Unconditional inclusion lists

[themandalore]

Awesome post!

I could see a scenario where you purposely fill the IL with as many low value transactions as you can to limit the rewards of other validators. a) how do you ensure the IL transactions are paying the appropriate fee for a block (or could you just stuff it with 0 gas txns?) or b) how do prevent just filling up the IL with useless things so other validators don’t have as much space to get MEV or higher value transactions?

Also, I saw Justin’s talk on splitting out the attester and proposer roles for MEV auctions. Why not have attesters be in charge of the inclusion list since the proposer role in general seems to be centralizing like the builder one?

[Pintail]

Also love this! One thought: rather than have a separate IL gas limit, why not just subtract any excess gas consumed by IL transactions from the gas limit of block n+2? For the EIP-1559 basefee update the excess gas of block n+1 is then accounted for in the block n+2 basefee calculation and overall throughput is unaffected.

[pyggie]

Does the gas base fee rule also apply to transactions in the IL? If yes, what happens to transactions in the IL whose gas price is lower than the base fee for the block?

[Pintail]

They have to be dropped if they can’t afford the basefee otherwise getting into the IL would be a way of circumventing it.

[ChrisBender]

Interesting proposal! However, I’m a bit worried/confused as to how IL blockspace doesn’t just degenerate into the same market structure as “normal” blockspace.

Since inclusion in the IL is valuable and scarce, users will be paying gas in a standard first-price auction, no? What prevents a similar relayer-builder dynamic from forming on the extended IL blockspace? Why would validators not also opt-in to “IL-mev-boost”?

[The-CTra1n]

@ChrisBender

Interesting proposal! However, I’m a bit worried/confused as to how IL blockspace doesn’t just degenerate into the same market structure as “normal” blockspace.

That’s a valid concern.

Unconditional txs in a block N probably need to pay a premium compared to normal transactions in block N (and possibly also N+1). Something that normal transactions wouldn’t do. Inclusion lists have the issue of handling the increase in gas from full block to full block.

For example, by forcing IL txs to commit to double the current base-fee (plus some tip), the IL should be used pretty exclusively for txs needing CR. Normal users can still tip+correct current basefee, and risk getting in through the normal entrypoint.

In such a setup, a user needing CR in the presence of non-censoring proposers probably sends an IL tx and a non-IL tx (which can tip more due to lower basefee). If the proposer is censoring, we’re back to square 1… Maybe ILs can be enforced by non-proposer validators?

[Nerolation]

@themandalore

how do you ensure the IL transactions are paying the appropriate fee for a block

First, there is still the base fee which every transaction must be able to pay. You cannot go below the basefee. Otherwise the IL would be perceived invalid and your full block would turn invalid too. The end result is that you missed your slot for building an invalid IL.
Second, with “useless” you refer to low-gas transaction. This is not the case as the IL has it’s own gas limit.
The only concern could be that you put ofac transaction in it to constrain the next proposer by not having access to 4 out of the 5 largest builders bc they are censoring.

@themandalore

Why not have attesters be in charge of the inclusion list since the proposer role in general seems to be centralizing like the builder one?

This is already the case. Validators are enforcing the IL by only attesting to blocks that obey the IL. If a builder builds a block that is invalid because e.g. it censors, then the relay wouldn’t even give that block to the validator because the relay would simulate the block and see that it’s invalid.

[Nerolation]

They won’t be dropped because they should never reach the state in which they cannot be put into a block at the beginning.
Every IL in which there is a transaction that doesn’t pay current_basefee + 12.5% as maxFeePerGas is invalid from the beginning. Thus, the validator who built it shouldn’t have gotten the block on-chain as validators should perceive that block as invalid.

The 12.5 ensure that the transaction is valid even if the basefee increases and the transaction pays nothing in priority fees.

[Nerolation]

I think this might make the whole thing little more complicated to implement and additionally adds this strange “attack” on the next proposer in which you fill the IL with non-mev/low priofee transactions to reduce the next’s profits. By allowing the IL to have it’s own limit, this cannot happen.

Would be actually interesting start discussing the size of the IL. It should accomodate large transactions (TC deposits/withdrawals of each 1m gas) but should also not end up raising the block gas limit by too much.

[Pintail]

I can see that the attack vector you describe is potentially a serious problem.

To me it seems that the introduction of a new protocol variable (an IL gas limit) represents significant unwelcome complexity. Is it really justified by the benefits relative to the ‘conditional IL’ approach?

[mikeneuder]

IMO yes! the unconditional property feels super important. @pintail what you describe as “not increasing the gas limit but still requiring the transactions to be in the block” is effectively lowering the gas limit of that block, which IMO is two sides of the same coin. Using it as an extension rather than a reduction is more of an aesthetic choice, i think the unconditional property is the real design consideration that is worth aiming for.

This is what I was trying to get across with

Note that viewing unconditional IL transactions as an extension of the gas limit of a block could equivalently be seen as a reduction of the gas limit of a block if the transactions are force-included even if the block is full.

Either way, these edge cases apply only when the blocks are full, which I think is rare enough to not worry about average case usage of ILs IMO.

[mikeneuder]

@themandalore

Also, I saw Justin’s talk on splitting out the attester and proposer roles for MEV auctions. Why not have attesters be in charge of the inclusion list since the proposer role in general seems to be centralizing like the builder one?

Making the attesters in charge of CR would be great, but in practice i dont see how this works. the attesters would need to come to consensus over a set of transactions to include, which is a whole can of worms and seems data intensive (e.g., coming to consensus over a mempool is kinda a blockchain in its own right lol).

[themandalore]

Why not just give it to the aggregators? Another benefit of aggregating the most attestations. If there’s not enough room for all of them, make it a race so they do it faster too

[Milli3E]

Mulled this over for a bit and I kind of feel like this is a bit overkill for the current censorship landscape, especially considering the fact that it doesn’t change the root of the problem, which seems to be relay centralization.

The main reason for relay centralization atm isn’t due to MEV forces as we predict will be the case in a post PBS world, but instead it’s due to the lack of incentives for running a relay.

Once PBS is enshrined I’m assuming there will be some economic incentive to be a builder, and thus, there will naturally be more competition and better builder diversity as a result.

The root cause of censorship seems to be:

1. Validators jobs involve block construction (even though most run MEV boost) and in practice they have the ability to include and disclude txs as a result

2. There isn’t ant incentive to run a relay

After PBS validators won’t need to be concerned with block building and so in practice they will likely ignore the contents of the block and simply attest to the most profitable blocks. And once there is an incentive for builder diversity, competition will increase and naturally censorship will decrease as a result.

If ILs are enforced right now, there’s a good chance many validators (especially the staking pool operators) will ignore the new spec, and the relays (which are easily identifiable entities) will ignore it as well just as they currently are.

If a builder and validator were to respect the inclusion lists, then they would also likely process a block with those txs without inclusion lists anyway (assuming the base fee and priority fees are respected).

So I’m a little concerned that ILs don’t change much in practice and instead create a contentious environment on the chain and a culture of ignoring protocol spec (which isn’t the case right now) over something that isn’t egregious as of yet.

Atm it’s a validator’s prerogative to include or not include what ever txs they want and that’s also the case for Bitcoin miners. The protocol was designed to factor that in and maintain a fair degree of censorship resistance in light of that (which to this day, I’d say has been successful if not for the highly trusted and un-incentivized role of relays)

I think ILs would make a lot more sense if the volume of censorship was much greater,

ie) If builders were censoring transactions over $10k between “unverified” parties based on some jurisdictional restrictions or terms and conditions.

imo if the above example were to happen then inclusion lists would be 100% warranted and there would likely be enough of an incentive to service such a large market and certainly more relays would come online to fill that role, even before enshrined PBS.

I should note that this is just my humble observation and if any of the assumptions I’m making are incorrect (especially in regards to the root of the censorship issues or to the severity of censorship) I’d be happy to change my views

[ChrisBender]

Even if you have double base fee for IL blockspace, that does not change anything about the potential for “IL-MEV-boost”, since proposers will always make more money by getting their IL blocks from sophisticated builders, rather than the public mempool.

Unless I’m missing something, I see zero value-add with this CR proposal over the current status quo.

[MicahZoltu]

@mikeneuder

IMO yes! the unconditional property feels super important.

I would like to see this fleshed out more. The original post correctly states the following, which makes it unclear where the big win from unconditional ILs lies.

@mikeneuder

The IL provides no strict guarantees and is less MEV-able. This is the inverse of the previous point. When the IL transactions are only conditioned on the block having remaining gas, there is much less value gained from getting included in the IL during high congestion periods. However, because of EIP-1559, blocks are not regularly full (only 11690 / 432970 \approx 2.7%11690/432970≈2.7%11690 / 432970 \approx 2.7% of blocks contain >29mm gas over the last 3 months), so this may not significantly change the demand for IL inclusion.

The attack vector (block stuffing) mentioned in the original post (quoted below) requires builders pay extra to fill blocks, and every block they do this in a row gets exponentially more expensive, so censorship in this way even for a short time ends up costing a huge amount of money, which I suspect is sufficient disincentive to make the problem something that we can ignore.

@mikeneuder

The transaction inclusion guarantees are weaker because the ILs are conditional. As a result, a censoring builder might choose to fill the block with irrational transactions to avoid using the IL (see Barnabé’s post Fun and Games for the description of “block stuffing”). With conditional guarantees, multiple proposers may have to include the transaction in the IL before the transaction is included in a block (e.g. if the first block is full).

[mikeneuder]

@MicahZoltu

The attack vector (block stuffing) mentioned in the original post (quoted below) requires builders pay extra to fill blocks, and every block they do this in a row gets exponentially more expensive, so censorship in this way even for a short time ends up costing a huge amount of money, which I suspect is sufficient disincentive to make the problem something that we can ignore.

IMO the bigger issue is the fact that the builder will only need to stuff a single block to avoid the enforcement of the IL. e.g., if only 5% of blocks fill make use of the IL, the builder only has to stuff those blocks, unless we do the cumulative version of the ILs, which is stateful and much more complicated. the unconditional property that I like is “a transaction needs to get in a ~single~ in order to ensure that it lands onchain within the next two blocks”

[mikeneuder]

thanks for the super thoughtful response! i am going to push back on a few points, but really appreciate your perspective

@Milli3E

After PBS validators won’t need to be concerned with block building and so in practice they will likely ignore the contents of the block and simply attest to the most profitable blocks. And once there is an incentive for builder diversity, competition will increase and naturally censorship will decrease as a result.

This is where I disagree. I don’t see ePBS as a way of increasing builder competition and diversity. If anything, the builder market now with open relays is much more of a meritocracy given ultrasound accepts any blocks and is highly competitive.

@Milli3E

So I’m a little concerned that ILs don’t change much in practice and instead create a contentious environment on the chain and a culture of ignoring protocol spec (which isn’t the case right now) over something that isn’t egregious as of yet.

I see it slightly differently. IMO the censorship regime is highly unstable and could quickly evolve based on the decisions of a few people. CR seems like a candidate for a “defense in depth” approach, and the overton window of making big changes might be shrinking. setting the norm of “CR is the top priority” and getting ILs enshrined would also help us as we develop the protocol and begin to collect data on their usage.

@Milli3E

I think ILs would make a lot more sense if the volume of censorship was much greater,

The volume could quickly go to 90+% overnight. what is an “unacceptable level” for you? feels like having several years at 90% (if we don’t go for it in electra) is potentially much more damaging than any residual risk of “doing something”.

@Milli3E

even before enshrined PBS.

The current ePBS landscape is wide open. It is a highly contentious topic, and it doesn’t seem likely that anything will be enshrined in the next fork. So it’s helpful to think two years into the future. Do we think going two more years without directly addressing the CR holes in the protocol is a good idea? personally, i don’t.

[MicahZoltu]

@mikeneuder

IMO the bigger issue is the fact that the builder will only need to stuff a single block to avoid the enforcement of the IL. e.g., if only 5% of blocks fill make use of the IL, the builder only has to stuff those blocks, unless we do the cumulative version of the ILs, which is stateful and much more complicated. the unconditional property that I like is “a transaction needs to get in a ~single~ in order to ensure that it lands onchain within the next two blocks”

Assuming a block is half full (average due to 1559) and base fee is 20 nanoeth/gas, then this is 0.3 ETH cost to the builder to stuff a single block. Do we have data on how far apart various builder blocks are from each other? Is 0.3 ETH enough to make the non-censoring builder win the bid, or are the censoring builders more than 0.3 ETH better at block building than their competitors?

[Milli3E]

Thanks for the response Mike, I can appreciate your counter angle.

@mikeneuder

This is where I disagree. I don’t see ePBS as a way of increasing builder competition and diversity. If anything, the builder market now with open relays is much more of a meritocracy given ultrasound accepts any blocks and is highly competitive.

Why do you think competition won’t increase? Running a relay atm is basically a free service, there are no economic incentives to enter the market, especially since (as you mentioned) the current relays are offering rather competitive services.

To add to that question, in the early ePBS concepts being proposed, is there a meaningful economic incentive to be builder? My assumption was that there will be, but if that’s not the case then I would fully agree with you.

@mikeneuder

The volume could quickly go to 90+% overnight. what is an “unacceptable level” for you? feels like having several years at 90% (if we don’t go for it in electra) is potentially much more damaging than any residual risk of “doing something”.

I personally don’t think any level of censorship is acceptable. With that said, this particular form of censorship imo is less an issue of censorship than a philosophical pricing of risk by block builders.

The censorship in question is really more a case of builders thinking that a lack of an arbitrary incentive for creating a block is not enough to cover the risk of processing those txs.

I have no data to back this up but something tells me if the censored users were to increase priority fees (or increase slippage for a swap, etc) by a meaningful amount, some bock producer would pick up their txs and include it expeditiously by potentially bypassing the mempool/relays all together.

I think it’s quite difficult to enforce, what some builders would likely consider, a set price of risk (via ILs) for processing certain txs. Social layer economics are a non-trivial aspect of our society and they’re the primary reason why certain goods and services are more expensive in some countries vs others.

eg) Alcohol is much more expensive in middle east countries where it’s banned than in Europe/North America. Conversely alchohol in certain canadian jurisdictions is also more expensive due to government monopolies on the ability to sell liquor, leading to an uncompetitive market which ultimately over prices alcohol compared to most places in the first world.

Ultimately I think the concentration of relays makes for an environment where the risk of not censoring is priced too high and creates an environment which indirectly incentivizes censorship. Counteracting these effects requires more than a change in spec imo (which can easily be ignored). It really requires a fundamental change in the incentives to run a relay/be a builder, which equates to better competition.

I may need to brush up on what a post ePBS landscape looks like, but something tells me as long as builders (relays) have some economic incentive to participate, that competition is all but guaranteed to increase among actors. Especially considering the fact that there are like 3 relays atm. I just don’t see how it could possibly get more concentrated in the presence of incentives where it currently lacks.

To sum things up, I really wonder if the combination of the two points I made about lack of competition and the fair pricing of risk, will result in any meaningful change even in the face of ILs in a pre-ePBS world.