On the decentralization of the Cosmos Hub

Hub Proposals Proposal Ideas
1

Summary

This is not (yet) a concrete proposal or even set of proposals but rather simply a discussion of the “degree of decentralization” of the Cosmos Hub PoS consensus and a high-level analysis of some tradeoffs, technical and social concerns, and possible “incentive levers” which could be tweaked (in many different directions).

This analysis is mostly a brain dump and doesn’t draw any particular conclusions. Also, to be clear, these are my own views and not necessarily those of any official entities.

5 Likes
2

Part A: Gini coefficient calculation

“Decentralization” is not rigorously defined. For now I will focus on just the decentralization of consensus voting power (as opposed to e.g. decentralizaiton of account balances), since that is most directly relevant to consensus safety, liveness, and governance, and since it is easy to measure and we have reason to believe we can measure it accurately (I expect most currently separate validators are not secretely operated by the same entitites).

The Gini coefficient of the validator voting stake distribution seems like a reasonable first stab at a metric. It almost certainly fail to encapsulate everything one might mean by “decentralization”, but it seems to capture an important essence - a “centralized” system with all voting power in the hands of a single entity will have a Gini coefficient around one, and a “decentralized” system with exactly equal voting power (such as 1P1V democracy) will have a Gini coefficient around zero. The Cosmos Hub will necessarily fall somewhere between those two extremes - a blockchain of one validator isn’t particularly compelling, but nor would be a blockchain where all users validate, since it would be far too slow and operationally expensive (and perhaps for other reasons - e.g. no one would be able to afford secure hardware).

The Gini coefficient, which is half the relative mean difference, can be calculated on any numerical distribution as follows:

>> import numpy as n

>> def gini(x):
    return n.abs(n.subtract.outer(x, x)).mean() / n.mean(x) / 2

A few benchmarks first - the Gini coefficients of a random distribution, of an equal distribution, and of an extremely unequal distribution:

>> print(gini(n.random.rand(500)))
0.32322
>> print(gini(n.ones(500))
0.0
>> print(gini([1] + [0] * 499))
0.998

The Gini coefficient of the Cosmos Hub validators can then be calculated, using the Stargazer API:

>> import requests

>> res = requests.get('https://sgapi.certus.one/validators').json()
>> validator_weights = [v['weight'] for v in res]

Then calculate the Gini coefficient:

>> print(gini(validator_weights))
0.7816528136845804

Of course, this will vary if you run the command yourself according to the current data.

By comparison, the most unequal country by family income has a Gini coefficient of 0.632. I doubt that’s a very meaningful benchmark. A better benchmark might be Gini coefficents of consensus in other blockchains. The best prior research I can find is here, which lists the Gini coefficients of Bitcoin mining as 0.40 (they sourced from this list of pools) and Ethereum mining as 0.82 (from this list) - that post is a year and a half old, so the values have likely changed since.

Many more interesting metrics could be calculated - Gini coefficients of code commits, of account balances (although may be inaccurate due to single users using many accounts), and of interchain token exchange volume (once IBC is deployed :wink: ) would all be quite pertinent. I think it would be particularly useful for block explorers or network statistics trackers to display some of these “decentralization stats”.

7 Likes
3

Part B: Desiderata & Effects

Incentive design for blockchains is particularly complex because blockchains are not “closed systems” - incentives in a proof-of-stake state machine affect decisions made by node operators and users in the outside world, which in turn affect properties of the blockchain state (e.g. stake distribution). I think it can be helpful to split effects into “orders”, where first-order effects are directly caused by some primary value we want to analyze (in this case the Gini coefficient), second-order effects are caused by first-order effects, etc.

This cyclicality of causation has another important consequent - it may take awhile for an equilibrium to emerge (or one may never emerge). Likely a week after launch is too early to draw any high-certainty conclusions about the current incentive structure and which incentive changes would have what effects - but not too early to start analyzing possibilities :slight_smile: .

Possible effects of a high Gini coefficient

First-order

  • A lower number of validators would need to be compromised or colluding in order for consensus to be compromised.
  • A lower number of validators may generate significant income (from commission), but the amount each individually generates may be higher.

Second-order

  • Fewer validators may be able to support medium-security setups, but a few may be able to support high-security setups.
  • Fewer validators may be able to exert a lot of influence in governance.
  • Small validators may find operation unsustainable and elect not to participate in consensus.

Possible effects of a low Gini coefficient

First-order

  • A higher number of validators would need to be compromised or colluding in order for consensus to be compromised.
  • A higher number of validators may generate significant income (from commission), but the amount each individually generates may be lower.

Second-order

  • More validators may be able to support medium-security setups, but only a handful or none may be able to support high-security setups.
  • More validators may need to coordinate in order to pass governance proposals.
  • More validators may find operation sustainable enough to justify operational costs, but they may not be able to afford extensive setups.
5 Likes
4

Part C: Incentive Levers

One of the reasons I am particularly excited about proof-of-stake is that the design space is wide - there are many ways in which the incentives could be changed to attempt to encourage or discourage particular aspects of the network’s topology - and this holds true for the Cosmos Hub. I think it is helpful to split analysis into two categories: in-protocol changes, which change the Cosmos Hub state machine, how rewards are distributed, how slashing works, etc. and would require governance proposals or hard forks, and out-of-protocol changes, which include actions taken by individual actors, potential legal structures, or social norms, and can be enacted without governance proposals or hard forks (although governance proposals could still be used to poll stakeholder support).

Generally these changes are not mutually exclusive.

In-protocol

  • Sublinear rewards, where validators receive inflation and fees slightly less than linearly proportional to their stake, i.e. rewards ~ stake ^ 0.9 (at the moment rewards ~ stake ^ 1). Of course, larger stakeholders could simply run multiple validators, but the real-world transaction costs (in the economic sense) of doing that may be high - e.g. convincing delegators to balance their delegations between “ChrisValidator One” and “ChrisValidator Two” sounds tricky.
  • Sublinear proposer election, where validators’ chances of being elected proposer are slightly less than linearly proportional to their stake, i.e. ~ stake ^ 0.9 (at the moment ~ stake ^ 1). This would indirectly decentralize rewards a bit due to the proposer reward, and might be more effective than sublinear rewards if censorship is a particular concern. The same note on Sybil attacks applies.
  • Correlated slashing, where the slash fraction for equivocation or liveness faults is proportional with some coefficient to the amount of stake that has been slashed (including the stake being slashed) in a recent time interval (probably the unbonding period). This is not vulnerable to Sybil attacks in the same way, since three validators with 10% stake equivocating around the same time would be slashed as much as a single validator with 30% stake - so in that sense one might expect it to cause large validators to split up and diversify their setups (although legal risks or governance influence might remain correlated).

Out-of-protocol

  • Convincing large holders to split their delegations in a way which would preference smaller validators (relative to the current stake distribution), such as the Interchain Foundation (there’s already a petition), venture funds, or substantial individual holders.
4 Likes
5

Addition to C: Incentive Levers:

In-protocol:
Subliniear rewards: Incentivize splitting Validators to several accounts, thus driving out small validators. Also knowledge sharing like Certus.one did might not make sense anymore.

Another proposal:

Distribution based buff of rewards: Every Delegation from a single account yields more reward if the delegations are more evenly distributed among all validators. For example 7% default reward are boosted by up to 3% times (1 - Gini_coefficient_of_delegations). This is sybil resistant for delegations, but not for validators. So it should be complimented by correlated slashing.

4 Likes