DAPPCON 2024: Do We Really Need PBS? Solving MEV At The App vs Infrastructure Layer - Felix Leupold

Transcript

my name is Felix I'm leading the technical development at cow protocol and I'm here to talk or question um more so the direction that we're currently taking maybe as an ethereum Community um asking the the question if you know does ethereum really need PBS or are there other solutions to what we think is a you know fundamental problem me and can it be solved only at the infrastructure layer or can it be solved at the app layer before I start I want to give a brief history of how we got to the point that we are now with the discussion about enshrining PBS and basically really committing uh to infrastructure solutions to this problem of me and my history starts in uh November 2020 when a research Collective around Phil Dean

and his um PhD um colleagues at at um Cornell and some other researchers in the space founded a research colle Ive that was called flash Bots and that coined this term which became very influential in the etherum ecosystem me and the goal of flashs was really to hit the problem of n head-on um and tackle it um via three main kind of goals to illuminate distribute and um democratize access to Meb but let's first maybe look at what Meb stands for I think a lot of people know the acronym it stands for basically any value that can be extracted from the part that produces a block on a blockchain um by deciding The Ordering of transactions within that block the

most simple example is if you're minting an nft and there's a limited number of them let's say 100 but there's 200 people who want to get that nft and you're the proposer who creates the next block it's up to you to decide who of the 200 participants actually ends up getting that nft and if you are a big nft fan yourself you might even include your transaction first to make sure you get the very first version of it and so the first thing that flashboards did was um illuminate what they would call the Dark Forest the games that were being played in the public men pool around transaction ordering and the value that was extracted from users by doing so they created a number of um transparency dashboards this one is one of the more recent ones that only captures the value

extracted since the merge but that basically showed how much of a problem me really is it's a billion dollar a year kind of value that's being extracted and um at least the data that we see here is a lower bound because there's a lot of value and communication that are not actually visible on chain so the true meev that's being extracted is likely an order of magnitude more and that doesn't even take into account all the me that would be created if we got a lot more users on chain and at least in our mind solving me is a prerequisite of getting you know a million more users on chain because if there's no safe and secure ways to make sure you're not being taken advantage of um you will reside to other other

Solutions um but let's go back on the timeline um it is 2021 after Illuminating the Dark Forest um flash whats went on to democratize access to meev by creating a um client which was basically a fork of G that they called Meb and which gave block producers which were called miners at the time a way of communicating with another party um for the extraction of that me and that party was called the Searcher miners were traditionally very good at getting access to cheap Hardware cheap electricity but they were not defi Deans that would understand the underlying protocols and optimize kind of the games and strategies you could do in um

reordering including or censoring transaction in meaningful ways what Mev basically was was now an auction protocol that would allow the block producer to kind of sell off the right for in for for proposing the correct you know the the most value extracted version of the block to an external Party The Searchers um and basically have an auction for the Searcher that bids the um most for what they would call a bundle just an ordering of transaction uh end up getting their their bundle included on chain um we can see here that Meb G basically created a huge amount of extra revenue for the miners that opted into the system an order of magnitude um

larger block rewards if you were a participant in that Mev gu um protocol and you use the extra revenue from the Mev versus if you were uh just sorting transactions the vanilla way that that g would do um and so Mev found a lot of adoption I think just before the merge it was around 90% of blocks on proof of work ethereum were produced using Mev um and this was somehow kind of possible and easy because proof of work was very centralized there's only five roughly five or a handful of different mining pools that producing the largest part of blocks and all that kind of you know this flashboards had to do was to convince those um five mining pools to adopt Mev um and and and basically they could reasonably do so because there were so

few of them however one of the fundamental problems of the Mev approach in proof of work was that there was a trust assumption um inherent to the auction the Searcher would not be able to just reveal the bundles that they have found kind of straight to the minor and say Here's here's the me that I found please go and extract I will pay you 50% of it because in that case the minor could have just taken that bundle replaced the transaction of the Searcher put in their own address and taken 100% of that of that value now this kind of trust assumption is inherent to this this new you have Searchers you have you have block producers and but it was not such a problem in proof of work because the block production process was such a

repetitive game if there's only five entities creating blocks and it means like every minute you are creating a new block if you were to violate that trust ass assumption now just to get maybe one or two more eth in the current block you would lose up all the revenue in the future blocks because no Searcher would reveal their content to you anymore however in proof of stake our vision was that we would get on to many many different solo stakers Each of which would maybe produce a new block once every four months and so that trust assumption and that repetitive game that violating trust in one round of the game would you know sacrifice your entire revenue for the future is much more of a big problem if you know all you really get is one block every four months and so I guess if we hadn't thought about

PBS if we hadn't introduced PBS at the time what would have happened is flashboards would have gone to the big staking pool um got them involved into you know continuing to do the me stuff and working with Searchers and the solo stakers would have kind of been left out because you cannot really trust them but that would have led to significant centralization on the validator parts big mining pools or big staking pools would be able to get more revenue and so they would be able to ACR more and more stake centralizing the protocol further so what um the E ethereum foundation and also in balic post kind of suggested was that we split the task of creating consensus around what is the next block kind of more on a high level you know what is the block header and and attesting and validating blocks to

this core decentralized solo staking incentive cabable um group of people and have another task that is more specialized more complex uh which is actually creating the full contents of the block which transactions go into what slot to a different party which would be called the builders so we can keep proposers highly decentralized there's no advantage in being a big staking pool or a solo Staker as long as you opt into this again um auction system where Builders kind of propose blocks that you would adopt and you as a validator only have to take the highest bid and not worry about finding any Arbitrage or finding any other me yourself so you know this is great um great system and great in theory and and

also flashboards agreed to adopt this system and and basically build a proprietary version of PBS which they called Mev boost Mev boost got huge success in the first three months after the the merge and I think today about 95% of blocks are built using um this version of PBS however the the fundamental trust assumption that we had in Mev Geth and that we're you know trying to also somehow like model with with PBS remains is that the Builder or whoever finds the me cannot just simply give out the blueprint and Trust the proposer that they will not you know unbundle the block or change some of the the the blueprint for themselves but at the same time the proposer can also not just say hey Builder just give me a

block header and I'll will attest to it because if the proposer attests to a block that's invalid um or you doesn't actually get revealed at the end they also lose out opportunity cost and potentially even um get slashed in the in the proof of stake protocol so one of the core components in PBS is this middle layer the the so-called relay um which bridges that Gap and again takes something that is maybe not so repetitive in the game like a proposer only validating a block every four months and makes it a very repetitive game Builders will not submit their block blueprints to a relay if a relay starts leaking the content of the block Blueprints and proposers will not request um blocks from relays that have been known to give them invalid blocks

or blocks that end up um you know not getting revealed on chain later and so we ended up again with like this somewhat Central component that that involves trust and now the idea of enshrining PBS is to um I mean basically apply the fundamental theorem of blockchain engineering which says that well any um any problem can be solved by just introduction of another consensus committee and basically you know try to put that relay into the core layer um by virtue of adding well adding a new um adding a new consensus committee um I don't think this version of PBS is final yet I also don't want to go too much into the uh the details of how it works under the hood uh but basically you will have then uh the validators which are

fully decentralized attesting to the block headers and then you'll have another committee and the builders who are um responsible for revealing the block content separately but needless to say adding another committee adds complexity to the chain and um it's not even clear that enshrined PBS will be adopted because whenever you try to build something into a peer-to-peer layer you're taking some trade-offs which you don't have in uh the existing system some Advanced features of of um relays today are for instance Builder bid cancellations so if a builder changes their mind and doesn't want to um pay 10 eth for the block anymore but only 9 eth they can do this today um and also more Advanced collocation Techniques where you're trying to really

shave off milliseconds of latency by being very close to the relay or very close to um to to the Builder are things that just simply do not work in a fully peer-to-peer system so even if we enshrine PBS into the base layer it's not clear that big Builders and um you know large staking pools will adopt this as the only way of producing blocks so the question that I want to ask is is it worth to add all this complexity um or is there not another way of how we can um address me and I think um one slide that I actually also wanted to to just briefly mention one of the like kind of obvious drawbacks of of this proposer Builder separation is well it keeps the proposer layer very decentralized we have 1 million

validators that are proposing blocks but if you know the thing that's really important about blocks on ethereum is what's inside them and if the entities that decide on the contents of the block are just three that create here I think more than 90% of of today's blocks and two of them for instance apply some you know semi- questionable sensoring decisions to to the contents of their blocks then how decentralized is ethereum really like how how much value is there in having decentralized block header production if the block content production is is highly um centralized okay so this was my rant let's let's now go and and try to um try to find an alternative on how we can solve

this um before we do so I want to go through a few more types of me that are kind of at the core of this problem and contributing contributing to most of the value that is being leaked um today the first one you probably all know uh swap me uh commonly known as sandwich front running back run if uh you go on a me aware block Explorer like this one zero Mev and look up a trade that you may have done in the past on Unis swap or some other kind of traditional amm you might find yourself in what is known as a sandwich which basically um you have someone that is labeled as the minor so it might be the Searcher or the Builder uh that ends up trading the same asset that you are buying coincidentally just in front of you driving the price up

then your trade gets included at a higher price than you would maybe originally expect and then that same entity is selling the asset uh at the higher price because you just drove the price up even higher and makes a risk-free profit swap me is the most detrimental me to the average retail user but not the largest me in terms of absolute cost or absolute kind of value leakage um the largest is actually the Arbitrage that happens between centralized and decentralized exchanges which is also commonly known as lvr loss versus rebalancing and it stems from the fact that centralized Exchange move at a much faster Pace than the ethereum blockchain binance has a trading model of continuous time so the price on binance updates kind of you always

whereas the price of a Unis swap pool for instant on ethereum can only update every 12 seconds when there is a new block and so now let's say that the price of binance went up and the price um of Unis well stayed untouched for the last 12 seconds whoever now gets the first slot in the block and can grab that outdated liquidity from the unisa pool at I think $2,800 here can turn around to binance sell it for 2,810 and make a risk-free profit that difference is called uh loss versus rebalancing um and it's basically a uh a cost a tax that is paid for by the liquidity provider that contributes uh funds to Unis swap um you can see this type of me usually at the top of the block there

are many minor transactions that are buying the same asset kind of on different pools trying to sweep in all the outdated um liquid at outdated prices and paying a hefty tip to the proposer to get the right to be included in the first Slots of the block we also have um liquidations if you have an AA or maker position and your collateral becomes worth less then um the protocol might trigger a permissionless liquidation where anyone can buy the debt from you pay back their um pay back the back the debt on your behalf to seize your collateral which again creates some me because there's usually a premium for doing so and so people are racing to be just behind the Oracle update which got your position underwater there's two more types of me

which by and large are negligible in in terms of frequency or size um so I don't want to go much more into detail here um the thing that I want to do is I want to slice Me by uh a dimension which I would consider you know Dex related Meb and non- deex related Meb and what we've done here is we've looked at the um transactions that are not found in the public men poool but ended up on chain so these are transactions that have been communicated directly between Searchers Builders block producers and those are an indicator of kind of me transactions that that um yeah try to kind of have a preference on how they are ordered and if we then look at how much of those this is the value that they produce if we look at how much of those

transactions are involving some kind of Dex trade um and how many are not we can see that me is vastly vastly dominated by Dex related transactions so if we can get rid of Dex related me um my argument is we get rid of a large chunk of the me even the non- deex related meev on this slide is by is partially could be considered somewhat trading related because nfts are taken out of here and even some of the liquidations are not accounted for and so if we can yeah solve Dex me uh we are basically reducing the amount of Me by an order of magnitude okay so let's try to solve Dex M and and for that I want want to First

recap the root cause and kind of what do all these points that I had before have in common the fundamental flaw that I think we've been doing in depth design for the last five years or basically since ethereum is around is that we've built defi mechanisms on the false promise of continuous time if you trade on ethereum if two people trade on on on Unis swap in the same block those two people will get different prices so we are in this spot now where there's only some amount of information getting revealed every 12 seconds and The Ordering of how transactions are ordered in the block that gets revealed is up to whoever produces this block yet we have the same asset inside the same block trade at

many different prices here we have the most liquid asset e USD trading at 1% difference within the same block and this basically allows the block producer to look at all the different trades that are in there and say okay I'm going to create a transaction that buys at the lowest price and sells at the highest price and make a risk profit really to me that's kind of the the fundamental root cause of me or Dex me at least is the fact that the same asset in the same block can have many prices so how do we solve this I have to speedrun this solution it's basically what's implemented in C protocol I'm happy to talk more in detail also afterwards but basically first what we have to do is we have to break kind of the sequential processing of transaction that is

inherent to the ethereum protocol so instead of having people say I'm sending this transaction touching this Unis pool and that's my trade we need people to sign limit orders or how they are now called intents that say I just want to buy some ether and at the best price but I don't care which pool you're using because that then allows us to batch all those trade intents together into one big settlement transaction which together with all the other liquidity we can find on chain we can um solve for so you can think of this as like a market with the May with demand and uh Supply and we're trying to find a solution that kind of you know settles demand and Supply but

it aderes to one simple rule every token just has a single price per batch so if you trading ether and I'm trading trading ether and we end up in the same batch we are getting settled at exactly the same price because there's no time priority there's no concept of who came first who came second in in ethereum it doesn't make sense to have different prices now finding such a clearing can be a very computationally complex task in fact it can be intractable for larger problem sizes so what we need to do is we need to decentralize that solution finding off to a network of what we call solvers which can try to find solution candidates for our batch auction problem and report it back to the protocol the

protocol then scores those um candidates based on a goodness criteria which we call Surplus and picks or allows the solver that proposed the best solution to set the trade so how does this protect from me um I mean basically well yeah this is what we built with cow swap or cow protocol or at least the design has been heavily influenced by by this fundamental idea and um it it provides me protection for a variety of of meev causes that we saw on the on the previous slide first of all it protects users from SWAP meev um in the very simple sense even if you know even if you're just looking at intent based systems like Unis swap X or 1-in Fusion one thing that those intent-based systems allow is they allow you as a

user to just say I want to buy ether and I don't care where which makes it much harder for a Searcher that's trying to manipulate the price on a specific amm to Target your trade and well basically manipulate the price because instead of just having to address one unisa pool that you picked before they now have to kind of um manipulate the entire liquidity that they can find on chain more importantly by being agnostic to the exact rout that your trade is uh taking we can do some more optimized things like uh deciding to not actually match you against an amm but instead match you against another user that also wants to trade at the same time this is what we call Coincidence of once short cow it's where the protocol takes its name from and the idea is that if you

want to buy ether in the same batch as I want to sell it then why do we need to pay liquidity provision fees price impact and all this stuff why don't we just trade peer-to-peer um but even if we canot find a coincidence of one inside the badge maybe the solver knows that oh this person is buying a very liquid token there might not be a counterparty right in this settlement here but I'm sure in the next 5 minutes somebody somebody will show up and and take the other side so a solver might just take some private inventory risk and Market make your swap against you uh and you don't have to touch an amm and therefore are not exposed to me risk but even if your token is il liquid and you end up just swapping it the best route is just ending up swapping it on Unis swap it's

not you who's taking the me risk has to defend them against sandwiches maybe use a private meol or do whatever um more sophisticated uh entities in this space would do it's the solver that has bit for the execution who is now responsible for delivering that execution to you solvers are sophisticated entities so they can protect themselves from the risks of the public mol much better than users can and we've abstracted that problem of me away from the user but cow protocol doesn't only solve me for Dex Traders and swap it also solves the much larger problem that we've seen um of centralized exchange decentralized exchange Arbitrage because if we actually make the liquidity provider part of the batch

and also settle the amm at the new equilibrium price which if you remember the slide was much larger than what Unis swap was you know in the previous block then that entire difference that lvr that currently gets captured by the arbitrager but who has to pay 99% to the Builder who has to pay 99% sent to the validator gets captured by the liquidity providers and can serve as an additional income on top of LP fees as Revenue so we can really make amms much more profitable by making them part of the batch and also having them adhere to uniform price clearing and Kau is working on a product for that which um hopefully will come out soon uh liquidations honestly can also be solved in this kind of model at the end of the

day a liquidation is just a conditional stop loss order where you're willing to um sell your collateral once a certain price is is you know um yeah hit or it goes below the asset goes below a certain price it's not yet you know done in cob um specifically but we would love to work with projects to explore also how we can uh capture liquidation me um on the app layer rather than on the infrastructure layer now I was talking a little bit about centralization of PBS and the Builder infrastructure before of course one of the um questions we get asked also a lot well isn't cow protocol also going to get um centralized and there are a few centralization risks I think the most obvious one is well if the Builder

Market is centralized how do we make sure the solver Market doesn't centralize in the same way well we have been using uh or the Dow has been using C protocols tokenomics to incentivize a more um heterogeneous and and um like diverse set of of solvers to operate by not simply giving just rewards to the winning solver but also giving some what's called consistency rewards and making sure that we have a good coverage of um of competition on on kind of the the the the token pairs that that people care about and now the clicker died but um the other um centralization risk is well whenever you have an auction you might also have a need for for for some

Auctioneer this the thing that you saw in PBS it was called relay um but I think that for cob what we actually need as an Auctioneer is just a data availability solution we need to agree on what are the orders that were valid when a batch was kind of released to the solvers and then we need data Avail availability on all the solutions that were kind of proposed by solvers and which one is the best and even you know if we end up creating a lot of complexity I think it it will be simpler to build this than than ens shining PBS but even if we just need another consensus committee and also apply the fundamental theorem of blockchain engineering then at least that complexity is um localized to the Dex use case and doesn't affect General transfer or all the other applications

that we hopefully be able to build on ethereum that don't evolve uh decentralized trading and with that I want to close and ask you um to join us on the mission to fix the underlying mechanisms and not kind of work towards more CH more complex um infrastructure and and um load the Bas layer with all that complexity and um yeah basically thank you very much