- Replicated Security
- Neutron: The First Potential Consumer Chain
- Neutron and the Hub
- Neutron and Hub Validators
- Neutron Governance
The Cosmos Hub recently launched Replicated Security as part of the successful v9 Lambda upgrade. Neutron, the first potential consumer chain, is ready to launch on the Hub and has put up a draft proposal on the Cosmos Governance Forum so the Hub community can discuss whether we are ready to onboard our first consumer chain. This is a big deal, and we want to make sure governance participants have all the information they need to make an informed decision.
Swiss direct democracy handbooks are short booklets produced by the Swiss government to inform citizens of the arguments for and against a referendum topic prior to voting. These info packets are intended to help voters go to the ballot box armed with information that might otherwise take a lot of time and energy to learn about.
Following that model, we want to put forward a collection of questions and answers that ATOM holders will find useful and informative, regardless of their prior education or knowledge about the issue at hand. This work builds on the booklets and FAQ put out by Sacha Saint-Leger for previous major proposals on the Hub:
- Proposal 69 Include CosmWasm in the Rho Upgrade
- Proposal 72 Bringing Liquid Staking and DeFi to the Cosmos Hub with Interchain Security
- Proposal 82 ATOM 2.0: A new vision for Cosmos Hub
We welcome any further questions about this proposal and suggestions about the format! This is meant to be a living document to gather information as it becomes available.
This booklet was put together by Lexa Michaelides (Hypha Co-op). Major credit and thanks go to Udit Vira (Hypha Co-op), Avril Dutheil (Neutron), and Abra (ICF) for providing information, insight, and editorial commentary during the writing process. Additional thanks to Juan Beccuti (Informal Systems) and Barry Plunkett (Skip) for thoughts and commentary on MEV and all its complexities.
This proposal asks: Should the Hub trigger the process to onboard Neutron as a consumer chain secured by the Cosmos Hub’s stake and validator set?
If Neutron is onboarded to the Hub, validators will be expected to start running a node for the Neutron consumer chain between roughly 26th of April to the 3rd of May.
What is replicated security?
Replicated Security (the feature released in v9-Lambda), aka Interchain Security v1, is Cosmos Hub’s current implementation of shared security. It allows the Hub’s validator set to validate other governance approved chains (called ‘consumer chains’) at once using their ATOM stake.
Consumer chains can have their own governance system, token, and product that is independent from the Hub, even though blocks are produced by the Hub’s validators. This allows projects to lease the Hub’s high security, meaning that the cost to attack a consumer chain will be the same as the cost to attack the Cosmos Hub itself.
As part of the lease agreement, consumer chains will send a portion of their tokens (typically from fees and/or inflation) to the Cosmos Hub validators. These tokens will be included as part of the Cosmos Hub’s staking rewards and passed on to validators and delegators.
Do all validators need to run a consumer chain?
‘Replicated’ means that the entire provider chain’s validator set is required to validate a consumer chain. In the current version of shared security on the Hub (as of the v9-Lambda upgrade), all validators _must _run all consumer chains that are onboarded to the Hub via governance. Validators cannot individually opt-in or -out, and misbehaviour such as double-signing or downtime in producing consumer chain blocks carries potential penalties on the provider chain (and all associated consumer chains) as well.
Alternatives to this approach have been proposed, but analysis by Informal Systems has suggested that enabling all validators to opt-out of securing a particular chain may be too risky for the security of the consumer chains due to the “subset problem”, which means that even if a validator set as a whole is secure, it’s not necessarily true that any subset (group) of that validator set is secure. However, shared security models are actively being researched, including mesh security and a soft opt-out option that would enable a lower percentage of the validator set to avoid penalties for not running a particular consumer chain.
What penalties apply to misbehaviour on consumer chains?
Downtime on a consumer chain occurs when a validator’s consumer chain node does not sign enough blocks in a given window. This window (both the number of blocks and the minimum % signed) is decided by the consumer chain with guidance from the Hub team.
For downtime on a consumer chain, the penalty is being jailed (removed from the validator set for a period of time) for 10 minutes, during which the validator will not be able to unjail themselves. After the 10 minutes have passed, the validator can send the unjail tx and rejoin the validator set.
For double-signing on a consumer chain, an ‘equivocation proposal’ can be made using Hub governance to approve slashing and tombstoning of a misbehaving validator.
Any jailing or tombstoning penalties incurred because of misbehavior on a consumer chain apply to all nodes run by that validator, including on the provider chain and all other consumer chains. Slashing penalties (which must be confirmed by an equivocation proposal) apply to the ATOM stake held by a validator.
Can equivocation proposals be used to slash any validator for any reason?
No. These proposals are used as social confirmation of slash packets sent by the consumer chain, meaning that they cannot be used unless there is clear technical evidence of double-signing occurring on-chain.
How is the Hub protected from malicious consumer chains?
All consumer chains are expected to have their code audited by a reputable auditing company before going live on the Hub. Neutron was audited by Oak Security (results here) and is currently being audited by Informal Systems. Chains are also expected to participate in the Replicated Security testnet to give Hub validators a chance to gain familiarity with their project and test features. Neutron has been running the Baryon-1 chain on the Replicated Security testnet since early February 2023.
The Hub will use a ‘throttle’ to ensure that the voting power on the Hub cannot be rapidly affected by consumer chains jailing validators. Sometimes this mechanism is referred to as a ‘slash throttle’ because it was developed to address slashing concerns, but in the current implementation of Replicated Security, there is no slashing penalty for downtime on consumer chains.
The only slashing penalty from consumer chains is for double-signing, and the process involves confirming a slashing infraction through Hub governance before a validator’s stake can be slashed. This introduces a social mechanism (controlled by the Hub) to prevent malicious slashing from occurring unexpectedly.
Another technical concern is that of malicious consumer chain code corrupting validators’ machines. Consumer chain code audits and testnets will ensure that the risk of this is negligible in practice. But for additional safety, validators should run their consumer chain and provider chain nodes in separate environments so consumer chain code can not affect their provider chain nodes. Further, validators should use the key assignment feature so that they can keep their provider chain and consumer chain keys separated.
Finally, the Hub always has the option to offboard a consumer chain via governance or, in an emergency, by coordinating >1/3 of the active set to halt the chain or >2/3 to remove it completely. While abruptly offboarding an honest chain would be detrimental to the Hub’s position as a premium security provider, being able to do this for an actively malicious chain is an important safety measure for the Hub.
Neutron: The First Potential Consumer Chain
What is Neutron?
Neutron is a new chain that is launching in the Cosmos system. It is billed as the Hub’s “execution layer” because it can run CosmWasm smart contracts, allowing many other projects to launch on top of it. Neutron is especially well suited for DeFi applications for the following three reasons:
- Permissionless smart contracts that allow any project to launch without going through governance. This low barrier to entry means room for rapid development and lots of flexibility in how projects take shape. All projects that write smart contracts on Neutron also get the benefit of the Hub’s security.
- The high security of the Hub means that the cost of attack on any Neutron-hosted project is extremely high. Handling large financial transactions and deals requires this sort of security.
- Cross-chain interoperability using Interchain Accounts and Interchain Queries will allow contracts to operate across multiple chains, simplifying coordination of DeFi processes across the interchain significantly. More information about these can be found in P2P’s threads on ICQ and ICA.
Who is working on Neutron?
Neutron is developed by P2P, an OG Cosmos Hub validator team and a major contributor to the ecosystem. Some of their major projects include co-founding Lido (a liquid staking solution on many networks) and building an API solution for the Agoric blockchain (which is currently in progress).
The Neutron team currently comprises 16 full time contributors including:
- Avril Dutheil, Neutron’s General Manager. Having purchased his first Bitcoin in his high school cafeteria, Avril has been active in the Web3 community since 2016. He worked for major web3 leaders including P2P and Lido, growing communities, brands, dealflows and leading strategic business initiatives.
- Andrei Zavgorodnii, Neutron’s Technology Lead who brings over 10 years of development and leadership experience to the team. He began his career in information security and led research and development for Russia’s largest food tech company before transferring his skills to Web3. He has held leadership roles at multiple top-tier crypto and blockchain projects, including P2P and Lido.
What sort of projects are going to launch using Neutron?
Neutron is permissionless, meaning any project that wants to deploy CosmWasm contracts on Neutron can do so without going through governance. DeFi applications and projects that would benefit from alignment with ATOM are likely to be interested in launching on Neutron or collaborating.
So far, it’s been publicly confirmed that Neutron will be supported by Leap Wallet, Keplr, and Mintscan. Nine other significant projects (including Nolus, Astroport, Kado, CronCat, Squid) have been confirmed, with many more in the final stages of confirmation or active discussion. Announcements will be coming in the next few weeks via Neutron’s Twitter, Discord, and Telegram group. This list will be updated as the announcements are made!
How will Neutron’s initial token supply be allocated?
Neutron’s initial supply will be 1,000,000,000 with no inflation. When NTRN tokens are used to pay fees on Neutron, 25% will be sent to the Hub as a Replicated Security payment while the remaining 75% are burnt, making NTRN a deflationary token.
The initial token supply will be divided as follows:
- 23% will go to founders and be locked for one year. Tokens will be unlocked linearly over three years with no voting power while being unlocked.
- 11% to early backers with the same locking/unlocking timeline as the founders, but these tokens will have voting power during unlocking.
- 12% will go to the community via an airdrop and launch event. These tokens will be unlocked over 3 months and have voting power during unlocking.
- 54% to the Neutron DAO, held in the DAO’s Reserve and Treasury. These tokens are mostly liquid and are controlled by the majority of voters.
More details on Neutron’s airdrop calculations can be found in their announcement here.
Neutron and the Hub
What is the existing relationship between Neutron and the Hub?
Neutron was incubated by P2P, an OG Hub validator and a core contributor to the Lido DAO.
Neutron also received 25k ATOM from Proposal #72: Bringing Liquid Staking and DeFi to the Cosmos Hub with Interchain Security, which was seen as a soft commitment to securing Neutron in the future. Neutron will receive another 25k from Prop 72 upon launching the network.
Much of the discussion around Proposal #72 and voting to fund Neutron and other high-value consumer chains was to support the success of Interchain Security as a whole, with the expectation that ICS will create demand and utility for ATOM within the ecosystem as a whole.
Why does Neutron want to be secured by the Hub?
The Hub is a top 10 blockchain by staked capitalization, making it extremely secure. Attacks on the Hub require the attacker to control > ⅔ of the staked capitalization (i.e. staked ATOM).
By using Replicated Security, Neutron will have this high security immediately at launch rather than needing to establish an independent validator set. DeFi smart contracts operating on Neutron would benefit from this, making them more secure than contracts on other chains.
Working so closely with the Hub is also a way of enforcing co-operation and value alignment between the two chains - both sides benefit and are motivated to keep the relationship mutually beneficial.
What potential security risks are there to the Hub if Neutron becomes Hub-secured?
Any consumer chain launching on the Hub has the same set of basic technical risks.
First, malicious or faulty codebases may present a security risk to the Hub itself. Because of this, consumer chains should be thoroughly audited and tested before launching. Neutron’s code was audited by Oak Security here and is undergoing a second audit by Informal Systems, which developed Replicated Security. They have launched testnets independently and by participating in Game of Chains and the Replicated Security persistent testnet.
Second, validator downtime or other misbehaviour may lead to security risks on the Hub. An example of this is if too much of the Hub’s voting power is slashed or jailed at once. This has been addressed by the Hub’s decision to use governance-gated slashing, meaning that proof of equivocation must be confirmed with a ‘YES’ outcome on an equivocation proposal. Automatic slashing is still being developed and will involve using the slash throttle to ensure that the voting power on the Hub isn’t drastically affected.
Are there non-technical risks to the Hub as well?
With any consumer chain, there is a risk that the additional burden of securing a new chain will impact smaller validators’ business and impact the decentralization of the validator set. This is why the compensation model and financial impact of each new project should be considered carefully.
The most project-specific risk is that Neutron won’t end up creating value for the Hub and ATOM by bringing increased activity to the network. Because Neutron is a new project, it is also worth examining the quality of past work by the team to assess how it will perform after launch.
What does the Hub gain by securing Neutron?
Staked ATOM holders will receive 25% of transaction fees and MEV revenue from activity on Neutron. These financial benefits scale with activity on the Neutron chain and will be in a combination of ATOM and NTRN, with USDC and other ecosystem tokens potentially available later on. Holding NTRN will also expose tokenholders to the upside of the project as a whole, as the token value may appreciate with the success of the project.
The more successful Neutron becomes, the more revenue it generates for the Hub; the more revenue the Hub receives, the more valuable ATOM becomes and, in turn, the more secure Neutron and all consumer chains will be.
ATOM holders will also be included in the initial token allocation of NTRN. Details about this airdrop have been announced here.
A more subtle benefit is that Neutron will enable applications to launch as smart contracts under the Hub’s security. This means that projects with high security needs which might otherwise be consumer chains can launch on Neutron instead. One of the main concerns with Replicated Security is that adding new consumer chains puts additional strain on the validator set, but if projects are able to launch as smart contract applications instead, this could be a good thing for the Hub in the long term.
How will ATOM be affected by Neutron?
The DeFi hub created by Neutron will likely drive utility and use cases for both NTRN and ATOM while also providing easy access to liquid staked ATOM derivatives. With more flexibility in how staked ATOM can be used, it will be well positioned to become the reserve currency of the ecosystem.
Having a DeFi centre attached directly to the Hub could also help bring ATOM liquidity back into its sphere of influence rather than being heavily influenced by other DeFi chains such as Osmosis.
Neutron and Hub Validators
How much will this affect the cost of running a Hub validator?
Surveys of Hub validators put the cost of running an additional chain between $200 and $600 USD (approx. 14 - 43 ATOM) per month depending on the infrastructure being used. Bare metal operators tend to have cheaper infrastructure costs, but put more time and resources into monitoring and operational costs. The downtime window on Neutron is expected to be much longer than that of the Hub, so it’s expected that monitoring costs will be lower.
There are also ongoing conversations between Hub validators, the Replicated Security team at Informal (led by Jehan Tremback) and the Neutron team about strategies for reducing costs.
How much revenue would Neutron have to generate to cover the additional validator costs incurred by running a new consumer chain?
There are several different ways to model both the cost of a new chain, and revenue that could be created by Neutron. It gets complicated because there are a number of variables that could affect the outcome, so all calculations here should be taken with a grain of salt. It’s also a big question, so let’s break it down into a few parts.
- How much will it cost to run Neutron (or any new consumer chain)?
- How much revenue is required to cover that cost?
- How much revenue would Neutron need to generate overall to send that much to the Hub?
- Roughly how much revenue could Neutron produce?
- What other financial benefit might the Hub get from securing Neutron?
1. How much will it cost to run Neutron (or any new consumer chain)?
To begin, we can look at the total cost of running this additional chain, which means picking an average monthly cost-per-node. For this example, let’s assume that it costs $400 per month to run an additional node.
So the total cost of running the Neutron chain is 175 validators * $400 per month per validator * 12 months in a year = $840 000 per year.
2. How much revenue is required to cover that cost?
One model we can use to think about covering costs is to analyze the Neutron revenue, fee split, and average Hub commission. For this, let’s assume that the average Hub commission is 5%.
To generate $840 000 purely based on commissions, the Hub would need to receive $840 000 / 5% commission = $16.8 million from Neutron each year.
3. How much revenue would Neutron need to generate overall to send that much to the Hub?
Neutron’s compensation proposal is that the Hub gets 25% of the transaction fees and MEV recapture from their chain. So Neutron would need to generate $16.8 million / 25% fee split = $67.2 million per year in transaction fees and MEV revenue.
Tweaking the initial assumptions (cost/month and average commission) produces a range of results:
|Monthly cost / avg commission||5%||10%|
|400||$67.2 million||$33.6 million|
|600||$100.8 million||$50.4 million|
|800||$134.4 million||$67.2 million|
4. Roughly how much revenue could Neutron produce?
Revenue from transaction fees depends heavily on the activity of the network. As a permissionless CosmWasm and prospective DeFi hub, it’s possible that Neutron’s activity range could mimic pre-crash Terra (180 million tx per year) or even higher. Neutron’s minimum fee per transaction will aim to be approximately $0.05, so initial estimates put the total transaction fee revenue generated by Neutron around $9 million or higher.
Fees might be the simplest way to calculate cost-covering numbers, but there may be other effects on validator income that are much harder to estimate, such as MEV revenue and ATOM appreciation.
MEV is very hard to model but we can try using some very rough numbers estimated for Neutron.
- Blocks per day: 28,800 (assuming roughly 3s block time, which is the intention for both the Neutron testnet and mainnet). Note that most Cosmos chains have a 6s block time and produce 14,400 blocks per day.
- Transactions per block: Anywhere between 4 and 20 (or more) depending on network activity.
For an initial MEV revenue per transaction, we’ll use numbers estimated from data shared by Skip Protocol on Juno and Osmosis. These numbers are based on existing Cosmos chains and markets, and may or may not accurately represent what might occur on Neutron depending on token prices and network activity.
- Auction revenue on Juno has generated about $10k USD per month, equating to roughly $0.02/block.
- Cyclic arbitrage on Osmosis has generated about $30k USD per month, equating to approximately $0.07/block.
However, a critical part of MEV is that the revenue per tx may increase as the project gets more active (and the number of tx/block grows) and extraction methods improve. On Ethereum, for example, MEV revenue per block varies wildly but is generally well over $5/block according to the Flashbots dashboard.
|MEV revenue per block||Daily MEV revenue||Annual MEV revenue|
MEV recapture may start off quite slow (low tx/block, low revenue/tx) and scale as Neutron grows.
5. What other financial benefit might the Hub get from securing Neutron?
Another way to model value that could be created by a relationship with Neutron is to consider how much the value of ATOM might increase from the partnership, and how that might affect validator revenue regardless of any fee split. Some assumptions used in this calculation:
- Total ATOM staked on the Hub is 206 million ATOM
- ATOM price is $13
- ATOM APR is 20%
- On average, Hub validators charge 5% commission
So each year, total ATOM rewards are roughly 206 million ATOM * 20% APR = 41.2 million ATOM.
Validators take a 5% commission of that, so the validator set generates 41.2 million ATOM * 5% commission = 2.06 million ATOM. In USD, that’s 2.06 million ATOM * $13 per ATOM = $26.78 million per year.
In order to cover the additional ~$840 000 that it costs to run the Neutron chain (assuming $400/month/validator), the validator revenue would need to increase to $27.62 million, which could happen if the price of ATOM was $13.41 (an increase of about 3.14%). Of course - token price fluctuates more than this on a regular basis, so it makes sense to think of this value proposition more as a general trend in the demand and value of the token rather than as a price increase.
Like the revenue model, these numbers change depending on the assumptions made.
|Monthly cost / avg commission||5%||10%|
This gives us a foundation for thinking about the proposed compensation and how it could translate to the Hub.
Is the proposed compensation sufficient to cover validator costs?
Judging compensation as ‘sufficient’ means considering how much room there is to further reduce costs as well as how much potential there is for revenue. It’s hard to say whether the offered compensation is ‘sufficient’ because there are so many variables - token appreciation, activity in the network, fee and MEV revenue, and the possibility that validator costs can be decreased. The previous section only takes into account fee/MEV revenue and potential ATOM appreciation, but does not consider any initial NTRN token allocations or ongoing exposure. More information about those forms of compensation may be added as information becomes available.
Cost reduction can come from various places, such as not needing to monitor the setup as much, as well as from creative future developments for the financial relationship between Neutron and the Hub validators. For example, a recent idea proposed by Jehan Tremback is a soft opt out for a percentage of the validator set, meaning that the lower x% of the Hub set would not face any penalties for downtime (and thus not necessarily need to run a node).
Benefits that accrue from Neutron could come in four ways:
- Revenue: 25% of transaction fees and MEV recapture
- ATOM appreciation
- NTRN exposure
Other streams of compensation are both harder to measure and potentially much more significant than transaction fees alone. Being so closely connected to the Hub means that Neutron could generate utility and demand for ATOM, raising the token’s value. This may have a ripple effect as ATOM-denominated revenue from all sources (including tx fees) becomes more valuable to validators and ATOM-holders. Similarly, Neutron’s success may raise its own token value and anyone holding NTRN will benefit from the upside of this asset which intends to be deflationary over the long term.
In the previous question, the rough math is that there would be enough revenue coming into the Hub to cover cumulative validator costs if Neutron is generating roughly $67 million in revenue. There might also be enough ATOM appreciation to cover the additional costs if the token increases by 3.14%. Each of these two options could be sufficient, and we may experience some of each option (both revenue and appreciation).
However - this speculation considers the validator set as one entity with cumulative costs and income. The reality is that the validator set is very diverse, and while all validators might experience roughly similar costs for running new nodes, smaller validators get significantly less revenue from their validation services and may operate at a loss if Replicated Security scales without addressing this problem. This is an issue directly related to the stake distribution in the Hub itself, as both Hub and consumer chain rewards scale with the ATOM stake held by a validator.
This issue is being actively discussed by members of consumer chain teams as well as Hub validators and developers. Some options for handling the disparity in the validator set are the soft opt-out or subsidies specifically for smaller validators (either from the Hub or consumer chains). Research on this is ongoing and we’ll link to it as more details become available.
This soft-out could involve the lower 5% of the validator set not needing to validate Neutron, which would mean not incurring the additional cost of running a node. The lowest 5% of the Hub’s set by voting power comprises roughly 70-75 validators, so this would reduce the overall cost by about $30k/month or $360,000/year. Most importantly, this idea acknowledges the strain placed on smaller validators with Replicated Security, and takes steps to address it from the consumer chain side.
What is Neutron’s governance model?
In sovereign Proof of Stake networks such as the Cosmos Hub, token-holders stake their ATOM with validators who both secure the network and participate in governance. On Cosmos chains, validators vote on behalf of all the stake that has been delegated to them, but delegators can always override their validators’ votes.
Hub validators will secure Neutron using ATOM staking but Neutron’s governance implementation is smart-contract based and derives voting power from the NTRN token, not ATOM. Thus, participating in Neutron governance requires holding NTRN or its derivatives.
Neutron governance will involve several subDAOs which are empowered to change network parameters through the admin module. Each of these subDAOs is accountable to the main governance layer, which can veto motions from the subDAOs. The main governance layer does not involve delegation of voting power to validators or any other entity.
What decisions can ATOM holders make about Neutron?
ATOM governance will control adding and removing Neutron from the Hub’s security. Any other decisions will go through Neutron governance. However, since NTRN tokens are sent back to the Hub as rewards and ATOM validators/delegators are included in the initial token allocation, ATOM holders will gradually accumulate NTRN tokens and be able to participate in Neutron governance. Upgrades to Neutron’s chain will be facilitated through Neutron governance.
If ATOM holders no longer want the Hub to secure Neutron, what happens?
Hub governance can remove any consumer (including Neutron) with a governance proposal. This proposal would be subject to the usual Hub governance parameters, which currently means a two week voting period and 40% quorum. At any time, >33.3% of the Hub’s voting power can coordinate outside of governance to simply stop running Neutron.
However - this is just the technical side of the picture and the relationship between a provider and consumer chain is more than just technical. The social norms around removing Neutron should be discussed as part of the proposal.
As a premium provider of security, the Hub should be thoughtful about providing opportunities for a consumer chain to address any problems before being removed. Because being forcibly removed from the security provider chain would be incredibly detrimental to a project, the Hub should clearly communicate about ending the relationship early on, such as by making a signaling proposal and giving a grace period of several months before making a proposal to remove the consumer chain.
What happens if Neutron wants to leave the Hub’s security?
From a technical point of view, Neutron would need to establish their own validator set or find a new security provider. This new validator set (either a sovereign one or a different provider) could just start running a fork of the chain, but it would be good practice to exit the Hub’s security via governance before starting a fork of the chain.
Socially, the process will likely be similar to the Hub initiating an offboard: A signaling proposal on Neutron followed by a grace period to allow stakeholders to organize and part ways on good terms before making the final proposal to remove the chain.
There is no code constraint which prevents Neutron from leaving the Hub’s security, but it makes strategic sense to remain connected to the Hub’s strong security indefinitely. If Neutron does choose to offboard in the future, the initial NTRN airdrop to ATOM holders and any future allocations would ensure that the Hub continues to benefit from Neutron’s success even if the relationship ends.