Against proof of stake for [zk/op]rollup leader election

[edmundedgar]

@GriffGreen

@barryWhiteHat

On layer 2 this is very different. It seems very unlikely to be able to coordinate a hardfork in order to slash a misbehaving coordinator of some layer 2 system. Removal of this tool fundamentally limits the ability of POS to be able to respond from attacks.

Slashing can still be done without a hard fork, as long as the Staking is done on L1 and the Staking contract has a time lock and a strategy to apply slashing (could be just a subjective Staking Coordinators’ vote, Kleros or Aragon Court judgement, or an automated strategy).

What am I missing?

So the difference is that with a protocol-level fork, the “true” fork can win even if the attacker marshals more funds than the defender, because people will just ignore the bad ledger and use the good one. Governance systems like Augur that work on top of L1 have this subjective security property with respect to their own token, REP, but resort to an objective measure when it comes to all the “hard” assets they manage that they can’t fork. In Augur’s case, they fork Augur into two, but all the ETH and DAI locked in existing markets will go to the version of Augur that had more REP moved into it. So you can break Augur enough to steal the ETH and DAI by controlling more REP than the other side, and moving them into the “lying” fork. Augur tries to disincentivize attacks like this by using fees to regulate the amount of “hard” assets it controls compared to the value of REP, but this is probably not really enforceable even for them, and it wouldn’t be practical here.

Note that you could have subjective security for a governed rollup with respect to the governed rollup’s governance token (if it had one), and any assets issued inside the rollup. So if I issue a token on the rollup’s ledger, the governance of the rollup could get broken, the rollup ledger copied by another operator, and my token now exists in both ledgers. Since the “honest” ledger is more useful, we can reasonably hope the users and the value will migrate to that, regardless of the governance breakage.

I think you can take this to another level and say that since we have to take the security hit for governance anyhow and preserve the possibility of forking to secure it (albeit we couldn’t totally secure the “hard assets”) we may as well build in a general-purpose oracle, so that the same trust anchor used to manage who should be operating the rollup can also tell you (via an escalation game), “what is the value of 1 ETH in USD” or “Who won the 2024 presidential election”. Making complex, interrelated contracts work properly in the event of a governance fork is something that’s quite practically tricky to do on the current L1 - I’ve tried - but should be very simple and clean if you’re just copying a rollup ledger.