Hey there, Mol_Eliza from Analytics Workstream!
First of all, thank you @KimonSH for transparent and precise formulated proposal, all participants for discussion and @chainproof and @ccitizen for their proposals for mitigation mechanisms.
I’d like to provide my view on options for risk mitigation.
Risk decomposition
For baseline step I’ll dive deep in risks associated with performing validator duties, based on Risk assessment for community staking for 1 Validator (cluster)
All numbers would be calculated within a reasonable upper boundary assumptions (as risk decreases with overall APR) on CL and EL rewards based on recent observed data
- Cl rewards: 3.2%
- EL rewards: 1.2%
- Risks associated with slashings:
1.1. Initial penalty: 1 ETH
1.2. Correlation penalty: variable*
1.3. Attestation penalties: 0.0757 ETH (for 36 days exit period)
1.4. Missed rewards: 0.1389 ETH (for 36 days exit period) - Risks associated with validator inactivity:
2.1. Attestation penalties: 0.768 ETH (for 1 year of inactivity)
2.2. Missed rewards: 1.408 ETH (for 1 year of inactivity)
Correlation penalty is incremental and depends on share of total network within ongoing slashing:
- 0 ETH in case less than 1.04% (8988 validators for today) of total network within ongoing slashing
- 1 ETH for 1.04% - 2.08% of total network within ongoing slashing
- 2 ETH for 2.08%-3.13%
- 3 ETH for 3.13% - 4.17%
- <…>
Considering mitigation it seems important to explicitly specify risks covered from the list above: as for me it seems more clear that direct penalties (1.1-1.3) are within scope, but missed rewards associated with slashings (1.4) and risks associated with validator inactivity (2) may be not included within the proposals.
If possible, would really appreciate clarification @chainproof, @ccitizen
Risk coverage
Applying framework above i’d like to share my vision on different risk-scenarios and compare them with coverage provided within existing fund and proposals for external coverage.
As minor scenarios (~100 validators slashings) could be covered with existing fund, the focus would be on major incidents
All calculations would be done assuming 41 000 DVT ETH / 1281.25 Validators (non-integer value for stake of scalability)
Scenario 1 Only slashing: all validators are slashed and exited within 36 days, <1.04% of total network within ongoing slashing
Scenario 2 Only slashing + Correlation (1 ETH): all validators are slashed and exited within 36 days, >1.04% and <2.08% of total network within ongoing slashing
Scenario 3 Massive downtime + Slashing: all validators are inactive for one year, then slashed and exited within 36 days, <1.04% of total network within ongoing slashing
Scenario 4 Massive downtime + Slashing + Correlation (3 ETH): all validators are inactive for one year, then slashed and exited within 36 days, >3.13% and <4.17% of total network within ongoing slashing
Calculations details
Payout is calculated based on generous assumption of covering all risks
Key observations:
1. Inactivity risks
If inactivity (downtime) risk is not included in coverage - substantially lowering coverage should be considered, as even im most catastrophic reasonable scenario (all validators are slashed, no correlation penalty) total effect only from penalties would be ~1.3k ETH
2. Correlation penalty risks
Levels of coverage provided are sufficient enough to cover 1-2 ETH correlation penalty, but this risk is out of scope of simple DVT (and hence not affected by risks involving with using new technology).
It would require more than 1% of network slashing simultaneously with all validator slashing within module for correlation penalty to reach 1 ETH from 0.
Taking this risk should be considered rather than covering
3. Coverage providers comparison
For all major scenarios Nexus proposal demonstrates more coverage and effect in terms of payout / costs
While its worth to mention that for minor events (~100 Validator slashings) Chainproof deductible structure would lead to some levels of payments, while under Nexus police all effect (~120 ETH) would be under deductible amount
Given observations 1-2 so far proposals on extrenal coverage provided may be overestimating the impact to cover and, therefore, reasonable premium to cover those effect may be too high in comparison with self-covering
For minor incidents (<300 validator slashings) both options provides little to no coverage as most of the impact (>50%, up to 100% for ~150 validators) would be within deductable amount