Economic Security in Optimistic-Style Challenges

Transcript

economic mechanisms. So, I'm not sure everybody is familiar with optimistic mechanism, but it's a very simple. So, in optimistic mechanism, so in blockchain, the execution cost is much higher than normal system. So, to the the calculate such values efficiently, there's was optimistic mechanism proposed. So, in this system, the proposer the post a value without any proof. And if the value is wrong, then any verifier can tackle it like send challenge.

And even if there was no proof, the smart contract can verify such challenge is valid or not. Then after that, the if challenge is valid, then the proposer the deposit is confiscated in this is sent to the honest verifier. So, in this way, most of cases proposers do not post a wrong or fraudulent value, and the blockchain can um execute the systems efficiently. So, and this mechanism is widely uh applied in the roll-up systems.

And this is very simple. And so, so optimistic mechanism operate under one very simple assumption. That is there at least there's one on honest verifier exist. And it looks very simple. But how easy is this assumption? So, my question is that what does it promise to participants, verifiers, proposers economically? So, it will take confiscated bond, but how much of the bond will be effectively a promised, and how much of the economic profit that verifiers will expect? Cuz in most of the cases, the

only correct values are posted, then why do honest verifiers need to verify? Then also this is related to verifiers dilemma, the so-called. And so, and actually this is not really discussed enough cuz of centralization. So, in optimistic optimistic roll-ups, I only know only single fraud proof case. And that was the optimistic roll-up called Croama. And even if it was only single case, that was caused by the bug of the proposers code. So, so indeed, there was no single

valid fraud fraud proof case. So, we so I think it's not because optimistic mechanisms are efficient. I guess it's rather about the centralization of the proposer environment. So, previous works were mostly explored the the evil the verifiers. So, in this two challenge and defend, the you need certain amount of the bond. So, in previous works like a bolt of Arbitrum or Dave of Cartesi, they they explored and thus analyzed this kind of

situation. So, if there are many evil verifiers, even if there's the claim is invalid, then honest proposer will not be able to prepare all the bond to defend all the evil claims. So, this was the most of the focus in the previous works. So, my talk is about the different based on different scenario. So, it's about evil proposer. So, it's very simple that even if there's the evil proposer, there's honest verifier. Honest verifier will take reward, and the it will be wrong value will be challenged. But what if evil evil proposer can be evil verifier?

This is decentralized environment. So, even if like evil proposer post a wrong value, and he can self-dispute, and he will get confiscated bond, and my money comes back to my wallet. Then it will say, "Oops, sorry." Yeah. Then then what is the point of this system? And so, in this talk, this is just a simplest scenario, not focus of the talk, but so in this talk you will learn about the the worst the proposer scenario, and also the incentive analysis based on it, and evaluation of the existing roll-ups based on it, and also mechanism direction for such roll-ups.

So, what is the worst proposer scenario? I just introduced the evil proposer can be the the only like a evil verifier, but I'll assume there exist honest verifiers, but also um oh Also, there will be the the evil proposer participating as civil verifiers. So, what is the properties of the this system?

Sorry. So, self First one is self-funding. The reward comes from the proposer's bond. And second, that is decentralized participation. Anyone can be the verifier. But like some roll-ups have some white list, but let's say there's a decentralized participation is possible. So, proposer also can participate as a verifier as as many accounts they have. So, if I when I read this assumptions, the properties as a evil mind, then I can read first first property like this.

Then oh, that the reward comes from my wallet, then it's originally my money. I should take it back, and then using decentralized participation, I should participate if you if there's an honest verifier will participate, then I also participate to take my money back. So, the worst case scenario is like this. So, attacker is not just a fraudulent proposer. Proposer will participate as verifier and the civil verifier as much as possible, and this the civil verifier will appear only if the honest verifier's transaction is observed.

So, so uh it's about so mechanism design what I what I want to say in this optimistic mechanism should be based on this kind of worst case. So, security is preparing the worst case. So, simply giving all the rewards to the verify verifier is I think it's about optimistic case of the optimistic mechanism. But what I want to say is that based on this worst proposer case, we can calculate and calculate or consider proper parameters for such reward and the punishment.

So, my only leader to this work is presented in the first week of this month actually in WTSC. So, my pre- previous work says if the optimistic mechanism is based on a fee or proposer ordering based, then this this security doesn't work at all cuz imagine the second price auction to be the first challenger. Let's say if first challenger will take the reward from the bond, then there will be the can be the competition to be the the first challenger. Then if it's a second price auction, then the winning winning auction price will be

the exactly the reward of the optimistic the the mechanism, then honest verifiers will not have any motivation to join it. So, current the optimistic mechanisms are very vulnerable for front running. And there's a competition to be a first challenger as a like a fee competition, it doesn't work at all. And so, assumption in this talk is the fair transaction ordering opportunity, and second is no white list of verifiers, and third is no trusted private mempool. If there's a trusted private mempool, then it will work.

Here are two core questions in in my research. So, first one is how much of the deposit does the attacker should lose? And do honest verifiers have sufficient incentive to participate considering this scenario? So, here are parameters parameters to model. For the Q1 is the first one is deposit of the proposer, and second one is the reward fraction, and third is civil's cost. And civil cost is actually can be considered very low cuz to challenge there you need a bond, but bond doesn't mean uh bond doesn't mean exact cost cuz the after value challenge, the the civil challengers of

the fraudulent proposers will will make value challenge. So, if it's a valid challenge, the bond will returned. Then bond doesn't mean exact cost. So, the attacker can just borrow the big amount of bond, but actually the challenge period is very short like uh can be 1 day to like a week, then the actually the the landing cost is very small. And also I uh assumed the APR as a 5% for such bonding uh cost.

Also, another point is that uh recently some rollups are uh transiting to ZK fraud proof, but ZK fraud proof uh also allow the civil um uh civil attack civil verifiers. So, and because of the ZK fraud proof, the uh one example is OP Kaluwa the adopted in BOB, and they their bond is bond for proposer and challenger is uh 0.5 Ethereum. That is quite smaller than uh other the rollup systems. And this also this makes the such civil attacks more severe cuz the borrowing the this

half Ethereum is very um cheap for such a short period. So, core mechanism about uh this consideration actually it's about alpha. Alpha is uh uh the the part the Alpha is a reward fraction of the deposit. So, if deposit is 10 years Ethereum and alpha is the 0.3, then three Ethereum only will be sent to verifiers as reward. And the the in Arbitrum Bold,

only 1% is sent to a verifier, and other OP system 100% of the deposit will be sent to verifier is extremely different, and it will change the the the result. So um if we increase the alpha that's a more reward, that it means the more verifiers will participate economically, and attackers inject fake verifiers to capture reward also. And if we we set alpha uh less than before, then the less reward still even if there should there are more civil attackers. And but another the problem is that if

reward is going down, then the honest verifiers will not appear. And uh this is the exact relationship I got from the modeling, and so the the the loss of the attacker uh in the equilibrium situation is such eta, and this is modeled as such formula. And with this analysis, I got this result. So, in Arbitrum Bold, the because of the only 1% of the the confiscated bond is sent to the verifier, the 99% uh most of the most of the deposit is lost by from the attacker. And the in OP Stack, um only

3% is 3% is lost from attacker, and OP Success Light 11%, and OP Kaluwa 4.6. And another point is that the in Arbitrum Bold, the bond is 3,600 Ethereum. It's actually it's really high, and um I think it's actually barrier barrier big barrier for the decentralized verifier the environment. And the in OP Stack, uh even if the the maximum bond is 315, the only 3% 3.1, so nearly like a 10 Ethereum will be lost by from the attacker.

And in OP Kaluwa, its bond is half Ethereum, so the its loss is nearly negligible. And um another the analysis I performed is the collapse cost. So, I I calculated how much the the very civil verifiers will appear than the honest verifiers don't have any motivation to join this join this the decentralized the verifier ecosystem. So, it's in Bold, the the the initial bond is very high, so it's very high, and the OP Stack 25 Ethereum, and OP Success Light or Kaluwa it's very

negligible. So, actually this means not their system is easily collapse, but it's about actually the in OP Success Light or OP Kaluwa, maybe honest verifiers don't have any economic motivation to join the system unless they have a very crucial app in their L2. And so, the Bold is very different. They set like a 99% of only 1% of the bond to be sent to honest verifier, but another the problem is that where does where will do 99% of the confiscated bond go? It goes to Arbitrum DAO. And then I didn't find

where how the the Arbitrum DAO will handle this 99%. But but as the first scenario, what if the proposer is operated by Arbitrum, and 99% of the confiscated bond go to Arbitrum Arbitrum DAO, and actually it's kind of same entity. I mean, I I'm not saying like Arbitrum DAO is just a center entity uh operating the proposer system, but uh many people doubt that many of DAOs are actually the center entity. So, actually it's very ambiguous like 99 why where do 99% of confiscated deposit will

go, but but actually there was no fraud proof case. We don't know. And uh as I mentioned the small deposit like a limit the such design space for motivating honest verifier honest verifier, and also demotivating the proposer. So, the it's it's kind of rigid. So, how should such proposer should be like improved or changed? So, first thing is what I want to say is a big part of slashed account the the deposit should be burnt. Like a why should we give to everyone? Like a to suppress attackers to

try such a fraudulent proposer. We we can like a burn like half percent 60% 70% of the deposit, and give rest of it to the attacker. We We I think we don't need to give such big part of the deposit to DAO or something because there's a possibility that DAO is also kind of and same entity with the proposer. And also, while modeling I found that in OP Stack the by such bisection games make this incentive calculation very tricky. So, the we don't know like how much of depth of this bisection game in like a general situation. So, like honest verifiers will have difficulty to calculate exact

like honest the the profit of such a situation. And also the So, assuming the decentralized ZK market is act active, then I think it's better to uh transit to such ZK fraud proof for the clear the economic uh calculation, not not just for the one shot fraud proof. And also, the lowering the what I lowering the challenge entry barrier like a half Ethereum is good really good intent, but it actually demotivate honest verifiers. So, I think it will be nice to have very low bond required for

challengers, but I think at least they should make proposers have a real large bond to do such an attack. So, so uh even so, in this scenario, proposers will self-dispute, then someone can ask, then what is the point? Uh so, even if this activity itself doesn't make any really good um profit, I think this kind of attacks scenarios can be um can be used with other attacks. For for example, like in there was a selfish mining by Cubic to Monero. I analyzed it, and Cubic didn't make like actually

it didn't make any profit. Like the performance was lower than honest mining, but because of the this kind of attack, the Cubic got a lot of attention and kind of reputation. And so, someone say it's actually it was modeled as a gold finger attack. So, in this kind of situation, for example, if it's a decentralized proposer environment, like in in the market, like if it's a OP chain, then then if I'm an attacker, I make short position to the OP OP coins, and then make the fraudulent the fraudulent the state, and self-dispute, and I think I can make more than the

such little losses in in the market. Yeah. And that's all, and thank you for listening my talk. Uh thank Thank much. Do we have uh questions, comments from the audience? Maybe let me step in with a question first. So, how do you see um this being implemented in practice? Is this purely theoretical research, or do you see already implications on how this can be deployed? Uh I think there I think the there really needs to the changes in implementation. I think the the dispute mechanisms are uh for example, bisection games are quite complicated for the most of the

verifiers, and also uh as I mentioned, there was no single real fraud proof case. So, we really don't know what will happen in if fraud proof like um the fraudulent the state is proposed. So, at least the parameters should be modified to to restrict such a such a the evil proposer cases. Another thing is the most urgent thing is that these mechanisms are really vulnerable again from the front running. So, at least that should be changed, but actually it's a bit tricky. So, to So, my one assumption was fair

the challenge opportunity based on fair ordering, but actually there's no fair ordering in Ethereum. It's a usually fee-based, and some people can try the flash board protect all some private pools, but you should know that if you're if you can approach such private mempool, then attackers can approach private mempool, so yeah. Perfect. Um Any further research directions that you would want to explore based on the work that you've done?

Uh yeah, I'm actually the improving the the modeling part of the this work, so I'll be um releasing the paper after some refinement. Yeah. Thank you so much. Very much looking forward to it, and with that I would like to close the session before lunch, and uh thank you so much for your participation. Thank you. Thank you. Uh we will reconvene in 1 hour, I guess. Yeah, 2:00 p.m. Thank you so much.