Anti-correlation attestation penalties

Abstract

The decentralization of the validator set is one of the most important properties of Ethereum for credible neutrality and censorship resistance. By adjusting penalties to foster decentralization, diversification and fault-tolerance, this EIP proposes to adjust penalties in a way that more diversified entities get lower penalties while entities with high correlations in their setup face more severe ones.

Motivation

As of now, during times of usual network operation, there are no economic incentives to diversify node operations through using multiple different nodes, geographical locations, clients, ISP providers, etc., except for reducing the risk of penalties affecting all validators simultaneously, thereby limiting the impact to only a fraction of them.

Attestation penalties are currently agnostic to other participation actions. This proposal scales attestation penalties as a function of other participants' actions. The goal is to decrease the profitability of participants that exhibit correlated behavior.

Specification

Add a variable NET_EXCESS_PENALTIES to the beacon state.

Let penalty_factor be determined through

min(
    (non_attesting_balance * PENALTY_ADJUSTMENT_FACTOR) // (NET_EXCESS_PENALTIES * total_active_balance + 1), 
    MAX_PENALTY_FACTOR
)

Let NET_EXCESS_PENALTIES be max(1, NET_EXCESS_PENALTIES + penalty_factor) - 1

Rationale

PENALTY_ADJUSTMENT_FACTOR

This variable impacts the sensitivity of the NET_EXCESS_PENALTIES.

Given stable participation, the penalty_factor is one. If participation decreases, the penalty_factor will temporarily increase above one until net_excess_penalties catches up. If participation increases, the penalty_factor will temporarily be zero until net_excess_penalties catches up.

The PENALTY_ADJUSTMENT_FACTOR regulates how fast net_excess_penalties catches up. In other words, the PENALTY_ADJUSTMENT_FACTOR determines the frequency that the penalty_factor is not one.

A high PENALTY_ADJUSTMENT_FACTOR causes the net_excess_penalties to adjust slower. A low PENALTY_ADJUSTMENT_FACTOR causes the net_excess_penalties to react more sensitively to changes in participation.

MAX_PENALTY_FACTOR

The MAX_PENALTY_FACTOR puts a ceiling onto the maximum factor with which the penalty for missed attestations is scaled to prevent overly harsh punishments.

Backwards Compatibility

This is a backwards incompatible adjustment of attestations rewards and penalties that requires a scheduled network upgrade.

Security Considerations

We acknowledge that splitting validator views can be leveraged as an attack to increase the penalty_factor for validators of consecutive slots with little risk for the proposer. TBD.

Copyright

Copyright and related rights waived via CC0.