Stake Decentralization Using Pledge as a Bidding Parameter to Calculate Saturation Limit.md

CIP: TBD
Title: Stake Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit
Author: Jay Pseudonym Cappucino <jycappucino@gmail.com>
Status: Draft
Type: Standards Track
Created: 2022-02-28

 

Abstract

With the current saturation limit set at 68 M per pool and with 3119 pools, the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (e.g., Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, i.e., the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and infrastructure. This expense, likewise, confers the system a high very resistance against Sybil attack.

 

Motivation

This proposal attempts to solve the ongoing stake centralization while preserving (if not enhancing) the security guranteed by the current consensus mechanism. It solves the problem by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, i.e., whether the ecosystem is under-pledged, fully pledged, or over-pledged. The parameters under this proposal are adjusted in a very dynamic manner using a set of well-defined equations and, therefore, allows the staking ecosystem to operate without the need for frequent network consensus. Because of this mechanism, the would-be protocol not only enhances stake decentralization, it also ensures robustness of the ecosystem against any abrupt changes in the staking circumstances without intervention from the community.

 

Specification

Nonmathematical Description

      There is no barrier to entry to set up a pool, but there exists an optimal pledge which is used as a yardstick to determine pool saturation limit in proportion to pledge.

• Individual pool saturation limit decreases exponentially when pool pledge < optimal pledge.
• Individual pool saturation limit increases only incrementally when pool pledge > optimal pledge.
• The ecosystem is under-pledged when the total saturation limit < circulating supply. Under this condition, pools can over-pledge to “borrow” additional saturation limit from the under-pledged pools. If there is still remaining saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed limit can still be re-claimed by under-pledged pools by continuing to pledge up to optimal pledge.
• The ecosystem is in equilibrium when the total saturation limit = circulating supply. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit allocated for them. The over-pledge pools’ excess saturation limit, likewise, will continue to decrease until all excess had been returned. This and the proposition from the previous bullet point ensures that:
  • a close system is maintained, i.e., the total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, i.e., under-pledged, fully pledged, or over-pledged.
  • no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization.
• Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack:
  • optimal pledge is expensive for MPOs.
  • expense to conduct Sybil attack increases as the total number of pools increases.
     

Mathematical Description

Calculating Optimal Pledge

 

where p_opt is the optimal pledge, φ is the amount of ADA in circulation (currently 33B), k is the total number of pools, and n is a variable that is determined to warrant an economically viable optimal pledge (p_opt). Therefore, it appears that n is a variable that the community can vote for adjustment to increase or decrease p_opt. In effect, it can be used to control the total number of pools (k) so that at some value n, the ecosystem gradually settles to some value k which the community thinks is the optimal value.

If we set n =15,

scenario 1 (very small number of pools):

• k = 500,
• p_opt = ~ 774,763 ADA per pool

scenario 2 (current number of pools):

• k = 3119 (epoch 321)
• p_opt = 47,205 ADA per pool

scenario 3 (very large number of pools):

• k = infinity
• p_opt = 27,440 ADA per pool
   

Conclusion: p_opt becomes cheaper as the total number of pools (k) increases, but more expensive when the total number of pools decreases.
 

Calculating Saturation Limit (α)

case 1: p_a ≤ p_opt


where:
p_a = actual pool pledge
p_opt = optimal pledge
α_unc = saturation limit left unclaimed even after some pools have over-pledged. This variable is defined in Equation 7.
T_a = pool accumulated time of operation (in days) counting from day 1 of operation (read explanation below).
T_tot= total accumulated time of operation (in days) of all pools (read explanation below).

The first term of Equation 2 allocates saturation limit based on pledge, and ensures that saturation limit increases or decreases exponentially with pledge.

We wish to have α_unc = 0, but if we do, the second term of Equation 2 ensures its distribution. The distributed α_unc, however, can still be re-claimed by under-pledged pools by increasing their pledges.

Distribution of α_unc based, yet again, on the proportion of pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,T_a, as a parameter for the distribution of α_unc which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of α_unc. This mechanism is very important when the number of pools (k) suddenly decreased to a very low number, making p_opt very expensive and leading to significant under-pledging.

Example 1

• k = 3119 (epoch 321)
• p_opt = 47,205 ADA (at n = 15, see calculation in the previous section)
• p_a = 47,205 ADA
• α_unc = 0 (we will deal with nonzero values later)
• φ = 33B (current ADA in circulation)
  
        α = $\frac{33B}{3119}$ $e^{1 - 47,205/47,205}$ = $\frac{33B}{3119}$ = 10.6M
  
  Conclusion: Epoch 321 saturation limit for pools with at least 47,205 ADA in pledge is 10.6M (at n = 15). The ratio 33B/3119 guarantees that every ADA in circulation has a pool to stake to without risking oversaturation. Note that the current average stake per pool is only 7.6M, suggesting that a vast number of pools are not adequately staked. Setting the saturation limit, on average, to 10.6M would make some large pools to become oversaturated which will encourage delegators of these pools to move their stakes to small pools.
   

Example 2 (same variable values as in example 1 but lower p_a).

• k = 3119 (epoch 321)
• p_opt = 47,205 ADA
• p_a = 30,000 ADA (for example)
• α_unc = 0 (we will deal with nonzero values later)
• φ = 33B (current ADA in circulation)
  
        α = $\frac{33B}{3119}$ $e^{1 - 47,205/30000}$ = 6.0 M
  
  Conclusion: Saturation limit decreases exponentially when p_a<p_opt, encouraging pools to achieve p_opt. In an under-pledged ecosystem, pools can over-pledge to borrow saturation limit from under-pledged pools (see next case).
   

case 2: p_a>p_opt (the equation is quite complex so please bear with me)


where:

• n=(p_a\p_opt) is an integer division (example: 4\3 = 1).
• $\frac{(x-|x|)}{2}$ returns 0 when x is positive, otherwise it returns the value of x.
• The first term in equation 3 (blue text) is the guaranteed saturation limit since the pool exceeded p_opt.
• The second term in equation 3 (red + green text) calculates saturation limit in excess of the guaranteed limit.
• The second factor of the second term in equation 3 (green text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases as under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, lowers the excess saturation limit (red text) of the over-pledged pools. Hence, an over-pledged pool "return" the borrowed saturation limit without further intervention.
   

Example 1: ecosystem is not over-pledged

• p_a = 110,000 ADA
• p_opt = 47,205 ADA (n = 15)
• Δ=1 (Please accept this for now. Proof is provided later.)
• current circulation supply (φ) = 33B ADA
• current total number of pools (k, epoch 321) = 3119
  
  Because the system is not overpledged, Equation 3 is reduced to:
  
  
  
  Plugging in the values,
  
  
  
  Conclusion: Since p_a/p_opt = $\frac{110000}{47205}$ = 2.33, the pool is guaranteed a saturation limit that is twice of $\frac{33B}{3119}$. The other additional limit $\frac{33B}{3119}$ $e^{-2.028}$ comes from the 0.33 fractional excess and is penalized exponentially.
   

Example 2: ecosystem is over-pledged.
Here, we will provide the derivation for the penalty factor (Δ) and we will prove that it leads to a close system, i.e., the total saturation limit is always equal to the circulation supply no matter how under-pledged or over-pledged the ecosystem is. The penalty factor (Δ) has the following characteristics:

• Δ = 1, when the ecosystem is either under-pledged or at equilibrium. Under this condition, the excess saturation limit of over-pledged pools are unaffected. In essence, they are not yet "returning" any of the borrowed excess.
• Δ ⟶ 0, when the ecosystem is over-pledged, and p_a of the under-pledged pools approaches p_opt. Under this condition, the excess saturation limit of over-pledged pools also approaches zero. In essence, they are "returning" the borrowed excess.
  
  We first calculate the total saturation limit (α_total) excluding:
  • saturation limit from over-pledges.
  • distributed unclaimed saturation limit (α_unc, see second term in Equation 1).

where p_ai is the actual pledge of pool i. Since total saturation limit (α_total) can never exceed circulating supply (φ), the unclaimed saturation limit (α_unc) is then calculated as follows:



It is important to note that for the calculation of α_total, we must only use p_a≤p_opt for all pools even for over-pledging pools. Realistically, some pools will be over-pledged and their total excess saturation limit (α_ovp) may be added as follows:



Solving for α_ovp we have,



Another way of expressing the total excess saturation limit (α_ovp) is by using Equation 3 and is given as follows:



where j is any over-pledging pool. Plugging in Equation 9 into Equation 8, we have:



Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simplifying, we have:



It is very important to note that at α_unc ≤ 0, its value must be zero. This is very important, otherwise a close system cannot be guaranteed.

Now, we will prove that Equation 11 guarantees a close system, i.e.,

Δ = 1, when the ecosystem is either under-pledged or at equilibrium.
Δ ⟶ 0, when the ecosystem is over-pledged, and p_a of the under-pledged pools approaches p_opt.

Case 1: Ecosystem is under-pledged and over-pledging pools keep over-pledging to borrow additional saturation limit: the denominator is going to increase (red arrow) while the numerator is going to increase by the same magnitude through a decrease (blue arrow) in the unclaimed saturation limit (α_unc) :



Case 2: Ecosystem is under-pledged and under-pledging pools keep pledging to claim the remaining saturation limit: the second term in the numerator is going to increase (red arrow) while the third term is going to decrease by the same magnitude (blue arrow):



Case 3: Ecosystem is over-pledged (α_unc = 0) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In essence, an over-pledged pool is simply returning the “borrowed” excess, and its excess saturation limit approaches zero as Δ approaches zero.



Case 4: Ecosystem is over-pledged (α_unc = 0) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease and, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of the under-pledged pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (α_total < φ) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when α_unc = 0. However, such weakness may possiby be exploited. Hence, when α_unc = 0, any pledge from an over-pledged pool should rejected.



   

Sybil Attack

Simplifying scenario: ecosystem average pledge = optimal pledge and 33B ADA staked.

scenario 1 (small number of pools):
n = 15 and k = 500,
p_opt = ~ 774,763 ADA

A Sybil attack requires 501 nodes, number of pools (k) totals 1001 (500 + 501), and optimal pledge (p_opt) decreases to 148, 011 ADA. Therefore, an attack requires 501 pools that need to be fully saturated (16.5M in stake) and a total of ~74M ADA (501*148,011) in pledge.

scenario 2 (large number of pools):
n = 15 and k = 3119 (epoch 321),
p_opt = 47,205 ADA

A Sybil attack requires 3120 nodes, number of pools (k) totals 6239 (3119 + 3120), and optimal pledge (p_opt) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge.

 

Rational

The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools as well as discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization.

To mitigate the problem outlined above, we recognized that saturation limit needs to get decreased to some minimum that allow fair distribution of stake but avoids the potential risk of oversaturation. We may do this by allocating saturation limit based on pledge. This idea was first explored by Casey Gibson in his CIP which you may find here. We found that there may be potential weaknesses to his ideas, but the same weaknesses are addressed in our proposal. These weaknesses are:

• The Gibson proposal appears to be less effective at solving stake centralization.
  To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA. Therefore, each pool requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools. The total pledge would amount to 21.5M, but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it.
  
  The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at n = 15 and k = 3119 (epoch 321). The calculation is as follows
  
  p_opt = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$
  α = $\frac{33B}{3119-60+pools}$
  pools = 2.8B/(α+p_opt)
  
  We have three equations and three unknowns which resolves to pools = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge)
   

• The Gibson proposal may disenfranchise a significant portion of ADA in circulation from getting staked at low pool number.
  Because the Gibson proposal does not gurantee that the total saturation limit of all pools is equal to the amount of ADA in circulation, there exists a significant risk of disenfranchising some portion of ADA in circulation from getting staked. For example, if the number of pools abruptly dropped to 500, all pools need to pledge at maximum (500,000 ADA to get 68M saturation limit) so that the ecosystem can achieve a total saturation limit that is approximately equal to the total ADA in circulation. However, all pools pledging at maximum is a very unlikely scenario, leaving some ADA disenfranchised. Risk of disenfranchisemnt exists even at the current number of pools. In contrast, the total saturation limit under our proposal is always equal to ADA in circulation.  

• The Gibson proposal may require frequent network consensus to tweak parameters.
  Since the Gibson proposal rely on parameters that can only be changed when there is network consensus, such design is less robust against abrupt changes in the ecosystem, e.g., when there is a need for the number of validators to scale up with demand or when the number of pools declines abruptly due to extreme events. Our proposal scales up and down without further intervention because the protocol is governed by equations.
  
   

Copyright

This CIP is licensed under CC-BY-4.0