PaperlayerView exact revision on arXiv

Source-linked AI summary

Too Late to Slash: Coordinating a Risk-Free Equivocation Attack

Hao Chung, Chen-Da Liu-Zhang

arXiv:2609.30509v1cs.GTcs.CR

TL;DR

The paper asks whether rational validators will coordinate despite slashing, then constructs a risk-free strategy for soliciting an attack. It shows that the prescribed strategy is an ex post Nash equilibrium under a timely-progress assumption, even without advance knowledge of who will participate.

  • Problem

    The paper asks whether rational validators will seek accomplices and learn whether enough others will attack despite large bonds and small attack rewards.

    Source: §1 · p. 3

  • Method

    It constructs a risk-free coordination attack in which rational validators are incentivized to discover whether enough others are willing to join.

    Source: §1.1 · p. 3

  • Results

    Under timely blockchain progress, the prescribed strategy is an ex post Nash equilibrium, even when validators do not know in advance who will participate.

    Source: §1.1 · p. 4, §3.4.1 · p. 13

  • Takeaways & Limitations

    Once coordination is considered, application security is not proportional to stake, and slashing cannot deter attackers able to block their own punishment.

    Source: §1.1 · p. 3

    The equilibrium proof assumes timely blockchain progress so prescribed transactions can be included and finalized by the wall-clock horizon.

    Source: §3.4.1 · p. 13

Abstract

from arXiv · show

Slashing is commonly argued to secure proof-of-stake blockchains by confiscating the stake of misbehaving validators. The usual justification is that, without slashing, validators can solicit an equivocation attack by signing conflicting blocks: if enough others join, the attack succeeds; otherwise, the attempt incurs no loss. Slashing is intended to make such attempts costly and thereby guarantee the security of applications whose economic value is comparable to the bonded stake. This rationale, however, rests on heuristic arguments rather than a formal game-theoretic guarantee. We challenge this rationale by constructing a risk-free coordination protocol for rational validators under algorithmic slashing. We show that the prescribed strategy profile, in which rational validators solicit other validators to equivocate, constitutes an ex post Nash equilibrium, even when validators do not know in advance how many others will participate. The equilibrium holds for any gain $\epsilon>0$ from successful equivocation, however small relative to the bonded stake. Thus, slashing alone does not guarantee economic security proportional to the value of bonded stake. Our results expose a fundamental limitation of algorithmic slashing. Whereas conventional collateral arrangements in many real-world scenarios can rely on external enforcement, for example through courts, algorithmic slashing depends on the same consensus process that the attackers control. These findings call for a formal analysis of slashing's security, rather than overly simplistic arguments drawn from financial systems with independent enforcement.

1 Introduction

The introduction questions whether slashing deters rational validators from coordinating, and presents a risk-free coordination strategy that can yield an attack equilibrium. It argues that algorithmic slashing cannot guarantee application security proportional to stake when a coalition controls the consensus process that enforces penalties.

1 Introduction

  • The introduction frames slashing’s deterrent effect as a prediction about whether rational validators will seek accomplices, and asks if they will coordinate despite large bonds and small attack rewards.The coordination question is whether validators can discover others’ willingness to attack before any of them risks slashing.Source: §1 · p. 3

1.1 Our Contribution

  • The authors conclude that application security is not proportional to stake once coordination is considered; algorithmic penalties depend on consensus controlled by the attackers, unlike external social enforcement.A penalty must be included in a block and finalized by the validators it targets.Source: §1.1 · pp. 3, 5
  • Validators register intent without producing double-signing evidence; after a deadline, the contract aborts below the monopoly threshold or enables equivocation and censorship at or above it.Participants censor slashing transactions until withdrawing their full stake.Source: §1.1 · pp. 3–4
  • The prescribed strategy forms a Nash equilibrium even when validators do not know in advance who will participate.The paper also reports that joining yields a positive gain without losing stake when the other rational validators follow the coordination strategy.Source: §1.1 · p. 4
  • Deposit-backed reporting rewards preserve the attack equilibrium, while anonymous enrollment with sufficient collateral supports equilibrium under broader rules that never punish honest validators.The reporting-reward deposit is forfeited if any coalition member is slashed, preventing profitable betrayal.Source: §1.1 · p. 4
  • The construction is idealized and requires monopoly-threshold coalition power, greater than the power needed to violate safety; operational-error slashing may still help careless participants.The authors say these practical uses do not establish security against sophisticated coordinated rational attacks.Source: §1.1 · pp. 4–5

1.2 Related Work

  • Prior rational-participant work asks whether parties deviate from protocols [Hal08] [RPG22]; unlike bribery contracts, this mechanism reveals existing willingness without transferring funds.A related analysis starts with an already formed coalition that knows its consensus weight and relies on network delays; this work studies coalition formation without a network partition [BLPR24].Source: §1.2 · p. 5

2 Modeling Blockchains with Slashing

The model makes slashing effective only through finalized transactions and treats validator states relative to finalized histories. It defines a monopoly threshold by the coalition weight needed to equivocate and censor penalties.

2.1 Blockchains with Slashing

  • The committee and consensus weights remain fixed during an episode, while the network model is abstract and may be instantiated under synchronous, partially synchronous, or asynchronous settings.The resulting colluding thresholds may depend on the network model.Source: §2.1 · p. 6
  • The model permits conflicting finalized histories, so account states and whether a validator is slashed are evaluated relative to a specified history.A validator can be slashed in one finalized history but not another.Source: §2.1 · p. 7
  • A slashing penalty changes an account only when its transaction executes in a finalized block, and observers can determine the resulting confiscation from that history.The amount may vary with violation severity, from fractional slashing for minor mistakes to the full balance for equivocation.Source: §2.1 · p. 7
  • Equivocation evidence is usually a pair of signatures on conflicting blocks, though the model allows evidence generation to be interactive.Finality certificates make conflicting finality publicly verifiable, including when observers receive them at different times.Source: §2.1 · p. 7

2.2 Monopoly Threshold

  • The monopoly threshold measures coalition weight sufficient to finalize conflicting blocks and exclude slashing transactions; the section previews that equivocation can form a Nash equilibrium even under a restricted strategy space.A coalition controlling the entire committee satisfies both properties, so the threshold exists for any natural blockchain protocol.Source: §2.2 · pp. 7–8

3 The Basic Coordination Game

This section models a threshold-based coordination game in which rational validators can coordinate an attack without being slashed, even for an arbitrarily small gain; it shows that switching from honest behavior to the prescribed strategy is strictly beneficial, so honesty is not a best response.

3.1 Rational Validators and Equivocation Slashing

  • The model gives rational validators private types, no common prior over type profiles, and the option to maximize utility by deviating, including by signing conflicting consensus blocks.Honest validators follow the protocol and do not equivocate; rational validators do not know the other validators’ types.Source: §3.1 · p. 9

3.2 Coalition Coordination

  • Signing and submitting registration messages alone creates no slashing evidence, and an abort causes no modeled loss because the coordination contract locks no collateral.The contract activates when the enrolled coalition reaches qcoord and aborts otherwise.Source: §3.2 · p. 10

3.3 Coordination Game

  • The game counts a successful attack’s gain as ϵ, but charges the full initial stake si if a validator is slashed or fails to withdraw on either selected branch by deadline T.The loss is charged once even if both conditions occur; an executed penalty in any finalized history by T incurs the full loss.Source: §3.3 · p. 12

3.4.1 Risk-free attack equilibrium

  • Under timely execution, prescribed play is an ex post Nash equilibrium for every type profile; below the monopoly threshold coordination aborts, while above it the attack succeeds without slashing and rational validators withdraw their full stake.With negligible failure probabilities, the equilibrium holds up to a negligible additive error; above the threshold, participation remains strictly preferable to honest nonregistration when ϵ > (ϵ + si)η(λ).Source: §3.4.1 · pp. 13–14

3.4.2 Strict incentive to join

  • Once other rational validators coordinate, the section states that an individual validator is incentivized to join.The supplied passage identifies this as Corollary 3.5 under Theorem 3.3’s assumptions.Source: §3.4.2 · p. 14
  • Switching from honest behavior to the prescribed coordination strategy raises validator i’s payoff from 0 to ε > 0, so honesty is not a best response.Under honest behavior, validator i never registers, is outside every enrollment set, and incurs neither attack, failed-exit, nor slashing penalties.Source: §3.4.2 · p. 14

4 Extensions of the Coordination Game

This section extends risk-free validator coordination to reporting rewards, broader slashing rules, and anonymous enrollment. It characterizes equilibrium under the stated assumptions, including when prescribed play succeeds and why unilateral deviation or honest behavior does not improve on joining.

4.1 Coordination with Reporting Rewards

  • With sufficient collateral and the stated assumptions, the prescribed coordination strategy remains an ex post Nash equilibrium despite rewards for reporting equivocation.Along prescribed play, rational validators recover their collateral and are not slashed; when the coalition meets the coordination threshold, the attack succeeds and rational validators withdraw their full stake by T.Source: §4 · p. 15, §4.1 · p. 16
  • Honest behavior is not a best response for a rational validator: switching to the prescribed coordination strategy yields payoff ϵ > 0.This conclusion holds under the assumptions of Theorem 4.1.Source: §4.1 · pp. 17–18

4.2 Anonymous Enrollment under General Slashing Rules

  • For broader slashing rules, anonymous enrollment uses unlinkable user accounts so enrollment evidence cannot be attributed to a validator without risking punishment of an honest validator.The argument applies to mechanisms satisfying honest-stake safety, which forbids accepted evidence against an honest validator.Source: §4.2 · p. 18

4.2.1 Coordination Protocol

  • The coordination protocol enrolls accounts with deposits, activates when at least m accounts register, and refunds deposits after linked account-and-validator signatures certify equivocation and full-stake withdrawal.Before finalized activation, rational validators follow the honest protocol; missing or invalid inputs can prevent the next step and leave waiting through T.Source: §4.2.1 · pp. 18–19
  • Each validator and its user accounts form one player with shared utility, while each account benefiting from a successful selected attack is counted once.Collateral loss is measured as the largest total amount remaining unreturned on any terminal finalized branch; locked collateral counts as unreturned.Source: §4.2.1 · p. 20

4.2.2 Equilibrium Analysis

  • Under Assumption 3.2, honest-stake safety, and the stated collateral bound, the prescribed anonymous-deposit strategy sano is an ex post Nash equilibrium for every type profile.The theorem also states that every prescribed deposit is returned by time T.Source: §4.2.2 · p. 20
  • When |R(t)| < m, coordination never activates; under unilateral deviation, any attack gain requires d_i ≥ m−|R(t)|+1 ≥ 2, and at least (d_i−1)D of i’s collateral remains unreturned on each branch extending the common activated outcome.Source: §4.2.2 · pp. 20–21
  • When |R(t)| ≥ m, the selected attack succeeds and each rational validator earns ε, with no rational validator slashed and timely full-stake withdrawal.Censorship and the common selected signer set support the shared continuation, and timely settlement returns each deposit on branches containing it.Source: §4.2.2 · pp. 20–21
  • When |R(t)| ≥ m, joining yields ε > 0 while unilateral honest behavior yields 0, so honest behavior is not a best response.The honest strategy follows the blockchain protocol and creates no enrollment accounts or collateral deposit.Source: §4.2.2 · p. 21
Loading 2609.30509v1…