Lido for the Interchain

[kethfinex]

We present a framework for deploying Lido as a custom implementation designed to serve the liquid staking needs of the entire IBC ecosystem.

This proposal seeks to initiate a conversation around the proposed design.

For those unfamiliar with the Interchain’s lexicon, a short glossary is included at the end of this proposal.

Motivation

High inflation rates and staking APRs across the Cosmos ecosystem have made staking lucrative, but also placed a high bar on yield and stifled the growth of the DeFi sector. As a result, a significant portion of each zone’s supply is bonded and illiquid. Deploying our liquid staking solution will lower the competition on yield for new protocol and release significant amounts of capital that can be recirculated within the ecosystem, bolstering its growth.

Liquid staking, coupled with the right incentives, has the potential to trigger a positive feedback loop for the whole Cosmos DeFi ecosystem.

Given the high APR and staking ratios, we expect liquid staking tokens to rapidly gain popularity among the Cosmos community.

The Interchain has the potential to become one of the largest ecosystems after Ethereum: deploying a well designed implementation would support the growth of the ecosystem, provide the DAO with exposure to Cosmos’ success and a diversified stream of revenue.

The liquid staking sector of the Interchain is rapidly becoming more competitive: Persistence, Quicksilver, StaFi, Stride and Supernova have all announced Interchain Liquid Staking products.

About Cosmos

Mission

Cosmos is a network of blockchains powered by Tendermint’s BFT consensus engine and built with the Cosmos SDK. It offers an alternative to the vertical scaling paradigm associated with monolithic blockchains such as Bitcoin and Ethereum. Instead, Cosmos envisions a network of interoperable, deeply integrated and sovereign blockchains (“zones”), optimized for specific purposes.

Context

While DeFi activity has remained somewhat tame compared to other L1 environments, underlying technologies and fundamentals have been improving rapidly. In this regard, the fall of Terra has a silver lining: hundreds of devs and protocols are migrating to their own app-chain or to other Cosmos smart-contract platforms. Together with Interchain Security, Accounts and Queries, and modular blockchains primitives such as Celestia, the Cosmos ecosystem seems primed for sustained growth.

Currently, liquid staking is not available to most of the Interchain. This can be explained by the limitations of traditional LS architecture, which often relies on the deployment of smart-contracts on each new network. In the context of the Interchain, such design is often either impractical or impossible to deploy, as appchains can opt-out of smart-contract support in favor of baking code directly into modularized binary.

Within the Interchain, Lido’s main competitor is probably Quicksilver. The protocol is currently on testnet and enjoys a fairly positive reputation across the Cosmos community. Slated to launch on the 7th of September, Quicksilver is planning to transition to Interchain Security upon the feature’s release, early 2023.

Metrics

The Interchain comprises ~40+ interconnected zones. Mintscan provides a good overview of the various chains, their capitalizations, staking ratios and activity.

The Cosmos Hub is the Interchain’s central and most economically secure zone. It does not support smart contracts but aims to become the main Interchain Service Provider (routing IBC transactions, providing security,…). Its token, ATOM, has a circulating supply of roughly 290M, no maximum supply, and a market cap of roughly $3.6bn, according to CoinMarketCap. Roughly 66% of the circulating supply is currently bonded, according to Mintscan, which can be explained by the high staking APR (~18.89%), and the Hub’s focus on staking and security. ATOM can be provided to various liquidity pools on Osmosis and other DEX, as collateral on Umee, etc.

Revenue simulation

📆 All data was sourced from Mintscan on the 22nd of June 2022, when prices were severely suppressed. As a result, the simulation below are likely to be very conservative.

First, we’ll focus on the Cosmos Hub, which is likely to be the first zone to be onboarded and should make up the most of the protocol’s initial revenue.

🧮 **Cosmos Hub Simulation:** Protocol Revenue = Total Stake * Market Share * Staking APY * Protocol Fee * Atom Price DAO Revenue = Total Stake * Market Share * Staking APY * DAO Fee * Atom Price

Simulating revenue for an Interchain Liquid Staking Protocol is more complex. Each network comes with its own set of variables, zones may not be wish to be onboarded, and the order and speed at which interested zones will be onboarded is unknown, and Lido’s market share across zones is unlikely to be homogenous.

Yet, this protocol is designed to work across multiple networks. Disregarding this data altogether would provide a reductive representation of the protocol’s potential.

So, for the sake of illustration, here is a simulation of revenue based on broad assumptions: all 28 zones for which Mintscan has Market Cap data are onboarded, and market share is homogenous across all onboarded zones.

🧮 **Interchain Simulation:** Protocol Revenue = Market Cap * Bonded Ratio * Staking APY * Market Share * Protocol Fee DAO Revenue = Market Cap * Bonded Ratio * Staking APY * Market Share * DAO Fee

Solution design

Interchain Liquid Staking

Using Interchain Accounts (ICA), IBC and Interchain Queries (ICQ), a solution capable of onboarding any ICA-enabled blockchain with as little as one relayer and a single transaction can be built:

Interchain stAssets

To the user, Interchain Liquid Staking functions the same way as a native liquid staking solution. It receives and stakes native token (e.g. ABC tokens) directly from the user’s zone and mints liquid staking tokens that accrue staking-yield (e.g. stABC).

Thanks to Iqlusion’s liquidity staking module, users have the option to deposit tokenized delegations instead of liquid tokens. With this method, users can obtain liquid staking tokens against existing delegations, without having to wait an entire unbonding period.

The protocol regularly claims staking rewards and re-stakes them: stAssets don’t rebase, they auto-compound. This makes them perfectly suitable to liquidity pools, Interchain transfers and other DeFi uses. Over time, the value of stAssets increases relative to native assets.

Semi Permissioned Validator Set

A novel validator set and stake distribution model can be implemented on Cosmos. Instead of a single list of approved validators, we recommend implementing a permissioned and a permission-less list:

• The permissioned list is evaluated and formed by the LNOSG and ratified by the Lido DAO. Delegations are distributed among whitelisted validators according to weights assigned by an algorithm using on-chain and off-chain parameters. This data can include existing delegations, overall performance, infrastructure decentralization, commission rate, community service (e.g. running IBC relayers), etc…
• The permission-less list can be joined by any validator that satisfies a set of basic performance criteria that can be checked on-chain. These criteria can include existing delegations, commission rate, etc. Delegations are distributed among the permission-less set according to weights calculated automatically using on-chain data. The amount of delegations received by a validator on the permission-less list is capped to a fraction of the protocol’s delegation.

The share of delegations allocated to each list is set by the DAO. After launch, validators from the permission-less list demonstrating outstanding performance can be selected to join the permissioned set.

Underlying Zone

To be suitable for the release of the protocol, a zone has to meet the following requirements:

• High Economic Security: e.g. Interchain Secured by the Cosmos Hub,
• Interchain-Interoperable Smart-Contracts: CosmWasm, IBC, ICA & ICQ enabled with smart-contract support.

We propose to launch Lido for the Interchain on Neutron, a permission-less CosmWasm smart-contract platform which features all of the above.

Neutron is incubated by P2P, a core contributor to Lido with deep knowledge of the Cosmos tech stack. Neutron is slated to be one of the first Interchain Secured zones, for which it has received support and funding from the Cosmos Hub.

See Proposal / Bringing Liquid Staking and DeFi to the Cosmos Hub with Interchain Security

Neutron will have its own token and is looking to incorporate veTokenomics and gauge-voting to distribute liquidity mining incentives and grants.

This could prove beneficial to Lido, as Neutron incentives could help bridge the incentive gap between Lido and other Liquid Staking protocols launching as appchains. Such LS appchains benefit from a total control over their token’s initial distribution and are able to dedicate significant portions of their supply to subsidizing yield or growing their userbase.

On the flipside, launching on a smart-contract platform rather than an appchain should allow Lido to integrate with other DeFi primitives faster, and synchronously (which is not possible over IBC). This comes with a wide range of benefits, including a better control over stAsset liquidity, better utility and composability, making Lido’s liquid staking tokens more attractive to Interchain users.

References

• Proposal / Bringing Liquid Staking and DeFi to the Cosmos Hub with Interchain Security
• https://linktr.ee/neutron.org / All Neutron related resources

Glossary

• Tendermint: A Byzantine-Fault-Tolerant consensus engine used by Cosmos zone.
• Cosmos SDK: A modular framework for building interoperable, public Proof-of-Stake (and permissioned Proof-of-Authority) blockchains that can be customized using modules.
• CosmWasm: A WebAssembly-like smart-contracting module for the Cosmos SDK. It can be plugged into any Cosmos SDK blockchain to allow the development of smart contracts in various languages, such as Rust and AssemblyScript.
• IBC (Inter-Blockchain Communication): A communication protocol that lets blockchains exchange data packets to enable the transfer of assets, messages and transactions.
• ICA (Interchain Accounts): An interchain standard which enables one blockchain to securely control an account on another blockchain over IBC.
• ICQ (Interchain Queries): An upcoming Cosmos SDK module which will allow one blockchain to securely retrieve data from another in a permission-less fashion over IBC.
• Interchain Security: A technology that allows one blockchain to rely on the consensus layer of another for security. With Interchain Security, validators from a Provider-Chain securely produce blocks for a Consumer-Chain.
• Relayers: Validator-like entities which maintain nodes on both sides of an IBC channel to securely pass data packets from one blockchain to another.

[interchain_anon]

Been waiting for a formal proposal on lido for the interchain for so long!! Thanks for putting this up!

In terms of implementation detail, will this lido hub set of contracts reuse a lot of the previous Terra 1.0 LS contracts built by lido? Or it’s mostly building from scratch? If it’s vastly extended from the Terra contracts, I think it gives lido a great edge comparing to other LS solutions because it’s been battle tested for a long time.

[Spaydh]

The set of smart-contracts will actually have a much smaller attack surface! No complex unbonding logic like on Terra, for instance, thanks to Iqlusion’s LSM.

[danku_r]

Great read and exciting news!

As danku_zone w/DAIC validator, we are happy to support and contribute to this!

[Nils_Blockscape]

As a Lido NO and validator of many IBC chains, Blockscape is highly interested in joining this effort!

[clawmvp]

01node will support it as well.

[malyenmalek]

Klub Staking would be interested in supporting and contributing to this effort as well.

[IBSValidator]

Hi ,

https://ibs.team Inter Blockchain Services is a professional validator on 20 cosmos sdk based chains , infrastructure endpoint provider and relaying over 22 chains . We will be happy to contribute

[soi2studio]

Liquid Staking for the Interchain

First, there was the Cosmos SDK. Then came IBC, and Interchain Accounts. Despite macro headwinds and terrible market conditions, the internet of blockchain is gradually coming online. Foundational technologies are being developed, released and implemented throughout the ecosystem. With the upcoming launch of Interchain Security, and Interchain Queries, the Cosmos vision for a fully integrated network of blockchains is coming to life.

Yet, numerous challenges remain on the Interchain’s path to challenging monolithic blockchains. In this article, let us explore the quirks of Proof-of-Stake security, and how Liquid Staking can be harnessed to fuel the internet of blockchains’ economy.

Achille’s Heel

Sprawling DeFi economies secured by Proof-of-Stake (PoS) suffer from a fundamental misalignment of incentives:

In a PoS system, security emerges from staked value: as it increases, attacks become more prohibitively expensive to conduct. To prevent malicious actors from escaping the cost of an attack, most PoS blockchains enforce a bonding period: when tokens are unstaked, they remain locked for a certain amount of time before withdrawals can be made.

While such a mechanism inherently produces some degree of opportunity cost, the phenomenal growth of the DeFi sector has created innumerable high-yield opportunities which, in most networks, has competed against staking modules for a share of the circulating supply. In other words, opportunity cost directly undermines the security of PoS systems.

To circumvent this issue, and in an attempt to distribute their tokens widely, numerous Cosmos networks have instead opted for extreme inflation schedules, reinforced by a strong airdrop culture. This has made stake more sticky, and more lucrative, but it has also stifled the growth of the DeFi sector, by shifting the burden of competitive yield to financial products.

Liquid staking solves these fundamental issues by removing the opportunity cost and capital inefficiencies associated with traditional staking. It is a fundamental primitive for DeFi to thrive in a secure, PoS environment - one that Cosmos has been sorely lacking, up until now.

Today, we are excited to share our team’s liquid staking vision for the Interchain, to kickstart the conversation on how to design a liquid staking protocol that strengthens the Cosmos networks it operates on, benefits their economies and scales alongside the Interchain.

Scaling with the Interchain

So far, the horizontal expansion of Cosmos has made traditional liquid staking architecture, which rely on the deployment of a set of custom smart contracts for each new network, unable to scale with the Interchain. Safely porting a protocol’s contracts to forty unique chains is not only a colossal task, it is often impossible, as many of Interchain’s networks opt out of CosmWasm and bake code into their binary instead.

Leveraging Interchain Accounts (ICA), IBC and a custom implementation of Interchain Queries, it is possible to build a solution capable of onboarding any ICA-Enabled blockchain with as little as one relayer and a single transaction.

Its core CosmWasm contracts are deployed on an Interchain-Secured, ICA-Enabled Hub, which allows the protocol to create and manage accounts on each onboarded zone.

Users can deposit their native tokens to Lido’s accounts on any of the supported zones, without bridging and through the same, unified interface.

Once deposits are verified via an Interchain Query (ICQ), the Hub mints and delivers a liquid, yield-bearing token to the user’s wallet via IBC.

These liquid staking tokens will be fully redeemable for the underlying tokens, they will accrue staking rewards, and be composable with liquidity pools, money markets, and other DeFi protocols. Even at today’s depressed prices, and with conservative penetration estimates, the advent of liquid staking could release hundreds of millions of tokenized capital into the Interchain economy.

Coupled with the right incentivizes, liquid staking tokens have the potential to set-off a flywheel effect whereby these new DeFi primitives become increasingly liquid, which leads to more integrations. These integrations improve the velocity and expressivity of the market, which drives activity and fees for all the platforms involved, making them more appealing and valuable. Incentives thus appreciate and the virtuous cycle continues.

Securing the Interchain

For the sake of concision, we will focus on security implications at the consensus layer. Audits, bug bounties and other security measures will be presented in a subsequent post.

Validation is at the core of Proof-of-Stake. A proper validator set increases the security, performance and decentralization of the host chain, but the reverse is also true: a subpar, underperforming or centralized set is any PoS system’s most existential threat.

Unfortunately, most PoS network suffer from very uneven distributions of stake, particularly Tendermint blockchains, where the problem is compounded by a low cap on the number of active validators:

Numerous factors contribute to such skewed distributions: the ability of CEXs to offer streamlined staking services to a large user base, visibility and ranking biases in staking interfaces, a general lack of education surrounding validation and the topic’s inherent complexity, etc. Together, these dynamics have resulted in the concentration of stake in a few established players which gradually erodes the security assumption of PoS blockchains.

To mitigate these centralizing forces and ensure performance, numerous UIs and protocols opt to create an algorithm to grade validators based a set of on-chain data. These often include voting power, uptime and/or commission rate. The resulting scores can then be implemented at the protocol level (i.e. stake is attributed to validators based on their ranking), or via incentive systems (i.e. users who delegate to high-ranking validators are rewarded).

Results from specific implementations of this approach vary widely, depending on the quality of the algorithm, and how it is used to allocate stake. Assuming a reasonably well crafted implementation, this approach has significant benefits over natural distributions: it limits the concentration of stake, rewards performance and carries some level of damage control by removing stake from less performant validators.

Yet, it also neglects important security considerations. Because the algorithm is constrained to quantitative data that can be obtained on-chain (or via oracles, at the cost of additional trust assumptions), it is unable to take into account the geographic or legal distribution of operators, the quality of their setups, the reliance on third party providers, etc.

The importance of these aspects tends to be downplayed, as they are hard to quantify and cannot always be made public. Yet, they often reveal hidden vulnerabilities: one of the surveys we conducted (to which 50% of the network’s active validators responded) revealed extreme server concentration in two centralized entities, and in two jurisdictions. Simply put, if services had been denied, be it technically or legally, keeping the network online would have required the remaining validators to coordinate off-chain, in an emergency.

In order to tackle all of these issues at once, we propose a novel, semi-permission-less delegation model. It leverages Lido’s expertise to curate a set of whitelisted validators with varied, performant and reliable setups, to ensure hidden vulnerabilities are minimized.

On top of this permissioned foundation, and to prevent the concentration of stake among whitelisted validators, a permission-less list will be maintained algorithmically. Any validator that satisfies a set of public, on-chain criteria will be able to join the permission-less set and receive delegations from the proto. These criteria can include existing delegations, commission rate, etc.

We intend to use this permission-less list to onboard independent validators demonstrating outstanding performance to the permissioned set. This architecture will allow the protocol to scale as deposits increase and maintain a high level of performance without compromising the security of the underlying network.

We are excited to finally share our vision with the community, as it is the culmination of many months of work. We’re looking forward to your feedback - let’s drive the security and prosperity of the ecosystem, together.

[monky]

Hi, indeed I agree to the challenges in the field.

Operating a secure validator set is a challenge, it requires some creativity, dedication and good mentorship.

At this point, let me address a shout out to Blockpane, who was of great help securing our validator, deciding for the hardware, providing nice blogs on key management and architecture, solving monitoring and metric challenges, and personal dedication to answer critical questions. One of the greatest contributors to the community (together with many others).

I like your approach to evaluate validators off-chain, since many things are not visible. Our validator is operating silently, not visible to the public, distributed in 3 different juristications, each of them on independent providers. In addition, the set includes our public sentries, with different levels of mitigation on DoS.

Though, there is the other side of the coin. Getting operations and cost aligned, it’s currently concentrated in Europe, which is a risk.

The Web3 ban of Hetzner motivated us to more decentralization. But I see, that only a handful of validators took action, which is understandable due to the highly competitive prices. Evaluating other providers can be a headache, many of them are just ‘resellers’, which leads to percieved decentralization, but isn’t.

Regarding voting power mitigation, Axelar currently field-tests the approach of quadratic voting power. We’ll see, how this plays out: Axelar Adds Quadratic Voting to Bolster Cross-Chain Security | Business Wire

Feel free to elaborate more,

Holger

[Nils_Blockscape]

We have applied for the Quark testnet of Neutron, supposedly starting on 24th October.
Let us know if we can be of help in regards to anything Lido related
Our announcement: https://twitter.com/BlockscapeLab/status/1580139099612069889
Neutron validator form: Quark Testnet Validators

[randomishwalk]

@kethfinex

We present a framework for deploying Lido as a custom implementation designed to serve the liquid staking needs of the entire IBC ecosystem.

Maybe a dumb question on my end, but don’t the planned upgrades to Cosmos effectively enshrine liquid staking in-protocol?

https://hub.cosmos.network/main/roadmap/cosmos-hub-roadmap-2.0.html#v9-lambda-upgrade-expected-q1-2023

v9-Lambda Upgrade (expected Q1 2023)

• Gaia v9.0.x
• Cosmos SDK v0.47
  • Phasing out broadcast mode
  • Remove proposer based rewards
  • Consensus-param module
    • With the deprecation of the param module, this will allow governance or another account to modify these parameters.
  • Changes required for Interchain Security
    > * Liquid Staking module [BOLDED MY EMPHASIS]
    > * Free, secure and low-risk delegations for use in other parts of the Cosmos ecosystem
    > * Features include enabling transfer of rewards and voting rights
• Interchain Security - Required Participation of Provider Chain Validators
  • The Cosmos solution to shared security that uses IBC Cross Chain Validation (CCV) to relay validator set composition from a Provider Chain (Cosmos Hub) to a Consumer Chain. This validator set is in charge of producing blocks on both networks using separate nodes. Misbehavior on the Consumer Chain results in slashing Provider Chain staking tokens (ATOM).
• Bech32 Prefix forwarding
  • GitHub - osmosis-labs/bech32-ibc
• Liquidity Module Deprecation
  • Contains forced withdraw of liquidity

[Spaydh]

It enshrines non-fungible tokenization of specific delegations of specific amounts of tokens to specific validators, which is more a primitive which can be used by other liquid staking protocol than an actual liquid staking protocol.

[randomishwalk]

Ah I see, seems like I need to read up on the upgrade a bit more. Thanks for clarifying!

[Spaydh]

A quick update on Neutron: core development has been completed. The chain ran on testnet thrice, including baryon-1, Neutron’s latest, persistent testnet, audited once by Oak Security and is undergoing a second audit by Informal Systems ahead of the planned launch next month (Mar 2023).

Another proposal by @monet-supply, Interchain Liquidity for stTokens, is being discussed and could, assuming support from the DAO, pave the way for the launch of Lido on the Interchain.