Baseline Enforcement for Lido on Terra validators

Node Operators
1

Background

Lido validators are a core part of the Terra ecosystem and their behavior is of special attention to the community. As the largest liquid staking provider on Terra, Lido has a responsibility to further the security and health of the network. To this effect, the DAO recently formalized and adopted a baseline criteria we expect our validator set to follow.

To satisfy the baseline criteria, validators are expected to avoid:

  • being slashed/jailed/tombstoned,
  • signing less than 80% of the latest 100 000 blocks,
  • 6-hours period without signed blocks,
  • providing less than 80% of oracle votes for a month,
  • 6-hours period with no oracle votes,
  • missing a network update (being offline for 3 hours after network migration/security-related fork),
  • setting the commission rate to more than 10%,
  • missing more than 4 out of the 20 latest votes on the Terra governance (having less than 80% participation).

Assessment

Since the introduction of the baseline, and thanks to the tremendous work of all validators in our set, oracle vote and sign performance has drastically improved across the board.

Given that less than 20 votes have taken place since the adoption of the baseline, enforcing its governance participation requirement is slightly trickier. Currently, the simplest alternative is to consider that any validator having missed more than four votes since the baseline’s inception has fallen short of the baseline. Applying this approach to the current whitelisted set reveals that six validators have unfortunately failed to vote at least 5 times:

Validator Votes missed since baseline Participation since baseline
Dokia 9 0%
everstake 8 11%
DSRV 9 0%
Figment 6 33.33%
Certus 9 0%
01node 5 44.44%

Discussion

Because a policy is only meaningful if it is enforced, we believe that falling below the baseline requirements warrants the intervention of the DAO. Below, we provide additional elements of context to assist the DAO in its decision.

  • Were operators aware of the policy? Operators were called for feedback before the baseline proposal was pushed onto the forum. Nevertheless, operators were not directly notified when the policy was adopted by the DAO.
  • Were operators notified when their performance started to deviate for the baseline’s requirements? Early monitoring efforts were focused on oracle votes and sign performance and we have only recently implemented notifications and automation around governance participation.

The Lido on Terra team acknowledges that we should have communicated more directly about the baseline and reached out to operators in a timelier manner once we noticed a deviation. We will improve this going forward. Nonetheless, following the baseline is a validator’s responsibility and Lido delegations are conditional to its requirements.

Proposal

Properly enforcing the baseline is of great importance to the sustainability of Lido’s operations on Terra. We, therefore, invite the DAO to thoroughly discuss the following paths to resolution:

  1. Issue a notice for underperforming validators to bring their performance in line with the baseline requirements within a reasonable period of time (provided enough votes are held to increase governance participation); those who do not will be removed from the whitelist. Operators are welcome to re-apply to join at next onboarding.
  2. Remove underperforming validators from the whitelist once the 3rd Onboarding Wave is completed. Operators are welcome to re-apply to join at next onboarding.
  3. Issue a one-off warning for underperforming validators to bring their performance in line with the baseline requirements as soon as possible. Please note that this is only really being offered as an option due to the recent formalization of the baseline.

What’s next?

We intend to let this proposal sit until 25 Apr 2022 to ensure the DAO has ample time to discuss the issue and form an optimal path to resolution. During this time, we invite all stakeholders, including operators and the broader Terra community for review and discussion of the issue.

Once this window of time expires, the proposal will be amended to take relevant feedback into account, frozen for two days then subjected to the DAO’s vote.

The Lido on Terra team will notify operators and enforce the DAO’s decision.

7 Likes
2

We appreciate the care and attention Lido has given considering validator violations and baseline parameters for staking with the organization. As a committed validator for Lido on several chains, we as an offending validator would like to make an argument for Option 1 - not for the sake of leniency, but in recognition of the importance of enforced governance participation.

Figment is the 10th largest validator on Terra with 7,142,664 LUNA staked to our validator for a total of 2.3% voting power on the network. We are strong proponents of the Terra ecosystem including governance in validator scoring, and are working continuously on being highly performant in governance as it matters deeply to the development and growth of a chain. We have given this offense strong consideration, especially given our position on the importance of governance participation across the ecosystems we support.

Our approach to Governance

As an organization, we have strategic security bottlenecks in place that have historically only allowed one individual to vote on governance proposals at our organization. This is the most direct path for us to protect our delegators’ funds. We are presently distributing this ability to others at Figment in order to increase our participation. The first network that we removed this bottleneck was Terra. Previously, we’ve kept our voting behaviors the same and continued to vote on ⅓ of the proposals on the Terra network, keeping consistent with our voting history.

Upon receiving the email on April 8th, we discovered that we missed communication on the Discord and on the forum that would have alerted us to the baseline parameters that were set, but the parameter for punishment were not. Fortunately, we as an organization are already in the process of re-evaluating our internal governance processes, but by the time notice was provided, not enough time had elapsed for these effects to become visible.

The importance of incentivized governance

Governance in web3 is a complex and as yet unrefined process for all involved. Its importance in the space is generally badly expressed. On the front of validator participation, we want to signal that enforcing this mechanic is a necessary step since in our experience across all the chains we support, positive incentives don’t seem to exist and elective participation leads to poor turnout.

In our experience, this may be one of the only ways to truly incentivize participation. While an honor-based system for governance is typical, validators have a unique position with a network’s long-term stability and incentives for regular participation should reflect that responsibility. Optimistic participation can be effective up to a certain point, but a hardline approach for maintaining a baseline participation level should make up for its shortcomings. We greatly appreciate Lido for taking initiative in this regard.

Our position

With this in mind, we hope that going with option 1 will serve as a warning to offending validators to show up in the ways that we are now explicitly obliged to. It will be starkly evident in the next period that those of us who sought to improve on meeting the baseline, and we plan on ensuring that we, among the other offenders, both meet and exceed our obligations.

We suggest a timeline where validators have a month after the vote ends to rectify their voting participation and one quarter probation period where they must maintain that participation baseline (i.e., not missing more than 3 of the most recent 20 proposals). We personally have already rectified what was blocking us from doing so. This way, we are still accountable to the community by setting a deadline (instead of option 3) and we can continue operations without a break in service (option 1).

3 Likes
3

This may be unpopular but I would argue for Option 2. Governance participation is a core function of a validator. Regardless of baseline requirements these validators should be participating. While many of the other community functions, blockchain support some of these validators perform are extraordinary they are in a sense distinct in my view of being a validator and in a way marketing to attract delegators. The core main functions of a validator need to be performed first to any over and above.

Additionally it is not fair to remove onboarding wave 3 validators for violating another of the baseline requirements but give a pass to these whitelisted validators.

4

Some things to consider here are:

  1. Not all baseline requirements are equal (because not all “core functions”, as you say, of a validator are equal). This doesn’t have to do with whether they are important or not, but a validator that is underperforming is not the same as a validator that is not voting in governance. For example, it is very difficult to imagine a scenario where a validator with terrible performance but good voting participation would manage to retain a significant amount of delegated stake for any meaningful period of time.

  2. If the outcome of waiting 1 month (e.g. option #1) is that we potentially end up with a validator set that is larger and more validators actively participating in Terra, this is a better overall outcome for both the Lido and Terra validator sets both in the medium and short term. In effect, it we have potentially more benefit for a very minor cost.

Ultimately what we want is a robust set that is steadily growing and improving over time; I believe that when weighing options such as these we should favor those which maximize the potential to further that goal.

5

we have already outlined what happened in our case on the onboarding thread : Announcement: Onboarding for (Terra Wave 3) - #46 by clawmvp

we now have 3 systems in place only for governance and we made a little tool for others to use, so they don t end up in a similar situatie :slight_smile:

2 Likes
6

Maybe I’m stuck on letter of the law but the baseline was set. If it was the DAOs consensus that governance was less important than it should have been set lower than the same 80% as oracle voting and signing. Or there should have been a different removal/parole/correction situation.

While a larger and more diverse set for Lido is important I’d argue that removing these validators would do more for in that same sense for the Terra blockchain since they have outsized voting power well above .77%

Dokia - #2 3.2%
Everstake - #5 2.8%
DSRV - #4 2.9%
Figment - #10 2.4%
Certus - #11 2.3%
01node - #19 1.6%

7

I think option #2 is a bit harsh, and option #1/3 is not harsh enough.

What we used to do in tradfi was called giving them a holiday. (where the broker wouldn’t get any business from the client for a month or so)

I propose a option #4.

Issue them a notice, and withdraw 50% of their stake and spread it through the validator set.

If they fail to fix their performance issues after a period, then they can be kicked.

3 Likes
8

Thank you for taking the time to respond here.

As @kai points out in his original message:

While the baseline was set, the punitive measures to not meeting that baseline across these requirements were not, which is why we’re seeking leniency here that will address future errancy by validators. While you point out that we have outsized voting authority, @Izzy is right to address that punitively removing us when we are a top performing validator with only one offending action on our record in the form of governance participation feels a bit outsized in response.

Now that we better appreciate that participation in Terra governance is a major issue toward validator performance for Lido, we have taken measures to prevent it happening again in the future. Key management makes governance participation for those who validate on multiple chains difficult, but Cosmos SDK-based solutions to this issue released on Feb22 (the same day that the baseline rules were set) should make it so that this isn’t an excuse going forward, specifically for Terra and other Cosmos-based chains. Since we weren’t notified of the rules being set, we didn’t prioritize utilizing the AuthZ module to make participation easier for ourselves.

Offering leniency would increase the number of validators offering their services to the Lido contract ahead of the next participation requirement, decreasing the impact on validator participation, in addition to ensuring that the importance of these rules is clear to all active validators by explicitly outlining the punitive measures that will be taken in not meeting the baseline.

While I respect your desire to sit by the letter of the law, this is a situation wherein the laws specific to the offense were not yet set in stone, nor shared widely. It’s likely the reason that the other offending validators are not participating in this conversation, while we are.

4 Likes
9

I missed this section of the baseline post and see your point.

For now, the decision of deregistering a validator is made by the Lido DAO. It means that removing a validator will be put on a DAO voting. Rules described in this post are going also be put on a DAO voting so that it would be possible to instantly deregister a validator breaking the rules.

Given it is declared to be going to the DAO for vote each time until a vote is held to make it automatic and instant then I’m not so strongly arguing for Option 1 anymore. Given all the circumstances mentioned in the original post some other options should be provided for the DAO vote on. I feel adding PFC option 4 is a good suggestion.

3 Likes
10

Hello everyone! I’m Ann from Everstake.

On behalf of the Everstake team, I want to thank the Lido team and all the validators for their work. According to the criteria, Everstake has failed only in governance participation (voting). We are aware that the Terra community is very proactive and expects to be proactive from all the network participants.

We have taken into account this overlook from our side and want to reassure you that we will try to do our best in order not to miss any voting and be active in the governance life.

And as for notification, we were not timely notified and haven’t received any warnings so that we could correct our work.

It would be one of the best solutions in this situation: “The Lido on Terra team acknowledges that we should have communicated more directly about the baseline and reached out to operators in a timelier manner once we noticed a deviation. We will improve this going forward.”

The more direct communication, the more precise result we would have.

Thank you!

3 Likes
11

I like this option! However, given that we’re still in the midst of our rebalancing program, I think it may make sense to adopt it as a course of action once that’s over and done with. In any case, if e.g. some of the operators fail to correct, that stake would get redistributed to the rest of operators once they exit the set.

2 Likes