Add the liquid staking module to Cosmos Hub
Summary
This is a signaling proposal to replace the staking, distribution and slashing modules on the Cosmos hub with variants that regulate liquid staking. We call these variants collectively the liquid staking module.
This proposal is a temperature check with the Cosmos Hub community. This proposal is NOT executable. No on-chain actions will be triggered if the proposal passes. Before any on-chain actions are executed, a separate software upgrade proposal would need to be posted on-chain and be voted in by governance.
Developed by Iqlusion , the LSM is designed to safely and efficiently facilitate the adoption of ATOM liquid staking.
The LSM is best understood as a form of regulation on liquid staking providers. It enacts a safety framework and associated governance-controlled parameters to regulate the adoption of liquid staking.
The LSM mitigates liquid staking risks by limiting the total amount of ATOM that can be liquid staked to 25% of all staked ATOM. As an additional risk-mitigation feature, the LSM introduces a requirement that validators self-bond ATOM to be eligible for delegations from liquid staking providers or to be eligible to mint LSM tokens. This new mechanism is called the āvalidator bondā, and is technically distinct from the current self-bond mechanism, but functions similarly.
At the same time, the LSM introduces the ability for staked ATOM to be instantly liquid staked, without having to wait for the twenty-one day unbonding period.
In sum, the liquid staking module equips the Cosmos Hub to thrive in a world with increasing demand for liquid staked ATOM. It proposes a safe, regulated path towards increasing capital efficiency.
Pending community discussion, this forum proposal will be submitted as an on-chain signaling governance proposal on: April 14, 2023.
If the proposal passes, it will signal to the Gaia team to integrate these changes into a near term future upgrade. Our goal would be to include this upgrade in q3 of 2023.
Change log
April 7, 2023 - Original forum post made
Liquid staked ATOM
Over the past six months, there has been a boom in Cosmos DeFi. There are now multiple DEXes, money markets, CDP stablecoins, and perpetual futures markets on chains across the Cosmos. With the imminent launch of Neutron and Sei, the rapid growth of Cosmos DeFi shows no signs of slowing down. This explosion of DeFi in the Cosmos is creating unprecedented demand for ATOM.
As the oldest, biggest, and most prestigious token in the IBC-connected Cosmos, ATOM has emerged as the collateral token of choice for Cosmos DeFi. Whether you visit Mars, Umee, Demex, or Kujira - ATOM is the most popular collateral token.
In addition to increasing demand for ATOM, the development of Cosmos DeFi is solving one of the biggest limitations of the Cosmos ecosystem - a lack of liquidity. As an increasing amount of loans are collateralized with ATOM and an increasing amount of decentralized CDP-backed stablecoins are minted with ATOM, liquidity conditions in the Cosmos are improving. The more credit available, the more liquidity can be created.
Thus, the growth of Cosmos DeFi over the past six months has represented a virtuous cycle. As DeFi activity increases, the demand for ATOM increases and liquidity conditions improve. And as the demand for ATOM increases and liquidity conditions improve, ATOM appreciates in price, leading to more DeFi activity.
But this virtuous cycle wouldnāt be possible without liquid staking. Without liquid staking, the use of ATOM as collateral is not economically viable, due to forfeited staking rewards. Only with liquid staking does it make economic sense to deploy ATOM as collateral, since the user doesnāt have to forfeit his staking rewards.
Liquid staked ATOM, especially Strideās stATOM, has played an essential role in the development and expansion of Cosmos DeFi over the past six months. Most upcoming Cosmos DeFi apps will also be dependent on liquid staked ATOM.
At this point, the Cosmos Hub has the opportunity to solidify and expand ATOMās role as the premier collateral token for Cosmos DeFi by embracing liquid staking. This means recognizing the increasing demand for liquid staked ATOM and implementing features that would securely and efficiently facilitate the adoption of ATOM liquid staking, and can further accelerate the growth of the burgeoning ATOM economic zone.
How the LSM works
First, letās discuss the liquid staking safety features introduced by the liquid staking module.
Limiting liquid staking
The LSM would limit the percentage of liquid staked ATOM by all liquid staking providers to 25% of the total supply of staked ATOM. There is currently 222.76M ATOM staked, so if the LSM were installed today then the total liquid staked ATOM supply would be limited to a maximum of 55.69M ATOM.
This is a key safety feature, as it would prevent liquid staking providers from collectively controlling more than ā of the total staked ATOM supply, which is the threshold at which a group of bad actors could halt block production.
Technically speaking, this cap on liquid staked ATOM is enforced by limiting the total number of tokens that can be staked via interchain accounts and tokenized using the liquid staking module on the Cosmos Hub. Once this cap is reached, the LSM prevents interchain accounts from staking any more ATOM and prevents delegators from tokenizing any more delegations using the LSM.
Validator bond
As an additional security feature, validators who want to receive delegations from liquid staking providers would be required to self-bond a certain amount of ATOM. The validator self-bond, or āvalidator-bond,ā means that validators need to have āskin in the gameā in order to be entrusted with delegations from liquid staking providers. This disincentivizes malicious behavior by the validator and empowers the validator to negotiate its relationship with liquid staking providers. Please see the Appendix FAQ for additional descriptions of the validator bond factor and associated dynamics.
Technically speaking, the validator-bond is tracked by the LSM. The maximum number of tokens that can be delegated to a validator by a liquid staking provider is equal to the validator-bond multiplied by the āvalidator-bond factor.ā The initial validator bond factor would be set at 250 and can be configurable by Cosmos Hub governance. Please see the appendix for details on this governance parameter and the starting value of 250.
With a validator-bond factor of 250, for every one ATOM a validator validator-bonds, that validator is eligible to receive up to two-hundred-and-fifty ATOM delegated from liquid staking providers. The validator-bond has no impact on anything other than eligibility for delegations from liquid staking providers.
Without validator-bonding ATOM, a validator canāt receive delegations from liquid staking providers. And if a validatorās maximum amount of delegated ATOM from liquid staking providers has been met, it would have to validator-bond more ATOM to become eligible for additional liquid staking provider delegations.
The Appendix FAQ section contains additional perspectives on the effects a validator-bond requirement could have on voting power distribution.
Instantly liquid staking staked ATOM
Next, letās discuss how the LSM makes the adoption of ATOM liquid staking more efficient, and can help the Cosmos Hub build strong relationships with liquid staking providers. The LSM enables users to instantly liquid stake their staked ATOM, without having to wait the twenty-one day unbonding period. This is important, because a very large portion of the ATOM supply is currently staked. Liquid staking ATOM that is already staked incurs a switching cost in the form of three weeksā forfeited staking rewards. The LSM eliminates this switching cost.
A user would be able to visit any liquid staking provider that has integrated with the LSM and click a button to convert his staked ATOM to liquid staked ATOM. It would be as easy as liquid staking unstaked ATOM.
Technically speaking, this is accomplished by using something called an āLSM share.ā Using the liquid staking module, a user can tokenize their staked ATOM and turn it into LSM shares. LSM shares can be redeemed for underlying staked tokens and are transferable. After staked ATOM is tokenized it can be immediately transferred to a liquid staking provider in exchange for liquid staking tokens - without having to wait for the unbonding period.
Implementation
The liquid staking module codebase is developed by Iqlusion, open-source at https://github.com/iqlusioninc/liquidity-staking-module .
Example user flow:
- Alice bonds 500 ATOM to iqlusion.io
- Alice executes MsgTokenizeShares for the 500_000_000uatom and 500_000_000cosmosvaloper1xxxx42 in return.
- Alice does an OTC deal with Bob for 250_000_000cosmosvaloper1xxxx42 assets.
- Bob exectutes MsgRedeemTokensforShares for 250_000_000cosmosvaloper1xxxx42 which now becomes a delegation of 250atom to iqlusion.
- While the shares were tokenized, TokenizedShareRecord 42 is recieving the full 500 atom of rewards minus iqlusionās commission.
- Once Bob redeems his tokens for shares, now TokenizedShareRecord 42 will only recieve 250 atoms worth of rewards.
- Alice can execute MsgWithdrawTokenizeShareRecordReward pass these rewards back to Aliceās account.
What will happen if this on-chain proposal passes
This is a signaling proposal. It is NOT executable. No on-chain actions will be triggered if the proposal passes. Before any on-chain actions are executed, a separate software upgrade proposal would need to be posted on-chain and be voted in by governance.
This proposal is a temperature check with the Cosmos Hub community.
Appendix: Addressing liquid staking risks
If the Cosmos Hub is to embrace liquid staking, it is important that the risks of liquid staking are acknowledged and that features are implemented to remove or mitigate these risks.
Governance risk
This is the risk that a liquid staking provider amasses more than ā the total staked supply on a given chain, giving it the power to halt that chainās block production or censor transactions and proposals.
The liquid staking module removes this risk. Not only would a single liquid staking provider be prevented from amassing ā of the Cosmos Hubās voting power, but all liquid staking providers combined would not be able to cross this threshold.
Validator corruption risk
Principal-agent dynamics exist in proof of stake systems. In delegated proof of stake systems such as Cosmos, validators are expected to act in the network and their delegatorsā best interest. The unbonding period aligns incentives by enforcing a delayed withdrawal so that if a validator violated the blockchainās rules (e.g. by double signing), but the infraction is only discovered later, on-chain evidence can still be presented and trigger a slashing event while the validator still has value at risk (tokens delegated).
Validators with delegations from delegators could become corrupt and use their voting power to behave maliciously. The Cosmos Hub does not enforce a minimum self-bond: it does not require validators to lock up any of their own capital on-chain with their own validator. So this principal agent risk exists with standard staking today; delegators should select validators wisely.
What does this mean for the Cosmos Hub? Malicious actors (e.g. a Cosmos Hub competitor) could spin up a validator with no self-bond, attract delegations from the community, then misbehave, triggering slashing of their delegatorsā funds, without suffering a slash themselves.
With liquid staking, this principal-agent problem could be exacerbated. Liquid staking providers use validator selection mechanisms to select the validators they delegate to on behalf of liquid staking users. Under flawed liquid staking provider validator selection mechanisms, it could be easier for a malicious validator to attract delegations from a liquid staking provider than to attract delegations directly from delegators. A malicious profit-driven entity could spin up a validator with no self-bond, attract delegations from a liquid staking provider, open a short position on the liquid staking token, then misbehave, triggering slashing of the liquid staking providerās funds. The liquid staking token would depreciate in line with the slash and the malicious entity would profit from their short position.
Itās important to note that this principal agent problem exists today. The LSM prevents it going forward. The liquid staking module mitigates this principal-agent risk by requiring that validators put their own capital at risk in order to be eligible for delegations from liquid staking providers. Requiring them to validator-bond ATOM provides an additional disincentive to misbehave. If validators behave poorly they risk having their delegation removed. The LSM validator bond requirement is a strict improvement to todayās liquid staking safety guarantees.
Vote power concentration risk
This is the risk that a liquid staking provider amasses a large amount of stake and delegates it to validators already near the top of the active set, increasing the concentration of vote power and lowering the Nakomoto coefficient of the chain.
The liquid staking module does not address this risk. However, Stride, a leading Cosmos liquid staking provider, delegates its ATOM in such a way that a maximum of 25% is delegated to validators in each quartile of the active set, as measured by existing delegations. Strideās innovative and responsible approach to host-chain validator selection means that liquid staking with Stride does not entail the risk of vote power concentration. Ideally, other liquid staking providers will follow Strideās example and delegate their ATOM in a way that distributes it across the active set.
Cascading liquidations risk
This is the risk that a large amount of sell pressure on an ATOM liquid staked token results in the LST falling below the value of its backing ATOM held by the liquid staking provider. And if the ATOM LSTās price decline is significant and sustained, it could trigger liquidations, which would put further sell pressure on the ATOM LST.
Such a cascade could affect the price of unstaked ATOM, and could result in a large amount of ATOM being unbonded as a consequence of arbitrage, temporarily reducing the economic security of the Cosmos Hub. During such a cascade, an attacker could also accrue increased voting power in a capital-efficient manner by purchasing liquid staked ATOM at a discount and redeeming them for native ATOM.
The liquid staking module mitigates these risks, by limiting the percentage of total staked ATOM that can be liquid staked. With this limit set at 25%, it minimizes the maximum size of a potential liquidation cascade.
Final thoughts
The Cosmos Hub and ATOM community gave birth to the Cosmos ecosystem, by funding the development of Tendermint consensus, the Cosmos SDK, and IBC.
Cosmos Hub and ATOM are experiencing an unprecedented period of innovation, which will secure their relevance and value for decades to come. And liquid staking is a big part of that.
Replicated security enables the Cosmos Hub to contribute its security to help other chains. The burgeoning ATOM Economic Zone enables Cosmos Hub to contribute its economic resources to help other chains, and liquid staking module can help the Cosmos Hub secure ATOMās role as the collateral token of choice for Cosmos DeFi.
These three innovations - replicated security, the Economic Zone, and the liquid staking module - can work together to push the Cosmos forward and ensure the Cosmos Hub remains at its center.
As stated at the outset, pending community discussion this proposal will go onchain on April 14, 2023. Please comment, ask questions, make suggestions, and contribute to the discourse.
Appendix: Governance Parameters
ValidatorBondFactor
ValidatorBondFactor is a parameter of the x/staking module. ValidatorBondFactor is configurable by Cosmos Hub governance using a param-change governance proposal. Please see the associated ADR (liquidity-staking-module/adr-001.md at master Ā· iqlusioninc/liquidity-staking-module Ā· GitHub) for an example proposal.
With a ValidatorBondFactor of 250, for every one ATOM a validator validator-bonds, that validator is eligible to receive up to two-hundred-and-fifty ATOM delegated from liquid staking providers. The ValidatorBondFactor is a chain-wide parameter, it applies to all validators equally.
GlobalLiquidStakingCap
GlobalLiquidStakingCap is a parameter of the x/staking module. The GlobalLiquidStakingCap is configurable by Cosmos Hub governance using a param-change governance proposal. Please see the associated ADR (liquidity-staking-module/adr-001.md at master Ā· iqlusioninc/liquidity-staking-module Ā· GitHub) for an example proposal.
With a GlobalLiquidStakingCap of 25%, once the share of voting power held by liquid staking providers plus the share of voting power tokenized using the LSM reaches 25%, delegations can no longer be tokenized using LSM and liquid staking providers cannot stake additional tokens. The share of voting power held by liquid staking providers is measured as voting power held in module accounts (note that ICA accounts are module accounts).
Appendix: FAQ
Why choose 250 as the validator bond factor?
ValidatorBondFactor determines the degree of āskin in the gameā validators must have in order to be entrusted with delegations from liquid staking providers. This disincentivizes malicious behavior and enables the validator to negotiate its relationship with liquid staking providers.
Itās important to note that the proposed 250 starting value is just a starting point. The Cosmos Hub currently does not enforce a minimum self-bond. In other words, there is currently no limit to the number of liquid staking tokens that can be minted against a validatorās stake, even if that validator has no self-bond. In practice, today most Cosmos Hub validators self-bond nothing, so this is a first step towards aligning validators and solving the principal-agent problem.
If the validator bond factor were set to 250, 3.4m USD of validator bond would be required to reach a 25% GlobalLiquidStakingCap. This seems like a reasonable amount of āskin in the gameā that wonāt dramatically hinder the Cosmos Hubās capital efficiency, and the parameter can be adjusted by governance.
For a validator, the economics boil down to: is the commission revenue earned on an additional 250 units of stake from an LST provider enough to outweigh the cost of locking up 1 additional unit of validator bond? For example, on the Cosmos Hub, assuming a 5% validator commission, validator bonding 1 additional unit of ATOM can attract 250 additional units of ATOM stake from LST providers. The annual commission revenue on those additional 250 units of ATOM is 250 unit * 21% APR * 5% commission = 2.625 additional units of annual commission revenue.
In other words, the average validator can earn 2.6 units of commission revenue each year on each unit of validator bond they lock up, so it seems economical for validators to validator bond. The Cosmos Hub community, through governance, can vote to adjust to validator bond factor, to modulate the competitive dynamics between validators, liquid staking users and liquid staking providers.
Whatās the tradeoff of a high validator bond factor vs. a low factor?
The LSM is best understood as a form of regulation on liquid staking providers. It enacts a safety framework and enshrines associated governance-controlled parameters that the Cosmos Hub community can use to regulate the adoption of liquid staking. The LSM proposes a safe, regulated path towards increasing capital efficiency.
Current ATOM liquid staking markets are unregulated by the Cosmos Hub. They are āshadow marketsā, outside the control of Cosmos Hub governance.
ValidatorBondFactor determines the degree of āskin in the gameā validators must have in order to be entrusted with delegations from liquid staking providers. Current ATOM liquid staking markets require zero validator āskin in the gameā ā the effective current validator bond factor is infinite.
High validator bond factors are a step toward regulated capital efficiency. They meaningfully reduce the dangers posed by principal-agent dynamics and address the current lack of regulation. Relative to the current system, they are less capital efficient: require validators put more āskin in the gameā. Relative to low validator bond factors, high validator bond factors are more capital efficient and require less āskin in the gameā.
Low validator bond factors are less capital efficient: they require validators to put more āskin in the gameā. They economically encourage liquid staking providers to provide liquid staking through shadow markets (e.g. CEX liquid staking through a multisig) unregulated by the Cosmos Hub governance and unaffected by LSM guardrails. By requiring validators to lock up more capital, low validator bond factors also encourage stake centralization amongst the richest validators who have more capital at their disposal to validator bond.
Recall that current ATOM liquid staking markets require zero validator āskin in the gameā ā the effective current validator bond factor is infinite. Beginning with a reduction from effectively infinity to a validator bond factor of 250 is a big step towards safety. The 250 starting value also retains stake decentralization: it is high enough that all validators in the set can afford to post a validator bond (economics for validators are in the next FAQ). This is just a starting value; the Cosmos Hub community is in control, governance can choose other values going forward.
As a validator, how does validator bond work? Can I get back my tokens? Are they subject to additional slashing conditions?
The following Q&A are written for validators.
1 Who can validator bond? The validator themselves, but also any other address delegated to the validator.
2 How does a delegator or validator mark their delegation as a validator bond? Once delegated to a validator, sign a ValidatorBond message. Please see full instructions in this ADR (liquidity-staking-module/adr-001.md at master Ā· iqlusioninc/liquidity-staking-module Ā· GitHub).
3 Are validator bonds subject to additional slashing conditions? No, in the event of a slash, a validator bond is slashed at the same rate as a regular bond.
4 Can I unbond my validator bond? If all the liquid staking capacity made available by a validatorās validator bond is utilized, validator bond delegated to that validator cannot be unbonded. If new capacity becomes available (either by redemption of liquid staking tokens or addition or new validator bond), then existing validator bond can be undelegated.
1 Example: Suppose Iqlusion validator bonds 2 ATOM, then liquid staking providers delegate 500 ATOM to Iqlusion. Now Iqlusion cannot remove any of their validator bond because the full liquid staking capacity made available by Iqlusionās validator bond is consumed.
1 If liquid staking providers undelegate 250 ATOM from Iqlusion, Iqlusion can now remove 1 ATOM of validator bond.
2 If, instead, the ICF or a community member validator bonds 1 additional ATOM to Iqlusion, Iqlusion can now remove 1 ATOM of validator bond.
5 Can I validator bond some of my tokens and delegate the remaining portion normally? The ValidatorBond message converts the full balance delegated to a validator into validator bond. To validator bond some tokens and delegate the remaining portion normally, use two addresses: the first will delegate + ValidatorBond, and the second will just delegate.
How do validator bonds solve the principal-agent problem?
Please see the āValidator corruption riskā section above, in the Appendix: Addressing liquid staking risks.
Why choose 25% as the global liquid staking cap? What happens if stakers unbond?
The purpose of the GlobalLiquidStakingCap is to prevent a liquid staking provider from amassing more than ā the total staked supply on a given chain, giving it the power to halt that chainās block production or censor transactions and proposals. Not only would a single liquid staking provider be prevented from amassing ā of the Cosmos Hubās voting power, but all liquid staking providers combined would not be able to cross this threshold.
Itās important to note that the proposed 25% starting value is just a starting point and was chosen in the spirit of highly conservative precaution. The Cosmos Hub does not currently enforce a limit on the maximum share of voting power that can be held by liquid staking providers. The GlobalLiquidStakingCap parameter could begin at 33%. A 33% GlobalLiquidStakingCap would improve safety standards relative to the current Cosmos Hub design and would help to protect against liquid staking providers accruing ā voting power.
Starting with the more conservative 25% cap leaves an extra 8% safety buffer. With this safety buffer, suppose the 25% cap were reached: then, over 33% of the non-LS ATOM would need to unbond for the share of voting power held by liquid staking providers to reach 33%. For example, say there are 100 ATOM total staked, 25 of which are liquid staked; 25 of the 75 remaining ATOM need to unbond for the liquid staked voting power to rise to 33%.
Wonāt the LSM cause validator inequality?
A 250 factor is high enough that validators can afford to validator bond enough tokens to allow all their delegators to tokenize
- Today, the self-bond required to support 1/3 liquid staking is small, only $7k for the median validator, which is likely affordable since it equals ~1 month worth of the validatorās commission revenue.
- The smallest validator in the set has 91k ATOM delegated. With a ValidatorBondFactor of 250, validator bonding just 365 ATOM ($5k USD value) opens capacity for all of the validatorās delegators to mint LSM tokens.
While larger validators may have more free capital to validator bond, the validator bond system does not further inequality between validators when you adjust for existing voting power. Smaller validators need less validator bond in order to enable all their delegators to tokenize. A validator with 250k ATOM tokens who wishes to allow users to tokenize all their delegations must only validator bond 1k ATOM. A larger validator with 25m ATOM tokens would need to validator bond 100k ATOM to allow users to tokenize all their delegations. [Edited. Thanks @CuriousJ ] In this way, the validator bond requirement adjusts for current voting power.
Entities other than the validator itself can also validator bond. For example, the Interchain Foundation, the Atom Accelerator or the Community Pool could contribute to validatorsā self-bond, subsidizing validator bonds for highly regarded validators who have lower lower-voting-power. Contributors to this proposal expect to discuss the possibility of creating such a program with the aforementioned entities aimed at further decentralizing the set. This opens up a rich design space for allocating common resources to enable validators to negotiate their position with liquid staking providers.
