Native Ethereum Delegation (NED): Protocol-Routed Delegation With Split-Neutral Allocation and Coverage-Bounded Consensus Amplification

squijello · August 13, 2026, 12:39am

Informally: the Flanders Protocol.

Abstract

Ethereum already has delegation economically, but the protocol does not provide a provider-neutral native delegation primitive.

Today, a user’s choice of staking provider commonly influences where that user’s stake ultimately operates:

\text{commercial provider choice} \longrightarrow \text{validator destination} \longrightarrow \text{consensus weight}.

Native Ethereum Delegation (NED) explores a different architecture.

A user delegates to a common native pool rather than selecting a validator or staking provider at the consensus layer. NED-enabled validators receive delegated principal according to protocol-visible native base stake rather than the user’s commercial provider.

The balanced routing target is:

\boxed{D_i=uB_i}

where B_i is validator i's NED-eligible native base effective balance, D_i is its assigned NED delegated principal, and u is the common target delegation ratio.

Linearity makes the target exactly neutral to subdivision of the same eligible stake across additional validator identities.

Selective participation still creates a harder problem: delegated weight can amplify the participating subset relative to non-participants. The current construction bounds that amplification using a Delegation Concentration Envelope (DCE), which asks how much delegated principal can actually fit inside any eligible-base slice large enough to contain a protected hidden coalition.

For protected pre-NED coalition share \kappa, threshold \tau, eligible coverage e, normalized delegation d, and effective NED multiplier \gamma, the hard condition is:

\boxed{ \kappa+\gamma C(\min(\kappa,e)) \le \tau(1+\gamma d) }.

For Ethereum’s one-third threshold, \tau=1/3.

The protocol does not need to identify which validators belong to the hidden coalition.

The design has a useful scaling property:

NED earns scale by earning coverage.

Narrow validator participation permits little safe delegation. Broad participation permits progressively more. At universal proportional participation, NED approaches zero relative consensus amplification.

This remains an idea-stage research mechanism, not yet an EIP.

1. Motivation and scope

Ethereum’s practical delegation layer exists mostly above the protocol. A passive staker may use an exchange, custodian, LST or staking service, creating a reinforcing relationship:

\text{commercial staking success} \rightarrow \text{more customer stake routed to the provider} \rightarrow \text{more consensus influence}.

The narrower protocol question is:

If Ethereum exposes native delegation, why should the user’s commercial provider choice itself determine where the delegated consensus weight goes?

Under NED:

\text{ETH holder} \rightarrow \text{native NED pool} \rightarrow \text{protocol-routed validators}.

Commercial services can still compete on custody, liquidity, insurance, reporting, compliance and UX. Those relationships are not NED routing inputs.

NED does not attempt to identify beneficial ownership or operator families, determine which validators are genuinely independent, subsidize purported small operators by identity, decentralize the existing validator set, prohibit conventional staking services, prevent custodians from staking customer ETH outside NED, or eliminate application-layer LSTs.

The targeted property is narrower:

\boxed{ \text{commercial provider choice} \not\Rightarrow \text{native delegation destination} }.

2. State model

For every active validator i, let V_i be its ordinary native effective balance and define:

S=\sum_iV_i.

If validator i is NED-enabled:

B_i=V_i,

otherwise:

B_i=0.

Thus 0\le B_i\le V_i.

B_i is a protocol-visible quantity. It is deliberately not called operator-owned stake. Ethereum can observe validator credentials and effective balance; it cannot reliably observe beneficial ownership.

Let D_i\ge0 be validator i's assigned active NED delegated principal before exceptional safety downweighting. Active NED state requires D_i>0\Rightarrow B_i>0; retiring principal is accounted separately.

Define:

E=\sum_i B_i,\quad D=\sum_i D_i,\quad e=\frac{E}{S},\quad d=\frac{D}{S}.

Normally all assigned NED principal is consensus-effective. For exceptional safety recovery define:

0\le\gamma\le1.

Effective delegated consensus balance is:

Q_i=\gamma D_i,

and NED consensus weight is:

\boxed{W_i=V_i+Q_i}.

Normal operation targets \gamma=1.

3. Delegators do not select operators

A native NED delegation request contains no validator index, validator public key, operator, staking company, fee bid, reputation score, geography or commercial wrapper as a consensus-routing target.

The native operation is not:

\text{delegate this ETH to validator }i.

It is:

\boxed{\text{delegate this ETH through NED}.}

A commercial service may custody or wrap that position without becoming the consensus destination of the customer’s delegated weight.

4. Split-neutral routing

The balanced target is:

\boxed{D_i=uB_i}.

Suppose one hidden economic actor represents eligible base stake through arbitrary validator identities:

B_A=\sum_{j\in A}B_j.

Then:

\sum_{j\in A}D_j =u\sum_{j\in A}B_j =uB_A.

Creating more validator identities does not increase aggregate target allocation.

More generally, exact neutrality to subdivision requires an identity-local allocation law g to satisfy:

g(x+y)=g(x)+g(y).

Under ordinary continuity or monotonicity assumptions, this gives:

\boxed{g(x)=ux}.

This is why NED does not use a nonlinear “small operator” curve as its identity defense. Convex identity-local rules reward splitting, while concave rules create economies of scale. Linear resource allocation makes subdivision irrelevant.

5. Zero-amplification boundary

There is a useful boundary result before considering selective participation.

Suppose total delegated weight D is fully allocated and require that no possible hidden coalition receive any increase in relative consensus share. For every singleton validator:

\frac{V_i+D_i}{S+D} \le \frac{V_i}{S}.

This implies:

\frac{D_i}{D}\le\frac{V_i}{S}.

Both distributions sum to one, so equality is forced:

\boxed{D_i=D\frac{V_i}{S}}.

Therefore:

If zero amplification must hold for every possible hidden ownership partition, delegated allocation must reproduce the complete validator distribution proportionally.

Universal proportional NED participation is therefore the zero-amplification endpoint. The difficult case is incomplete participation, where useful selective delegation must be bounded without pretending hidden ownership is observable.

6. Delegation Concentration Envelope

Normalize each NED validator by total ordinary base stake:

b_i=\frac{B_i}{S},\quad y_i=\frac{D_i}{S}.

For normalized eligible-base mass m, define the Delegation Concentration Envelope:

\boxed{ C(m)= \max_{\substack{0\le z_i\le1\\ \sum_i z_i b_i\le m}} \sum_i z_i y_i }. \tag{1}

This is a fractional-knapsack upper bound. Sort eligible validators by D_i/B_i, highest first, and fill eligible base mass m; the final validator may be consumed fractionally.

The fractional relaxation is conservative. It measures the delegated principal that can actually be packed into an eligible-base slice of size m. A tiny high-leverage validator contributes only the principal it can carry, rather than its ratio being multiplied across unrelated stake. Proportional identity splitting leaves C(m) unchanged.

7. Hard hidden-coalition invariant

Let \kappa<\tau be the largest pre-NED base-stake coalition NED is required to prevent from crossing threshold \tau solely because of NED amplification.

For Ethereum’s one-third threshold:

\tau=\frac13.

Define:

m=\min(\kappa,e).

Require:

\boxed{ \kappa+\gamma C(m) \le \tau(1+\gamma d) }. \tag{2}

Proof sketch

Take any hidden coalition A with ordinary base share:

p_A=\frac{V_A}{S}\le\kappa.

Its eligible base share satisfies:

a_A=\frac{B_A}{S} \le\min(p_A,e) \le m.

By definition of the DCE:

\frac{D_A}{S}\le C(m).

After the global multiplier:

\frac{Q_A}{S} =\gamma\frac{D_A}{S} \le\gamma C(m).

Therefore its NED-weighted consensus share satisfies:

q_A \le \frac{\kappa+\gamma C(m)}{1+\gamma d} \le\tau.

So Equation (2) bounds every hidden coalition with current pre-NED base share at or below \kappa, without an ownership oracle.

8. Coverage-adaptive capacity

In a balanced normal state:

\gamma=1,\quad D_i=uB_i.

Then:

C(m)=um,\quad d=ue.

Equation (2) reduces to:

\boxed{ \kappa+u\min(\kappa,e) \le \tau(1+ue) }. \tag{3}

For e\le\kappa:

\boxed{ d_{\max}=\frac{\tau-\kappa}{1-\tau}}. \tag{4}

For \kappa<e<\kappa/\tau:

\boxed{ d_{\max}=\frac{e(\tau-\kappa)}{\kappa-\tau e}}. \tag{5}

Once e\ge\kappa/\tau, concentration alone no longer upper-bounds d. Other risk limits still should.

Illustrative 32% protection level

Take:

\kappa=0.32,\quad \tau=\frac13.

The concentration-only frontier is approximately:

NED-eligible coverage e	Concentration-safe D/S
40%	2.86%
60%	6.67%
80%	20%
88.89%	50%
90%	60%
92%	92%

Below 32% coverage, the concentration-only ceiling is 2% of base stake. A narrow participating subset therefore cannot absorb a large native pool simply because it opted in first.

Conversely, a 50% D/S pool becomes concentration-compatible at about 88.89% coverage under this illustrative \kappa.

This is the intended behavior:

low coverage → low safe capacity

broad coverage → high safe capacity

universal proportional coverage → zero relative amplification

9. Three separate risk limits

Hidden-coalition concentration

Equation (2) controls consensus-share amplification.

Local principal-agent leverage

Define \ell and require:

\boxed{D_i\le\ell B_i}. \tag{6}

This limits delegated principal per unit of eligible base.

System-wide NED exposure

Define \Lambda and require:

\boxed{d=\frac DS\le\Lambda}. \tag{7}

This caps systemic NED size near universal coverage.

In balanced normal operation:

\boxed{ d\le \min\left( d_{\text{concentration}}(e), \ell e, \Lambda, d_{\text{demand}} \right). } \tag{8}

As an illustrative test vector only, not a mainnet recommendation:

\kappa=32\%,\quad \ell=\frac23,\quad \Lambda=\frac12

would allow NED to reach 50% of ordinary base stake at about 88.89% eligible coverage, while separately capping local and total nominal delegated exposure.

10. Bounded-cost DCE implementation

A consensus implementation can conservatively approximate the exact DCE with a fixed leverage histogram over:

0\le\frac{D_i}{B_i}\le\ell.

For each bucket maintain aggregate eligible base and delegated principal. Scan high to low; only the partially consumed boundary bucket uses its leverage ceiling.

Then:

\boxed{\widehat C(m)\ge C(m)}.

With K equal-width buckets:

\boxed{ \widehat C(m)-C(m) \le\frac{m\ell}{K} \le\frac{\kappa\ell}{K}. } \tag{9}

For illustrative \kappa=0.32, \ell=2/3, K=1024, the worst-case normalized overestimate is about 0.02083% of ordinary base stake.

The conservative \widehat C can replace C directly in Equation (2).

11. Exceptional safety multiplier

Normal activation must satisfy Equation (2) with \gamma=1. An involuntary state change can nevertheless alter eligible base or delegation after activation.

Rather than physically rescaling every D_i, NED applies one global effective-weight multiplier \gamma. Nominal D_i and the DCE histogram remain unchanged; consensus uses Q_i=\gamma D_i.

Let C denote the exact or conservative nominal envelope. The hard condition is:

\kappa+\gamma C \le \tau(1+\gamma d).

If C-\tau d>0, the largest safe multiplier is:

\boxed{ \gamma^* = \min\left( 1, \frac{\tau-\kappa}{C-\tau d} \right). } \tag{10}

A lower \gamma reduces NED-derived consensus weight and rewards without changing pool ownership. Because nominal D_i, C, and d stay fixed, the calculation is homogeneous and does not recursively cascade.

While \gamma<1, new NED activation is frozen. A later increase in \gamma is activation-like and should consume accountable-safety/churn capacity.

The interaction between abrupt \gamma reduction and Ethereum’s accountable-safety properties, including the cost of deliberately inducing a global downweighting event, remains a consensus-analysis blocker.

12. Base impairment and sticky eligibility

A validator cannot voluntarily remove NED backing while active delegated principal depends on it.

If eligible base falls involuntarily from B_i^{old} to B_i^{new}<B_i^{old}, assigned delegated principal is locally reduced by at least the same proportion:

\boxed{D_i^{new}\le D_i^{old}\frac{B_i^{new}}{B_i^{old}}.} \tag{11}

The excess stops creating new consensus weight and enters retiring NED principal. The DCE is recomputed and \gamma supplies a network-wide backstop only if still required.

Voluntary NED exit proceeds conceptually as:

\text{stop new allocation} \rightarrow \text{retire }D_i \rightarrow \text{accountability tail} \rightarrow \text{clear NED eligibility}.

This prevents an operator from briefly opting in to inflate coverage and then immediately removing backing after additional pool capacity activates.

13. Consensus-weight semantics

I previously explored making NED attestation-only to avoid execution-layer MEV leakage. I no longer think that should be the default design.

Separate finality and proposer stake bases create additional complexity across proposer boost, rewards and inactivity accounting.

The current reference direction is therefore:

\boxed{W_i=V_i+\gamma D_i}

for stake-weighted consensus roles NED participates in.

At minimum this includes:

FFG justification/finality weight,
LMD-GHOST attestation weight,
proposer selection probability,
consensus-layer attestation/proposer rewards and penalties,
inactivity accounting,
proposer and attester slashable authority.

Proposer boost should be normalized to total active NED consensus weight:

W=\sum_iW_i,

so its scale remains tied to average attesting committee weight.

Sync-committee treatment remains open. Sync assignments are long-lived and light-client-facing, so I do not want to specify their NED semantics without dedicated modeling.

A Core EIP would need to classify every current use of effective_balance and specify whether it consumes V_i, W_i, or a role-specific quantity.

14. Rewards and execution revenue

Consensus-layer rewards attributable to effective NED weight belong economically to the NED pool, subject to an eventual operator-compensation rule. A natural accounting model splits consensus-layer balance deltas between base and delegated ledgers according to their contribution to effective weight.

Priority fees, builder payments and other MEV are not reliably measurable as one protocol-visible revenue stream, so NED does not pretend it can force all execution-layer value back into the pool.

Execution-layer proposer revenue remains with the validator operator. This is an intentional operator rent and participation incentive, not a routing input. Operators cannot bid for more NED delegation because routing remains protocol-controlled.

The consequence is explicit: NED pool yield will generally be below the full economic return of directly operating validators and may be below products that successfully redistribute execution-layer MEV.

NED also changes consensus reward economics. If W_i is the effective balance used for rewarded consensus work, total active reward weight increases with effective NED delegation. The final specification must therefore define how W enters the base-reward denominator and issuance accounting. NED does not promise that direct validators keep an unchanged per-ETH consensus yield as the pool grows.

Whether native settlement, lower intermediary risk and application-layer liquidity wrappers compensate for the resulting yield trade-offs is an adoption question that needs modeling. NED does not introduce a synthetic issuance subsidy to hide them.

15. Bootstrap and operator commitment

Coverage matters because safe NED capacity grows with e, creating a two-sided coordination problem at launch.

Operators can precommit validators to future NED eligibility subject to maturity and sticky exit, while delegators can enter a pending queue. Pending delegation has no consensus weight, reward or slashing exposure. Precommitted validators do not count as e, and pending principal does not count as D, until activation.

It does not guarantee adoption. The equilibrium needs agent-based modeling rather than a hand-selected bootstrap subsidy.

16. Pool accounting and withdrawals

NED uses one native pool rather than a dense delegator-to-validator graph. Users hold claims on a common pool NAV.

The protocol needs approximately:

pending and active pool principal,
active D_i by validator,
retiring non-voting principal,
pool shares or equivalent account claims,
withdrawal requests,
pending NED slashing notices.

A protocol-native transferable LST is not required. Applications can wrap NED positions if they want liquidity.

A withdrawal request does not immediately crystallize a fixed ETH amount. Requested shares remain inside the loss-bearing pool while their NED weight retires and while the delegated slashing claim window remains open.

This blocks the simplest slashing bank run: observing a likely offense does not let a user immediately lock an old NAV and leave everyone else with the loss.

The trade-off is pooled latent liability. A new depositor can enter while an old, not-yet-proven NED offense remains inside the bounded claim window.

The L1 primitive accepts that pooled risk to preserve fungibility. Higher-layer wrappers can provide stricter cohort isolation.

17. Finite NED slashing claim window

Ethereum’s ordinary attester-slashing validity does not impose a simple fixed age limit on conflicting attestations while the validator remains slashable. That creates a fundamental boundary for pooled delegation.

NED cannot simultaneously provide:

unbounded historical delegated liability,
finite final withdrawal with no clawback,
exact assignment of every arbitrarily late loss to the users who backed the old offense.

The reference design therefore gives the delegated component a finite claim window while leaving ordinary validator slashing rules unchanged.

Initial reference value:

\boxed{W_{NED}=8192\text{ epochs}}. \tag{12}

This aligns with EPOCHS_PER_SLASHINGS_VECTOR; ordinary Ethereum evidence does not expire at this boundary.

A valid NED slashing notice submitted during the window preserves the corresponding pool liability even if settlement happens later.

A withdrawal can settle only after:

\text{last NED exposure epoch}+W_{NED}

and after all timely pending NED notices that can affect it have resolved.

A proof first presented after the NED window can still affect the ordinary validator under Ethereum’s normal slashing rules if applicable, but it no longer reaches an already-finalized historical NED claim.

This asymmetry is deliberate: without a liability-finality boundary, finite NED withdrawal is impossible. At current timing, 8192 epochs is roughly 36 days, so the liquidity cost is substantial.

18. Historical NED exposure and proof ordering

A slashable message may have been signed when a validator’s NED weight differed from its current weight.

For a slashable pair signed at states t_1 and t_2, define reference delegated exposure:

\boxed{ X_i= \min\left(Q_i(t_1),Q_i(t_2)\right). } \tag{13}

For double votes or surround votes this bounds the delegated principal common to both conflicting authorities. The exact delegated penalty schedule remains to be specified.

If D_i and \gamma are committed in BeaconState, existing state roots and Capella historical summaries provide plausible commitment points for SSZ proofs of historical exposure. The historical-summary period is 256 epochs, so the reference window spans 32 periods. Exact proof format remains to be specified.

NED liability also cannot rely only on the ordinary validator.slashed boolean. A validator could be slashed by one proof and later have another valid proof reveal larger historical NED exposure from the same participation period.

For each NED liability session, track maximum already-accounted exposure:

X_i^{charged}.

For each timely valid slashing notice with historical exposure X_i:

\boxed{ \Delta X_i = \max(0,X_i-X_i^{charged}) } \tag{14}

then:

X_i^{charged}\leftarrow\max(X_i^{charged},X_i).

Thus maximum accounted exposure is proof-order independent. A low-exposure proof cannot immunize a larger historical exposure.

A NED slashing notice must satisfy the ordinary conflict/signature conditions, reference historical NED exposure, and arrive within the NED claim window. It can open NED liability only while the validator is slashable under ordinary rules. Once an NED liability session has been opened by a valid ordinary slashing, later timely proofs may increase X_i^{charged} even though the validator is already marked slashed. This prevents proof ordering from hiding larger historical NED exposure without creating a new delegated liability after the base validator has already escaped ordinary slashability.

If D_i reaches zero, the old session remains open through the NED claim window. A new clean participation session begins only after zero delegated exposure has persisted through that window.

19. Churn and accountable safety

NED must not create an unlimited side channel for rapidly adding or moving consensus weight.

Conceptually, D_i\uparrow is activation-like and D_i\downarrow is retirement-like. Moving principal from validator A to validator B is retirement followed by later activation.

Normal changes in effective NED weight should consume Ethereum’s balance-based accountable-safety/churn budget, or a rigorously derived sub-budget within it.

The exceptional \gamma path is intentionally asymmetric: \gamma may fall quickly if necessary to restore the hard concentration envelope, but increasing \gamma is activation-like and should occur through churn.

The accountable-safety implications of abrupt \gamma reduction remain a blocking consensus question.

20. Economic-finality and bypass limitations

NED delegated principal is real slashable consensus capital while it contributes to W_i, but NED does not prove that V_i+D_i is wealth economically owned by the validator controller.

The controller operates the key while delegators provide some supporting capital. The local limit \ell bounds this principal-agent leverage; it does not create an ownership oracle or prevent delegator losses.

Likewise, a custodian can accept customer ETH and stake it directly outside NED. Ethereum cannot reliably distinguish proprietary ETH from customer ETH under the same credentials.

NED targets a narrower feedback loop:

\boxed{ \text{customer use of provider }P \not\Rightarrow \text{NED routing to provider }P }.

A provider may still become commercially large or increase its ordinary validator stake independently.

21. Relationship to current specs and prior work

Current-spec details referenced above come from the Phase 0 beacon-chain, fork-choice, Altair incentives, Capella beacon-chain, and Electra beacon-chain.

eODS is the closest Ethereum-native delegation substrate I have found. It explores protocol-level operator/delegator separation, explicit delegation accounting, churn and delegated slashing.

Rainbow Staking explores the broader separation of capital providers and validation services.

EIP-7251 provides relevant precedent for variable validator effective balances and balance-based churn, but is not a native delegation mechanism.

EIP-7685 provides a generic execution-layer-to-consensus request framework that may be useful for NED lifecycle operations.

Prior native-liquid-staking work also explores protocol-wide validator-set exposure. NED does not claim universal proportional indexing as novel; universal proportional participation is the zero-amplification endpoint derived above.

I do not claim native delegation, pooled staking, proportional allocation, fractional knapsack or operator/delegator separation individually as novel.

The narrower candidate contribution is the combination of:

provider-neutral pooled native delegation in which commercial provider choice is absent from routing,
additive base-stake routing chosen specifically for identity-split neutrality,
the zero-amplification boundary for identity-blind selective delegation,
the DCE as a hidden-coalition delegated-mass bound under incomplete participation,
coverage-adaptive capacity,
separate concentration, local-leverage and total-exposure limits,
and a bounded pooled-liability path for historical NED slashing.

22. Executable checks and remaining blockers

The current harnesses test conservative bucketed DCE computation, hidden-coalition bounds, proportional split invariance, coverage/capacity formulas, global \gamma safety downweighting, proposer-boost normalization to NED consensus weight, base-impairment handling, bounded pooled withdrawal liability, NED session separation and proof-order independence.

Recent runs included 151,551 hidden-coalition checks plus split, proposer-boost, slashing-order and pooled-liability fuzzing. These are mechanism tests, not a consensus implementation or safety proof.

Before a Core EIP, I think at least the following remain blocking:

Select and justify \kappa, \ell, \Lambda, DCE precision and the NED claim window.
Produce Pyspec for activation, routing, retirement, \gamma, pool accounting and historical slashing.
Audit every consensus-spec use of effective_balance against V_i, W_i, or a role-specific quantity.
Complete accountable-safety and adversarial-griefing analysis for exceptional \gamma reduction.
Resolve sync-committee semantics.
Specify delegated and correlated-slashing penalties.
Specify and benchmark historical exposure proofs against existing state-history commitments.
Model operator participation and bootstrap equilibrium.
Model issuance, direct-validator yield, operator rent and NED adoption, including the execution-revenue gap.
Measure state growth and epoch-processing cost for the DCE histogram, pool accounting and notice queues.

The claims I would most like attacked are:

\boxed{D_i=uB_i}

as the split-neutral target;

\boxed{ C(m)= \max_{\sum z_i b_i\le m} \sum z_i y_i }

as the hidden-coalition delegated-mass envelope; and

\boxed{ \kappa+\gamma C(\min(\kappa,e)) \le \tau(1+\gamma d) }

as the resulting full-network amplification bound.

If one of those fails, I would rather find the counterexample directly than hide it under another pricing curve or identity assumption.

Conclusion

The original problem is simple:

Commercial staking-provider success can translate into additional consensus power because the user’s provider choice also influences where delegated stake operates.

NED removes that choice from the native routing primitive.

It does not try to identify which validators are genuinely independent or which operator identities belong together.

Linear routing makes validator-identity subdivision irrelevant to target allocation.

The Delegation Concentration Envelope bounds how much NED principal can actually be packed into any hidden coalition below a chosen base-stake threshold.

Coverage determines scale. At low participation, NED is deliberately constrained. At broad participation, it can become economically meaningful. At universal proportional participation, relative amplification tends to zero.

The question is not whether NED can eliminate Ethereum staking concentration. It cannot.

The question I think is worth testing is:

Can Ethereum provide a provider-neutral native delegation path whose ability to scale is mathematically tied to broad validator participation, while bounding the additional consensus leverage created by delegated capital without relying on a real-world ownership oracle?

Working name: Native Ethereum Delegation (NED).

Informally: the Flanders Protocol.