Proof-of-Deposit – initial proposal and request for feedback

Governance
24

Apologies, we’ve been mixing up terminology a bit. I believe what you’re asking is:

Is a validator offering to share 100% of their epoch rewards with cUSD depositors an attack vector?

We stress that this isn’t an attack vector and is entirely allowed! A “malicious” validator taking such a course of action would be akin to intentionally mispricing an asset: e.g. trying to sell CELO for $1 or $100 even though the market price of CELO is $3. That is to say, you are free to do it, but you are much better off matching the market.

In our case, the result of a validator “mispricing” the proportion of epoch rewards they share with cUSD depositors, is that such a validator will end up earning less epoch rewards overall. It can be quite simply explained why this is the case:

  1. Validator M, the “mispricer”, “misprices” the proportion of epoch rewards they share with cUSD depositors by offering more than the market rate

    (a) The below also applies if M offers less than the market, but with CELO and cUSD switched

  2. Initially:

    (a) CELO stakers will start moving their votes from M to other validators as they will get a better return

    (b) cUSD depositors will start moving their votes from other validators to M as they will get a better return

  3. Because the percentage of epoch rewards a validator earns is based on min(%CELO, %cUSD), the outflow of CELO from M will start reducing their percentage of epoch rewards earnt faster than for other validators

    (a) Even though there is also an outflow of cUSD from other validators, as they are the majority, the reduction to their percentage of epoch rewards is less as they have a higher starting %cUSD

  4. cUSD depositors will also start moving their votes from M to other validators

    (a) Even though M is offering to share more of their epoch rewards, the percentage of epoch rewards M is receiving will be increasingly lower than other validators

  5. M ends up experiencing an outflow of both CELO and cUSD, reducing their overall percentage of epoch rewards earnt

All this is from using the deceptively simple min function, meaning that the incentive to fill a deficit of %CELO or %cUSD a lot stronger than acquiring an excess of %CELO or %cUSD.

Retaining this cap for CELO does not interfere with proof-of-deposit. It is unnecessary to set a similar cap for cUSD as our use of the min function means that there is an increasing disincentive to having %CUSD above %CELO (which has a cap).

We do however recommend setting a small minimum cUSD requirement for becoming a validator (similar to the already existing minimum CELO requirement). This will eliminate any remote possibility of 100% of cUSD votes going to a single validator.

2 Likes