If we keep ourselves in the scope of this draft proposal, we should have a concrete plan for validator funding.
I really liked that the hub team is aware of the problem and wanted to work on this thoroughly, but I am not comfortable with a proposal that talks about the problem but doesn’t give a proper solution but instead gives the timeline to solve the problem, and that solution might be unacceptable to the majority but we won’t be able to reverse replicated security and offboard multiple chains, that will be a disaster.
This might sound like a dystopian scenario but It can happen given the situation. So we should talk openly about the funding of the validators.
We need a set of rules for how the consumer chain will fund the validators.
If a consumer chain fails in funding who will bail out? the treasury?
Keep in mind the overall market condition of the industry and the timing of this proposal, if a big bitcoin mining company can go bankrupt, our beloved validator teams can go bankrupt too with the lack of funding.
Out of scope but the important point is in most of the bottom of the chain 85% of the validators are not even breakeven.
Personally, I would expect that the Hub would just reject consumer chains that are not somewhat profitable and prepared to adequately compensate the Hub. It’s clear that we have different risk tolerances on this (and that’s fine - collegial disagreement like this is how we come to the best ideas)!
From my perspective, enabling Replicated Security doesn’t produce the problem, so it’s not in the scope of the proposal to fully address it. Each consumer chain that wants to come onboard will potentially produce the problem, so it’s in the scope of those proposals to solve it. Especially because we’re bound to have a variety of projects with very different needs and revenue expectations, so there may not be a one-size-fits-all solution.
We need a set of rules for how the consumer chain will fund the validators.
The thing I hope we all agree on is that Hub validators deserve not only break-even compensation, but profit! You’re absolutely right that we need some guidelines and social norms around it.
I’ve been working with the ICS team and some consumer chains to put thoughts together on this and I have an essay I’m really excited to share I’ll publish early in the New Year, but I need to take some time off for the holidays with my family
Enjoy the family I wish you all the best, regarding to compensation / profit what can be almost a utopia it’s to be paid in stable coin instead of $Atom this could prevent sell pressure and help communities to focus on the tech Cosmos offers but not in the price.
Will just mention that as hub validators we share these concerns.
Validators are forced to run sidechains (at least in the current form of ICS) significantly complicating infrastructure requirements and knowledge required for all validators. If chains pass with a minimal yes vote for the on-chain governance we run the risks of not being able to start consumer chains or keep them running if the rewards are negligible. Especially validators at the bottom set will have a harder time supporting the hub if the sidechains dont bring direct value.
Less of these problems will exist in the future version of ICS where replicated security is not 1:1 with the Hub.
However, we are very excited for ICS to come to the hub after running GOC and will vote yes when the upgrade proposal comes online.
Now you make me curious. Have been dying to enter the active set on the Hub (but do not have the funding yet), but this sounds like a new reason really wanting me to enter the set…
Have some nice days off and when your essay is here I will give it time to read it
At any point in time, ⅓ (by power) of the Cosmos Hub validators will be able to stop running the consumer chain at once: the chain will halt, and none of them will be slashed for downtime.
Since halting the chain does not require a vote, does this create or increase the risk of a centralized, existential threat to the consumer chain and users of its product(s)? How can Cosmos Hub reduce the level of uncertainty users and developers will face when they consider using the consumer chain’s product(s)?
Does the consumer chain return back online if it regains 2/3 validator support?
Is there a “grace period” being considered for when this happens? It would be great if a consumer chain would continue to remain live with fewer than the full 175 Cosmos Hub validators for a short period of time as it attempts to regain 2/3 support of the Cosmos Hub validators. It would also provide the chain with a sufficient buffer in the case where it may be required to organize a smaller validator set and prepare to move towards full sovereignty.
Once a consumer chain proposal passes, Cosmos Hub validators can begin running the consumer chain and receiving rewards. The chain will only start if more than ⅔ (by power) of the Cosmos Hub validators decide to run the consumer chain.
Is it possible to run a validator for a consumer chain without running infra for Cosmos Hub?
How do validators signal they are ready to support a consumer chain? Do they simply run the current testnet until the 2/3 quorum is reached?
What happens if fewer than 2/3 of validators are running infra for an extended period of time (say 3 months) before 2/3 validators decide to run the consumer chain? Are validators compensated for signaling earlier support? Is this a “consumer chain” problem that each team will deal with on their own?
This applies to all the Cosmos chains - the chain will halt if >1/3 validators stop running. In that sense, the risk of a centralized existential threat seems no greater than it is on any other chain.
Does the consumer chain return back online if it regains 2/3 validator support?
Yes. When a sufficient number of validators are running the binary again, it will start up.
The grace period is a curious idea, but I personally think it is outside the scope of Replicated Security. I do want to point out that a chain CAN remain live with fewer than 175 validators - so long as >2/3 of the validators (by voting power) are running the binary, the chain is life and the active validators not running it are being slashed.
I think that the norms necessary for this offboarding period are more in the off-chain communication and collaboration than in code that would allow a technical grace period for the edge case. I envision maybe a signalling proposal for removing a consumer chain followed by a grace period in which the consumer chain should be setting up its own validator set (which may very well include Hub validators who want to keep supporting their project). But that is different from remaining a consumer chain with only partial support from Hub validators.
Is it possible to run a validator for a consumer chain without running infra for Cosmos Hub?
No. The consumer chain is leasing the full replicated security from the Hub’s validator set, so all of the validators involved are also running Hub infra. A while back there was talk of a version of ICS in which there could be a partially duplicated validator set (e.g., Some Hub validators and some non-Hub validators) but that’s not in the scope of Replicated Security.
Great proposal. I’m really looking forward what ICS & consumer chains get bring to the Hub.
Easy Yes to this proposals, but I think concerns made by @waqarmmirza is very important. Despite of few big validators, small validators won’t be able to economically maintain “if” the consumer chain’s payment to hub validators are not enough.
However, if consumer chains have to pay a lot to replicate security of hub, they may choose to find their own validator set because some chains may not need as much security as hub does. And it may lead to less projects considering Replicated Security.
Also, I’m curious about consumer chains’ independent governance mechanism. Although its governance cannot affect the downtime slashing, I expect consumer chains’ governance decision would affect hub in some degree.
Will hub validators incentivizes to be included in consumer chain’s governance?
Is there any consumer chains that announced about their own governance mechanism?
I personally believe it’s a false equivalency. It’s unlikely that the incentives and motivation of Cosmos Hub validators to support Consumer Chains is equal to the incentives and motivation of a validator on “any other chain” actively deciding to enter the active validator set of “any other chain.”
If the incentives and motivations are not the same, it’s hard to believe the existential risk of centralization is the same.
The power dynamics and incentives of the trust supplier (Cosmos Hub validators) and the trust consumer (Consumer Chains) is a different dynamic than the incentives of Cosmos Hub validators to continue to run infrastructure for the Cosmos Hub chain.
Many of these validators have very large self-delegations. For some context, 5 out of the top 10 validators on Cosmos Hub are not known for running infrastructure on multiple Cosmos chains. Of those 5, 3/10 are investment funds who self-delegate and 2/10 are exchanges that are staking on behalf of retail customers who don’t self-custody. Those 5 validators currently hold 21.27% of all currently staked ATOM. As of today, it would take at least 51 validators to make up the 21.27% delegations missing without those 5 validators’ support.
I recognize the ICF delegations should reduce that amount to ~17% once it’s delegated, as all the delegations will be outside the top 20 validators. However this is a very large percentage for just 5 validators and I believe it could cause some serious problems for the longevity of ICS if not properly planned and accounted for.
There will be a strong social convention that consumer chains that are being shut down are shut down through governance, not by validators refusing to run them. That scenario is described to illustrate what might happen in a worst case scenario, not a normal case.
Ultimately, consumer chains of the Cosmos Hub are getting the Cosmos Hub staking token distribution and validator set. We think it’s a very secure one and relatively decentralized, but each consumer chain will need to decide for itself.
Decentralisation of voting power stays a threat which needs to be addressed more openly in the long run. It is something which can be beneficial at the very beginning, but can be a major disadvantage on the longer run.
So maybe ICS will create some additional awareness for it.
I also remember that there is work being done on making the (financial) investment for validators as small as possible to make this a viable feature.
LeonoorsCryptoman - you run a validator, right? Wondering if you have some time to meet and discuss reducing the technical requirements for consumer chains.
My long-awaited essay on some of the considerations relevant to consumer and provider chains. Looking forward to seeing some discussion about the nuances of this dynamic!
I’ll publish early in the New Year, but I need to take some time off for the holidays with my family 