i still have trouble understanding one thing - I literally disliked polkadot previously because one validator set was securing whole parachain ecosystem. if polka dot would go down, bye bye to all the parachains!
with ICS 2.0, and PSS - whats the difference here? ATOM 180 validators secure the AEZ and if Hub goes down, AEZ follows!
I’ve posted this before here and Proindicator did a great job explaining why its not entirely true, but it is also true! It’s still vague. Why would we go for such centralization
You’re looking for more information than this post, right?
Do you have more specific questions?
The Pro Delegators team is explaining a fairly technical process that essentially means – if the Hub’s validator set goes down, all consumer chains will continue operating with the set they had when the Hub went down.
Hey! Atom only secures two chains right now, with maybe a few more in the upcoming years. Cosmos ecosystem is vast and full of L1s , the point is not about securing all chains in a monolithic way. ATOM just need to secure a handful of powerful chains
But if we agree that all the validators that are securing consumer chains, are coming from hub - if there is nothing to secure (in case atom goes down) then the whole AEZ goes down
I dont see a case where hub goes down, hubs validators have nothing to derive security from and secure CC’s? not sure it works that way!
Tagu, thanks for your input. I will try to clarify my point better to you as I think you missed it
I am well aware what cosmos ecosystem stands for.
Atom Economic Zone entails the idea that you build on top of ATOM going forward, and new chains get liquidity and/or security from the 180 validators (specific sub set of validators to be exact out of this 180). and If hub goes down, so those 180 validators have nothing to secure anymore, the whole AEZ will crumble down in domino effect
“Hub goes down” – oh, you mean going down as in ATOM tanking and the overall security of the Hub being reduced dramatically as opposed to infrastructure technically turning off!
Well in this case, yes, Neutron and Stride would suffer. I imagine they would simply fork away from the Hub and become sovereign chains. Stride was once a sovereign chain, after all. And both chains’ teams have experience coordinating their validator set now and could likely continue doing so with a fully sovereign set.
This is not to downplay the huge annoyance and impact a true Hub failure would cause on the AEZ, but I don’t think it would be the ultimate death of all consumer chains. They would just no longer have ATOM security.
Yes, I mean fundamentally Hub going down, as in outage or vulnerability in smart contracts or 51% attack and whatnot.
Then I do not see how we are different from other chains like SOL, DOT, APT, SUI and even ETH - if their blockchain goes down, their whole ecosystem dies.
ATOM before was always for sovereignty and independence. Seems like we have deviated from that path with AEZ implementation, well at least the way it is implemented currently
Well…all chains are vulnerable to those fundamental issues. That’s why we work on our security responses and we have things audited and tend to pride ourselves on having such high locked value that a 51% attack is truly impractical.
if their blockchain goes down, their whole ecosystem dies.
This just isn’t true. If the Hub goes down, consumer chains would continue and likely just change their validator set.
Beyond that, perhaps we just have a philosophical difference.
To me, the interchain is a web of connected projects that are naturally interdependent. We all use the same core technology (with some variations) and rely on IBC to talk to one another. Interchain Security on the Hub may be one step further than that since we are leasing out security, but the whole interchain is connected to the point of being supported by one another. If Osmosis “goes down”, you can bet there will be huge ripple effects. Same with Noble (and Noble is quite a recent addition to the interchain, all things considered), or Neutron, or Stride. The Hub is no different, and the chains that rely more heavily on the Hub would naturally be impacted more. But none of these chains are fully dependent on one another.
What I think is different about the interchain (and Interchain Security) is that there is a clear recovery path. If Eth goes down, everything stored on that chain goes down too. The path to recovery is very hard because the chain would have stopped and no new blocks could be created with the information needed to fix the situation. If the Hub goes down, consumer chains would have a lot of work to do but they would still have blocks to work with and time to make their decisions.
Lexa, I admire your deep understanding of the matter. Thank you
You’ve mentioned that they would just change validator - but how one would change validator to a new one, if out of 180 validators, none are operating anymore as the hub is in outage?
Moreover, you’ve mentioned that
If Eth goes down, everything stored on that chain goes down too
Same applies to other chains, and this is what makes us different, we were always for sovereignty and independence. And frankly, I think our philosophical views align, otherwise one of us would have been in SOL or whatever is trending now
but how one would change validator to a new one, if out of 180 validators, none are operating anymore as the hub is in outage?
Good question! This is what the other validators on the thread were trying to explain.
A “validator” is a company that offers validation services. To avoid favouritism here, I’ll say “Coinbase” is a validator company because hopefully no one takes this as me endorsing delegating to Coinbase…
“Coinbase” as a company secures all three chains
But to do that, “Coinbase” needs to run three different nodes – one for each chain
Unfortunately we tend to refer to each of those different nodes as a validator as well, but this time we mean “validator” as in “a node that has sent a tx to become a validator”, which has nothing to do with being a company!
The Hub, Neutron, and Stride share a company-validator set, but they have different node-validator sets. Company-validators know not to use the same keys between chains, which means that if one node gets compromised, the others are not impacted.
So with all that in mind:
If the entire Hub is in outage, it means >1/3 of the Hub node-validators are down (no blocks being produced), and the Hub can no longer communicate with its consumer chains using IBC. So if we anthropomorphize a bit, the validator-nodes on the consumer chains actually have no idea that anything is wrong with the Hub. Consumer chain node-validators continue operating, blocks are still produced, transactions can still be made, and even IBC to chains other than the Hub can continue. A company-validator’s node-validator on the Hub would be down and not producing blocks, but their node-validators on Stride and Neutron would continue operating.
Again, I don’t want to understate what a stressful and dangerous time this would be. I have my personal opinions about the best way to coordinate a chain in this situation but I’ll keep them to myself – I don’t want to publicly discuss an emergency strategy
Lexa this is simply amazing! Thanks for your comment
I see what makes and breaks the system here - it’s not only the validators but the nodes they run for each CC. In this case, you’ve mentioned that 1/3rd of the Hub node-validators are down - is there any limitation to one validator running node number ? meaning, Coinbase securing instead of 3 CC’s, they secure 50 CC’s, is there a limitation to it?
Lexa, your are amazing, thank you for taking your time to educate me and others alongside me
We run different machines for consumer chains so if the Hub went down, the consumer chains continue to run but wouldn’t be able to record their transactions in the Hub’s blocks, until the Hub was back up. @lexa is this correct? Do consumer chains record their transactions in Hub blocks?
We also run a validator for Polygon and the same holds true. If Ethereum goes down Polygon and other layer 2s continue to operate, but can’t pass their transactions down to be recorded on Ethereum, until Ethereum is back up.
Queation please, why does it matter for CC’s to record their transactions on the hub? And if they cant do it, does it mean value flow is capped at that moment ?
AFAIK a consumer chain never records transactions in hub blocks !!
The consumer chain only send to the hub which validators to rewards or to slash
With this in mind it means that if hub validators stop there is nothing to slash
There is a big difference between AEZ and Polkadot: AEZ goes beyond the ISS and AEZ is optional - it’s a model designed for the Atom alignment and Atom centric security. If you don’t want it then don’t use it. If a chain doesn’t want it it doesn’t mean that the chain is worse. It’s still part of the Cosmos / Interchain ecosystem.
There you can be a part of AEZ by contributing to Atom economy (eg use liquidity and share yield) while not using the ISS.
Finally, AEZ is open - you can propose a new alignment and if the AEZ governance will approve it then you are in.
It’s not correct to say that consumer chains record their transactions in Hub blocks, but what Victor says here is related and true:
The consumer chain only send to the hub which validators to rewards or to slash
With this in mind it means that if hub validators stop there is nothing to slash
If the Hub stops producing blocks, the consumer chains will continue writing transactions with their own node-validators and their own blocks, but with no validator set updates or rewards. This is still a dangerous state to be in, as it means that a validator who misbehaves on the consumer chain cannot be punished on the Hub or the consumer chain and the validators and delegators aren’t getting any staking rewards during the Hub’s downtime.
Validator misbehaviour is noticed on the consumer side, then communicated to the Hub where the Hub node-validator is jailed, which is communicated back to the consumer side so that the consumer’s node-validator is also jailed. These updates normally occur once per epoch (which is currently set to 600 blocks – roughly one hour).
Validator set updates also include changes to stake distribution (and this is far more common than jailing). So if the Hub stops, the stake distribution on the consumer chain will remain static. I don’t think this is really a problem, since if the Hub is halted, there are no changes to ATOM stake anyway
Thank you for correcting me. Why don’t consumer chains record their transactions in Hub blocks, like L2s do on Ethereum? Wouldn’t that increase their security? Wouldn’t that make the Hub more purposeful? Wouldn’t that increase demand for ATOM? @jtremback
