Mallesh Pai 🛸 An Economic Definition for Censorship Resistance

[Music] this is another obviously yet another talk on censorship resistance it's in the same way as some of the earlier talks you saw today by Shri RAM for example um and here's where we sort of come at this so a lot of the talks that you've seen today um think of sensorship resistance as the idea that valid transactions make it onto the chain right that that if there's a valid transaction sitting around in the M Pool it will get included and a lot of our hand ringing and concern has been about the idea that for example ofac sensor transactions take a really long time these days to make it onto the chain that's all that uh as written we currently guarantee valid transactions will make it onto the chain eventually now the question is is this enough as long as valid transactions are making it on chain is this enough for uh for us to do the things that we want to do with blockchains so I'd suggest and submit that for a lot of valuable transactions and not just sort of for uh our goals of credible neutrality but also for that um this is not enough so a lot of things are not just about getting on chain eventually but getting on chain on time so Oracle updates is an example of something that you want to be guaranteed to get on you know get on in a timely fashion all sorts of financial transactions arbs liquidations are stuff that you want to get on in a timely fashion and it's not just stuff that we're doing right now that requires this sort of censorship resistance that requires stuff to get on in a timely fashion it's also stuff like um the stuff that you could do if you did have those sorts of guarantees so being able to guarantee timely inclusion opens up new mechanisms that you can't do right now so onchain auctions uh are currently really hard to run for reasons we'll discuss you you could potentially do uh faster rollups without a 7-Day window all of this would be possible potentially if um you you could uh stay away if if you had uh censorship guarantees now the problem that I'm talking about is not sort of you know I'm not the first person to discover it so uh indeed it was one of the first things thought about so this is from uh vitalic blog post and the date uh is June 6 2015 so it's a thought process that has been circulating in the community for a while and here's sort of the thought experiment I want you to think about so suppose I write you a European op option that expires on block X so this is for a thought experiment this is not for a real sort of smart contract that me might want to write but think of it as I sell you an option and that option pays you the difference on block X between the price of ethereum and uh the strike price so at today the price is 2,000 I tell you okay I will pay you the difference the positive difference between ethereum's price right now and sorry between ethereum's price in Block X and 2,000 so if it goes up to 2,100 I owe you $100 if it goes down I owe you nothing and we walk away now for our simple thought experiment the idea is that this contract is written poorly it says that if you want to exercise this option so if you want to come to me and say hey males the price of E is up pay up you have to submit a transaction in that block so you have to submit a transaction in that very block and um the trouble with uh aligning or the trouble with writing a contract like that is that you know for instance imagine the price of ethereum has gone up to 2100 which means you are uh you have a $100 gain if you can get a transaction into the block the trouble is I am willing to pay up to $100 to censor your transaction if you put only a tip or a priority fee of $90 it's actually profitable for me to uh you know pay uh somehow pay the proposer to censor your transaction that is not include the transaction because even if I pay this proposer $91 he'd prefer to censor your transaction rather than include it I have still like a $9 profit so that's of the thought experiment that vitalik walks us through and I'd argue that the trouble you know there are a lot of lovely things to love about PBS and there's a lot of reasons uh it was done but one dark side of PBS is that it sets up a market for censorship so blocks are auctioned off to the highest bidder in PBS and that means that a motivated sensor could in principle offer a block without the underlying transaction with a higher bid and no one would ever know that's why we're now trying to undo this um sort of undo this potential issue with things like inclusion list now we did a simple version of this few months ago just to check how easy it is and with a better engineer than me I should be honest but with a good engineer it was literally two hours of work to spin up a public Builder spin up like an open source Builder put in a few bids and then land a block so we actually landed a block and we had exactly one transaction in the block you can check the chain yourself the BL the block contains one transaction the uh graffiti for the block is the first sensor of Rome and there's a link to our paper so that's the block it was $100 and a few hours of uh great Engineers time so not completely cheap but if you have a builder lying around this is an easy thing to do and of course our block was empty and obvious it was it was there for um you know just so people knew uh that this could be done but part of the issue which you've probably heard about multiple times today is that if there was a sophisticated Builder who left out just one valid transaction because they had a side note or they had a side payment guaranteed by somebody else You' never have known about it and this is problematic so we need a definition of this one of the I mean going back to Shri Ram's talk um one of the things shiram said in an audio space that stuck with me discussing this was that if you can't measure it you can't improve it so we need a definition of how should we measure the level of censorship resistance a protocol or a blockchain is getting and to do that we need to abstract away from the machinations of a specific uh protocol so let's just walk away from everything and think of a public bulletin board so a public bulletin board is just a place where people can post stuff and it has two uh operations available to it one is a read operation you can do it for free and it always succeeds the interesting operation is a right operation so it takes some underlying data uh data and it takes a tip T and either succeeds at writing the data to the bulletin board at a cost of t or fails so those are the only things two ways you can interact with a bulletin board now what's our definition of censorship resistance our definition of censorship resistance is a function fee and this function fee is the amount it would cost a censoring party to write uh to cause the a right operation to fail so there is a censorship party we don't a censoring party we don't know there objectives they might be ofac they might be something else there might be uh you know one like me in the thought experiment from a few minutes ago trying to stop you from getting the right uh getting this option uh getting able to being able to exercise this option now the ideal sensorship resistance of a chain is of course Infinity you want it to be extremely expensive for a sensoring party to uh do it but you can now think through with this definition what is the censorship resistance of a particular thing of a particular protocol so if there's a single designated block that's the relevant public bulletin board fftt equals T if you have a burn so if you know with the IP 1559 we have the burn and if B is the base fee then actually it's cheaper to censor because the proposer is not getting part of the associated tip for inclusion some part is getting burnt so the proposer is only getting the difference the proposer will be willing to censor for anything uh larger than T minus B rather than t a bulletin board that consists of K consecutive slots has higher censorship resistance so if you think of K independent uh SL proposers then given a tip T it would cost K times t for uh the censorship to fail and for K large this gives n excellent censorship resistance but it does it at a cost what is the cost any read operation any any operation that you want to do with the data for instance run an auction would have to wait the length of time of the K blocks to make sure all the relevant data is in so what do we do in the paper it's it's late and you guys have been doing this for seven hours so um in the paper we study how onchain auctions perform as a function of the censorship resistance we have a model of a bunch of biders who can submit private bids and public tips and there's one more bid who bidder who's a sensoring bidder who can enter the auction or they can bribe the proposer to leave some competitive bids out or both the summary of the findings uh which uh I I'll tell you is the I mean I'll link it in the last slide is that if the censorship resistance is low the auction is going to perform poorly so the revenue of the auction is going to be low the majority of the Surplus that is the profits that are made from this auction don't actually go to the seller of the good they are split between the sensoring bidder and the proposer meanwhile if you have high sensorship resistance you restore proper functioning of the auction okay so so far all I've told you is that censorship resistance is a good property woohoo and um some ways to write a public bulletin Bo or set up a public bulletin board um restore High censorship resistance but of course the only solution we've told you so far is to have K consecutive blocks and of course that's a Time issue so if you're doing something time sensitive an uh a liquidation an oracle update you might not want to wait k blocks to get the uh degree of time our solution well is uh to end the proposal Monopoly so as an economist a lot of the issues that we see uh are seeing here is because even though there are a lot of proposers a lot of potential validators in the ethereum system or in any blockchain for any given instant for any 12 seconds there's only one of them and that Monopoly power is what's causing this Distortion so our solution is to have multiple concurrent block proposal it's it's uh it's more of a wireframe solution it's not not a working engineering solution yet but some people are working on it um and essentially K block proposes any right operation is sent to all of them uh so the block is the union of the blocks proposed by these multiple concurrent block proposer and we allow for conditional tipping so for instance you can submit two tips a little tip small t and a capital tip large tip capital T if multiple proposals include the data then each of them gets paid the small tip and if only one proposer includes the data then that proposer gets paid the large tip now what's the idea why does this work the reason it works is that conditional tipping sets up a prisoners dilemma among the block producers so every block producer is thinking should I include this tip or not should I include this transaction or not if every proposer is thinking about this they're thinking well look if the other proposal are not including it then I can make a large tip capital t from including it so it's very strongly incentivized for me to include it but of course if everyone is including it then I own or if at least one other person is including it I only get paid little tea so um the idea is that this conditional tipping separates the cost of getting something onto the chain which is K times Little T with the censorship resistance of a uh of the chain which is K times Capt so you can now have like a lot of sensorship resistance but cheap inclusion now of course you need to do stuff with Spam and throughput and so on but that's that's that's a separate set of concerns this is uh I think already if you don't care about transaction ordering and you can layer on transaction ordering but if you're trying to do something like just a pure chain to run an auction for example where you care only about the set of bids not the order in which they arrived this is a chain that's uh ready to go in terms of uh arranging this high level um arranging this sort of thing so in short what I we talked about we've I've tried to introduce a novel measure of censorship resistance it's um one of many measures so for instance Shri Ram's uh time to censorship resistance is a different measure and the community I think needs to think about not just um you know what we want but also what are the measures of how we measure it so which are the ones we're prioritizing or optimizing for I'm not like I I don't want to sh my specific definition uh but we do think that this one uh gives a useful way not just about censorship per se but also about thinking about the viability of various mechanisms on chain so the possibility of censorship and the absence thereof opens up not just not like it doesn't just take away the censorship risk it also opens up the design space for a designer in terms of What mechanisms uh they can they can credibly or they can safely Implement on chain faster for prooof Windows uh more efficient defi protocols all of these are possible I with higher censorship resistance um so that was my talk I'm happy to stick around for questions um the paper is up on mechanism. org Library along with some of our other research and we'd be very happy to hear from you with thoughts comments anything else done