A balancing attack on Gasper, the current candidate for Eth2's beacon chain

[kladkogex]

@vbuterin

I don’t think this is true, at least in the appropriate model for this circumstance. Particularly, chain-based PoS protocols have come up with liveness proofs, and those do have constant complexity per participant. So this suggests that we can solve the problem by importing the key characteristic of chain-based protocols (namely, the proposer bottlenecking) in a safe way, which is what I have proposed here:

My gut feeling about this you can probably prove liveliness of non-finalizing PoS algorithms. BTC and ETH1 never finalize. ETH2 without Casper never finalizes.

If a blockchain finalizes (using say Casper), this pretty much make it a solution of a binary consensus problem.

Indeed, you can simply deploy a smartcontract that collect votes of byzantine generals, and once the SC collect 2 t + 1 votes , it will solve the binary consensus problem by simply choosing the the majority vote (1 or 0).

So any finalizing blockchain leads to a practical solution of binary consensus, which is, as we suspect O(N^2) at best. No one ever proved that one cant do binary consensus better than O(N^2) but many people tried and did not invent anything better.

Based on the hand waving argument above, ETH2 may be made provably live without finalization, but if one wants to finalize, the attacks as described in the paper may be unaddressable.
It is my subjective feeling based on the argument above.

It may be that one needs to act out of the box, in particular involve PoW or VDF to help resolve the deadlock, as I suggest here

Fixing balancing attacks on Gasper using VDF

Here a balancing attack on gasper is described. https://ethresear.ch/t/a-balancing-attack-on-gasper-the-current-candidate-for-eth2s-beacon-chain/ The essence of the attack IMO is to bring the complex network into an undecided equilibrium of a split vote and then use a small number of malicious nodes to keep the system in the undecided equilibrium forever. I think it may be impossible to solve problems like this while staying purely PoS in large systems, since essentially resolving an undecid…

Essentially I am suggesting to use a VDF to introduce a new proposer if finalization gets stuck. The proposer can affect things if things are not stuck, since VDF time can be made larger than a typical finalization time.

As far a the block proposal uniqueness is concerned, it can be easily addressed by having a proposal signed by a 2 t + 1 signature of a committee. It is an easy fix which would make ETH2 work much better.

To summarize, I do not have exact proof for what I am stating, but the argument seems pretty strong to me.

Another direction for thinking is how realistic the attacks are. It may be that some of them become impractical when the system grows because computational requirements on the attacker grow fast. Essentially keeping a system in unstable equlibrium requires lots of effort.

It may be that one can do faster binary consensus under the assumption that computational resources of the attacker are finite. It is a really interesting direction of research IMO.