On Decentralizing Lido by Jorge Arce (@0xjorgeth)

Transcript

all right good morning everyone so thank you for the introduction um yeah I am Jorge Arce block singing and cryptography researcher at nethermind today I want to tell you guys about some of the work we have been doing uh alongside Lido uh we as part of the nethermine research team in order to support them in their goal of having a permissionless or moving towards a permissionless operator is set for Lido okay so I would like to start with sort of like a big picture recap of what what are the fundamental problems behind liquid staking and why what motivates some of the design choices regarding the security and and how to make these protocols make sense I think the main one would be when you're dealing with

liquid staking and any form of delegates taking for that matter so how do you incentivize operators to behave correctly when they are handling delegated stake because the issue here is they are taking funds from other parties and they are putting putting them up to stake so if they get slashed for example uh these are not their funds that are going to be losing and in this like fundamental change in the incentive structure makes it so that you need a different mechanism to establish trust with the node operators and whichever mechanism you end up choosing is gonna shape how your liquid sticking protocol ends up looking pretty much so let's go over the two most uh common approaches for like the main uh

I guess lines of attack against this problem let's start with the case of rocketpool for example um we know that the way rocket pull this deals with this problem is it's sort of like a 50 50 distribution of the of the stake between a staking pool and the node operator right so the node operator puts up 16 eth of his or her own collateral and then the rest of the it comes from a pool this is great in the sense that uh there are very few centralization or cartilization concerns amongst the different uh or amongst rocket pool validators because they're running independently they're running permissionlessly it does have the problem that it is harder to start a new to spin up a new rocket pool validator in the sense that

you need to have that Capital available now on the other hand we can think about an approach like one lighter follows which is a whitelisted based approach where the white list is curated and chosen by a Dao this has the great advantage that it's easier to start new validators essentially like a node operator is not going to be limited by his own his or her own capital in order to start up new validators they can pretty much uh stake all of the funds that they are delegated as long as their infra allows them to but it does have the downside as has been discussed a lot in the in this in the space in the community of like the centralization and cartilization concerns what happens if

the Dow is taken over if it takes uh malicious decision sort of a malicious vote passes for example okay um so here's a chart of Rocket pools or each deposit pool and its balance as a function of time over the last year and so what what this means is this is the stake that is sitting in rocket pool waiting to be staked and so for example check out after October 2022 all the way down to well this month and you see that the pool has been full for most of the time this is 5K eth that's sitting in the pool and has not been able to be staked so far it's

waiting for a node operator to come up with the collateral to spin up a new validator and so we use this as evidence or us like a supporting point to the fact that decentralization is important for sure and we definitely should have all liquids taking protocols move towards decentralization but so is capital efficiency the ability for a protocol to receive new funds and stake them as quickly as possible is essential for uh like how well it does in terms of market share and just how friendly it is to attract new capital and here's like the current state of affairs regarding staking we see a

lighter sitting I I scraped this data yesterday hopefully it's still um accurate so lighter is sitting at around roughly 31 of stake and we have a rocket tool sitting at a 2.4 percent of stake okay so with that introduction out of the way we have discussed what is rocket tools approach what is Lido's approach we have discussed strengths and weaknesses for both of them now let us talk about how we want to move forward and how we want to improve the situation so the goal that we have in the research team with um with Lido is for us to design a mechanism that is going to check the following boxes we kind of want to like

get the strengths of both approaches in as much as we can and so one of the sign a mechanism that allows nodes to onboard the network without requiring permission from a central Authority or governance it is okay if there's still a white list for um permissioned operators that are allowed to get more stake for example but we would like there to be a way for permissionless operators to get in without um having to to to go through this whitelist approach we wanted to not be entirely dependent on bonding and the reason for this is that uh when when we use bonding as the only mechanism to guarantee the correct behavior of our validator set the capital efficiency goes down and this is

the concept that we're referring to before with this rocket tool chart and finally we would like the mechanism to still prevent or mitigate misbehavior of the node operators okay so having said that and trying to get to combine these approaches of okay decentralization while keeping Capital efficiency as high as possible what are some of the approaches we can take and we were brainstorming with uh with Lido and we have some ideas that this is by no means an exhaustive list because in fact there's a lot of the research that still needs to be done but the first things that would come to mind are as follows

if you're not using bonding as your mechanism to establish trust then it is likely that you will have to rely on some form of well Identity or reputation that you can use to establish trust with your node operators and this identity reputation can come from a variety of places it can come from data sources whether within web3 or outside web3 let's even say web 2 sources or even real world identity sources if we could find a way to make a mechanism like this work in an automated fashion and in a way that is respectful of privacy as well then this could be an approach also tracking the node performance of operators our formationless operators in

order to increase their reputation over time that's also something we can do and in the cases where you have a new operator coming into the system and you absolutely cannot establish trust because you don't have enough information on the on the operator then you could still use bonding but you don't want to use this as the sole mechanism you also want the the operator to have a way to climb up its way on on its reputation or how much trust the protocol has has in them without having to realize exclusively on Modern for this and finally another approach that is I think it's going to be absolutely beneficial for the entire staking landscape it's related to a talk we just heard on DVT DVT can play an amazing role as a buffer

against misbehaving operators because if you're able to for example pair trusted nodes with untrusted nodes in in a DVT pool this can essentially uh will diminish or nullify the effects of a malicious operator within uh a validator and the stake it controls now you you could say that there are potential problems if you're using identity and reputation as sources of uh establishing trust with node operators and you would be absolutely correct and two problems that you have to watch out for in particular would be the first one are is civils so if you're using some Identity or reputation system you

don't want to party or like an entity whether this is a person or an organization you don't want them to control multiple operators behind the scenes you don't want them to spin up a bunch of identities that supposedly belong to different people but are in fact controlled by the same person get into the protocol and then get to control much more stake that they actually should this is a problem it will let it happen the second problem would be white labeling in which um we understand by why labeling having a party that is already a part of our protocol and it for whatever reason it doesn't want to run its validator duties it when it delegates those duties of like running the infrastructure to another

party in this case the white label operator and the reason these two things are especially harmful is because we are going to get a secured image of what our validator set is actually when these if these attacks are successful we're going to have single points of failure and we're going to have uh malicious acts would be much more harmful in the sense that we could have a single party behind the scenes controlling much more stake than they should okay so let's put all the pieces together let's talk about the road map a roadmap that would make sense to address all of this the approaches We are following or like the step-by-step approach we're

following here is where following different phases of research uh the first one would be phase one in which we looked at the identity problem and what kind of tooling is out there in order to make this happen and so we uh did this a systematization of knowledge for decentralized identities and verifiable credentials and so this phase was completed late 2022 so last year and I will tell you guys more about it in a in a minute and this is currently where we're at phase two on white labeling resistance which is uh the stage of the research that we want to undertake next and for the future we have planned out uh civil resistance and how to score or

determine the reputation of node operators and finally an implementation phase okay so let's talk about phase one of the research that has already been completed so in this in this phase of the research we are studying what tools are out there that can be used to bring to construct an identity mechanism for Lido and we wanted to look at the centralized identities and verifiable credentials as a way to handle these identities in a way that is as permissionless as possible so decentralized identities for example

in the words of the ethereum foundation um they underlie the idea that identity related information should be self-controlled it should be private it should be portable so that sounds a lot like what we want to move towards and regarding verifiable credentials these are also a crucial piece of the puzzle in the sense that using them users can prove to a verifier that a set of claims about their identity is true so verifiable credentials are going to allow you for to have privacy and to reveal only the necessary identity data that you need to reveal in order to establish Trust okay let's come back to an approach that we discussed earlier on how we can meaningfully populate these identities

in order to identify node operators and so this is the idea that we can find multiple sources for this identity whether coming from off chain or even on chain and use them to well establish the identity of operators so what could be examples we have some sources of data in web 3 such as nfts Soul bound tokens even like the history of ethereum accounts we also have but we want to like look beyond that and see if there are any valuable sources of reputation outside the blockchain space that could be bootstrapped into web3 and be used for our purposes so think of like web 2 Services where people already have reputations related to their technical activities or to their

um influence in the ecosystem so let's say reputation scores on places like stack Overflow stars on GitHub or Twitter things like this now we have to be careful if we were to follow this approach because we must use data that cannot be farmed easily that is rare enough to obtain and we need to have mechanisms to prevent the sort of uh let's say someone decides to start spinning up Twitter accounts just to try to game the mechanism so we need to have heuristics in place to determine or to prevent this from happening and finally there's a rational of this idea of how to pull the data on chain in order to populate our identities is once again use data that is valuable

enough in order to increase civil resistance and then the challenge here would be how do you want to pull this data or how can we pull this data in a verifiable way so that the system is not likely to be exploited and so what did we check as part of our systematization of knowledge we took the work of surveying over 100 academic papers and implementations regarding identity we sorted them in terms of like quality in terms of relevance to the problem at hand we look through them and we decided to keep 70 of them that were worthy of mention and so we look for example at

verifiable credential schemes from classical papers all the way to the 90s to like more modern approaches we looked at how to ensure that the user cannot pull the verifier this is a crucial step to guarantee the soundness of the protocol and how to protect the privacy of users as well on the centralized identities how to show statements efficiently how to issue credentials in a way that's decentralized and what implementations are out there that we can use today or that we could get working for our problem with some minimal changes and regarding getting data to web3 This was um if you guys are interested in looking at the deliverable here's a QR code that's going to take you to it so we constructed like a database with all the different articles we have them sorted

by year quality score relevant score uh we label them according to whatever um to to the topic that they refer to and each of the papers has a note by us on how it can be relevant to the problem what are the merits of each approach and what are potential downsides as well all right and so let me highlight some notable implementations from what we found we found for example polygon ID which is a system that allows us to manage identities and also make zero knowledge

claims about the identities we found sismo which is a protocol for the creation of zero knowledge attestations we found some protocols that already are looking at this problem of how to integrate real world data and pass it over to web3 and with on protocols like candid which uh proposes a mechanism that can work for identities of people who live in the US we found ebsi which is a mechanism that can work for people who live in the European Union and finally we found interrep which is an anti-civil service that analyzes this problem of having web 2 Data or web to reputation and bringing

it over to web3 another of the good pieces of infrastructure that we found that can be useful for this problem is called deco so what Deco does is it allows you to get data that is behind encrypted behind a TLS connection without any TLS modifications to the to the server side so it is privacy for servant as well and the way it does this is when you're having a deal when you have a TLS connection with a given service let's say it could be Twitter GitHub or what have you then the client side which is the person that is interacting with the service can be split into two roles approver and a verifier which is going to be an outside Oracle that is

auditing this connection and at the program the verifier can perform the clients jobs via secure two-party computation and in this way information about what's going on in that web 2 connection can be extracted and uh verified so after doing all the research after looking at all of those articles what are like our general takeaways on following this identity approach well we have some positives we have some negatives positives are we have interesting projects that are already trying to make verifiable credentials a part of ethereum and we have viable approaches to getting webto data to web3 as we have already a certain and some of the approaches even go to

deal with dealing with real world identities such as evsi for the EU candidate for the us as I already described if you would like some more information about this then I would encourage you to consult the the deliverable that we were talking about we also found some negatives for example many of the solutions required a centralized issuer however there are some solutions that allow you to issue verifiable credentials without a centralized issuer and we would like to take inspiration on those there are also some problems with standards for the IDS in the sense that there's not a lot of there's not like consensus on what should be like the implementation guide or standards or guidelines to have like

sort of like a common set of tools that look similar and that we can adapt and and modify if needed and finally finally not many of the projects that we looked at relating regarding to a identity try to fight civils and this is a problem of course because an identity approach or reputation approach is going to be very weak to civil to civils on its own so we're going to have to look at this um angle of the problem on a different phase as well okay so that's regarding identity now we haven't looked into the implementation of an identity system yet because well there's a variety of reasons for example the Lido team is right now very busy working on withdrawals which is of

course quite the priority and also we want to look at some of these uh questions from a theoretical point of view before we jump straight into implementation and now we want to talk about the next one which would be perhaps the next one in priority which is white labeling and white labeling resistance so we currently have a proposal going on on Lido's uh Research Forum and it's currently on Snapshot for the Dao for the token holders to vote and in this proposal we propose a roadmap I think it's like a 22-week role model research which is going to look at the following tasks we want to look at white labeling and we'll do and do a systematization of knowledge on the literature and the relevant approaches that are out there

we also want to look at Arbiter protocols for reasons that I will explain next things like decentralized oracles prediction markets token created Registries and decentralized justice we want to look at how these can be put together to design a resolution mechanism and finally how we can have heuristics against civils and white labels so using off and on change signals coupled with heuristics or machine learning classifiers even to find uh probable civils so what's the deal with arbitrary protocols which is one of the main lines of of our research or one of the main things that we're trying to look at here with Arbiter protocols the idea is that we could have a settling mechanism that

could take evidence that was gathered either from off chain or on chain about a given operator being currently a white label because these things do get out eventually and or a motivated investigator can pick up some of the signal this evidence would then be presented to an Arbiter protocol or some kind of settling mechanism that would look at the evidence and determine whether uh the operator should be deemed a wide label or not and so examples of protocols or mechanisms that could play this part apart from like the centralized Justice protocols like let's say clearos are things like prediction markets where people bet on future events and so here the idea is that

establish the economic incentives for people to tell the truth and to be interested in participating of curating the validator set decentralized oracles as well as a way to get all of this off-chain data on chain all of this off-chain evidence of on chain and token curator Registries too where our token holders can collectively vote on an enter to be included in the registry for them to once again curate the validator set once again this is all still in in very early stages and these have been some of the ideas that the lighter team has been interested in us looking at and that we have been interested uh of our own volition as well into looking at and I would like to close this talk with

uh once again reminding you that the proposal is currently live and if you guys are ldo token holder so if you know any ldo token holders we would invite you to vote for our proposal and oh well whatever yes or no we would like to invite you to participate to speak your mind and well we would definitely appreciate uh a support at your support so that we can continue looking into these problems which I think especially problems like white labeling and civil resistance are not as well understood or they do not have as many solutions or tooling available for us in the web3 space and whatever we built we would hope and whatever we research would hope would benefit uh not only lied about the

ethereum community as well so once again I just want to close this with a call to action to all Leo holders who would very much appreciate your support