Challenges for Ethereum Staking Protocols in the Post-Merge World

Transcript

hey everyone um welcome we're a little bit behind so i'm gonna try to push through uh i'm here to talk about challenges for ethereum staking protocols in the post-merge world um so who am i first of all uh i'm mr doris posadas feel free to call me izzy i come from a traditional like corporate background auditing and accounting and with a focus on risk management for financial risk and i.t risk and recently i've started working with the light odow to help coordinate and wrangle wrangle light on node operators through the application and onboarding process um as well as developing the processes through which we run node operations and evaluate them against the the current

set of uh like goals that we have as a slider as an organization and helping develop strategies to decentralize the protocol further uh really quickly about lido so lido is a dow that's building a family of staking protocols uh headquartered on ethereum so the idea is that we want to become a multi-chain staking protocol currently we have over 7.8 billion us dollars staked across the three chains that are currently live on on mainnet that's ethereum terra and solana with over 1.4 million ethereum staked in our contracts on the east side we started with five node operators on the ethereum side and then we moved to nine around may of last year and as of end of august we have 14 node

operators with more on the way in a coming onboarding round within the next few months so what am i going to talk about in this presentation first of all i'm not going to photo focus specifically on lido i want to talk about what risks and rewards staking protocols are facing in general with the merge that's upcoming in ethereum slated to happen sometime between february and june of next year and what staking protocols and users of these protocols can do to help mitigate any potential risks and ensure that the users are getting the rewards that that they should be getting um this talk is going to be a little esoteric because i don't have the time to lay the first principles for everything but what i will do is have a references sheet at the end of the talk

so if you want to do your own investigation your own research feel free to get back to me afterwards and i'm happy to have a talk to discuss specifics or if you missed anything during the talk so when i say sticking protocols i mean taking protocols in general and not just lido i'm going to attempt to outline key issues that affect all sticking protocols and not specific issues that are maybe specific to only lido so really quickly what's the merge the situation we're in right now is that there are two semi-isolated layers in ethereum we have ethereum 1.0 which is a combination of a consensus layer and a execution layer all on proof of work eventually what we want to do is separate out the proof of work part of

this execution layer deprecate it and merge the execution layer with the proof of stake layer that we currently have on the on the beacon chain to end up with ethereum 2.0 or basically the proof of staking ethereum and what that means is that in practice the the rights responsibilities and rewards that are afforded to minors currently within proof of work ethereum will roll over to validators and those pose both rewards and risks so we're going to examine what in three phases what are the risks and awards now what will the risks and rewards be after right after the merge and what will the risks and awards be after the merge and withdrawals are enabled because from what we know from the ethereum foundation's roadmap

withdrawals will not be enabled right away together with the merge so i'm going to look at the risk and rewards really quickly just to outline them and then we'll look at each risk specifically and what strategies we've come up with with atlato and what we've observed the strategies that i've come up with in general uh through like the ethereum foundation research posts or on ether magicians etc to handle these issues so what are the what do rewards look like right now for users that are using staking polls as opposed to staking solo the first is delegation in delegation there's two kinds of of benefits one is indirect which is the act of delegating itself what does that mean it means that you

outsource the operational responsibility and accountability of actually running the software and the hardware necessary to perform validation to other node operators and the direct reward is that you by investing your money into the sticking protocol which then hires these node operators to do the actual validation accrue ethereum staking rewards and a small percentage of that goes to the dow and the node operators for providing the surface currently these rewards are non-withdrawable what does that mean it means that as you're gaining rewards they're sitting on the ethereum beacon chain and we cannot withdraw them and we will not even be able to do it at the merge we'll have to wait for withdrawals after the merge and the secondary reward that you get by participating in certain kinds of

staking pools but not all but lido for example is that you may get a liquid staking derivative uh when you stake your earth so this liquid taking derivative basically allows you to sell your steak at any point in time on secondary uh decentralized exchanges or earn yield on this staked if as it's taking so basically using your liquid token potentially putting it in ave or maker in the near future to take out loans or you know putting it in your curve and then urine and then uh abracadabra to mint magic internet money if that's what you want to do so what are the current risks the risks are that withdrawals are not permissionless and some are still custodial which means

that node operators can to a certain extent hold state eth hostage doesn't mean they can run away with it but they can prevent you from withdrawing it and then of course you have the loss of possible funds due to operator errors accidents software bugs smart contract risk etc what are the risks and rewards uh post-emerge so from a delegation perspective this is where a lot of things are added we still accrue ethereum sticking rewards in a non-withdrawable manner but because now the validator has replaced the roles and responsibilities and therefore also gets the rewards of the miner sorry the validator has replaced the miner they can receive priority fees so those of us that use metamask post one five five nine we know that priority

is like the thing that you add on top of the actual uh maximum fee for the transaction that you want to process so this is the so-called tip and they can also receive emmy mev rewards and these mbv rewards might either be directly given to validators on the execution layer or out of band which means that they're paid outside of the actual ethereum protocol and so because priority fees and mev rewards can actually be paid directly on the execution layer that means that they're immediately usable both by the node operators and then therefore the stakers whose ethereum they are validating from a liquidity and d5 rewards perspective nothing really changes you still have your stake teeth token which you can sell at any point in time or use

within d5 because the withdrawals are not yet available it probably means that the peg is also not exactly one to one because it's not possible for our arbitragers to easily move between the beacon chain and the execution layer in order to bring that peg to a one-to-one balance so here we have one risk that's added to the two that we previously outlined and that risk is that priority fees and mbv rewards are volatile and i'll explain more why this matters and why it matters in terms of how many validators a certain staking pool or a certain user uh has on on ethereum and that node operators may not fairly redistribute these rewards to stakers okay and in a post merge plus

withdrawals world these are the rewards and risks so one is delegation words again this time they're withdrawable so that means that if at a certain point in time it will make sense to let's say we're running 32 validators right and each one of them has accrued one each in rewards you will want to exit these validators withdraw that ether because you've got a total of 32 ether that has been amassed across your whole staking pool that you can use to create a new validator which basically allows for compounding of staking rewards you still receive priority fees and tips straight to the execution layer and you can receive any rewards straight to the execution layer or out of ban from a liquidity and d5 rewards perspective the what withdrawals will enable is a much stronger peg

reaction and equalization at times when the peg falls uh well out of peg and the new risk that's trigger that's inserted here is that with like mass withdrawals may trigger a very high rate of validator churn or cycling so basically because a lot of people will want to exit their validators to retrieve the staked eth and the ether rewards that have been accrued to that stake to eat this is going to cause a very long entry and exit queue to validators on the ethereum network and that queue may be weeks or even months in size so that will in practice reduce the actual apr for that whole time period so let's look at the possible solutions and explain a little bit more about what what each risk entails so withdrawals

are not permissionless what does this mean it means that because the validator is actually controlled by the node operator they have the access to the keys to actually send the exit message to the beacon chain and in theory if a staking protocol or a user asked for their eth to be withdrawn a validator could say no however in most staking protocols which are permissioned and curated like lido is where we pick our node operators there are really really few economic incentives for a node operator to do this it doesn't make sense for them because what they want to do is provide long-term and lasting value to to their protocols that they serve and that the users that they serve um so the possibility of a malicious actor is really reduced by the fact that these

operators would either be kicked off uh like our services both on ethereum and anywhere else that they happen to be validating with lido they would suffer really harsh brand and reputational damage and potentially also be blacklisted by other sticking protocols and sorry and they'll also potentially face on-chain penalties so what's another way to fix this if in theory you don't have a curated protocol but you have an open protocol like rocket pool where anybody can be a node operator what you can do is you can create a mechanism for triggerable withdrawals so basically that the sticking protocol itself or the dow that controls it or a certain sub selection of users on that staking protocol

could receive a pre-created message every time a validator is created and then issue that message when they want to exit a validator and then the node operator will not be able to deny that message uh how we can come up with creating such a mechanism is either through a new set of withdrawal credentials or by using a generalized message bus which i'll describe in a little bit the next possible solution a risk that we're going to look at is lots of funds due to operator errors accidents etc so this is a bit of a catch-all risk and it's like smart contract risk plus you know blockchain risk um there's nothing you can do to ever mitigate all of the risk in this in this like field but what you can do and what most sticking particles strive

to do as good stewards of the ecosystem is increase diversity and distribution so what do we mean by diversity first of all we need to promote valid validator diversity there's been already a couple of talks this week about how prism has a super majority right now validator clients like over 70 percent so what we want to do as later is first gather data around how many uh of our node operators are running which validator clients and at which percentages and then align together with the dow to figure out how we can incentivize these operators to to change the makeup of their validators either by running other validators or running multiple client types the other thing that we want to do is distribute operations so you don't want all of your node operators on the cloud you don't want all of them in the same data center

you don't want all of them in the same country um both for like regulatory risks in in the case that a country introduces legislation that's very crypto unfriendly but also for operational risk as we had like a data center in germany in germany that caught fire a couple months ago um and a lot of different validators and a lot of different protocols went down for like two days our next risk is around inclusion fees and mev rewards being volatile and non-fairly redistributed so because mev and inclusion fees depend on what's going on on the network at that point in time so if you propose a block during a really heavy heavily congested period of ethereum you're going to receive a lot more tips

than somebody who proposes a block when there's not a lot of network activity if you're a solo staker eventually when we are at max capacity of validators you may be proposing one block or less than one block a year so the amount of actual rewards that you're going to be getting is about how lucky you are at which point in time you happen to propose a block the same thing with mev if there's no any viewable transactions in a certain block or the total amount of immigrable transactions is quite low you might get really unlucky and not get anything so what a staking pool allows node operators and investors to do is equalize those rewards over time so every time one of our node operators in lido may produce mev or receive tips all of those will be smoothed out across all sde folders as opposed to only a

specific person who has invested in that node operator at that specific point in time getting those rewards so you have consistent rewards over time and not susceptible to the volatility of what might be happening on the network you know at any point in time um so current solutions to this are basically like working with flashbots because what is what is flashlights it's a prototype for how to separate who creates mev bundles and who executes them ev bundles there are like downsides to this row because flashbots right now runs its own private relay right they control in theory who can access the private relay and who can't access the private railway and they also actually control whether the relay is up or not

um and the other thing that they control is selecting which miners or eventually validators would be on this white list because you don't want validators on a white list for a relay that may take an mev bundle um and act maliciously against it so whether that means running and keeping the mev for themselves or sandwiching a sandwich so to solve that problem of possible mev centralization and actually there was a really interesting talk that vittala gave on this last week uh i think in a bucharas conference together with the guys from another mind we have a proposal for proposal builder separation baked into the core ethereum protocol and the the notes to vitalik's presentation are included in the reference to this this presentation

and lastly in terms of risks we have that withdrawals may trigger a very high churn rate for validators so the best possible solution for this and also the triggerable withdrawals that we mentioned earlier is creating a generalized message bus so uh the team at lido like our crack technical team and devs have come up with a way for the execution layer once we're in the post merge world to communicate with the beacon chain in order to do and execute any number of predefined set activities according to like an abstract message model we can allow for triggerable withdrawals it can allow for key rotation so for example if you state uh ethan lydo when we were still using a 9 of 11 multisig to control uh deposits

and withdrawals you can rotate those keys without having to fully exit the validators and then re-ingest them into the protocol and it'll also allow most importantly for skimming of staking rewards so this means that for any balance above 32 eth on any running validator you will be able to take out that balance over 32 eve move it to the execution layer and then potentially compound it by reinvesting it into the ethereum protocol without having to exit the validator fully and then re-enter all of those validators plus the new validators from the the compounded interest so what can you do as a staking operator or a staking pool or a user so if you're solo staking

and you're running a non-majority client that's good if you're running a majority client that's bad like pick another one so right now techo has one of the lowest percentage use rates but it's actually the most profitable client in terms of uptime and inclusion distance and also started learning about ssv because ssv basically allows you to share the technical and operational burden of running a validator between other parties that you may or may not trust it doesn't matter because it's a multi-sig so it can work however you want it to if you're a staking protocol or node operator be open about your performance data and client metrics so we started an initiative at lydo last week to collect all of these major metrics and within the end of november we're going to be releasing all of these

to the public for lido in aggregate and also about what our plan is to improve validator diversity if we need to uh thirdly be an ecosystem steward so that means putting forth and lobbying for improvement proposals that will benefit all stakers and network health this is like the generalized message bus that lighters team came up with or the 0x03 withdrawal credential proposal that uh giorgio's costadopoulos came up with on the eth research forums and most importantly as a user be an active participant in the staking in the core protocol governance so like we have ldo and ldo's our governance token but if you're not voting with it and if you're not voting with your money as well then you're not really driving the protocol to make the changes that it needs to so

research research contribute and lobby for the features that you want as a user and ultimately hold the staking pools that you use accountable thanks so i think we also have some time for questions if anybody has any okay thank you