that that economics misses and economics imposes capital requirements that sgx may not have so using these together is kind of our proposal here at flashmont's next slide um and another reason for that is because of these system shots we're talking about so here are some flash boss bundles that are the most profitable bundles ever you can see some bundles that pay as much as uh you know 10 different e blocks 30 different eat blocks 50 different heat blocks of reward um so in these moments and we expect these to continue increasing um it's much easier to kind of defect from the crypto economic system because of that lower barrier to defection than from this kind of uh more technical cryptographic uh equilibrium even imperfect cryptographic equilibrium next slide um all right uh so this is the last slide that i think is kind of important so you might be thinking like sjx is pwned it's not secure and this is the slide i kind of want you to to look at and internalize if that's your opinion um so uh here i have two different worlds and i'm not sure which world we're in but i want to raise the top and bottom world as two possible worlds and what these graphs are showing is how much does it cost to attack sgx how much does it cost to attack one chip and break it and then how much does it cost to generalize that attack to two chips to three chips to four chips to five chips what is the economic marginal cost of attack so in that top world it's expensive to have a specific attack maybe it requires a lot of research but cheap to kind of reproduce it um [Music] sorry the labels on these emojis should be switched that should be non-trivial or it's low marginal costs basically um in that world we're screwed right because miners can simply pay this three dollar sign which is probably going to be less than the total available mev and scale their attack to infinity however if instead we live in the bottom world where there is a marginal cost at equilibrium to attack each ship after the first one has been phoned we can leverage that to build secure crypto economic systems by only entrusting each chip with the amount of value that is uh kind of much lower than that estimated marginal cost so that is where the security of sgx comes from and why sgx is still secure even in the face of attacks next slide um the last slide here that i'm going to talk about and i'm over time so i'm not going to finish the slideshow most of it the rest of it is just fluff but i really want to get through this um it's what about when sgx breaks so this is a key way to think about sgx in your protocol what happens when protocol security properties break first of all can the public tell um if if it can't tell then maybe sgx can still provide some defense in depth where if it's working it gives you additional properties but if it's not we don't really rely on those that's what's known as defense in depth and like layered defense to make attacks more expensive if the public can tell on the other hand if it produces objective evidence um or if it produces evidence at all you can build protocols that are either subjectively or objectively secure without relying on intel and without relying on sgx or trust because you have this kind of additional falsifiability when it fails so anyway that's all i wanted to say at flashbacks we're building both protocols i would love to talk to you guys about where sgx fits in this ecosystem and where it doesn't and let's chat more about it sorry for the technical issues earlier i'm going to go dig into my linux configs and make sure it doesn't happen during the rest of the day uh thanks everyone for listening and probably no time for questions but feel free to ask them on twitter i think great thank you phil there seems to be a lively discussion on the east global.tv um uh live chats um so uh if any of the speakers here have time um can also hop onto global.tv to interact with our global audience