Sreeram Kannan & Kartik Talwar I Restaking Risks with EigenLayer I Pragma Denver 2024

[Music] and for our last talk I want to bring on sham from iir to talk about basically everything that could possibly go wrong with iir we're gonna have a a pretty uh interesting back and forth to uh to analyze some of the the attack vectors and risks so without further Ado let's welcome stre Rob on stage Kik thank you Karthik exited to be here looking forward to hear all the ways in which we can break I I'm the T this this was meant to be a a conversation on data availability but I think this one is a much better conversation topic um the way I want to frame it is maybe maybe we'll kind of spend two minutes Define some of the the key uh terminologies here and then uh from my perspective the goal here is to come up with the FAQ of what could go wrong and the actual answers um so let's start with uh two things uh let's define what reaking is and then also what is ABS yeah um IG layer is a platform that allows take anybody who has tokens in the ethereum platform to stake their tokens and make credible commit commments commitments that I will run a certain validation function correctly these commitments are endogeneous what do I mean by endogeneous I make a commitment that I will not steal from your shop and I can hold to it myself these commitments are very different from like monetary commitments like you know I I go and put up a collateral and then borrow something and then when the price moves between these two things that's not something I control that is exogeneous Market risk pretty much all of defi is the risk that you're underwriting is some kind of price risk relative price volatility in igen layer what you're underwriting when you're doing validation you're putting up a stake and making a promise that you will not perform a malicious action when you're doing the validation and this is endogenous something that you can control yourself what is an AVS AVS is is an actively validated service actively which means you have to do something to validate to make sure that the service is running correctly uh an actively Val a simplest example of an actively validated service is a chain you know I want to run a new chain on top of something else on on top of the stake that would be an actively validated service but the scope of actively validated Services is much larger than chains imagine I'm sitting on ethereum and I want to make a call to an oracle so some group of nodes need to go and fetch some prices and then put them on ethereum that would be an actively validated service I want to run a co-processor I want to run you know when I lock my liquidity into a Unis swap V3 pool or a V4 hook I want to make sure that the liquidity is only provisioned in a certain price range where the price range is desired as a function of the historic toxicity of the you know order flow this is something you could do by calling let's say a AI co-processor a processor that would actually run is and then bring the answer into ethereum these things don't need to be chained there is no you know change structure data that matters not the yeah exactly it is a certain uh input that the service is providing that is what matters you can think of these as trusted apis right like you know in in like the cloud era we have apis can go call an API I'll give you an answer but a co-processor is a trusted API a trust it because it is underwritten with a certain amount of capital that that output will be correct so that's the two sides stakers people who stake there's a CO there's a nearby s side to the Staker side which is operators people who actually run the computation operations and we assume that the relationship between the Staker and operator is uh arbitrary we don't constrain these relationships and then finally there is Services anybody can come and build new Services igen layer igen in German for your own which means open Innovation we want more people to come and build their own things on top so that's the over overall structure of throw in one one curve well what is LRT let's just put that in perspective and then we should be ready for the the fight okay getting ready for the fight uh LRT a liquid reaking token so what's a liquid reaking token when you stake in igen layer whether that may be sted to ethereum and then restake through igen layer so the way you restake through stake in etherum and restake toon lay you stake in ethereum set the withdrawal credentials to your own sub smart contract in the IG layer system called an igon pod so what this does is you create your own like Zone inside the igen layer thing and then now you can actually set your withdrawal credentials in the ethereum staking to this your igen pod and your igen pod you can control because you can have the keys for that so that's the basic structure of reaking now what is liquid reaking tokens is somebody does all of this for you so you just come in and you have a bunch of eat you're like man I don't want to go find operators I don't want to go find bet these avss what what are these avss how do I know if any of them are any good I how how do you know they're paying the right price is it overpaying underpaying I don't want to do any of this stuff I want somebody to do all of this for me okay so there may be some kind of a democratic governance which may be run by you know a committee or a token or like some kind of dual governance like Lio has with you know the the position holders and the native token holders but the basic idea is you know as a Staker you don't want to do a lot of this work and you want to Outsource it so people started building these things called liquid reaking protocols and the output of a liquid reaking protocol is I put in an eat and then I get a liquid reaking token which is like a liquid representation of my position of your liquid position uh no no the the position would have not been liquid if I didn't do the liquid reaking token oh there are some others who stake lstd into the IG layer contracts and then create a liquid recing position so there are there is now like native LRT and then liquid LRT but these differences don't matter as much as one might think because fundamentally all you can think about is you delegating different set of operators to run your ethereum thing and a different set of operators to run your igen layer Services which is actually maybe beneficial in some ways but the that's the overall structure so now you have a liquid reaking token which represents your position in IG so that's what a liquid reaking toiz so does the shot for LRT which is what cost cost so so does the liquid reaking token or the igen layer chain have or just that that system rather just just abstract system have the knowledge of what level deep this token is meaning can I actually restate a liquid token oh great question so so when people think about like looping a liquid reaking token or whatever or re re re re reaking or whatever people exactly what I'm getting you can't do that on a so what it means is in aair the contracts know what your position is so we only allow native staking or some kind of LST which only does staking outside so why is this needed this is this is important because igen layer wants to maintain a full accounting of all the risks as closely as possible this is one of the reasons we keep saying that you know eventually I lay should be internalized into ethereum reaking protocol should be internalized into ethereum because ethereum has the most context both at the staking level and every other level that can then be built on top you need a single point lock on the entire system and in the absence of ethereum internalizing it in the short term we are trying to make sure that all the activities and risks that are underr purely out of validation are uh fully transparent because igen layer has mechanisms to use this transparency to do all kinds of allocation and cryptoeconomic calculations which we'll get into later but it is very important that all the risks or all the different commitments so you think of like I I'm putting in a stake and I'm making a bunch of credible commitments and I want to make sure that the total volume of those commitments are well accounted for who are you speaking on behalf of because in this case that means you are running a ABS okay uh the IG protocol needs to be aware of this whole thing because the igon protocol is making sure that each ABS is getting a certain portion of what we call attributable security and the idea of attributable security is so the the the interface between the AVS and I layer there are two two models the simplest model is what we call Pool security pool security is hey there is a big pool of stake and let's say there 1010 billion stake today so you take this $10 billion of stake and we you know all these stakers opt into let's say 100 projects 100 avss now like you know to attack any one AVS I need to acquire a $10 billion capital and I know if I do attack you know if the validators cute to attack the xavs they're going to lose half of this $10 billion of capital so that is a much much higher security guarantee then if each of these 100 protocols went their own way to acquire the stake because each of them would get only $100 million of stake at the par like rewards yeah exactly so that is our first model of security so I'll explain the second model of security so that sets up like for some of the attacks that might come up this so in this model of security if some service wants to slash like the stakers what happens is all the Stak is burnt all the attackers are found out and the stake is burnt it's not redistributed it is not attribut alloc at it to the different avss so all that you have as a as a ABS is this guarantee that if somebody attacks my protocol I know that like $5 billion of stake might get burnt and that is a rigid guarantee for me to like build something on but what you miss in this kind of like a pooled security model is the ability to know so imagine there are 100 protocols and one of them is a really big protocol maybe base who wants to build on wagon layer and Bas is saying hey I you know all these other Protocols are happy with 100 million security maybe they only need 10 million security I need 3 billion of security because you know I'm moving more value whatever so there's no way to attribute this in the original pool security model everybody's smudged together into a common pool by the way that's exactly what ethereum does ethereum smudges all the applications together into a common security po so okay now what can we do better what we do better is the second model of security we call attributable security attributable security is when you come to ig lay and you buy a portion of slashing rights you want to buy these slashing rights let's say you know base or AVS buying these rights AVS is the one that's buying these rights absolutely so because AVS is the one that's worried that they're smudging together with all these Rando avss you're competing and you want to offer better services or exactly exactly you want to do something more than what you could do in the burning scenario Maybe for example you're running a bridge and you want to say that hey I I have like a weekly transaction volume of $100 million in this bridge and I have more than 10000 million dollar like attributable security so I'm perfectly covered so you can actually make claims like this to do this you need to be able to say that I will not only be able to slash I will be able to slash and uniquely redistribute this portion of money even if all the other avss slash simultaneously even if all the other avss slash simultaneously so this this is what we call attributable security and this requires igen layer to maintain the contract I layer contracts you know he mentioned I chain just to make sure other people are on on par I is not a chain I is just a system of smart contracts on it so I contracts on ethereum maintain this proof of solvency the proof of solvency is that like all my attributions are can be simultaneously honored no matter what happens in the system so that's a cal calulation that Aon L needs to maintain but the benefit that you get with attributable security is now you you are getting this portion of let's say you know $3 billion of security just for yourself as base as an EVS but you also get the benefit to attack your protocol 3 billion is not enough you need 10 billion and the remaining portion of it is still going to be slashed so this gives a very rigid guarantee to the avss well this actually creates a whole new set of other things because now you have created a marketplace where people have to compete so the obvious question I have from this is that means for me to go from 3 billion to 10 I need to figure out how do I incentivize people to transfer to me which usually means I will introduce a token or maybe points or both and you can pay e you can pay e no problem well people will not transfer their e to me in this hypothetical scenario I'm not running any EVS this is not Financial advice um so the question becomes well you now have an incentive structure that can be introduced and chances are it will be um and that can mess up the accounting because I will end up offering you a better yield than being another ABS and the question is well where does that yield come from and how does it actually affect effectively people thinking about the worth of their lrts or their restake tokens now is that a valid concern it it is a valid concern for an AVS to understand how they actually acrew a certain portion of reaking or a certain portion of attribution even in the pool security model you still even though I called it the pool security model the way I L works is each Staker decides what they restake into so the pooling is like Market emergent rather than like more on the slashing argument more on what happens to the slashing argument exactly it is basically in in the first model you just burn the funds so there is no need to specifically attribute who which AVS I'm slashing for because burning is burning like it doesn't matter whether I'm burning for AVS one or AVS 2 when I'm doing re distribution you need to be specific but back to this question so you do need like the abss to incentivize the stakers to restake to them and so how do we do this how do avss do this we we don't know it but avss need to do it how do they do it they can do one of let's say two fundamental models one is hey I'm getting a bunch of fees for my AVS and because I'm getting fees I can pay a portion of the fees to the stakers that's one model of course on Day Zero when you're introducing a new AVS you probably have no fees and so therefore you're not able to attract a lot of stakers but I can uh launch a token and have you stake that that's the second option oh have you sted that okay that's a new new idea CU that's how well if you look at a lot of the dii protocols from the defi summerwave the whole way to boot that was well we'll just take our own tokens which you just earned and that's how you boost up the APR which means that I can now combine and advertise the interest rate by combining the yield from my own token plus the restake token which creates this compound packed product that is honestly a mess so uh okay so the the maybe this is the third model I'll tell you the second the first two yes the simple second model is the AVS has a value acral token and the token is you know some kind of a system which basically says he you know whenever I we get fees through the AVS some fraction of it goes to the D or treasury or something and therefore this token's potentially valuable and now you know I want the stakers to be aligned with this system so I'm giving a portion because I don't have fees today but I have a portion of potential fees that I'm allocating to the you know through through my own token that I'm allocating to the ethereum stakers who stake to me so that would be the natural next model and this is already like pretty powerful because I have a you know as an avas you have a token and like you know you potentially have at least future fees otherwise you know you've not thought about the model now uh and then you're allocating a portion of it to the stakers to actually restake to your server so that that is the second model I think there is some more complex third model that you're alluding to and I want to listen to We have to cover that but here's another scenario that may happen from the second model you talked about I introduced a token as an ABS and uh let's say I'm a smaller one so I have 100 million uh security that I'm kind of covering as an EVs and I launch my token it goes really big and now my token's FTV is 200 million and I do a bad job as an EVs and get slashed but technically I can use my token on the open market and still redeem some eat for it and still subsidize people who got slashed potentially or find a way to like minimize loss now does that affect the global state of the system okay so there is a few assumptions picked in so what happens when an AVS goes wrong so let's start from that so what does it mean for an AVS to go wrong firstly a Staker is taking making a promise that I am not going to do malicious validation activity and why do we need this we need this because it's a permissionless open system and who knows who the heck these sters are and whether they will actually hold to their covenants that they have promised so that's why we need Stak now if you go to the AVS side what they actually what the Staker is concretely opting into through the IG L system they're opting into a AVS contract the avus contract specifies what the registration condition is who which stakers can register what the payment condition is whether it's a fee payment or a token payment or whatever and then the third one is what is the slashing governance what is the what is the situations under which you will be slashed and that's return into the smart contract now if you look at an AVS contract and the simplest scenario the AVS has objective slashing conditions on a contract now if a Staker is opting in they actually know what the covenants that they're opting into and what they could get Slash from and to protect any bugs and of course we know in crypto there are bugs always in all these systems to protect against any bugs in the system we have a manual committee the slashing veto committee which has to approve so the the way slashing approval Works in Iger is the contract has to trigger a slashing request and the committee has to approve it only then the slashing is considered approved so the committee cannot unilaterally slash stakers but the committee can veto the slashing so that's all that the committee's power is so the trust assumption from the Staker point of view is if either the contract is right or the veto committees works correctly then they will not get slashed for a non-malicious action no matter what the ABS does right just it's how you want the system to work but we're talking about crazy scenarios which means like assume they get slashed but they had a token no no no but let's let's go through like why they got slashed despite these two things right so sure so I want to make sure that that's covered so the first thing is because there is a slashing veto committee The veto committee on board AVS so you know you couldn't just onboard a random AVS without the permission of the veto compane because they need to know what the heck they are like vetoing for what is the true slashing condition that it represents So Random like you know crazy avss may not be I can just launch an AVS and show up next week without okay no the is that a short-term thing or is that but the how do we think about this long term so in we don't like any of these like permission like intervention structures but it is important to keep the Fidelity of the system in the short term what do we think about in the long term the first thing is if you launch an ABS and you have stress tested it with the slashing veto committee over a certain period of time then you can move from like a you know protected by the veto committee to like unprotected by The veto Committee of course takers are going to be very suspicious of a service that is not protected by a veto committee and we're not going to enable this day one but in a in in the short to medum yeah so in in that case what happens is like abss will migrate to a more immutable uh structure where like the not and therefore like they have to convince the stakers to move with them or restake to them because they are actually underwriting a very open risk that the the the contract is wrong in the short term or so the the evolution path is AVS is launched with the protection of a v committee and then moveed to like a permissionless strata even this veto committee we are actually thinking how to make it like a Marketplace for example in the uh uh me supply chain there is this role called the relay right you you compare and you compete and like so that could be like a marketpl of V to committees so we don't need to be like trying to like introduce a whole new Vector here collusion okay let's what's the collusion with st well it's not collusion but it's like you now can actually default not defa like you can actually make it a higher probability of somebody disagreeing with your ability to like prevent the slashing even if the slashing was honest so you can Bank on probabilistically people would say I let them have a pass and uh and that means you can create weird incentives on the ABS side yeah so this the re the slashing veto committee is a doubly trusted party just like the relay is a w trusted party so the AVS has to agree to the slashing veto committee and the Staker has to agree and they can only interact if they go through the common you know trusted party so that's what basically the market structure is so what it does prevent is interactions when you don't have a common trusted committee then you can't inter an Open Marketplace in this sense cuz you still need some sort of you yeah exactly just like the relays today um so okay so that is the structure so despite all these things catastrophe can strike you know we are in crypto land so what do we do like what happens when an AVS does slash some stake if these two assumptions are broken then we don't know what will happen right like so that's that's basically the the trust model is you know okay now it's going to get slashed if it's in the redistribution model the redistribution power goes to whoever bought the insurance which may be the D or it may be a smart contract that has reallocation rights to some users so in in those scenarios it's possible that the that an AVS uses its own token and if it's still solvent so to say to actually like subsidize or like protect users or or stakers in that scenario so oh it helps the the minimize the loss for the user but does that how does that impact the the IG system but they if a large amount of stake in the IG ecosystem got slashed for you know both these trust models broke which is that the contract of slashing was wrong and the staking slashing V committee is wrong then you you do get this thing where like you know people are losing money and what fraction of stakers lose money what is the scale of this event it doesn't mess up the accounting of the systems ever in no no the unconditional correctness of attributable security holds which means even an AVS is completely wrong and has a Bonker slashing condition it doesn't matter if you have a certain attributable security you have it unless the IG layer contract is strong which is also a possibility so you know we just need to examine just you know this is the case with all the blockchain systems we need to examine each layer of trust assumption and one of the things we take a lot of care and you know we mentioned liquidy taking tokens I just want to mention this take a lot of car is in the igen layer core contracts if the igen layer contracts do get hack got forid uh they you cannot withdraw money from the IG ler Contra all withdrawals from the IG layer contracts take a onee escrow so IG layer contracts themselves have like a passing and like a security Cil and all these things to make sure that you know in case something really goes wrong there is a protection against feel safe so that that's how the whole whole thing works there are like because of all of these things there is a bunch of like in like the slashing veto committee there's a security console all l2s today have security consoles and that's just over time as the contracts to start this way otherwise you can't it's risky yeah um all right so we'll try to do some quick ones and I'll try to be meta about this thing so I'll I'll ask you to figure out what could go wrong instead of me pointing out an example because I don't think I'm going to win on this one um so the most obvious one is well what are possible scenarios where we get some sort of Leverage reaking situations happen and how does that affect the whole system if I can I know get 100x or 10x on my restake eth and it's just crazy aprs everywhere what goes wrong in those world yeah this is something that actually is that even possible it it is possible and it is concerning so how is it possible how is it concerning you can't natively leverage on I you can't stake e get an LRT and then take the LRT and stake it on a that's not possible but you can stake get an LRT which is a representation of your state position go to a landing Market pledge it get e deposit it get an LRT pledge it and go round and round I can layer CDP this kind of people got that one this is great so this is leveraged reaking I I say everywhere that I layer does not have leverage but leverage reaking absolutely has leverage it's there in the word leverage reaking so you go going round and round in this you know pledging an LRT and get getting it so why are you doing it why are people doing it they're doing it because they want to get like leveraged exposure to whatever WS that go through the ion layer system so of course that's possible and allowed but in a case where you get liquidated for getting margin called it shouldn't affect the system right so am I am I missing something no it doesn't affect the ion system itself but that the the the thing that might happen is you know if there is a lot of lity loop like this then temporarily like you know this week to next there is a withdrawal period one week to two weeks and after the two weeks you have a lot of stake might move out so there's just a fluctuation of security you move the price everywhere and maybe possibly create Cascade effects yeah the Cascade effects are basically that the AVS has let yeah exactly the outside Cascade effects are what we are worried about which is that people think oh you know I'm I'm doing this thing what what can go wrong like what how how would an LT not be equal to e there are all kinds of short-term scenarios why like an LRT won't be equal to an eat and it's because there's no liquidity for this thing and the now you're not only dependent on the ability to withdraw from AO you're also dependent on the ability to withdraw from your LRT and lrts may not have withdrawals enabled or have withdrawals enabled after a lag or whatever other thing is going on so the the there may be a scenario like I described the I contract gets hacked and the contract you know the security console probably meet and revert the hack but in the intervening period you think the LRT is going to hold Peg maybe not and then everybody gets liquidated in their positions so of course this risk is not affecting Igan L per se but this is an extraneous second order thing imagine there is a big stable coin built on top of like an LRT or something else and all these things can get affected so it it is a defi risk it is not an IG layer risk but to we caution users not to use leverage you know it's just something that but it is a permissionless platform so each user up to their own but at least understand all the risks that are involved before you go take a leverage position I have a three other things I want to cover but um I'm going to I'm going to test the waters on this one and if this ends up being like a more than a two-minute answer then we'll we'll we'll continue this the other another time so here's another crazy scenario $ 1010 billion of e stake on igel there and I L launches a token can that token represent $10 1010 billion of collateral effectively behind it and that creates a whole not directly but can that be the representation eyes of people that hey look the igler token basically is a access to this much pulled security and I can now do crazier things but reaking that or leveraging on that and that may cause some damage is that does that change anything is that even a worry uh that's not a model that we building so one of the things a lot of people thought we would be doing is to launch our own like liquid staking or liquid reaking token and we have no interest or I was taking yeah that that's one of the reasons a lot of like people are trusting us and building their own like liquid reaking tokens and stuff great next one is what are other possible scenarios where there could be Mass slashings uh other possible scenarios where there could be m m slashing is basically something goes wrong in the uh the AVS contracts right the AVS has a slashing contract what if something goes wrong there what if something goes wrong in the igen layer slashing contracts there's some bug to trigger slashing on igen layer that is protected by the security Council but you know we have to worry about it uh those are the two fundamental reasons that trigger slashing in the