# Proof-of-Deposit – initial proposal and request for feedback

**URL:** <https://forum.celo.org/t/proof-of-deposit-initial-proposal-and-request-for-feedback/3041>\
**Category:** Governance\
**Created:** [March 10, 2022, 4:45pm UTC](https://forum.celo.org/t/proof-of-deposit-initial-proposal-and-request-for-feedback/3041 "2022-03-10T16:45:12Z")\
**Posts on this page:** 1\
**Showing post:** 24

<div class="post-metadata">

**Author:** ![ying\_chan](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.celo.org/ying_chan/32/6757_2.png) [@ying\_chan](https://forum.celo.org/u/ying_chan)\
**Post date:** [March 22, 2022, 3:45pm UTC](https://forum.celo.org/t/proof-of-deposit-initial-proposal-and-request-for-feedback/3041/24 "2022-03-22T15:45:05Z")

</div>

> [@tim](#):
>
> How do you address the challenge that offering a 100% rate to depositors is a great attack vector for a malicious validator?

Apologies, we’ve been mixing up terminology a bit. I believe what you’re asking is:

> Is a validator offering to **share 100% of their epoch rewards** with cUSD depositors an attack vector?

We stress that this isn’t an attack vector and is entirely allowed! A “malicious” validator taking such a course of action would be akin to intentionally mispricing an asset: e.g. trying to sell CELO for $1 or $100 even though the market price of CELO is $3. That is to say, you are free to do it, but you are much better off matching the market.

In our case, the result of a validator “mispricing” the proportion of epoch rewards they share with cUSD depositors, is that such a validator will end up earning less epoch rewards overall. It can be quite simply explained why this is the case:

1. Validator **M** , the “mispricer”, “misprices” the proportion of epoch rewards they share with cUSD depositors by offering more than the market rate

2. Initially:

3. Because the percentage of epoch rewards a validator earns is based on `min(%CELO, %cUSD)`, the outflow of CELO from **M** will start reducing their percentage of epoch rewards earnt faster than for **other validators**

4. cUSD depositors will also start moving their votes from **M** to **other validators**

5. **M** ends up experiencing an outflow of both CELO and cUSD, reducing their overall percentage of epoch rewards earnt

All this is from using the deceptively simple `min` function, meaning that the incentive to fill a deficit of `%CELO` or `%cUSD` a lot stronger than acquiring an excess of `%CELO` or `%cUSD`.

> [@tim](#):
>
> One important piece of the mechanism right now which has a considerable security benefit but means that this does not look like a “market” is the group vote cap, which even with sybil groups imposes a cap on the effective funds that a single validator can receive. Interested how your proposal interacts with this?

Retaining this cap for CELO does not interfere with _proof-of-deposit_. It is unnecessary to set a similar cap for cUSD as our use of the `min` function means that there is an increasing disincentive to having `%CUSD` above `%CELO` (which has a cap).

We do however recommend setting a small minimum cUSD requirement for becoming a validator (similar to the already existing minimum CELO requirement). This will eliminate any remote possibility of 100% of cUSD votes going to a single validator.

---

_[View the full topic](https://forum.celo.org/t/proof-of-deposit-initial-proposal-and-request-for-feedback/3041)._