[IDEA] Native Ethereum Delegation (NED) - Operator Families and Concentration Reserve

squijello · August 13, 2026, 12:39am

This is still an idea-stage proposal, not an EIP. I am approaching it mostly from the staking-incentive and economic-design side rather than as a consensus-layer researcher.

The question is simple:

If Ethereum is going to have delegation economically anyway, can the protocol provide a neutral native delegation primitive while making concentrated delegated control progressively more expensive to the operator, without hard market-share caps, validator elections or real-world identity requirements?

The earlier version tried to do this with declining per-domain rewards. That fails because pseudonymous splitting gives smaller identities better economics. The current construction instead uses operator families, a linear operator bond, a quadratic concentration reserve and source-attributed runoff.

Native delegation

Ethereum already has delegation economically:

ETH holder → staking/delegation layer → validators

The protocol just does not provide the delegation relationship itself.

Under NED, an ETH holder could delegate through the protocol while retaining ownership of the ETH, subject to whatever slashing, withdrawal and consensus rules delegated stake requires.

Conceptually:

ETH holder → operator family → validators

The delegator chooses the operator. The operator does not own the delegated ETH or redirect it elsewhere.

Existing providers could still compete above this primitive through LSTs, liquidity, DeFi integrations, insurance, institutional services, compliance, analytics and UX. The idea is to standardize the base delegation relationship, not the products built above it.

Operator families

The economic unit would be a persistent cryptographic operator family, not an individual validator key.

One family could operate one validator or thousands. Multiple pools or validator clusters could certify the same family. A human-readable brand could be mapped offchain while consensus only needs the cryptographic family identity.

This does not solve hidden beneficial ownership. An operator can create another family. The point is that honest sub-pools can remain under one persistent economic identity instead of resetting concentration economics per validator.

Linear operator bond

Let:

D_F = delegated ETH associated with family F
B_F = operator bond
\lambda = maximum delegated ETH supported per unit of bond

Require:

D_F \leq \lambda B_F

or equivalently:

B_F \geq \beta D_F,\qquad \beta=\frac1\lambda

If delegation and bond are split proportionally,

D_j=\alpha_jD,\qquad B_j=\alpha_jB

then:

\frac{D_j}{B_j}=\frac{D}{B}

so creating more identities does not manufacture additional bond-backed capacity.

The bond is not the concentration solution. It is a linear leverage/skin-in-the-game constraint.

I would treat B_F and the concentration reserve below as separate, cumulative accounting requirements. The same ETH should not satisfy both simultaneously.

The bond may remain productive or earn some protocol return; that is a separate design choice. The concentration reserve is deliberately nonproductive.

Quadratic concentration reserve

Let:

D_F = delegated ETH controlled by family F
\Theta = a slowly moving reference delegation mass

Define sterile operator capital:

Z_F=\frac{D_F^2}{2\Theta}

“Sterile” means it does not earn ordinary staking issuance, increase delegation capacity or count as delegated ETH.

Its marginal requirement is:

\frac{\partial Z_F}{\partial D_F} = \frac{D_F}{\Theta} = s_F

where:

s_F=\frac{D_F}{\Theta}

So the next unit of delegation requires sterile operator capital approximately equal to the family’s current share.

Family share	Average reserve / delegated ETH	Marginal reserve
0.1%	0.05%	0.1%
1%	0.5%	1%
5%	2.5%	5%
10%	5%	10%
20%	10%	20%

There is no hard concentration cap. Additional concentration progressively consumes more operator capital.

Whether Z_F should also be slashable as additional first-loss capital is open. If it is slashable, that still should not allow it to double-count as B_F.

Operator economics

Suppose:

y = staking return on productive ETH
\phi = operator’s effective fee fraction on delegated rewards
r_B = annual carrying cost of one unit of bond capital, net of any return the bond earns
r_Z = annual carrying cost of one unit of sterile reserve capital

Another unit of delegation produces operator revenue approximately:

\phi y

The linear bond adds marginal carrying cost:

\beta r_B

The quadratic reserve adds marginal carrying cost:

s_Fr_Z

So, before other operating costs:

\frac{\partial \Pi_F}{\partial D_F} \approx \phi y-\beta r_B-s_Fr_Z

An interior marginal-indifference point is therefore:

s_F^* \approx \frac{\phi y-\beta r_B}{r_Z}

provided the numerator is positive and the result lies between 0 and 1.

This exposes both failure boundaries.

If:

\beta r_B\geq\phi y

delegation is non-profitable even at zero concentration. Since \beta=1/\lambda, a rough viability condition is:

\lambda>\frac{r_B}{\phi y}

before other operating costs.

At the opposite extreme, if:

\frac{\phi y-\beta r_B}{r_Z}\geq1

there is no interior economic stopping point before 100% market share.

As:

r_Z\rightarrow0

the calculated stopping point diverges.

So this mechanism does not guarantee decentralization against an operator for whom eligible reserve capital is effectively free.

The earlier intuition:

s_F^*\approx\phi

is only a special case when approximately:

r_B\approx0,\qquad r_Z\approx y

This matters because capital costs differ. An operator may have strategic or otherwise-idle eligible treasury capital whose next-best use is not staking. That can make r_Z<y. I would not assume customer custody ETH is available unless the operator is legally and contractually allowed to use it.

The mechanism therefore prices concentration; it does not guarantee identical stopping points across operators.

Family-controlled admission

A family must be able to cap or close new delegation. Otherwise an attacker could grief it by forcing delegation into the family and increasing its capital requirement.

A family chooses how much delegation it is willing to accept. Once capacity is full, new delegators choose elsewhere.

This is the intended competitive pressure: the protocol does not decide an operator is “too big”; the operator decides whether accepting the next unit remains worthwhile.

Why splitting hides a precise quantity

For:

D=\sum_iD_i

the unsplit reserve is:

\frac{D^2}{2\Theta}

Expanding:

\frac{\left(\sum_iD_i\right)^2}{2\Theta} = \sum_i\frac{D_i^2}{2\Theta} + \sum_{i<j}\frac{D_iD_j}{\Theta}

The first term is what the split identities visibly pay.

The second term is exactly what disappears when one economic position is represented as independent identities.

So the Sybil problem here is:

Identity splitting hides the cross-terms.

The protocol cannot generally discover hidden ownership, but it can stop a redelegation event from creating an instantaneous reserve refund.

Source-attributed reserve runoff

For a native redelegation:

x:A\rightarrow B

let a and b be A and B’s delegation before the transfer.

Before:

Q_{\text{before}} = \frac{a^2+b^2}{2\Theta}

After:

Q_{\text{after}} = \frac{(a-x)^2+(b+x)^2}{2\Theta}

If the transfer reduces current quadratic reserve, add the exact reduction to a runoff balance owned by source family A:

G_{A\rightarrow B} = \max \left( 0, Q_{\text{before}}-Q_{\text{after}} \right)

which simplifies to:

G_{A\rightarrow B} = \max \left( 0, \frac{x(a-b-x)}{\Theta} \right)

Then:

R_A\leftarrow R_A+G_{A\rightarrow B}

There is no global runoff variable and no pairwise family graph.

Define:

Q=\sum_F\frac{D_F^2}{2\Theta}

and:

C=Q+\sum_FR_F

At fixed \Theta, before scheduled runoff release:

if redelegation lowers Q, the exact reduction is added to source runoff
if redelegation raises Q, no runoff is added

Therefore:

\boxed{C_{t+1}\geq C_t}

for a pure native redelegation transition.

Example: honest rebalancing

A is 10%, B is 5%, and 1% moves A→B.

Ignoring the common normalization:

10^2+5^2=125

becomes:

9^2+6^2=117

The net reduction is 8, so A receives runoff 8.

A’s own term fell by 19 while B’s rose by 11. A therefore receives 11 of immediate reserve release and retains 8 in runoff. B is charged only its ordinary reserve.

As runoff releases, the system recognizes the genuinely lower-concentration state.

Example: split into a fresh family

A is 10%, B is empty, and 4% moves A→B.

Before:

10^2=100

After:

6^2+4^2=52

so:

R_A\leftarrow R_A+48

and:

36+16+48=100

A releases 16; B must post 16. If both secretly have the same owner, no operator capital is liberated at the moment of the split.

Path property

For a sequence of redelegations under the same fixed \Theta, define:

\Delta_k=Q_{k-1}-Q_k

and:

g_k=\max(0,\Delta_k)

Then:

\sum_kg_k \geq \sum_k\Delta_k = Q_0-Q_n

So subdivision or reordering cannot reduce total accumulated runoff below the net reserve decrease implied by the endpoints. It can only leave it equal or increase it.

Attribution across source families remains path-dependent.

What runoff does not detect

Runoff is not a hidden-ownership detector.

Suppose:

a=10,\qquad b=6,\qquad x=4

Then:

G_{A\rightarrow B}=0

because:

10^2+6^2=6^2+10^2

No current reserve is released by the transfer.

If A and B secretly share an owner, that blind spot existed before the transfer. Treating them as one 16-unit family would contain an already-hidden cross-term:

\frac{10\cdot6}{\Theta} = \frac{60}{\Theta}

An event-level runoff rule cannot reconstruct common ownership that was already invisible before the event.

So:

Source runoff prevents reserve-reducing transfers from creating an instantaneous capital wash. It cannot retroactively price a common owner that has already built multiple protocol-indistinguishable families.

That belongs to the general Sybil boundary, not to runoff accounting.

Bounded state

This does not require per-delegator lineage or pairwise family state.

Each family needs:

delegation D_F
operator bond/capital state
source runoff R_F
last runoff-update epoch

So the additional runoff state is:

O(\text{families})

rather than O(\text{redelegations}) or O(\text{family pairs}).

A family record can eventually be removed once delegation, bond and runoff are all zero, subject to anti-state-spam rules.

R_F is ETH-denominated when it accrues and does not automatically rebase when \Theta later changes.

One possible runoff rule is:

R_F(t+\Delta)=\rho^\Delta R_F(t)

with:

0<\rho<1

The exact release curve is open, but its timescale should be calibrated against deliberate full-exit laundering.

Let:

L_{\text{wash}} = fastest protocol-feasible full exit plus fresh re-entry
\eta = minimum fraction of runoff that should remain after that period

Require:

\rho^{L_{\text{wash}}}\geq\eta

If H is the runoff half-life:

H \geq L_{\text{wash}} \frac{\ln2}{\ln(1/\eta)}

For \eta=1/2:

H\geq L_{\text{wash}}

The relevant benchmark is the fastest feasible wash cycle, not the current average queue.

Finite runoff still cannot permanently solve hidden ownership. It only prevents ordinary withdrawal/re-entry from erasing most of the source counterweight before the replacement position can be established.

Full exit

A delegator should retain both native redelegation and ordinary full withdrawal.

If x leaves A entirely, there is no destination family posting replacement reserve.

The released current reserve is:

G_{A\rightarrow\varnothing} = \frac{a^2-(a-x)^2}{2\Theta} = \frac{x(2a-x)}{2\Theta}

and that amount is added to R_A.

The user remains free to withdraw. It is previously committed operator capital that runs off gradually.

Delegator mobility does not require operator accounting amnesia.

A patient attacker can eventually wait out finite runoff and re-enter through a hidden affiliate. That cannot be eliminated without identity information.

The Sybil boundary

There is a fundamental limit.

Douceur’s classic The Sybil Attack result describes the general identity problem in decentralized systems without a trusted certification authority.

NED deliberately avoids real-world identity, so consider two worlds:

families X and Y are independently owned;
X and Y secretly share the same owner.

If every protocol-visible fact is identical, no protocol rule based only on those observations can distinguish the worlds.

There is also a temporal version of the same design boundary. If hidden splitting produces permanent annual benefit c>0 while runoff or cooldown creates only a finite cost K, eventually:

cT>K

So:

No finite time penalty can permanently substitute for identity information the protocol does not possess.

These are not literally the same theorem, but they express the same mechanism-design boundary.

The broader Sybil literature points in the same direction. Platt, Platt and McBurney formalize a permissionlessness/Sybil-resistance/freeness trilemma, and Chitra, Penna and Schneider prove a narrower impossibility for two classes of splitting attacks in a restaking/slashing model.

NED should therefore not claim universal Sybil-proofness.

Its narrower target is to make economically unified delegated control costly to masquerade as independent unless the operator actually supplies additional capital, acquires separate delegation demand, accepts time/capital friction, or creates genuinely independent fault domains.

Different concentration problems

Several things are often grouped under “staking centralization” but are not the same problem.

Delegated consensus concentration is NED’s primary target: how much delegated consensus weight is controlled by the same operator family.

Operational correlation concerns validators that share infrastructure, clients or other fault domains and therefore fail together. This may provide a useful secondary signal, but it should not be treated as an ownership oracle.

Regulatory/policy correlation is different again. Independent actors can make the same inclusion or filtering decisions because they face the same sanctions regime, legal advice or policy constraints. That is correlation without common ownership.

Block-building/censorship concentration concerns specialized builders and relays. FOCIL addresses transaction-inclusion/censorship resistance at that layer. NED should not claim to solve it, and FOCIL does not solve delegated consensus concentration.

Operational correlation as a secondary signal

If supposedly independent families repeatedly fail together because they share infrastructure or common dependencies, correlated behavior may provide an identity-blind risk signal.

That could potentially create additional temporary capital requirements.

But this should remain complementary, not load-bearing. Common network events, client bugs and other confounders make false positives dangerous.

If an operator responds by actually making its supposedly independent systems operationally independent, Ethereum has received some of the decentralization benefit anyway.

Reference mass \Theta

Instantaneous total delegated ETH is a poor denominator because market-wide shocks could change reserve requirements abruptly even when an operator does nothing.

So \Theta should be a slowly moving, piecewise-constant reference over defined accounting intervals.

Redelegation/runoff calculations within an interval use the fixed \Theta. An update to \Theta is a separate system-wide recalibration.

Existing R_F remains ETH-denominated across that recalibration.

Bootstrap guard

A launch from zero adoption needs an explicit nonzero denominator.

A candidate form is:

\Theta_t = \max \left( \widehat{T}_{\text{NED},t}, \Theta_{\text{boot},t} \right)

where \widehat{T}_{\text{NED},t} is the smoothed native-delegation reference and \Theta_{\text{boot},t}>0 is a bootstrap floor, potentially derived from a broader protocol-scale quantity such as active stake.

This is mainly an initialization/shock guard.

If \Theta equals actual native delegated ETH, then D_F\leq\Theta, so:

\frac{Z_F}{D_F} = \frac{D_F}{2\Theta} \leq \frac12

The ordinary reserve ratio is therefore bounded. The pathological case is the zero launch denominator or a reference rule that lets \Theta become too small relative to live delegation.

If a \Theta update temporarily leaves an operator under-reserved, I would freeze new delegation admission rather than forcibly eject existing delegators.

New operators

A new operator begins with low concentration and therefore a small quadratic reserve. Real bond counts immediately.

That seems preferable to generic age/maturity discounts.

Merely parking empty identities in advance provides no delegation scale or accumulated economic benefit. This is different from patiently building multiple genuinely substantial families, which falls under the hidden-ownership boundary above.

LSTs and existing providers

NED would not create a native liquid staking token.

Existing protocols could wrap native delegation and continue providing liquidity, DeFi integration, insurance, institutional products and UX.

A major open question is whether wrappers simply recreate concentration at another layer.

I also do not see NED as anti-Lido, anti-Coinbase, anti-Chorus One or anti-provider generally.

A successful provider can remain large if delegators continue choosing it and the provider can economically justify the required capital. The mechanism is intended to make scale carry an operator-side cost, not prohibit scale.

Relationship to previous work

Several parts have clear prior work:

eODS (Enshrined Operator Delegator Separation) explores protocol-native operator/delegator separation and is probably the closest substrate to the native-delegation side of this idea.
Optional non-KYC validator metadata explores cryptographically self-certified validator/operator affiliation.
EIP-7716 and related anti-correlation research explore identity-blind penalties for correlated validator behavior.
Other staking systems provide prior art for operator pledge/bond and pool-saturation ideas.
Douceur (2002), Platt et al., and Chitra et al. provide relevant formal Sybil/impossibility results.

I do not think native delegation, operator bonding, self-declared affiliation, saturation or anti-correlation incentives are individually novel.

The part I am most interested in is the combination of:

quadratic family-level concentration reserve
cryptographic operator families
separate linear bond and convex reserve
source-attributed event-level runoff
bounded per-family runoff state
explicit Sybil/impossibility boundaries

The goal is not to identify hidden owners. It is to stop an observable repartitioning event from making an accumulated concentration cost vanish instantly.

What is exact in this candidate model

Given the stated accounting rules:

Validator splitting inside one declared family: neutral, because economics aggregate at family level.

Proportional bond splitting: neutral, because D/B is unchanged.

Tracked native redelegation: at fixed \Theta, source-attributed runoff ensures:

Q+\sum_FR_F

cannot fall at the instant of a reserve-reducing redelegation before runoff release.

Subdivision/reordering: accumulated runoff is bounded below by the endpoint reserve reduction.

These statements do not imply that pre-existing hidden common ownership has been identified.

What remains open

This construction does not guarantee a decentralized operator market.

It does not identify hidden beneficial ownership.

It does not establish:

whether native delegation itself is desirable
the correct \lambda, r_B-relevant bond design or Z_F slashing treatment
the correct \Theta smoothing/bootstrap rule
the correct runoff half-life/release curve
family creation/state-spam rules
safe operational-correlation accounting
the right interaction with validator effective balance, exits and withdrawals
how LST/application-layer concentration evolves

If reserve capital is nearly free, there may be no interior self-limit. If the linear bond is too expensive, there may be no viable delegation market.

Those are explicit economic boundaries, not claims the mechanism avoids.

Where possible, parameters should ideally be fixed long-term rules or derived from protocol-observable quantities rather than require frequent discretionary off-chain governance.

Questions I would especially like feedback on

Is native delegation desirable at the protocol level?
Is a cryptographic operator family a sensible economic unit?
Is Z_F=D_F^2/(2\Theta) a reasonable convex operator-side concentration cost?
Is there a better convex reserve function?
Is one source-runoff balance R_F per family a consensus-efficient construction?
What runoff rule best balances genuine deconcentration against full-exit laundering?
How should \Theta be initialized, floored and updated?
What minimum linear bond preserves \beta r_B<\phi y, and should B_F remain productive?
Is family-controlled delegation admission compatible with the desired UX?
Should correlated validator behavior play any secondary role?
Should Z_F be slashable, and what should the loss waterfall be?
How should delegation interact with effective balance, activation, exit and withdrawal credentials?
How would LSTs and DeFi wrappers interact with family-level accounting?
Is the quadratic-reserve plus source-runoff construction already present in prior work?
Is there a simpler construction that achieves the same objective?

Closing

I am not trying to prescribe a finished implementation.

The original declining-reward construction failed because pseudonymous splitting directly improved the economics.

The current candidate instead makes concentrated delegated control consume increasing operator capital and uses source-attributed runoff so reserve-reducing redelegation cannot create an instantaneous capital refund simply by repartitioning stake across identities.

It explicitly does not solve hidden beneficial ownership. That boundary appears fundamental without adding trusted identity.

If the direction has merit, I would rather see the specification develop through discussion with people already working on Ethereum staking, consensus and mechanism design than try to turn an idea-stage mechanism into a finished protocol alone.

The working name is Native Ethereum Delegation (NED).

Informally, the Flanders Protocol.