From aaccddfc7c100990cc40b64d18d5ac16656f8b90 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Mon, 28 Feb 2022 22:21:35 -0500 Subject: [PATCH 01/28] Decentralization: Using Pledge as a Bidding Param MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dear Community, It is a pleasure to have this chance to contribute to the Cardano ecosystem, and I am glad that this chance is open for everyone even to contributors like I am who is not a developer by profession. I do have a terminal degree in the sciences, so I can understand quite a bit of mathematics (this CIP is somewhat mathematically oriented). I must reveal that I am using a pseudonym as I am still not sure at this point what I am getting into. Here, I proposed a CIP that will hopefully address the steadily increasing stake centralization in the Cardano ecosystem. I am also aware that there is another proposed CIP by Casey Gibson (https://github.com/cardano-foundation/CIPs/pull/163) which is similar to mine. I discussed the differences of these two proposals in the Rational section of my CIP. Finally, I gave a very simple scenario below that may help orient the reader as to what the CIP is trying to achieve. Alice, Bob, and Charlie are pool operators, and each is entitled to 3 saturation limits (SL). However, they need to make a pledge to get any SL in a 1:1 ratio. The ecosystem has a total of 9 ADA in circulation, and the proposed CIP requires that the “total SL is always equal to ADA in circulation” regardless of pools’ pledge status. Scenario: a. Alice pledged 3, Bob 3, Charlie 3 (ecosystem is in equilibrium, total SL = ADA in circulation). Since all SL were claimed and no one is under-pledged, additional pledges from Alice, Bob, and Charlie will no longer allow them to gain any more SL nor will it decrease their current SL. b. Alice withdrew 1 pledge due to an unforeseen circumstance, and this makes the ecosystem under-pledged (Alice has 2 SL, Bob 3, and Charlie 3). The proposal always require that “total SL = ADA in circulation”, so the unclaimed SL must be redistributed. The redistribution uses pool accumulated time as the parameter instead of pledge so as not to disadvantage Alice even more by having the lowest pledge. Assuming they all started at the same time as pool operators, Alice, Bob, and Charlie deserve equal proportion to the unclaimed SL, and each will receive 0.33 SL. So, Alice has 2.33 SL, Bob 3.33 and Charlie 3.33. “total SL = ADA in circulation” is re-stablished. c. Eventhough, Alice’s unclaimed SL was re-distributed, it can still be claimed by anybody. So, Bob decided to pledge 1. Alice now has 2 SL, Bob 4 and Charlie 3. Since all SL were claimed but only Alice is under-pledged, only Alice can pledge at this point. Additional pledges from Bob and Charlie will no longer allow them to gain any more SL nor will it decrease their current SL d. Alice decided to pledge 1 to reclaim her SL. Now, Alice has 3 SL, Bob 3, and Charlie 3. Since all SL were claimed and no one is under-pledged, additional pledges from Alice, Bob, and Charlie will no longer allow them to gain any more SL nor will it decrease their current SL. e. Under the new proposal, the only way any one of them can take away SL from the other pools is to set up more pools. However, one will need to pay a pledge to take away only a tiny fraction of SL, which makes this strategy unrewarding. To illustrate scenario (e) even better, a current MPO that has 60 pools and controls 2.8B ADA in stake without any pledge must now pledge 12.8M and set up 282 pools to retain all 2.8B ADA in stake under the proposed CIP. --- ...Parameter to Determine Saturation Limit.md | 233 ++++++++++++++++++ 1 file changed, 233 insertions(+) create mode 100644 Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md diff --git a/Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md b/Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md new file mode 100644 index 0000000000..3c093c24b0 --- /dev/null +++ b/Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md @@ -0,0 +1,233 @@ +CIP: TBD\ +Title: Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit\ +Author: Jay Pseudonym Cappucino \\ +Status: Draft\ +Type: Process\ +Created: 2022-02-28\ +\ +  +# **Abstract** +With the current saturation limit set at 68 M per pool and with 3119 pools, the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack.\ +\ +  +# **Motivation** +This proposal attempts to solve the ongoing stake centralization while preserving (if not enhancing) the security guranteed by the current consensus mechanism. It solves the problem by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations and, therefore, allows the staking mechanism to operate without the need for frequent network consensus. Because of this mechanism, the would-be protocol not only enhances stake decentralization, it also ensures robustness of the ecosystem against any abrupt changes in the staking parameters without intervention from the community.\ +\ +  +# **Specification** +## **Nonmathematical Description** +      There is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. +* Individual pool saturation limit decreases exponentially when **pool pledge < optimal pledge**. +* Individual pool saturation limit increases **only incrementally** when **pool pledge > optimal pledge**. +* The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit from the under-pledged pools. If there is still remaining saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed limit can still be re-claimed by under-pledged pools by continuing to pledge up to optimal pledge. +* The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit allocated for them. The over-pledge pools’ excess saturation limit, likewise, will continue to decrease until all excess had been returned. This and the proposition from the previous bullet point ensures that: + - a **close system** is maintained, _i.e._, the total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. + - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. +* Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: + - optimal pledge is expensive for MPOs. + - expense to conduct Sybil attack increases as the total number of pools increases.\ +  +## **Mathematical Description** +### _**Calculating Optimal Pledge**_ +  +![equation1](https://drive.google.com/uc?export=view&id=1O_gmZ9LwpVV3xs2RVNqaXLh3um3zfFKs) + +where **_popt_** is the optimal pledge, **φ** is the amount of ADA in circulation (currently 33B), **_k_** is the total number of pools, and **_n_** is a variable that is determined to warrant an economically viable optimal pledge (**_popt_**). Therefore, it appears that **_n_** is a variable that the community can vote for adjustment to increase or decrease **_popt_**. In effect, it can be used to control the total number of pools (**_k_**) so that at some value **_n_**, the ecosystem gradually settles to some value **_k_** which the community thinks is the optimal value.\ +\ +If we set **_n_** =15, + +**scenario 1** (very small number of pools): +* **_k_** = 500, +* **_popt_** = ~ 774,763 ADA per pool + +**scenario 2** (current number of pools): +* **_k_** = 3119 (epoch 321) +* **_popt_** = 47,205 ADA per pool + +**scenario 3** (very large number of pools): +* **_k_** = infinity +* **_popt_** = 27,440 ADA per pool\ +  + +**Conclusion**: **_popt_** becomes cheaper as the total number of pools (**_k_**) increases, but more expensive when the total number of pools decreases.\ +  +### **_Calculating Saturation Limit (α)_** + + +**case 1: _pa ≤ popt_**\ +![equation2](https://drive.google.com/uc?export=view&id=1vwM9i8voMM6AnNtlxIzuwu8mQj1ntgi5) +\ +\ +where:\ +**_pa_** = actual pool pledge\ +**_popt_** = optimal pledge\ +**_αunc_** = saturation limit left unclaimed even after some pools have over-pledged. This variable is defined in Equation 7.\ +**_Ta_** = pool accumulated time of operation (in days) counting from day 1 of operation (read explanation below).\ +**_Ttot_**= total accumulated time of operation (in days) of all pools (read explanation below). + +The first term of Equation 2 allocates saturation limit based on pledge, and ensures that saturation limit increases or decreases exponentially with pledge.\ +\ + It is ideal that **_αunc_** = 0, but if **_αunc_** > 0, the second term of Equation 2 ensures its distribution. The distributed **_αunc_**, however, can still be re-claimed by under-pledged pools by increasing their pledges.\ + \ +Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_** which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) suddenly decreased to a very low number, making **_popt_** very expensive and leading to significant under-pledging. + +\ +**Example 1** +* **_k_** = 3119 (epoch 321) +* **_popt_** = 47,205 ADA (at **_n_** = 15, see calculation in the previous section) +* **_pa_** = 47,205 ADA +* **_αunc_** = 0 (we will deal with nonzero values later) +* **_φ_** = 33B (current ADA in circulation)\ + \ +      **_αunc_** = $\frac{33B}{3119}$ $e^{1 - 47,205/47,205}$ = $\frac{33B}{3119}$ = 10.6M\ +\ +**Conclusion**: Epoch 321 saturation limit for pools with at least 47,205 ADA in pledge is 10.6M (at **_n_** = 15). The ratio $\frac{33B}{3119}$ guarantees that every ADA in circulation has a pool to stake to without risking oversaturation. Note that the current average stake per pool is only 7.6M, suggesting that a vast number of pools are not adequately staked. Setting the saturation limit, on average, to 10.6M would make some large pools to become oversaturated which will encourage delegators of these pools to move their stakes to small pools.\ +  + +**Example 2** (same variable values as in example 1 but lower **_pa_**). +* **_k_** = 3119 (epoch 321) +* **_popt_** = 47,205 ADA +* **_pa_** = 30,000 ADA (for example) +* **_αunc_** = 0 (we will deal with nonzero values later) +* **_φ_** = 33B (current ADA in circulation)\ + \ +      **_α_** = $\frac{33B}{3119}$ $e^{1 - 47,205/30000}$ = 6.0 M\ +\ +**Conclusion**: +Saturation limit decreases exponentially when **_pa_**<**_popt_**, encouraging pools to achieve **_popt_**. In an under-pledged ecosystem, pools can over-pledge to borrow saturation limit from under-pledged pools (see next case).\ +  + +**case 2: _pa_>_popt_ (**the equation is quite complex so please bear with me**)**\ +\ +![equation3](https://drive.google.com/uc?export=view&id=1852sEfSyWtUbJPzyJ5Nbp8P4nafsMLfx)\ +where:\ +![equation4](https://drive.google.com/uc?export=view&id=1JhEh0dmbdUaENq512t_ftz3HyI-EY0x6) + +* **_n_** = (**_pa_**\\**_popt_**) is an integer division (example: 4\3 = 1). +* **$\frac{(x-|x|)}{2}$** returns 0 when x is positive, otherwise it returns the value of x. +* The first term in equation 3 (**blue** text) is the guaranteed saturation limit since the pool exceeded **_popt_**. +* The second term in equation 3 (**red** + **green** text) calculates saturation limit in excess of the guaranteed limit. +* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases when under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, lowers the excess saturation limit (**red** text) of the over-pledged pools. Using this equation, an over-pledged pool "return" the borrowed saturation limit even without further intervention.\ +   + +**Example 1**: **ecosystem is not over-pledged** +* **_pa_** = 110,000 ADA +* **_popt_** = 47,205 ADA (**_n_** = 15) +* **Δ=1** (Please accept this for now. Proof is provided later.) +* current circulation supply (**_φ_**) = 33B ADA +* current total number of pools (**_k_**, epoch 321) = 3119\ +\ +Because the system is not overpledged, Equation 3 is reduced to:\ +\ +![sample1](https://drive.google.com/uc?export=view&id=1cJg4uaHTGhaKv4pZvL5win3sTbOJeYoo)\ +\ +Plugging in the values,\ +\ +![sample2](https://drive.google.com/uc?export=view&id=1HUxMMwBfo8hAcHH8gAQn6rCboPvR3pkW)\ +\ +**Conclusion**: Since **_pa_**/**_popt_** = $\frac{110000}{47205}$ = 2.33, the pool is guaranteed a saturation limit that is twice of $\frac{33B}{3119}$. The other additional limit $\frac{33B}{3119}$ $e^{-2.028}$ comes from the 0.33 fractional excess and is penalized exponentially.\ +  + +**Example 2**: **ecosystem is over-pledged**.\ +Here, we will provide the derivation for the penalty factor (**Δ**) and we will prove that it leads to a close system, _i.e._, the total saturation limit is always equal to the circulation supply no matter how under-pledged or over-pledged the ecosystem is. The penalty factor (**Δ**) has the following characteristics: +* **Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. Under this condition, the excess saturation limit of over-pledged pools are unaffected. In essence, they are not yet "returning" any of the borrowed excess. +* **Δ** ⟶ 0, when the ecosystem is over-pledged, and **_pa_** of the under-pledged pools approaches **_popt_**. Under this condition, the excess saturation limit of over-pledged pools also approaches zero. In essence, they are "returning" the borrowed excess.\ +\ +We first calculate the total saturation limit (**_αtotal_**) excluding: + - saturation limit from over-pledges. + - distributed unclaimed saturation limit (**_αunc_**, see second term in Equation 1). + +\ +![Equation5](https://drive.google.com/uc?export=view&id=19VQyenWAntcKh8VavMpJxscc4scqT6_O)\ +\ +where **_pai_** is the actual pledge of pool _i_. Since total saturation limit (**_αtotal_**) can never exceed circulating supply (**_φ_**), the unclaimed saturation limit (**_αunc_**) is then calculated as follows:\ +\ +![Equation6](https://drive.google.com/uc?export=view&id=1JcYX5u499lXnhN9Ha7WSeN49d1WcSbtz)\ +\ +It is important to note that for the calculation of **_αtotal_**, we must only use **_pa_**≤**_popt_** for all pools even for over-pledging pools. Realistically, some pools will be over-pledged and their total excess saturation limit (**_αovp_**) may be added as follows:\ +\ +![Equation7](https://drive.google.com/uc?export=view&id=1Yj-_PGbl1WcWttDMX1acEex0e7ZFHWDM)\ +\ +Solving for **_αovp_** we have,\ +\ +![Equation8](https://drive.google.com/uc?export=view&id=1NnoNPLEhp8cihYNvscXdXKP8lPikuADQ)\ +\ +Another way of expressing the total excess saturation limit (**_αovp_**) is by using Equation 3 and is given as follows:\ +\ +![Equation9](https://drive.google.com/uc?export=view&id=15FezfQXXCskq6rblQdauD1jJOEtCFSpH)\ +\ +where _j_ is any over-pledging pool. Plugging in Equation 9 into Equation 8, we have:\ +\ +![Equation10](https://drive.google.com/uc?export=view&id=15iwumKXAAhPy6t98uHZpiJk0CsltAWkd)\ +\ +Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simplifying, we have:\ +\ +![Equation10](https://drive.google.com/uc?export=view&id=1lQYewlKuCotMs0QQ8I3xJcc4rfddyHk3)\ +\ +It is very important to note that at **_αunc ≤ 0_**, its value must be zero, otherwise a close system cannot be guaranteed.\ +\ +Now, we will prove that Equation 11 guarantees a close system, _i.e._, + +**Δ** = 1, when the ecosystem is either under-pledged or at equilibrium.\ +**Δ** ⟶ 0, when the ecosystem is over-pledged, and **_pa_** of the under-pledged pools approaches **_popt_**.\ +\ +**Case 1**: Ecosystem is under-pledged and over-pledging pools keep over-pledging to borrow additional saturation limit: the denominator is going to increase (red arrow) while the numerator is going to increase by the same magnitude through a decrease (blue arrow) in the unclaimed saturation limit (**_αunc_**) :\ + \ + ![logic1](https://drive.google.com/uc?export=view&id=1-vvc_xUd8KSY5zmkR9xXP8ebZ_re3y6h)\ + \ + **Case 2**: Ecosystem is under-pledged and under-pledging pools keep pledging to claim the remaining saturation limit: the second term in the numerator is going to increase (red arrow) while the third term is going to decrease by the same magnitude (blue arrow):\ + \ +![logic2](https://drive.google.com/uc?export=view&id=1XK1F2zG1zyaLPn2sz8rrISKPFEI0_r8B)\ +\ +**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess.\ +\ +![logic2](https://drive.google.com/uc?export=view&id=182u2H0u72eDxSX04vjulPkeXWzjEdZmW)\ +\ +**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of the under-pledged pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, any pledge from an over-pledged pool should rejected.\ +\ +![logic2](https://drive.google.com/uc?export=view&id=1j45ZEEhqwDDJoXcVxs4p1NqixegXGbmM)\ +  +## **_Sybil Attack_** +\ +**Simplifying scenario: ecosystem average pledge = optimal pledge and 33B ADA staked.** + +**scenario 1** (small number of pools):\ +**_n_** = 15 and **_k_** = 500,\ +**_popt_** = ~ 774,763 ADA + +A Sybil attack requires 501 nodes, number of pools (**_k_**) totals 1001 (500 + 501), and optimal pledge (**_popt_**) decreases to 148, 011 ADA. Therefore, an attack requires 501 pools that need to be fully saturated (16.5M in stake) and a total of ~74M ADA (501*148,011) in pledge. + +**scenario 2** (large number of pools):\ +**_n_** = 15 and **_k_** = 3119 (epoch 321),\ +**_popt_** = 47,205 ADA + +A Sybil attack requires 3120 nodes, number of pools (**_k_**) totals 6239 (3119 + 3120), and optimal pledge (**_popt_**) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge.\ +\ +  + +# **Rational** +The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools and discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization. + +To mitigate the problem outlined above, we recognized that saturation limit needs to get decreased to some minimum that allow fair distribution of stake but avoids the potential risk of oversaturation. We may do this by allocating saturation limit based on pledge. This idea was first explored by Casey Gibson in his CIP which you may find here. We found that there may be potential weaknesses to his ideas, but the same weaknesses are addressed in our proposal. These weaknesses are: +* **The Gibson proposal appears to be less effective at solving stake centralization.**\ +To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA. Therefore, each pool requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M, but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it.\ +\ +The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows\ +\ +**_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$\ +**_α_** = $\frac{33B}{3119-60+pools}$\ +**_pools_** = 2.8B/(**_α_**+**_popt_**)\ +\ +We have three equations and three unknowns which resolves to **_pools_** = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge)\ +  +* **The Gibson proposal may disenfranchise a significant portion of ADA in circulation from getting staked at low pool number.**\ +Because the Gibson proposal does not gurantee that the total saturation limit of all pools is equal to the amount of ADA in circulation, there exists a significant risk of disenfranchising some portion of ADA in circulation from getting staked. For example, if the number of pools abruptly dropped to 500, all pools need to pledge at maximum (500,000 ADA to get 65M saturation limit) so that the ecosystem can achieve a total saturation limit that is approximately equal to the total ADA in circulation. However, all pools pledging at maximum is a very unlikely scenario, leaving some ADA disenfranchised. Risk of disenfranchisemnt exists even at the current number of pools. In contrast, the total saturation limit under our proposal is always equal to ADA in circulation regardless of the pledge status in the ecosystem. +  + +* **The Gibson proposal may require frequent network consensus to tweak parameters.**\ +Since the Gibson proposal rely on parameters that can only be changed when there is network consensus, such design is less robust against abrupt changes in the ecosystem, _e.g._, when there is a need for the number of validators to scale up with demand or when the number of pools declines abruptly due to extreme events. Our proposal scales up and down without further intervention because the protocol is governed by equations. \ +\ +  +# **Copyright** + This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) + \ No newline at end of file From 7aefda36fe41200c4c30b269576470fca994e1af Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Sat, 5 Mar 2022 15:01:25 -0500 Subject: [PATCH 02/28] Update and rename Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md to CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md Hi @rphair, I revised the proposal in accordance with your suggestions. It took a while since I needed to get used to the GitHub workflow, but I think I may be getting better at it now. Please let me know if there is anything else that needs to be done, and thank you for your help! Updates: 1. File was moved to a subdirectory prefixed with "CIP". 2. File was renamed to README.md. 3. The header was wrapped with --- and should now appear in a table. 4. The header now includes Comments-URI. 5. File now contains standard Markdown syntax (line breaks are introduced using
instead of \ and  ). 6. Typos were fixed and some necessary edits were made to further improve the proposal. --- .../README.md | 313 +++++++++--------- 1 file changed, 154 insertions(+), 159 deletions(-) rename Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md => CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md (77%) diff --git a/Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md similarity index 77% rename from Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md rename to CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 3c093c24b0..bc4085d564 100644 --- a/Decentralization - Using Pledge as a Bidding Parameter to Determine Saturation Limit.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -1,39 +1,40 @@ -CIP: TBD\ -Title: Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit\ -Author: Jay Pseudonym Cappucino \\ -Status: Draft\ -Type: Process\ -Created: 2022-02-28\ -\ -  +--- +CIP: TBD +Title: Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit +Author: Jay Pseudonym Cappucino +Comments-URI: https://forum.cardano.org/t/cip-stake-decentralization-using-pledge-as-a-bidding-parameter-to-determine-saturation-limit/95936 +Status: Draft +Type: Process +Created: 2022-02-28 +--- # **Abstract** -With the current saturation limit set at 68 M per pool and with 3119 pools, the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack.\ -\ -  +With the current saturation limit set at 68 M per pool and with 3119 pools, the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. + + # **Motivation** -This proposal attempts to solve the ongoing stake centralization while preserving (if not enhancing) the security guranteed by the current consensus mechanism. It solves the problem by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations and, therefore, allows the staking mechanism to operate without the need for frequent network consensus. Because of this mechanism, the would-be protocol not only enhances stake decentralization, it also ensures robustness of the ecosystem against any abrupt changes in the staking parameters without intervention from the community.\ -\ -  +This proposal attempts to solve the ongoing stake centralization while preserving (if not enhancing) the security guranteed by the current consensus mechanism. It solves the problem by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations and, therefore, allows the staking mechanism to operate without the need for frequent network consensus. Because of this mechanism, the would-be protocol not only enhances stake decentralization, it also ensures robustness of the ecosystem against any abrupt changes in the staking parameters without intervention from the community. + + # **Specification** ## **Nonmathematical Description** -      There is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. +There is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. * Individual pool saturation limit decreases exponentially when **pool pledge < optimal pledge**. * Individual pool saturation limit increases **only incrementally** when **pool pledge > optimal pledge**. -* The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit from the under-pledged pools. If there is still remaining saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed limit can still be re-claimed by under-pledged pools by continuing to pledge up to optimal pledge. +* The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit from the under-pledged pools. If there is still remaining saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed limit can still be claimed by any pool by continuing to pledge. * The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit allocated for them. The over-pledge pools’ excess saturation limit, likewise, will continue to decrease until all excess had been returned. This and the proposition from the previous bullet point ensures that: - a **close system** is maintained, _i.e._, the total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. * Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: - optimal pledge is expensive for MPOs. - - expense to conduct Sybil attack increases as the total number of pools increases.\ -  + - expense to conduct Sybil attack increases as the total number of pools increases. + ## **Mathematical Description** ### _**Calculating Optimal Pledge**_ -  + ![equation1](https://drive.google.com/uc?export=view&id=1O_gmZ9LwpVV3xs2RVNqaXLh3um3zfFKs) -where **_popt_** is the optimal pledge, **φ** is the amount of ADA in circulation (currently 33B), **_k_** is the total number of pools, and **_n_** is a variable that is determined to warrant an economically viable optimal pledge (**_popt_**). Therefore, it appears that **_n_** is a variable that the community can vote for adjustment to increase or decrease **_popt_**. In effect, it can be used to control the total number of pools (**_k_**) so that at some value **_n_**, the ecosystem gradually settles to some value **_k_** which the community thinks is the optimal value.\ -\ +where **_popt_** is the optimal pledge, **φ** is the amount of ADA in circulation (currently 33B), **_k_** is the total number of pools, and **_n_** is a variable that is determined via consensus to warrant an economically viable optimal pledge (**_popt_**). Therefore, it appears that **_n_** is a variable that the community can vote for adjustment to increase or decrease **_popt_**. In effect, it can be used to control the total number of pools (**_k_**) so that at some value **_n_**, the ecosystem gradually settles to some value **_k_** which the community thinks is the optimal value. + If we set **_n_** =15, **scenario 1** (very small number of pools): @@ -46,188 +47,182 @@ If we set **_n_** =15, **scenario 3** (very large number of pools): * **_k_** = infinity -* **_popt_** = 27,440 ADA per pool\ -  +* **_popt_** = 27,440 ADA per pool + -**Conclusion**: **_popt_** becomes cheaper as the total number of pools (**_k_**) increases, but more expensive when the total number of pools decreases.\ -  +**Conclusion**: **_popt_** becomes cheaper as the total number of pools (**_k_**) increases, but more expensive when the total number of pools decreases.
+
### **_Calculating Saturation Limit (α)_** - -**case 1: _pa ≤ popt_**\ +**case 1: _pa ≤ popt_** ![equation2](https://drive.google.com/uc?export=view&id=1vwM9i8voMM6AnNtlxIzuwu8mQj1ntgi5) -\ -\ -where:\ -**_pa_** = actual pool pledge\ -**_popt_** = optimal pledge\ -**_αunc_** = saturation limit left unclaimed even after some pools have over-pledged. This variable is defined in Equation 7.\ -**_Ta_** = pool accumulated time of operation (in days) counting from day 1 of operation (read explanation below).\ -**_Ttot_**= total accumulated time of operation (in days) of all pools (read explanation below). - -The first term of Equation 2 allocates saturation limit based on pledge, and ensures that saturation limit increases or decreases exponentially with pledge.\ -\ - It is ideal that **_αunc_** = 0, but if **_αunc_** > 0, the second term of Equation 2 ensures its distribution. The distributed **_αunc_**, however, can still be re-claimed by under-pledged pools by increasing their pledges.\ - \ -Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_** which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) suddenly decreased to a very low number, making **_popt_** very expensive and leading to significant under-pledging. - -\ + +where: +**_pa_** = actual pool pledge +**_popt_** = optimal pledge +**_αunc_** = saturation limit left unclaimed even after some pools have over-pledged. This variable is defined in Equation 7. +**_Ta_** = pool accumulated time of operation (in days) counting from day 1 of operation (read explanation below). +**_Ttot_**= total accumulated time of operation (in days) of all nonover-pledging pools only (read explanation below). + +The first term of Equation 2 allocates saturation limit based on pledge, and ensures that saturation limit increases or decreases exponentially with pledge. + + It is ideal that **_αunc_** = 0, but if **_αunc_** > 0, the second term of Equation 2 ensures its distribution. The distributed **_αunc_**, however, can still be claimed by any pool by increasing its pledge. + +Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_** which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) suddenly decreased to a very low number, making **_popt_** very expensive and leading to significant under-pledging. Under this condition, pools that are under-pledged but had been in operation for a significant amount of time will be rewarded with a significant portion of **_αunc_**. + **Example 1** * **_k_** = 3119 (epoch 321) * **_popt_** = 47,205 ADA (at **_n_** = 15, see calculation in the previous section) * **_pa_** = 47,205 ADA * **_αunc_** = 0 (we will deal with nonzero values later) -* **_φ_** = 33B (current ADA in circulation)\ - \ -      **_αunc_** = $\frac{33B}{3119}$ $e^{1 - 47,205/47,205}$ = $\frac{33B}{3119}$ = 10.6M\ -\ -**Conclusion**: Epoch 321 saturation limit for pools with at least 47,205 ADA in pledge is 10.6M (at **_n_** = 15). The ratio $\frac{33B}{3119}$ guarantees that every ADA in circulation has a pool to stake to without risking oversaturation. Note that the current average stake per pool is only 7.6M, suggesting that a vast number of pools are not adequately staked. Setting the saturation limit, on average, to 10.6M would make some large pools to become oversaturated which will encourage delegators of these pools to move their stakes to small pools.\ -  +* **_φ_** = 33B (current ADA in circulation) + +**_α_** = $\frac{33B}{3119}$ $e^{1 - 47,205/47,205}$ = $\frac{33B}{3119}$ = 10.6M + +**Conclusion**: Epoch 321 saturation limit for pools with at least 47,205 ADA in pledge is 10.6M (at **_n_** = 15). The ratio $\frac{33B}{3119}$ guarantees that every ADA in circulation has a pool to stake to without risking oversaturation. Note that the current average stake per pool is only 7.6M, suggesting that a vast number of pools are not adequately staked. Setting the saturation limit, on average, to 10.6M would make some large pools to become oversaturated which will encourage delegators of these pools to move their stakes to small pools. **Example 2** (same variable values as in example 1 but lower **_pa_**). * **_k_** = 3119 (epoch 321) * **_popt_** = 47,205 ADA * **_pa_** = 30,000 ADA (for example) * **_αunc_** = 0 (we will deal with nonzero values later) -* **_φ_** = 33B (current ADA in circulation)\ - \ -      **_α_** = $\frac{33B}{3119}$ $e^{1 - 47,205/30000}$ = 6.0 M\ -\ +* **_φ_** = 33B (current ADA in circulation) + +**_α_** = $\frac{33B}{3119}$ $e^{1 - 47,205/30000}$ = 6.0 M + **Conclusion**: -Saturation limit decreases exponentially when **_pa_**<**_popt_**, encouraging pools to achieve **_popt_**. In an under-pledged ecosystem, pools can over-pledge to borrow saturation limit from under-pledged pools (see next case).\ -  - -**case 2: _pa_>_popt_ (**the equation is quite complex so please bear with me**)**\ -\ -![equation3](https://drive.google.com/uc?export=view&id=1852sEfSyWtUbJPzyJ5Nbp8P4nafsMLfx)\ -where:\ -![equation4](https://drive.google.com/uc?export=view&id=1JhEh0dmbdUaENq512t_ftz3HyI-EY0x6) +Saturation limit decreases exponentially when **_pa_**<**_popt_**, encouraging pools to achieve **_popt_**. In an under-pledged ecosystem, pools can over-pledge to borrow saturation limit from under-pledged pools (see next case).
+
+ +**case 2: _pa_>_popt_ (**the equation is quite complex so please bear with me**)**. +![equation3](https://drive.google.com/uc?export=view&id=1852sEfSyWtUbJPzyJ5Nbp8P4nafsMLfx) +where: +![equation4](https://drive.google.com/uc?export=view&id=1JhEh0dmbdUaENq512t_ftz3HyI-EY0x6) + * **_n_** = (**_pa_**\\**_popt_**) is an integer division (example: 4\3 = 1). * **$\frac{(x-|x|)}{2}$** returns 0 when x is positive, otherwise it returns the value of x. * The first term in equation 3 (**blue** text) is the guaranteed saturation limit since the pool exceeded **_popt_**. * The second term in equation 3 (**red** + **green** text) calculates saturation limit in excess of the guaranteed limit. -* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases when under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, lowers the excess saturation limit (**red** text) of the over-pledged pools. Using this equation, an over-pledged pool "return" the borrowed saturation limit even without further intervention.\ -   +* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases when under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, leads to a decrease in the excess saturation limit (**red** text) of the over-pledged pools. Using this equation, an over-pledged pool "return" the borrowed saturation limit even without further intervention. + -**Example 1**: **ecosystem is not over-pledged** +**Example 1**: **ecosystem is not over-pledged**. * **_pa_** = 110,000 ADA * **_popt_** = 47,205 ADA (**_n_** = 15) * **Δ=1** (Please accept this for now. Proof is provided later.) * current circulation supply (**_φ_**) = 33B ADA -* current total number of pools (**_k_**, epoch 321) = 3119\ -\ -Because the system is not overpledged, Equation 3 is reduced to:\ -\ -![sample1](https://drive.google.com/uc?export=view&id=1cJg4uaHTGhaKv4pZvL5win3sTbOJeYoo)\ -\ -Plugging in the values,\ -\ -![sample2](https://drive.google.com/uc?export=view&id=1HUxMMwBfo8hAcHH8gAQn6rCboPvR3pkW)\ -\ -**Conclusion**: Since **_pa_**/**_popt_** = $\frac{110000}{47205}$ = 2.33, the pool is guaranteed a saturation limit that is twice of $\frac{33B}{3119}$. The other additional limit $\frac{33B}{3119}$ $e^{-2.028}$ comes from the 0.33 fractional excess and is penalized exponentially.\ -  - -**Example 2**: **ecosystem is over-pledged**.\ +* current total number of pools (**_k_**, epoch 321) = 3119 + +Because the system is not overpledged, Equation 3 is reduced to: + +![sample1](https://drive.google.com/uc?export=view&id=1cJg4uaHTGhaKv4pZvL5win3sTbOJeYoo) + +Plugging in the values, + +![sample2](https://drive.google.com/uc?export=view&id=1HUxMMwBfo8hAcHH8gAQn6rCboPvR3pkW) + +**Conclusion**: Since **_pa_**/**_popt_** = $\frac{110000}{47205}$ = 2.33, the pool is guaranteed a saturation limit that is twice of $\frac{33B}{3119}$. The other additional limit $\frac{33B}{3119}$ $e^{-2.028}$ comes from the 0.33 fractional excess and is penalized exponentially.
+
+ +**Example 2**: **ecosystem is over-pledged**. Here, we will provide the derivation for the penalty factor (**Δ**) and we will prove that it leads to a close system, _i.e._, the total saturation limit is always equal to the circulation supply no matter how under-pledged or over-pledged the ecosystem is. The penalty factor (**Δ**) has the following characteristics: * **Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. Under this condition, the excess saturation limit of over-pledged pools are unaffected. In essence, they are not yet "returning" any of the borrowed excess. -* **Δ** ⟶ 0, when the ecosystem is over-pledged, and **_pa_** of the under-pledged pools approaches **_popt_**. Under this condition, the excess saturation limit of over-pledged pools also approaches zero. In essence, they are "returning" the borrowed excess.\ -\ +* **Δ** ⟶ 0, when the ecosystem is over-pledged, and **_pa_** of the under-pledged pools approaches **_popt_**. Under this condition, the excess saturation limit of over-pledged pools also approaches zero. In essence, they are "returning" the borrowed excess. + We first calculate the total saturation limit (**_αtotal_**) excluding: - saturation limit from over-pledges. - distributed unclaimed saturation limit (**_αunc_**, see second term in Equation 1). -\ -![Equation5](https://drive.google.com/uc?export=view&id=19VQyenWAntcKh8VavMpJxscc4scqT6_O)\ -\ -where **_pai_** is the actual pledge of pool _i_. Since total saturation limit (**_αtotal_**) can never exceed circulating supply (**_φ_**), the unclaimed saturation limit (**_αunc_**) is then calculated as follows:\ -\ -![Equation6](https://drive.google.com/uc?export=view&id=1JcYX5u499lXnhN9Ha7WSeN49d1WcSbtz)\ -\ -It is important to note that for the calculation of **_αtotal_**, we must only use **_pa_**≤**_popt_** for all pools even for over-pledging pools. Realistically, some pools will be over-pledged and their total excess saturation limit (**_αovp_**) may be added as follows:\ -\ -![Equation7](https://drive.google.com/uc?export=view&id=1Yj-_PGbl1WcWttDMX1acEex0e7ZFHWDM)\ -\ -Solving for **_αovp_** we have,\ -\ -![Equation8](https://drive.google.com/uc?export=view&id=1NnoNPLEhp8cihYNvscXdXKP8lPikuADQ)\ -\ -Another way of expressing the total excess saturation limit (**_αovp_**) is by using Equation 3 and is given as follows:\ -\ -![Equation9](https://drive.google.com/uc?export=view&id=15FezfQXXCskq6rblQdauD1jJOEtCFSpH)\ -\ -where _j_ is any over-pledging pool. Plugging in Equation 9 into Equation 8, we have:\ -\ -![Equation10](https://drive.google.com/uc?export=view&id=15iwumKXAAhPy6t98uHZpiJk0CsltAWkd)\ -\ -Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simplifying, we have:\ -\ -![Equation10](https://drive.google.com/uc?export=view&id=1lQYewlKuCotMs0QQ8I3xJcc4rfddyHk3)\ -\ -It is very important to note that at **_αunc ≤ 0_**, its value must be zero, otherwise a close system cannot be guaranteed.\ -\ -Now, we will prove that Equation 11 guarantees a close system, _i.e._, - -**Δ** = 1, when the ecosystem is either under-pledged or at equilibrium.\ -**Δ** ⟶ 0, when the ecosystem is over-pledged, and **_pa_** of the under-pledged pools approaches **_popt_**.\ -\ -**Case 1**: Ecosystem is under-pledged and over-pledging pools keep over-pledging to borrow additional saturation limit: the denominator is going to increase (red arrow) while the numerator is going to increase by the same magnitude through a decrease (blue arrow) in the unclaimed saturation limit (**_αunc_**) :\ - \ - ![logic1](https://drive.google.com/uc?export=view&id=1-vvc_xUd8KSY5zmkR9xXP8ebZ_re3y6h)\ - \ - **Case 2**: Ecosystem is under-pledged and under-pledging pools keep pledging to claim the remaining saturation limit: the second term in the numerator is going to increase (red arrow) while the third term is going to decrease by the same magnitude (blue arrow):\ - \ -![logic2](https://drive.google.com/uc?export=view&id=1XK1F2zG1zyaLPn2sz8rrISKPFEI0_r8B)\ -\ -**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess.\ -\ -![logic2](https://drive.google.com/uc?export=view&id=182u2H0u72eDxSX04vjulPkeXWzjEdZmW)\ -\ -**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of the under-pledged pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, any pledge from an over-pledged pool should rejected.\ -\ -![logic2](https://drive.google.com/uc?export=view&id=1j45ZEEhqwDDJoXcVxs4p1NqixegXGbmM)\ -  +![Equation5](https://drive.google.com/uc?export=view&id=19VQyenWAntcKh8VavMpJxscc4scqT6_O) + +where **_pai_** is the actual pledge of pool _i_. Since total saturation limit (**_αtotal_**) can never exceed circulating supply (**_φ_**), the unclaimed saturation limit (**_αunc_**) is then calculated as follows: + +![Equation6](https://drive.google.com/uc?export=view&id=1JcYX5u499lXnhN9Ha7WSeN49d1WcSbtz) + +It is important to note that for the calculation of **_αtotal_**, we must only use **_pa_**≤**_popt_** for all pools even for over-pledging pools. Realistically, some pools will be over-pledged and their total excess saturation limit (**_αovp_**) may be added as follows: + +![Equation7](https://drive.google.com/uc?export=view&id=1Yj-_PGbl1WcWttDMX1acEex0e7ZFHWDM) + +Solving for **_αovp_** we have, + +![Equation8](https://drive.google.com/uc?export=view&id=1NnoNPLEhp8cihYNvscXdXKP8lPikuADQ) + +Another way of expressing the total excess saturation limit (**_αovp_**) is by using Equation 3 and is given as follows: + +![Equation9](https://drive.google.com/uc?export=view&id=15FezfQXXCskq6rblQdauD1jJOEtCFSpH) + +where _j_ is any over-pledging pool. Plugging in Equation 9 into Equation 8, we have: + +![Equation10](https://drive.google.com/uc?export=view&id=15iwumKXAAhPy6t98uHZpiJk0CsltAWkd) + +Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simplifying, we have: + +![Equation10](https://drive.google.com/uc?export=view&id=1lQYewlKuCotMs0QQ8I3xJcc4rfddyHk3) + +It is very important to note that at **_αunc ≤ 0_**, its value must be zero, otherwise a close system cannot be guaranteed. + +**Now, we will prove that Equation 11 guarantees a close system, _i.e._,** + +**Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. +**Δ** ⟶ 0, when the ecosystem is over-pledged, and **_pa_** of the under-pledged pools approaches **_popt_**.
+
+ +**Case 1**: Ecosystem is under-pledged and over-pledging pools keep over-pledging to borrow additional saturation limit: the denominator is going to increase (red arrow) while the numerator is going to increase by the same magnitude through a decrease (blue arrow) in the unclaimed saturation limit (**_αunc_**) : + + ![logic1](https://drive.google.com/uc?export=view&id=1-vvc_xUd8KSY5zmkR9xXP8ebZ_re3y6h)
+
+ + **Case 2**: Ecosystem is under-pledged and under-pledging pools keep pledging to claim the remaining saturation limit: the second term in the numerator is going to increase (red arrow) while the third term is going to decrease by the same magnitude (blue arrow): + +![logic2](https://drive.google.com/uc?export=view&id=1XK1F2zG1zyaLPn2sz8rrISKPFEI0_r8B)
+
+ +**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. + +![logic2](https://drive.google.com/uc?export=view&id=182u2H0u72eDxSX04vjulPkeXWzjEdZmW)
+
+**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of all under-pledged pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, any continuing pledge from an over-pledged pool should rejected. + +![logic2](https://drive.google.com/uc?export=view&id=1j45ZEEhqwDDJoXcVxs4p1NqixegXGbmM) + ## **_Sybil Attack_** -\ + **Simplifying scenario: ecosystem average pledge = optimal pledge and 33B ADA staked.** -**scenario 1** (small number of pools):\ -**_n_** = 15 and **_k_** = 500,\ +**scenario 1** (small number of pools): +**_n_** = 15 and **_k_** = 500, **_popt_** = ~ 774,763 ADA A Sybil attack requires 501 nodes, number of pools (**_k_**) totals 1001 (500 + 501), and optimal pledge (**_popt_**) decreases to 148, 011 ADA. Therefore, an attack requires 501 pools that need to be fully saturated (16.5M in stake) and a total of ~74M ADA (501*148,011) in pledge. -**scenario 2** (large number of pools):\ -**_n_** = 15 and **_k_** = 3119 (epoch 321),\ +**scenario 2** (large number of pools): +**_n_** = 15 and **_k_** = 3119 (epoch 321), **_popt_** = 47,205 ADA -A Sybil attack requires 3120 nodes, number of pools (**_k_**) totals 6239 (3119 + 3120), and optimal pledge (**_popt_**) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge.\ -\ -  +A Sybil attack requires 3120 nodes, number of pools (**_k_**) totals 6239 (3119 + 3120), and optimal pledge (**_popt_**) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge. -# **Rational** +# **Rationale** The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools and discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization. To mitigate the problem outlined above, we recognized that saturation limit needs to get decreased to some minimum that allow fair distribution of stake but avoids the potential risk of oversaturation. We may do this by allocating saturation limit based on pledge. This idea was first explored by Casey Gibson in his CIP which you may find here. We found that there may be potential weaknesses to his ideas, but the same weaknesses are addressed in our proposal. These weaknesses are: -* **The Gibson proposal appears to be less effective at solving stake centralization.**\ -To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA. Therefore, each pool requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M, but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it.\ -\ -The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows\ -\ -**_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$\ -**_α_** = $\frac{33B}{3119-60+pools}$\ -**_pools_** = 2.8B/(**_α_**+**_popt_**)\ -\ -We have three equations and three unknowns which resolves to **_pools_** = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge)\ -  -* **The Gibson proposal may disenfranchise a significant portion of ADA in circulation from getting staked at low pool number.**\ -Because the Gibson proposal does not gurantee that the total saturation limit of all pools is equal to the amount of ADA in circulation, there exists a significant risk of disenfranchising some portion of ADA in circulation from getting staked. For example, if the number of pools abruptly dropped to 500, all pools need to pledge at maximum (500,000 ADA to get 65M saturation limit) so that the ecosystem can achieve a total saturation limit that is approximately equal to the total ADA in circulation. However, all pools pledging at maximum is a very unlikely scenario, leaving some ADA disenfranchised. Risk of disenfranchisemnt exists even at the current number of pools. In contrast, the total saturation limit under our proposal is always equal to ADA in circulation regardless of the pledge status in the ecosystem. -  - -* **The Gibson proposal may require frequent network consensus to tweak parameters.**\ -Since the Gibson proposal rely on parameters that can only be changed when there is network consensus, such design is less robust against abrupt changes in the ecosystem, _e.g._, when there is a need for the number of validators to scale up with demand or when the number of pools declines abruptly due to extreme events. Our proposal scales up and down without further intervention because the protocol is governed by equations. \ -\ -  +* **The Gibson proposal appears to be less effective at solving stake centralization.** +To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA. Therefore, each pool requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M, but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it. + +The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows + +**_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$ +**_α_** = $\frac{33B}{3119-60+pools}$ +**_pools_** = 2.8B/(**_α_**+**_popt_**) + +We have three equations and three unknowns which resolves to **_pools_** = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge) + +* **The Gibson proposal may disenfranchise a significant portion of ADA in circulation from getting staked at low pool number.** +Because the Gibson proposal does not gurantee that the total saturation limit of all pools is equal to the amount of ADA in circulation, there exists a significant risk of disenfranchising some portion of ADA in circulation from getting staked. For example, if the number of pools abruptly dropped to 500, all pools need to pledge at maximum (500,000 ADA to get 65M saturation limit) so that the ecosystem can achieve a total saturation limit that is approximately equal to the total ADA in circulation. However, all pools pledging at maximum is a very unlikely scenario, leaving some ADA disenfranchised. Risk of disenfranchisement exists even at the current number of pools. In contrast, the total saturation limit under our proposal is always equal to ADA in circulation regardless of the pledge status in the ecosystem. + + +* **The Gibson proposal may be less effective in dealing with abrupt changes in the staking parameters.** +Since the Gibson proposal rely on parameters that can only be changed when there is network consensus, such design is less robust against abrupt changes in the ecosystem, _e.g._, when there is a need for the number of validators to scale up with demand or when the number of pools declines abruptly due to extreme events. Our proposal scales up and down without further intervention because the protocol is governed by equations. # **Copyright** This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) - \ No newline at end of file + From 2071f0a44ec01859b113fd45bcd10c38f85f6183 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Tue, 29 Mar 2022 18:09:58 -0400 Subject: [PATCH 03/28] Update README.md Added a discussion on k-effective in the rationale section. --- .../README.md | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index bc4085d564..bafafbf1d1 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -140,7 +140,7 @@ where **_pai_** is the actual pledge of pool _i_. Since total saturat ![Equation6](https://drive.google.com/uc?export=view&id=1JcYX5u499lXnhN9Ha7WSeN49d1WcSbtz) -It is important to note that for the calculation of **_αtotal_**, we must only use **_pa_**≤**_popt_** for all pools even for over-pledging pools. Realistically, some pools will be over-pledged and their total excess saturation limit (**_αovp_**) may be added as follows: +Realistically, some pools will be over-pledged and their total excess saturation limit (**_αovp_**) may be added as follows: ![Equation7](https://drive.google.com/uc?export=view&id=1Yj-_PGbl1WcWttDMX1acEex0e7ZFHWDM) @@ -159,13 +159,12 @@ where _j_ is any over-pledging pool. Plugging in Equation 9 into Equation 8, we Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simplifying, we have: ![Equation10](https://drive.google.com/uc?export=view&id=1lQYewlKuCotMs0QQ8I3xJcc4rfddyHk3) - -It is very important to note that at **_αunc ≤ 0_**, its value must be zero, otherwise a close system cannot be guaranteed. + **Now, we will prove that Equation 11 guarantees a close system, _i.e._,** **Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. -**Δ** ⟶ 0, when the ecosystem is over-pledged, and **_pa_** of the under-pledged pools approaches **_popt_**.
+**Δ** ⟶ 0, when the ecosystem is over-pledged, and under-pledged pools continue to pledge.

**Case 1**: Ecosystem is under-pledged and over-pledging pools keep over-pledging to borrow additional saturation limit: the denominator is going to increase (red arrow) while the numerator is going to increase by the same magnitude through a decrease (blue arrow) in the unclaimed saturation limit (**_αunc_**) : @@ -178,11 +177,11 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp ![logic2](https://drive.google.com/uc?export=view&id=1XK1F2zG1zyaLPn2sz8rrISKPFEI0_r8B)

-**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. +**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the numerator and, therefore a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. ![logic2](https://drive.google.com/uc?export=view&id=182u2H0u72eDxSX04vjulPkeXWzjEdZmW)

-**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of all under-pledged pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, any continuing pledge from an over-pledged pool should rejected. +**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of all under-pledged pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, any continuing pledge from an over-pledged pool should be rejected. ![logic2](https://drive.google.com/uc?export=view&id=1j45ZEEhqwDDJoXcVxs4p1NqixegXGbmM) @@ -194,13 +193,13 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp **_n_** = 15 and **_k_** = 500, **_popt_** = ~ 774,763 ADA -A Sybil attack requires 501 nodes, number of pools (**_k_**) totals 1001 (500 + 501), and optimal pledge (**_popt_**) decreases to 148, 011 ADA. Therefore, an attack requires 501 pools that need to be fully saturated (16.5M in stake) and a total of ~74M ADA (501*148,011) in pledge. +A Sybil attack requires 501 nodes which makes the number of pools (**_k_**) totals to 1001 (500 + 501) and optimal pledge (**_popt_**) decreases to 148, 011 ADA. Therefore, an attack requires 501 pools that need to be fully saturated (16.5M in stake) and a total of ~74M ADA (501*148,011) in pledge. **scenario 2** (large number of pools): **_n_** = 15 and **_k_** = 3119 (epoch 321), **_popt_** = 47,205 ADA -A Sybil attack requires 3120 nodes, number of pools (**_k_**) totals 6239 (3119 + 3120), and optimal pledge (**_popt_**) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge. +A Sybil attack requires 3120 nodes which makes the number of pools (**_k_**) totals to 6239 (3119 + 3120) and optimal pledge (**_popt_**) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge. # **Rationale** The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools and discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization. @@ -223,6 +222,16 @@ Because the Gibson proposal does not gurantee that the total saturation limit of * **The Gibson proposal may be less effective in dealing with abrupt changes in the staking parameters.** Since the Gibson proposal rely on parameters that can only be changed when there is network consensus, such design is less robust against abrupt changes in the ecosystem, _e.g._, when there is a need for the number of validators to scale up with demand or when the number of pools declines abruptly due to extreme events. Our proposal scales up and down without further intervention because the protocol is governed by equations. + +* **The CIP effectively decreases the _k-effective_ parameter.** +The **_k-effective_** is a parameter that attempts to measure decentralization, and is defined by the equation shown as follows: +
+
+![k-effective](https://drive.google.com/uc?export=view&id=1A_foc_uYzkbSG3lJlcQt5F2IMh5T-e1z) +
+
+The parameter **_k-effective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases due to the fact that the saturation limit (**_α_**) defined in this proposal is inversely propotional to the number of pools **_k_**. As the number of pools increases, saturation limit decreases. This decrease, in turn, should decrease the ratio of group stake to total stake in Equation 12 which then leads to the increase of **_k-effective_**. +
# **Copyright** This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) From dbef48ccb02f3a9ae5f3af759d278cad5c0a75e6 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Tue, 29 Mar 2022 18:27:04 -0400 Subject: [PATCH 04/28] Update README.md Proofread and fixed some sentences. --- .../README.md | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index bafafbf1d1..1ec29be4e5 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -128,7 +128,7 @@ Plugging in the values, **Example 2**: **ecosystem is over-pledged**. Here, we will provide the derivation for the penalty factor (**Δ**) and we will prove that it leads to a close system, _i.e._, the total saturation limit is always equal to the circulation supply no matter how under-pledged or over-pledged the ecosystem is. The penalty factor (**Δ**) has the following characteristics: * **Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. Under this condition, the excess saturation limit of over-pledged pools are unaffected. In essence, they are not yet "returning" any of the borrowed excess. -* **Δ** ⟶ 0, when the ecosystem is over-pledged, and **_pa_** of the under-pledged pools approaches **_popt_**. Under this condition, the excess saturation limit of over-pledged pools also approaches zero. In essence, they are "returning" the borrowed excess. +* **Δ** ⟶ 0, when the ecosystem is over-pledged and under-pledged pools keep pledging. Under this condition, the excess saturation limit of over-pledged pools also approaches zero. In essence, they are "returning" the borrowed excess. We first calculate the total saturation limit (**_αtotal_**) excluding: - saturation limit from over-pledges. @@ -223,15 +223,10 @@ Because the Gibson proposal does not gurantee that the total saturation limit of * **The Gibson proposal may be less effective in dealing with abrupt changes in the staking parameters.** Since the Gibson proposal rely on parameters that can only be changed when there is network consensus, such design is less robust against abrupt changes in the ecosystem, _e.g._, when there is a need for the number of validators to scale up with demand or when the number of pools declines abruptly due to extreme events. Our proposal scales up and down without further intervention because the protocol is governed by equations. -* **The CIP effectively decreases the _k-effective_ parameter.** +* **The CIP effectively decreases the **_k-effective_** parameter.** The **_k-effective_** is a parameter that attempts to measure decentralization, and is defined by the equation shown as follows: -
-
-![k-effective](https://drive.google.com/uc?export=view&id=1A_foc_uYzkbSG3lJlcQt5F2IMh5T-e1z) -
-
-The parameter **_k-effective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases due to the fact that the saturation limit (**_α_**) defined in this proposal is inversely propotional to the number of pools **_k_**. As the number of pools increases, saturation limit decreases. This decrease, in turn, should decrease the ratio of group stake to total stake in Equation 12 which then leads to the increase of **_k-effective_**. -
+![k-effective](https://drive.google.com/uc?export=view&id=1A_foc_uYzkbSG3lJlcQt5F2IMh5T-e1z)
+The parameter **_k-effective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases due to the fact that the saturation limit (**_α_**) defined in this proposal is inversely propotional to the number of pools **_k_**. As the number of pools increases, saturation limit decreases. This decrease, in turn, should decrease the ratio of group stake to total stake in Equation 12 which then leads to the increase of **_k-effective_**.
# **Copyright** - This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) +This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) From 144e0d64ce04fb6248d846f4809e6fce3143da17 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Wed, 30 Mar 2022 16:09:28 -0400 Subject: [PATCH 05/28] Update README.md --- .../README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 1ec29be4e5..3ce27b086a 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -33,7 +33,7 @@ There is no barrier to entry to set up a pool, but there exists an **optimal ple ![equation1](https://drive.google.com/uc?export=view&id=1O_gmZ9LwpVV3xs2RVNqaXLh3um3zfFKs) -where **_popt_** is the optimal pledge, **φ** is the amount of ADA in circulation (currently 33B), **_k_** is the total number of pools, and **_n_** is a variable that is determined via consensus to warrant an economically viable optimal pledge (**_popt_**). Therefore, it appears that **_n_** is a variable that the community can vote for adjustment to increase or decrease **_popt_**. In effect, it can be used to control the total number of pools (**_k_**) so that at some value **_n_**, the ecosystem gradually settles to some value **_k_** which the community thinks is the optimal value. +where **_popt_** is the optimal pledge, **φ** is the amount of ADA in circulation (currently 33B), **_k_** is the total number of pools, and **_n_** is a variable that is determined via consensus to warrant an economically viable optimal pledge (**_popt_**). Therefore, it appears that **_n_** is a variable that the community can vote for adjustment to increase or decrease **_popt_**. In effect, it can be used to control the total number of pools (**_k_**) so that at some value **_n_**, the ecosystem gradually settles to some value **_k_** which the community thinks is the optimal value. If we set **_n_** =15, @@ -79,7 +79,7 @@ Distribution of **_αunc_** based, yet again, on pledge will further **_α_** = $\frac{33B}{3119}$ $e^{1 - 47,205/47,205}$ = $\frac{33B}{3119}$ = 10.6M -**Conclusion**: Epoch 321 saturation limit for pools with at least 47,205 ADA in pledge is 10.6M (at **_n_** = 15). The ratio $\frac{33B}{3119}$ guarantees that every ADA in circulation has a pool to stake to without risking oversaturation. Note that the current average stake per pool is only 7.6M, suggesting that a vast number of pools are not adequately staked. Setting the saturation limit, on average, to 10.6M would make some large pools to become oversaturated which will encourage delegators of these pools to move their stakes to small pools. +**Conclusion**: Epoch 321 saturation limit for pools with at least 47,205 ADA in pledge is 10.6M (at **_n_** = 15). Setting the saturation limit to 10.6M would make some large pools to become oversaturated which will encourage delegators of these pools to move their stakes to small pools. It is very important that the number of pools (**_k_**) is properly controlled by the parameter **_n_** so that **_k_** remains optimal - _i.e._, even if **_k_** is large but optimal, no pool will be devoid of blocks. **Example 2** (same variable values as in example 1 but lower **_pa_**). * **_k_** = 3119 (epoch 321) From 98796105fa6deb174c1027fd3f77a27a3f74ebeb Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Thu, 31 Mar 2022 15:58:46 -0400 Subject: [PATCH 06/28] Update README.md --- .../README.md | 24 +++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 3ce27b086a..3e5f08ccdf 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -201,20 +201,30 @@ A Sybil attack requires 501 nodes which makes the number of pools (**_k_**) tota A Sybil attack requires 3120 nodes which makes the number of pools (**_k_**) totals to 6239 (3119 + 3120) and optimal pledge (**_popt_**) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge. +## **_New Fee Structure_** +This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit to decentralize the ecosystem. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because, there are only two decisions that a pool can make: to pledge or not to pledge, and these decisions are not influenced by the decisions of any other pool. Here we propose a simple reward structure (in general terms) that is fair for all. + +Currently, pool operators are paid from a fixed cost of 340 ADA plus a margin per epoch. As long as a pool is minting even just a block in an epoch, the pool gets the fixed cost plus the margin of which both are subtracted from the total reward before the rest is distributed to the pool delegators. This mechanism appears to be not sustainable for small pools because the pool reward erodes the already meager delegators reward - _i.e._, a fixed cost of 340 ADA plus a margin is going to take a significant portion from the delegators reward since small pools mint fewer blocks. + +Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pools (or pool operators) are paid for each block they make. The reward for the pool operator that minted the block is a FEW PERCENT of the total fees generated from the transactions contained in that block. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total reward of all pools from the total fees collected per epoch, 20% of the total fees is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.616% per epoch (or 4.5% annually). If there remains an undistributed reward, this must be redirected to the treasury. + +It is tempting to propose that delegator reward should decrease for those who are delegated in an oversaturated pool. However, this mechanism can be exploited through connivance of pool operators and delegators through excess reward sharing. Oversaturad pools are expected to mint more blocks than fully saturated pools. Because of this, a pool may lure delegation by sharing the excess reward from oversaturation with its delegators. So even if the delegator reward is decreased due to oversaturation, this decrease is compensated from the excess reward sharing scheme. To prevent this possible exploitation, any delegation that oversaturates a pool should be outright rejected by the protocol. + +The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward in the current protocol is structured. This bias causes centralization of stake towrds pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked. All are getting the same reward. + # **Rationale** The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools and discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization. To mitigate the problem outlined above, we recognized that saturation limit needs to get decreased to some minimum that allow fair distribution of stake but avoids the potential risk of oversaturation. We may do this by allocating saturation limit based on pledge. This idea was first explored by Casey Gibson in his CIP which you may find here. We found that there may be potential weaknesses to his ideas, but the same weaknesses are addressed in our proposal. These weaknesses are: * **The Gibson proposal appears to be less effective at solving stake centralization.** -To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA. Therefore, each pool requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M, but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it. - -The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows +To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA. Therefore, each pool requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M, but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it. + + The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows -**_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$ -**_α_** = $\frac{33B}{3119-60+pools}$ -**_pools_** = 2.8B/(**_α_**+**_popt_**) + **_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$ **_α_** = $\frac{33B}{3119-60+pools}$ + **_pools_** = 2.8B/(**_α_**+**_popt_**) -We have three equations and three unknowns which resolves to **_pools_** = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge) + We have three equations and three unknowns which resolves to **_pools_** = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge) * **The Gibson proposal may disenfranchise a significant portion of ADA in circulation from getting staked at low pool number.** Because the Gibson proposal does not gurantee that the total saturation limit of all pools is equal to the amount of ADA in circulation, there exists a significant risk of disenfranchising some portion of ADA in circulation from getting staked. For example, if the number of pools abruptly dropped to 500, all pools need to pledge at maximum (500,000 ADA to get 65M saturation limit) so that the ecosystem can achieve a total saturation limit that is approximately equal to the total ADA in circulation. However, all pools pledging at maximum is a very unlikely scenario, leaving some ADA disenfranchised. Risk of disenfranchisement exists even at the current number of pools. In contrast, the total saturation limit under our proposal is always equal to ADA in circulation regardless of the pledge status in the ecosystem. From 76668c3d9696d732314572ee401fd52787abfdab Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Fri, 1 Apr 2022 23:27:46 -0400 Subject: [PATCH 07/28] Update README.md --- .../README.md | 29 +++++++++++-------- 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 3e5f08ccdf..1c64655d98 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -8,11 +8,11 @@ Type: Process Created: 2022-02-28 --- # **Abstract** -With the current saturation limit set at 68 M per pool and with 3119 pools, the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. # **Motivation** -This proposal attempts to solve the ongoing stake centralization while preserving (if not enhancing) the security guranteed by the current consensus mechanism. It solves the problem by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations and, therefore, allows the staking mechanism to operate without the need for frequent network consensus. Because of this mechanism, the would-be protocol not only enhances stake decentralization, it also ensures robustness of the ecosystem against any abrupt changes in the staking parameters without intervention from the community. +This proposal attempts to solve the ongoing stake centralization by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations which allows the staking mechanism to operate without the need for frequent network consensus. # **Specification** @@ -186,7 +186,7 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp ![logic2](https://drive.google.com/uc?export=view&id=1j45ZEEhqwDDJoXcVxs4p1NqixegXGbmM) ## **_Sybil Attack_** - + **Simplifying scenario: ecosystem average pledge = optimal pledge and 33B ADA staked.** **scenario 1** (small number of pools): @@ -201,16 +201,21 @@ A Sybil attack requires 501 nodes which makes the number of pools (**_k_**) tota A Sybil attack requires 3120 nodes which makes the number of pools (**_k_**) totals to 6239 (3119 + 3120) and optimal pledge (**_popt_**) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge. -## **_New Fee Structure_** -This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit to decentralize the ecosystem. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because, there are only two decisions that a pool can make: to pledge or not to pledge, and these decisions are not influenced by the decisions of any other pool. Here we propose a simple reward structure (in general terms) that is fair for all. +## **_New Reward Structure_** +This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair for all. -Currently, pool operators are paid from a fixed cost of 340 ADA plus a margin per epoch. As long as a pool is minting even just a block in an epoch, the pool gets the fixed cost plus the margin of which both are subtracted from the total reward before the rest is distributed to the pool delegators. This mechanism appears to be not sustainable for small pools because the pool reward erodes the already meager delegators reward - _i.e._, a fixed cost of 340 ADA plus a margin is going to take a significant portion from the delegators reward since small pools mint fewer blocks. +Currently, pool operators are paid a fixed cost of 340 ADA plus a margin per epoch. As long as a pool is minting even just a block in an epoch, the pool gets the fixed cost plus the margin of which both are subtracted from the total reward before the rest is distributed to the pool delegators. This mechanism appears to be not sustainable for small pools because the pool reward erodes the already meager delegators reward - _i.e._, a fixed cost of 340 ADA plus a margin is going to take a significant portion from the delegators reward since small pools mint fewer blocks. -Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pools (or pool operators) are paid for each block they make. The reward for the pool operator that minted the block is a FEW PERCENT of the total fees generated from the transactions contained in that block. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total reward of all pools from the total fees collected per epoch, 20% of the total fees is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.616% per epoch (or 4.5% annually). If there remains an undistributed reward, this must be redirected to the treasury. +Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pools (or pool operators) are paid for each block they make. The reward for the pool operator that minted a block is a FEW PERCENT of the total fees generated from the transactions contained in that block. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total reward of all pools from the total fees collected per epoch, 20% of the total fees is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.616% per epoch (or 4.5% annually). If there remains an undistributed reward, this must be redirected to the treasury. The 4.5% reward declines exponentially for delegators in an oversaturated pools according to the following equation: -It is tempting to propose that delegator reward should decrease for those who are delegated in an oversaturated pool. However, this mechanism can be exploited through connivance of pool operators and delegators through excess reward sharing. Oversaturad pools are expected to mint more blocks than fully saturated pools. Because of this, a pool may lure delegation by sharing the excess reward from oversaturation with its delegators. So even if the delegator reward is decreased due to oversaturation, this decrease is compensated from the excess reward sharing scheme. To prevent this possible exploitation, any delegation that oversaturates a pool should be outright rejected by the protocol. +![reward](https://drive.google.com/uc?export=view&id=1B32FcDnIPnkl2aqMLTv-Ul2Sfc7QBsDy)
+where +* **_rd_** is the delegator reward +* **_δ_** is the pool delegation +* **_α_** is the saturation limit +* the factor 10 in the exponent ensures that the reward drops by ~60% when pool delegation exceeds by 10% of the saturation limit. -The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward in the current protocol is structured. This bias causes centralization of stake towrds pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked. All are getting the same reward. +The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward in the current protocol is structured. This bias causes centralization of stake towards pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked - all are getting the same reward. Finally, the delegator reward should increase as Cardano adoption increases. This increase in the reward is expected to encourage more and more delegation which will enhance the security of the ecosystem. There may come a time when Cardano is able to increase the delegator reward to a point when it becomes more profitable to delegate ADA than to use it as a medium of exchange. Thereby, reducing the amount of liquid ADA in the ecosystem. This mechanism is akin to coin burning but in a rather more meaningful manner. # **Rationale** The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools and discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization. @@ -233,10 +238,10 @@ Because the Gibson proposal does not gurantee that the total saturation limit of * **The Gibson proposal may be less effective in dealing with abrupt changes in the staking parameters.** Since the Gibson proposal rely on parameters that can only be changed when there is network consensus, such design is less robust against abrupt changes in the ecosystem, _e.g._, when there is a need for the number of validators to scale up with demand or when the number of pools declines abruptly due to extreme events. Our proposal scales up and down without further intervention because the protocol is governed by equations. -* **The CIP effectively decreases the **_k-effective_** parameter.** -The **_k-effective_** is a parameter that attempts to measure decentralization, and is defined by the equation shown as follows: +* **The CIP effectively decreases the **_keffective_** parameter.** +The **_keffective_** is a parameter that attempts to measure decentralization, and is defined by the equation shown as follows: ![k-effective](https://drive.google.com/uc?export=view&id=1A_foc_uYzkbSG3lJlcQt5F2IMh5T-e1z)
-The parameter **_k-effective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases due to the fact that the saturation limit (**_α_**) defined in this proposal is inversely propotional to the number of pools **_k_**. As the number of pools increases, saturation limit decreases. This decrease, in turn, should decrease the ratio of group stake to total stake in Equation 12 which then leads to the increase of **_k-effective_**.
+The parameter **_keffective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases due to the fact that the saturation limit (**_α_**) defined in this proposal is inversely propotional to the number of pools **_k_**. As the number of pools increases, saturation limit decreases. This decrease, in turn, should decrease the ratio of group stake to total stake in Equation 12 which then leads to the increase of **_keffective_**.
# **Copyright** This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) From 23e625256e8f98afc815d7a2b40b4c28bca3d7a5 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Sat, 2 Apr 2022 13:48:14 -0400 Subject: [PATCH 08/28] Update README.md --- .../README.md | 40 +++++++++---------- 1 file changed, 18 insertions(+), 22 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 1c64655d98..174d600e1f 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -8,7 +8,7 @@ Type: Process Created: 2022-02-28 --- # **Abstract** -With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost of attack is 52 M ADA in plege from at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA from at least 177 adversarial pools only. These pools can be readily saturated using lucrative but fake ISPOs. We, therefore, posit that the current CIP is not only fair for all but also enhances decentralization and better security than the current protocol. # **Motivation** @@ -20,7 +20,7 @@ This proposal attempts to solve the ongoing stake centralization by allocating p There is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. * Individual pool saturation limit decreases exponentially when **pool pledge < optimal pledge**. * Individual pool saturation limit increases **only incrementally** when **pool pledge > optimal pledge**. -* The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit from the under-pledged pools. If there is still remaining saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed limit can still be claimed by any pool by continuing to pledge. +* The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit unclaimed by the under-pledged pools. If there is still remaining saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed limit can still be claimed by any pool by continuing to pledge. * The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit allocated for them. The over-pledge pools’ excess saturation limit, likewise, will continue to decrease until all excess had been returned. This and the proposition from the previous bullet point ensures that: - a **close system** is maintained, _i.e._, the total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. @@ -50,7 +50,7 @@ If we set **_n_** =15, * **_popt_** = 27,440 ADA per pool -**Conclusion**: **_popt_** becomes cheaper as the total number of pools (**_k_**) increases, but more expensive when the total number of pools decreases.
+**Conclusion**: **_popt_** becomes cheaper as the total number of pools (**_k_**) increases, but more expensive as the total number of pools decreases. Setting **_n_** = 15 is only for illustration purposes. The Cardano scientists and engineers may want to place a more restrictive value of this parameter. For example, at **_n_** = 14 and **_k_** = 3119, **_popt_** = 124k ADA.

### **_Calculating Saturation Limit (α)_** @@ -68,7 +68,7 @@ The first term of Equation 2 allocates saturation limit based on pledge, and ens It is ideal that **_αunc_** = 0, but if **_αunc_** > 0, the second term of Equation 2 ensures its distribution. The distributed **_αunc_**, however, can still be claimed by any pool by increasing its pledge. -Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_** which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) suddenly decreased to a very low number, making **_popt_** very expensive and leading to significant under-pledging. Under this condition, pools that are under-pledged but had been in operation for a significant amount of time will be rewarded with a significant portion of **_αunc_**. +Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_** which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) is suddenly decreased to a very low number, making **_popt_** very expensive and leading to significant under-pledging. Under this condition, pools that are under-pledged but had been in operation for a significant amount of time will be rewarded with a significant portion of **_αunc_**. **Example 1** * **_k_** = 3119 (epoch 321) @@ -91,7 +91,7 @@ Distribution of **_αunc_** based, yet again, on pledge will further **_α_** = $\frac{33B}{3119}$ $e^{1 - 47,205/30000}$ = 6.0 M **Conclusion**: -Saturation limit decreases exponentially when **_pa_**<**_popt_**, encouraging pools to achieve **_popt_**. In an under-pledged ecosystem, pools can over-pledge to borrow saturation limit from under-pledged pools (see next case).
+Saturation limit decreases exponentially when **_pa_**<**_popt_**, encouraging pools to achieve **_popt_**. In an under-pledged ecosystem, pools can over-pledge to borrow saturation limit unclaimed by the under-pledged pools (see next case).

**case 2: _pa_>_popt_ (**the equation is quite complex so please bear with me**)**. @@ -104,7 +104,7 @@ where: * **$\frac{(x-|x|)}{2}$** returns 0 when x is positive, otherwise it returns the value of x. * The first term in equation 3 (**blue** text) is the guaranteed saturation limit since the pool exceeded **_popt_**. * The second term in equation 3 (**red** + **green** text) calculates saturation limit in excess of the guaranteed limit. -* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases when under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, leads to a decrease in the excess saturation limit (**red** text) of the over-pledged pools. Using this equation, an over-pledged pool "return" the borrowed saturation limit even without further intervention. +* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases as under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, leads to a decrease in the excess saturation limit (**red** text) of an over-pledged pool. The penalty factor assures that over-pledged pools "return" the borrowed saturation limit even without further intervention. **Example 1**: **ecosystem is not over-pledged**. @@ -128,7 +128,7 @@ Plugging in the values, **Example 2**: **ecosystem is over-pledged**. Here, we will provide the derivation for the penalty factor (**Δ**) and we will prove that it leads to a close system, _i.e._, the total saturation limit is always equal to the circulation supply no matter how under-pledged or over-pledged the ecosystem is. The penalty factor (**Δ**) has the following characteristics: * **Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. Under this condition, the excess saturation limit of over-pledged pools are unaffected. In essence, they are not yet "returning" any of the borrowed excess. -* **Δ** ⟶ 0, when the ecosystem is over-pledged and under-pledged pools keep pledging. Under this condition, the excess saturation limit of over-pledged pools also approaches zero. In essence, they are "returning" the borrowed excess. +* **Δ** ⟶ 0, when the ecosystem is over-pledged and under-pledged pools keep pledging. Under this condition, the excess saturation limit of over-pledged pools decreases and approaches zero. In essence, they are "returning" the borrowed excess. We first calculate the total saturation limit (**_αtotal_**) excluding: - saturation limit from over-pledges. @@ -177,7 +177,7 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp ![logic2](https://drive.google.com/uc?export=view&id=1XK1F2zG1zyaLPn2sz8rrISKPFEI0_r8B)

-**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the numerator and, therefore a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. +**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the numerator and, therefore, a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. ![logic2](https://drive.google.com/uc?export=view&id=182u2H0u72eDxSX04vjulPkeXWzjEdZmW)

@@ -187,19 +187,15 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp ## **_Sybil Attack_** -**Simplifying scenario: ecosystem average pledge = optimal pledge and 33B ADA staked.** +We can calculate the cost to conduct a Sybil attack using the following equation: -**scenario 1** (small number of pools): -**_n_** = 15 and **_k_** = 500, -**_popt_** = ~ 774,763 ADA +![cost](https://drive.google.com/uc?export=view&id=1cqZJ7y9oBi1bA6rOYWzlseUAIyOH3avg) -A Sybil attack requires 501 nodes which makes the number of pools (**_k_**) totals to 1001 (500 + 501) and optimal pledge (**_popt_**) decreases to 148, 011 ADA. Therefore, an attack requires 501 pools that need to be fully saturated (16.5M in stake) and a total of ~74M ADA (501*148,011) in pledge. +We can give the best scenario for the attacker or group of attackers by assuming that their pools are fully saturated. We can then plot the cost of attack as a function of the number of pools (**_k_**) and considering a scenario when some pools turn adversarial (**_kadversarial_**). -**scenario 2** (large number of pools): -**_n_** = 15 and **_k_** = 3119 (epoch 321), -**_popt_** = 47,205 ADA +![costfuncpools](https://drive.google.com/uc?export=view&id=1lW93crB3YIFeOd4Y8iG0fxkmKHZKlrgr) -A Sybil attack requires 3120 nodes which makes the number of pools (**_k_**) totals to 6239 (3119 + 3120) and optimal pledge (**_popt_**) decreases to 35,992 ADA. Therefore, an attack requires 3120 pools that need to be fully saturated (16.5M in stake) and a total of ~112M ADA (3120*35,992) in pledge. +Notice the existence of a minimum in the plot at around 1600 pools. The cost of attack at this minimum is 45 M ADA in pledge and at least 600 adversarial pools. The cost increases as the number of pools decreases or increases from this minimum. For epoch 321, the cost of attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the cost of attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools, and these pools can easily get saturated using fake ISPOs. ## **_New Reward Structure_** This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair for all. @@ -212,10 +208,10 @@ Because we no longer need the current reward structure and it is expected that p where * **_rd_** is the delegator reward * **_δ_** is the pool delegation -* **_α_** is the saturation limit +* **_α_** is the pool saturation limit * the factor 10 in the exponent ensures that the reward drops by ~60% when pool delegation exceeds by 10% of the saturation limit. -The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward in the current protocol is structured. This bias causes centralization of stake towards pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked - all are getting the same reward. Finally, the delegator reward should increase as Cardano adoption increases. This increase in the reward is expected to encourage more and more delegation which will enhance the security of the ecosystem. There may come a time when Cardano is able to increase the delegator reward to a point when it becomes more profitable to delegate ADA than to use it as a medium of exchange. Thereby, reducing the amount of liquid ADA in the ecosystem. This mechanism is akin to coin burning but in a rather more meaningful manner. +The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward in the current protocol is structured. This bias causes centralization of stake towards pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked - all are getting the same reward. Finally, the delegator reward should increase as Cardano adoption increases. This increase in the reward is expected to encourage more and more delegation which will enhance the security of the ecosystem. There may come a time when Cardano is able to increase the delegator reward to a point when it becomes more profitable to delegate ADA than to use it as a medium of exchange. Thereby, reducing the amount of liquid ADA in the ecosystem. This mechanism is akin to coin burning but in a rather more meaningful manner. ADA is then use as a security coin, and the medium of exchange will shift to stable coins. # **Rationale** The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools and discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization. @@ -229,10 +225,10 @@ To illustrate this argument, let's detemine how the Gibson proposal would affect **_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$ **_α_** = $\frac{33B}{3119-60+pools}$ **_pools_** = 2.8B/(**_α_**+**_popt_**) - We have three equations and three unknowns which resolves to **_pools_** = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge) + We have three equations and three unknowns which resolves to **_pools_** = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge). These numbers will increase as the number of pools increases. * **The Gibson proposal may disenfranchise a significant portion of ADA in circulation from getting staked at low pool number.** -Because the Gibson proposal does not gurantee that the total saturation limit of all pools is equal to the amount of ADA in circulation, there exists a significant risk of disenfranchising some portion of ADA in circulation from getting staked. For example, if the number of pools abruptly dropped to 500, all pools need to pledge at maximum (500,000 ADA to get 65M saturation limit) so that the ecosystem can achieve a total saturation limit that is approximately equal to the total ADA in circulation. However, all pools pledging at maximum is a very unlikely scenario, leaving some ADA disenfranchised. Risk of disenfranchisement exists even at the current number of pools. In contrast, the total saturation limit under our proposal is always equal to ADA in circulation regardless of the pledge status in the ecosystem. +Because the Gibson proposal does not gurantee that the total saturation limit of all pools is equal to the amount of ADA in circulation, there exists a significant risk of disenfranchising some portion of ADA in circulation. For example, if the number of pools abruptly drops to 500, all pools need to pledge at maximum (500,000 ADA to get 65M saturation limit) so that the ecosystem can achieve a total saturation limit that is approximately equal to the total ADA in circulation. However, all pools pledging at maximum is a very unlikely scenario, leaving some ADA disenfranchised. Risk of disenfranchisement exists even at the current number of pools. In contrast, the total saturation limit under our proposal is always equal to ADA in circulation regardless of the pledge status in the ecosystem. * **The Gibson proposal may be less effective in dealing with abrupt changes in the staking parameters.** @@ -241,7 +237,7 @@ Since the Gibson proposal rely on parameters that can only be changed when there * **The CIP effectively decreases the **_keffective_** parameter.** The **_keffective_** is a parameter that attempts to measure decentralization, and is defined by the equation shown as follows: ![k-effective](https://drive.google.com/uc?export=view&id=1A_foc_uYzkbSG3lJlcQt5F2IMh5T-e1z)
-The parameter **_keffective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases due to the fact that the saturation limit (**_α_**) defined in this proposal is inversely propotional to the number of pools **_k_**. As the number of pools increases, saturation limit decreases. This decrease, in turn, should decrease the ratio of group stake to total stake in Equation 12 which then leads to the increase of **_keffective_**.
+The parameter **_keffective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases due to the fact that the saturation limit (**_α_**) defined in this proposal is inversely propotional to the number of pools (**_k_**), _i.e._ as the number of pools increases, saturation limit decreases. This decrease, in turn, should decrease the ratio of group stake to total stake in Equation 14 which then leads to the increase of **_keffective_**. # **Copyright** This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) From cd1a4681d5bf66b278ce5e780f122c02e5b85607 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Sat, 2 Apr 2022 14:57:21 -0400 Subject: [PATCH 09/28] Update README.md --- .../README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 174d600e1f..2a1140a41b 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -8,7 +8,7 @@ Type: Process Created: 2022-02-28 --- # **Abstract** -With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost of attack is 52 M ADA in plege from at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA from at least 177 adversarial pools only. These pools can be readily saturated using lucrative but fake ISPOs. We, therefore, posit that the current CIP is not only fair for all but also enhances decentralization and better security than the current protocol. +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost of attack is millions in plege from at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA from at least 177 adversarial pools only. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 198 fully saturated pools. We, therefore, posit that the current CIP is not only fair for all but also enhances decentralization and better security than the current protocol. # **Motivation** @@ -195,7 +195,7 @@ We can give the best scenario for the attacker or group of attackers by assuming ![costfuncpools](https://drive.google.com/uc?export=view&id=1lW93crB3YIFeOd4Y8iG0fxkmKHZKlrgr) -Notice the existence of a minimum in the plot at around 1600 pools. The cost of attack at this minimum is 45 M ADA in pledge and at least 600 adversarial pools. The cost increases as the number of pools decreases or increases from this minimum. For epoch 321, the cost of attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the cost of attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools, and these pools can easily get saturated using fake ISPOs. +Notice the existence of a minimum in the plot at around 1600 pools. The cost of attack at this minimum is 45 M ADA in pledge and at least 600 adversarial pools. The cost increases as the number of pools decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the cost of attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the cost of attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools, and these pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 198 fully saturated pools. ## **_New Reward Structure_** This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair for all. From d39e5d229799981c068e35d750fdcc877aef1db6 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Tue, 5 Apr 2022 14:36:15 -0400 Subject: [PATCH 10/28] Update README.md --- .../README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 2a1140a41b..9a4d7dd672 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -8,7 +8,7 @@ Type: Process Created: 2022-02-28 --- # **Abstract** -With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost of attack is millions in plege from at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA from at least 177 adversarial pools only. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 198 fully saturated pools. We, therefore, posit that the current CIP is not only fair for all but also enhances decentralization and better security than the current protocol. +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost of attack is millions in plege from at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA from at least 177 adversarial pools only. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools at near saturation. We, therefore, posit that the current CIP is not only fair for all but also enhances decentralization and better security than the current protocol. # **Motivation** @@ -195,7 +195,7 @@ We can give the best scenario for the attacker or group of attackers by assuming ![costfuncpools](https://drive.google.com/uc?export=view&id=1lW93crB3YIFeOd4Y8iG0fxkmKHZKlrgr) -Notice the existence of a minimum in the plot at around 1600 pools. The cost of attack at this minimum is 45 M ADA in pledge and at least 600 adversarial pools. The cost increases as the number of pools decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the cost of attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the cost of attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools, and these pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 198 fully saturated pools. +Notice the existence of a minimum in the plot at around 1600 pools. The cost of attack at this minimum is 45 M ADA in pledge and at least 600 adversarial pools. The cost increases as the number of pools decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the cost of attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the cost of attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools, and these pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools at near saturation. ## **_New Reward Structure_** This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair for all. From 17e88956a234416933d9091f1f10edb72bfb1826 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Tue, 5 Apr 2022 15:35:07 -0400 Subject: [PATCH 11/28] Update README.md --- .../README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 9a4d7dd672..b9c0507170 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -17,7 +17,7 @@ This proposal attempts to solve the ongoing stake centralization by allocating p # **Specification** ## **Nonmathematical Description** -There is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. +Under this CIP, there is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. * Individual pool saturation limit decreases exponentially when **pool pledge < optimal pledge**. * Individual pool saturation limit increases **only incrementally** when **pool pledge > optimal pledge**. * The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit unclaimed by the under-pledged pools. If there is still remaining saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed limit can still be claimed by any pool by continuing to pledge. @@ -195,7 +195,7 @@ We can give the best scenario for the attacker or group of attackers by assuming ![costfuncpools](https://drive.google.com/uc?export=view&id=1lW93crB3YIFeOd4Y8iG0fxkmKHZKlrgr) -Notice the existence of a minimum in the plot at around 1600 pools. The cost of attack at this minimum is 45 M ADA in pledge and at least 600 adversarial pools. The cost increases as the number of pools decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the cost of attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the cost of attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools, and these pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools at near saturation. +Notice the existence of a minimum in the plot at around 1600 pools. The cost to conduct an attack at this minimum is 45 M ADA in pledge and at least 600 adversarial pools. The cost increases as the number of pools decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the cost to conduct an attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the cost to conduct an attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools, and these pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools at near saturation. ## **_New Reward Structure_** This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair for all. From cf356df9a1508f930b781adb3c0a58363f0cfc87 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Tue, 5 Apr 2022 23:41:28 -0400 Subject: [PATCH 12/28] Update README.md --- .../README.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index b9c0507170..97e3eeefc7 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -8,7 +8,7 @@ Type: Process Created: 2022-02-28 --- # **Abstract** -With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost of attack is millions in plege from at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA from at least 177 adversarial pools only. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools at near saturation. We, therefore, posit that the current CIP is not only fair for all but also enhances decentralization and better security than the current protocol. +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack is millions in plege and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools only. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools at or near saturation. We, therefore, posit that the this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. # **Motivation** @@ -187,18 +187,18 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp ## **_Sybil Attack_** -We can calculate the cost to conduct a Sybil attack using the following equation: +We can calculate the total pledge to conduct a Sybil attack using the following equation: ![cost](https://drive.google.com/uc?export=view&id=1cqZJ7y9oBi1bA6rOYWzlseUAIyOH3avg) -We can give the best scenario for the attacker or group of attackers by assuming that their pools are fully saturated. We can then plot the cost of attack as a function of the number of pools (**_k_**) and considering a scenario when some pools turn adversarial (**_kadversarial_**). +We consider a scenario where some pools turn adversarial (**_kadversarial_**), and we can give the best scenario for the attackers by assuming that their pools are fully saturated. We can then plot the total pledge to conduct a Sybil attack as a function of the number of pools (**_k_**). ![costfuncpools](https://drive.google.com/uc?export=view&id=1lW93crB3YIFeOd4Y8iG0fxkmKHZKlrgr) -Notice the existence of a minimum in the plot at around 1600 pools. The cost to conduct an attack at this minimum is 45 M ADA in pledge and at least 600 adversarial pools. The cost increases as the number of pools decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the cost to conduct an attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the cost to conduct an attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools, and these pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools at near saturation. +Notice the existence of a minimum in the plot at around 1600 pools. The total pledge to conduct a Sybil attack at this minimum is 45 M ADA in pledge (when **_n_** = 15) and at least 600 pools turning adversarial. The total pledge to conduct a Sybil attack increases as the number of pools either decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the total pledge to conduct a Sybil attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the total pledge to conduct a Sybil attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools at or near saturation. ## **_New Reward Structure_** -This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair for all. +This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair to all. Currently, pool operators are paid a fixed cost of 340 ADA plus a margin per epoch. As long as a pool is minting even just a block in an epoch, the pool gets the fixed cost plus the margin of which both are subtracted from the total reward before the rest is distributed to the pool delegators. This mechanism appears to be not sustainable for small pools because the pool reward erodes the already meager delegators reward - _i.e._, a fixed cost of 340 ADA plus a margin is going to take a significant portion from the delegators reward since small pools mint fewer blocks. @@ -222,7 +222,8 @@ To illustrate this argument, let's detemine how the Gibson proposal would affect The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows - **_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$ **_α_** = $\frac{33B}{3119-60+pools}$ + **_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$ + **_α_** = $\frac{33B}{3119-60+pools}$ **_pools_** = 2.8B/(**_α_**+**_popt_**) We have three equations and three unknowns which resolves to **_pools_** = 282 and total pledge to 12.8M (282 pools * 45.5K in pledge). These numbers will increase as the number of pools increases. From bfa512fde1da440fd329547d437150ce2a23f993 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Fri, 8 Apr 2022 12:46:17 -0400 Subject: [PATCH 13/28] Update README.md --- .../README.md | 35 ++++++++++--------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 97e3eeefc7..770ec21db1 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -8,7 +8,7 @@ Type: Process Created: 2022-02-28 --- # **Abstract** -With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack is millions in plege and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools only. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools at or near saturation. We, therefore, posit that the this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack under this CIP is millions in plege and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools only. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. We, therefore, posit that the this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. # **Motivation** @@ -25,15 +25,15 @@ Under this CIP, there is no barrier to entry to set up a pool, but there exists - a **close system** is maintained, _i.e._, the total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. * Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: - - optimal pledge is expensive for MPOs. - - expense to conduct Sybil attack increases as the total number of pools increases. + - optimal pledge becomes expensive when the total number of pools decreases, thereby increasing the expense to conduct a Sybil attack. + - expense to conduct Sybil attack also increases as the total number of pools increases because although the optimal pledge is low, the attacker needs to setup a large number of pools in order to obtain 51% of delegated ADA. ## **Mathematical Description** ### _**Calculating Optimal Pledge**_ ![equation1](https://drive.google.com/uc?export=view&id=1O_gmZ9LwpVV3xs2RVNqaXLh3um3zfFKs) -where **_popt_** is the optimal pledge, **φ** is the amount of ADA in circulation (currently 33B), **_k_** is the total number of pools, and **_n_** is a variable that is determined via consensus to warrant an economically viable optimal pledge (**_popt_**). Therefore, it appears that **_n_** is a variable that the community can vote for adjustment to increase or decrease **_popt_**. In effect, it can be used to control the total number of pools (**_k_**) so that at some value **_n_**, the ecosystem gradually settles to some value **_k_** which the community thinks is the optimal value. +where **_popt_** is the optimal pledge, **φ** is the amount of ADA in circulation (currently 33B), **_k_** is the total number of pools, and **_n_** is a variable that is determined via consensus to warrant an economically viable optimal pledge (**_popt_**). Therefore, it appears that **_n_** is a variable that the community can vote for adjustment to increase or decrease **_popt_**. In effect, it can be used to control the total number of pools (**_k_**) so that at some value **_n_**, the ecosystem gradually settles to some value **_k_** which the community thinks is the optimal value. It is very important that **_k_** is tightly controlled by **_n_**, and **_k_** should only increase according to some parameters, for example, with increasing user demand. So that even if **_k_** is large, all pools are still minting blocks because of high user demand. If we set **_n_** =15, @@ -68,7 +68,7 @@ The first term of Equation 2 allocates saturation limit based on pledge, and ens It is ideal that **_αunc_** = 0, but if **_αunc_** > 0, the second term of Equation 2 ensures its distribution. The distributed **_αunc_**, however, can still be claimed by any pool by increasing its pledge. -Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_** which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) is suddenly decreased to a very low number, making **_popt_** very expensive and leading to significant under-pledging. Under this condition, pools that are under-pledged but had been in operation for a significant amount of time will be rewarded with a significant portion of **_αunc_**. +Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_** which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) is suddenly decreases to a very low number, making **_popt_** very expensive and leading to significant under-pledging. Under this condition, pools that are under-pledged but had been in operation for a significant amount of time will be rewarded with a significant portion of **_αunc_**. **Example 1** * **_k_** = 3119 (epoch 321) @@ -104,7 +104,7 @@ where: * **$\frac{(x-|x|)}{2}$** returns 0 when x is positive, otherwise it returns the value of x. * The first term in equation 3 (**blue** text) is the guaranteed saturation limit since the pool exceeded **_popt_**. * The second term in equation 3 (**red** + **green** text) calculates saturation limit in excess of the guaranteed limit. -* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases as under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, leads to a decrease in the excess saturation limit (**red** text) of an over-pledged pool. The penalty factor assures that over-pledged pools "return" the borrowed saturation limit even without further intervention. +* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases as under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, leads to a decrease in the excess saturation limit (**red** text) of all over-pledged pools. Therefore, the penalty factor ensures that over-pledged pools "return" the borrowed saturation limit even without further intervention. **Example 1**: **ecosystem is not over-pledged**. @@ -132,11 +132,11 @@ Here, we will provide the derivation for the penalty factor (saturation limit from over-pledges. - - distributed unclaimed saturation limit (**_αunc_**, see second term in Equation 1). + - unclaimed saturation limit (**_αunc_**, see second term in Equation 1). ![Equation5](https://drive.google.com/uc?export=view&id=19VQyenWAntcKh8VavMpJxscc4scqT6_O) -where **_pai_** is the actual pledge of pool _i_. Since total saturation limit (**_αtotal_**) can never exceed circulating supply (**_φ_**), the unclaimed saturation limit (**_αunc_**) is then calculated as follows: +where **_pai_** is the actual pledge of pool _i_. Since the total saturation limit (**_αtotal_**) can never exceed circulating supply (**_φ_**), the unclaimed saturation limit (**_αunc_**) is then calculated as follows: ![Equation6](https://drive.google.com/uc?export=view&id=1JcYX5u499lXnhN9Ha7WSeN49d1WcSbtz) @@ -148,7 +148,7 @@ Solving for **_αovp_** we have, ![Equation8](https://drive.google.com/uc?export=view&id=1NnoNPLEhp8cihYNvscXdXKP8lPikuADQ) -Another way of expressing the total excess saturation limit (**_αovp_**) is by using Equation 3 and is given as follows: +Now, we have to remember that the second term in Equation 3 calculates the excess saturation limit of an over-pledged pool. Therefore, the total excess saturation limit (**_αovp_**) can also be expressed as the sum of the second term of Equation 3 of all over-pledged pools and is given as follows: ![Equation9](https://drive.google.com/uc?export=view&id=15FezfQXXCskq6rblQdauD1jJOEtCFSpH) @@ -167,12 +167,12 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp **Δ** ⟶ 0, when the ecosystem is over-pledged, and under-pledged pools continue to pledge.

-**Case 1**: Ecosystem is under-pledged and over-pledging pools keep over-pledging to borrow additional saturation limit: the denominator is going to increase (red arrow) while the numerator is going to increase by the same magnitude through a decrease (blue arrow) in the unclaimed saturation limit (**_αunc_**) : +**Case 1**: Ecosystem is under-pledged and over-pledged pools keep over-pledging to borrow additional saturation limit: the denominator is going to increase (red arrow) while the numerator is going to increase by the same magnitude through a decrease (blue arrow) in the unclaimed saturation limit (**_αunc_**) : ![logic1](https://drive.google.com/uc?export=view&id=1-vvc_xUd8KSY5zmkR9xXP8ebZ_re3y6h)

- **Case 2**: Ecosystem is under-pledged and under-pledging pools keep pledging to claim the remaining saturation limit: the second term in the numerator is going to increase (red arrow) while the third term is going to decrease by the same magnitude (blue arrow): + **Case 2**: Ecosystem is under-pledged and under-pledged pools keep pledging to claim the remaining saturation limit: the second term in the numerator is going to increase (red arrow) while the third term is going to decrease by the same magnitude (blue arrow): ![logic2](https://drive.google.com/uc?export=view&id=1XK1F2zG1zyaLPn2sz8rrISKPFEI0_r8B)

@@ -195,14 +195,14 @@ We consider a scenario where some pools turn adversarial (**_kadversarial where @@ -211,14 +211,14 @@ where * **_α_** is the pool saturation limit * the factor 10 in the exponent ensures that the reward drops by ~60% when pool delegation exceeds by 10% of the saturation limit. -The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward in the current protocol is structured. This bias causes centralization of stake towards pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked - all are getting the same reward. Finally, the delegator reward should increase as Cardano adoption increases. This increase in the reward is expected to encourage more and more delegation which will enhance the security of the ecosystem. There may come a time when Cardano is able to increase the delegator reward to a point when it becomes more profitable to delegate ADA than to use it as a medium of exchange. Thereby, reducing the amount of liquid ADA in the ecosystem. This mechanism is akin to coin burning but in a rather more meaningful manner. ADA is then use as a security coin, and the medium of exchange will shift to stable coins. +The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward is structured in the current protocol. This bias causes centralization of stake towards pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked - all delegators are getting the same reward of 4.5% unless they are staked in oversaturated pools. Finally, the delegator reward should increase as Cardano adoption increases. This increase in the reward is expected to encourage more and more delegation which will further enhance the security of the ecosystem. There may come an instance when Cardano is able to increase the delegator reward to a point when it becomes more profitable to delegate ADA than to use it as a medium of exchange. Thereby, reducing the amount of liquid ADA in the ecosystem. This mechanism is akin to coin burning but in a rather more meaningful manner. Under this instance, ADA is then used as a security coin, and the medium of exchange will shift to stable coins. # **Rationale** The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools and discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization. To mitigate the problem outlined above, we recognized that saturation limit needs to get decreased to some minimum that allow fair distribution of stake but avoids the potential risk of oversaturation. We may do this by allocating saturation limit based on pledge. This idea was first explored by Casey Gibson in his CIP which you may find here. We found that there may be potential weaknesses to his ideas, but the same weaknesses are addressed in our proposal. These weaknesses are: * **The Gibson proposal appears to be less effective at solving stake centralization.** -To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA. Therefore, each pool requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M, but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it. +To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA in pledge. Therefore, each pool from this MPO requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M (43*500,000) but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it. The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows @@ -235,10 +235,11 @@ Because the Gibson proposal does not gurantee that the total saturation limit of * **The Gibson proposal may be less effective in dealing with abrupt changes in the staking parameters.** Since the Gibson proposal rely on parameters that can only be changed when there is network consensus, such design is less robust against abrupt changes in the ecosystem, _e.g._, when there is a need for the number of validators to scale up with demand or when the number of pools declines abruptly due to extreme events. Our proposal scales up and down without further intervention because the protocol is governed by equations. -* **The CIP effectively decreases the **_keffective_** parameter.** + +Finally, **this CIP effectively increases the **_keffective_** parameter.** The **_keffective_** is a parameter that attempts to measure decentralization, and is defined by the equation shown as follows: ![k-effective](https://drive.google.com/uc?export=view&id=1A_foc_uYzkbSG3lJlcQt5F2IMh5T-e1z)
-The parameter **_keffective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases due to the fact that the saturation limit (**_α_**) defined in this proposal is inversely propotional to the number of pools (**_k_**), _i.e._ as the number of pools increases, saturation limit decreases. This decrease, in turn, should decrease the ratio of group stake to total stake in Equation 14 which then leads to the increase of **_keffective_**. +The parameter **_keffective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases. This is due to the fact as the number of pools increases, the saturation limit (**_α_**) decreases. This decrease in the saturation limit, in turn, should decrease the ratio of group stake to total stake in Equation 14, which then leads to the increase of **_keffective_**. # **Copyright** This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) From 3f73a306587468512a0746b7f3cdad5aa1117807 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Tue, 3 May 2022 18:45:24 -0400 Subject: [PATCH 14/28] Update README.md --- .../README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 770ec21db1..54a316d5d2 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -202,7 +202,7 @@ This CIP describes a protocol that attempts to enhance decentralization but is v Currently, pool operators are paid a fixed cost of 340 ADA plus a margin per epoch. As long as a pool is minting even just a block in an epoch, the pool gets the fixed cost plus the margin of which both are subtracted from the total reward before the rest is distributed to the pool delegators. This mechanism appears to be not sustainable for small pools because the pool reward erodes the already meager delegators reward - _i.e._, a fixed cost of 340 ADA plus a margin is going to take a significant portion from the delegators reward since small pools mint fewer blocks. -Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pools (or pool operators) are paid for each block they make. The reward for the pool operator that minted a block is a FEW PERCENT of the total fees generated from the transactions contained in that block. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total reward of all pools from the total fees collected per epoch, 20% of the total fees is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.616% per epoch (or 4.5% annually) regardless of which pool the delegators are staked, except if they are in oversaturated pools. If there remains an undistributed reward, this must be redirected to the treasury. The 4.5% reward declines exponentially for delegators in an oversaturated pool according to the following equation: +Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pool operators are paid for each block they minted. First, the **reward per block** is calculated by dividing the **reward pot (reserve + fees)** by the number of blocks in an epoch. Then, the reward for the pool operator for a block he minted is a FEW PERCENT of the **reward per block** which is further multiplied by the "fullness" of the minted block - _i.e.,_ if the minted block is only 80% filled, then the operator reward for that block is multiplied by 0.8. This multiplier has an effect of decreasing the operator reward from minting a block if the pool fails to completely fill the block to maximum capacity. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total reward allocated to all operators, 20% of the **reward pot** is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.616% per epoch (or 4.5% annually) regardless of which pool the delegators are staked, except if they are in oversaturated pools. If there remains an undistributed reward, this must be redirected to the treasury or returned to the reserve. The 4.5% reward declines exponentially for delegators in an oversaturated pool according to the following equation: ![reward](https://drive.google.com/uc?export=view&id=1B32FcDnIPnkl2aqMLTv-Ul2Sfc7QBsDy)
where From eb8fefdbb312274f831981f23826339181c83f7b Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Tue, 3 May 2022 18:48:17 -0400 Subject: [PATCH 15/28] Update README.md --- .../README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 54a316d5d2..15c7970344 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -202,7 +202,7 @@ This CIP describes a protocol that attempts to enhance decentralization but is v Currently, pool operators are paid a fixed cost of 340 ADA plus a margin per epoch. As long as a pool is minting even just a block in an epoch, the pool gets the fixed cost plus the margin of which both are subtracted from the total reward before the rest is distributed to the pool delegators. This mechanism appears to be not sustainable for small pools because the pool reward erodes the already meager delegators reward - _i.e._, a fixed cost of 340 ADA plus a margin is going to take a significant portion from the delegators reward since small pools mint fewer blocks. -Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pool operators are paid for each block they minted. First, the **reward per block** is calculated by dividing the **reward pot (reserve + fees)** by the number of blocks in an epoch. Then, the reward for the pool operator for a block he minted is a FEW PERCENT of the **reward per block** which is further multiplied by the "fullness" of the minted block - _i.e.,_ if the minted block is only 80% filled, then the operator reward for that block is multiplied by 0.8. This multiplier has an effect of decreasing the operator reward from minting a block if the pool fails to completely fill the block to maximum capacity. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total reward allocated to all operators, 20% of the **reward pot** is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.616% per epoch (or 4.5% annually) regardless of which pool the delegators are staked, except if they are in oversaturated pools. If there remains an undistributed reward, this must be redirected to the treasury or returned to the reserve. The 4.5% reward declines exponentially for delegators in an oversaturated pool according to the following equation: +Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pool operators are paid for each block they minted. First, the **reward per block** is calculated by dividing the **reward pot (reserve + fees)** by the number of blocks in an epoch. Then, the reward for the pool operator for a block he minted is a FEW PERCENT of the **reward per block** which is further multiplied by the "fullness" of the minted block - _i.e.,_ if the minted block is only 80% filled, then the operator reward for that block is multiplied by 0.8. This multiplier has an effect of decreasing the operator reward if the pool fails to completely fill the block to maximum capacity. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total reward allocated to all operators, 20% of the **reward pot** is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.616% per epoch (or 4.5% annually) regardless of which pool the delegators are staked, except if they are in oversaturated pools. If there remains an undistributed reward, this must be redirected to the treasury or returned to the reserve. The 4.5% reward declines exponentially for delegators in an oversaturated pool according to the following equation: ![reward](https://drive.google.com/uc?export=view&id=1B32FcDnIPnkl2aqMLTv-Ul2Sfc7QBsDy)
where From 40805c4789a4b30afcc1aa626fa18db6fa8ef9bb Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Wed, 3 Aug 2022 22:51:17 -0400 Subject: [PATCH 16/28] Update README.md --- .../README.md | 50 +++++++++---------- 1 file changed, 24 insertions(+), 26 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 15c7970344..011ef01952 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -8,25 +8,23 @@ Type: Process Created: 2022-02-28 --- # **Abstract** -With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack under this CIP is millions in plege and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools only. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. We, therefore, posit that the this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. - - -# **Motivation** This proposal attempts to solve the ongoing stake centralization by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations which allows the staking mechanism to operate without the need for frequent network consensus. + +# **Motivation** +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack under this CIP is millions in pledge and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools **only**. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. We, therefore, posit that this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. - # **Specification** ## **Nonmathematical Description** Under this CIP, there is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. -* Individual pool saturation limit decreases exponentially when **pool pledge < optimal pledge**. +* Individual pool saturation limit increases/decreases exponentially when **pool pledge < optimal pledge**. * Individual pool saturation limit increases **only incrementally** when **pool pledge > optimal pledge**. -* The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit unclaimed by the under-pledged pools. If there is still remaining saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed limit can still be claimed by any pool by continuing to pledge. -* The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit allocated for them. The over-pledge pools’ excess saturation limit, likewise, will continue to decrease until all excess had been returned. This and the proposition from the previous bullet point ensures that: +* The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit unclaimed by the under-pledged pools. If there is still unclaimed saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed saturation limit can still be claimed by any pool by continuing to pledge. +* The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit allocated for them. The over-pledge pools’ excess saturation limit, on the otherhand, will continue to decrease as under-pledge pools continue to pledge until all excess had been returned. This and the proposition from the previous bullet point ensures that: - a **close system** is maintained, _i.e._, the total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. * Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: - optimal pledge becomes expensive when the total number of pools decreases, thereby increasing the expense to conduct a Sybil attack. - - expense to conduct Sybil attack also increases as the total number of pools increases because although the optimal pledge is low, the attacker needs to setup a large number of pools in order to obtain 51% of delegated ADA. + - expense to conduct Sybil attack also increases as the total number of pools increases because although the optimal pledge decreases, the attacker needs to setup a large number of pools in order to obtain 51% of the total delegated ADA. ## **Mathematical Description** ### _**Calculating Optimal Pledge**_ @@ -68,7 +66,7 @@ The first term of Equation 2 allocates saturation limit based on pledge, and ens It is ideal that **_αunc_** = 0, but if **_αunc_** > 0, the second term of Equation 2 ensures its distribution. The distributed **_αunc_**, however, can still be claimed by any pool by increasing its pledge. -Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_** which, in turn, ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) is suddenly decreases to a very low number, making **_popt_** very expensive and leading to significant under-pledging. Under this condition, pools that are under-pledged but had been in operation for a significant amount of time will be rewarded with a significant portion of **_αunc_**. +Distribution of **_αunc_** based, yet again, on pledge will further disadvantage those who are under-pledged. Therefore, we use accumulated time of operation,**_Ta_**, as a parameter for the distribution of **_αunc_**. This mechanism ensures that the unclaimed saturation limit is distributed into pools that had been securing the ecosystem for the longest time. This manner of distribution prevents any would-be attacker, likely someone who had just registered a pool (or pools), from getting a significant portion of **_αunc_**. This mechanism is very important when the number of pools (**_k_**) suddenly decreases to a very low number, making **_popt_** very expensive and leading to significant under-pledging. Under this condition, pools that are under-pledged but had been in operation for a significant amount of time will be rewarded with a significant portion of **_αunc_**. **Example 1** * **_k_** = 3119 (epoch 321) @@ -91,7 +89,7 @@ Distribution of **_αunc_** based, yet again, on pledge will further **_α_** = $\frac{33B}{3119}$ $e^{1 - 47,205/30000}$ = 6.0 M **Conclusion**: -Saturation limit decreases exponentially when **_pa_**<**_popt_**, encouraging pools to achieve **_popt_**. In an under-pledged ecosystem, pools can over-pledge to borrow saturation limit unclaimed by the under-pledged pools (see next case).
+Saturation limit decreases exponentially when **_pa_**<**_popt_** which should encourage pools to achieve **_popt_**. In an under-pledged ecosystem, pools can over-pledge to borrow saturation limit unclaimed by the under-pledged pools (see next case).

**case 2: _pa_>_popt_ (**the equation is quite complex so please bear with me**)**. @@ -104,17 +102,17 @@ where: * **$\frac{(x-|x|)}{2}$** returns 0 when x is positive, otherwise it returns the value of x. * The first term in equation 3 (**blue** text) is the guaranteed saturation limit since the pool exceeded **_popt_**. * The second term in equation 3 (**red** + **green** text) calculates saturation limit in excess of the guaranteed limit. -* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases as under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, leads to a decrease in the excess saturation limit (**red** text) of all over-pledged pools. Therefore, the penalty factor ensures that over-pledged pools "return" the borrowed saturation limit even without further intervention. +* The second factor of the second term in equation 3 (**green** text), is the penalty factor that is accounted when the ecosystem is over-pledged. This factor decreases (eventually going to zero) as under-pledge pools continue to increase their pledges. The decrease in the penalty factor, in turn, leads to the decrease in the excess saturation limit (**red** text) of all over-pledged pools. Therefore, the penalty factor ensures that over-pledged pools "return" the borrowed saturation limit even without further intervention. **Example 1**: **ecosystem is not over-pledged**. * **_pa_** = 110,000 ADA * **_popt_** = 47,205 ADA (**_n_** = 15) -* **Δ=1** (Please accept this for now. Proof is provided later.) +* **Δ = 1** (Please accept this for now. Proof is provided later.) * current circulation supply (**_φ_**) = 33B ADA * current total number of pools (**_k_**, epoch 321) = 3119 -Because the system is not overpledged, Equation 3 is reduced to: +Because the system is not over-pledged, Equation 3 is reduced to: ![sample1](https://drive.google.com/uc?export=view&id=1cJg4uaHTGhaKv4pZvL5win3sTbOJeYoo) @@ -140,7 +138,7 @@ where **_pai_** is the actual pledge of pool _i_. Since the total sat ![Equation6](https://drive.google.com/uc?export=view&id=1JcYX5u499lXnhN9Ha7WSeN49d1WcSbtz) -Realistically, some pools will be over-pledged and their total excess saturation limit (**_αovp_**) may be added as follows: +Realistically, some pools will be over-pledged and their total excess saturation limit (**_αovp_**) may be deducted from the circulating supply (**_φ_**) as follows: ![Equation7](https://drive.google.com/uc?export=view&id=1Yj-_PGbl1WcWttDMX1acEex0e7ZFHWDM) @@ -163,25 +161,25 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp **Now, we will prove that Equation 11 guarantees a close system, _i.e._,** -**Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. -**Δ** ⟶ 0, when the ecosystem is over-pledged, and under-pledged pools continue to pledge.
+**Δ** **= 1**, when the ecosystem is either under-pledged or at equilibrium. +**Δ** **⟶ 0**, when the ecosystem is over-pledged, and under-pledged pools continue to pledge.

-**Case 1**: Ecosystem is under-pledged and over-pledged pools keep over-pledging to borrow additional saturation limit: the denominator is going to increase (red arrow) while the numerator is going to increase by the same magnitude through a decrease (blue arrow) in the unclaimed saturation limit (**_αunc_**) : +**Case 1**: Ecosystem is under-pledged and over-pledged pools keep over-pledging to borrow additional saturation limit: the total excess saturation limit is going to increase (red arrow) while unclaimed saturation limit is going to decrease (blue arrow), thereby increasing the numerator by the same magnitude as the denominator. ![logic1](https://drive.google.com/uc?export=view&id=1-vvc_xUd8KSY5zmkR9xXP8ebZ_re3y6h)

- **Case 2**: Ecosystem is under-pledged and under-pledged pools keep pledging to claim the remaining saturation limit: the second term in the numerator is going to increase (red arrow) while the third term is going to decrease by the same magnitude (blue arrow): + **Case 2**: Ecosystem is under-pledged and under-pledged pools keep pledging to claim the remaining saturation limit allocated for them: the second term in the numerator is going to increase (red arrow) while the third term is going to decrease by the same magnitude (blue arrow): ![logic2](https://drive.google.com/uc?export=view&id=1XK1F2zG1zyaLPn2sz8rrISKPFEI0_r8B)

-**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the borrowed saturation limit: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the numerator and, therefore, a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. +**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the saturation limit borrowed by the over-pleding pools: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the numerator and, therefore, a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. ![logic2](https://drive.google.com/uc?export=view&id=182u2H0u72eDxSX04vjulPkeXWzjEdZmW)

-**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of all under-pledged pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, any continuing pledge from an over-pledged pool should be rejected. +**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of all non-overpledging pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, any continuing pledge from an over-pledged pool should be rejected. ![logic2](https://drive.google.com/uc?export=view&id=1j45ZEEhqwDDJoXcVxs4p1NqixegXGbmM) @@ -202,7 +200,7 @@ This CIP describes a protocol that attempts to enhance decentralization but is v Currently, pool operators are paid a fixed cost of 340 ADA plus a margin per epoch. As long as a pool is minting even just a block in an epoch, the pool gets the fixed cost plus the margin of which both are subtracted from the total reward before the rest is distributed to the pool delegators. This mechanism appears to be not sustainable for small pools because the pool reward erodes the already meager delegators reward - _i.e._, a fixed cost of 340 ADA plus a margin is going to take a significant portion from the delegators reward since small pools mint fewer blocks. -Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pool operators are paid for each block they minted. First, the **reward per block** is calculated by dividing the **reward pot (reserve + fees)** by the number of blocks in an epoch. Then, the reward for the pool operator for a block he minted is a FEW PERCENT of the **reward per block** which is further multiplied by the "fullness" of the minted block - _i.e.,_ if the minted block is only 80% filled, then the operator reward for that block is multiplied by 0.8. This multiplier has an effect of decreasing the operator reward if the pool fails to completely fill the block to maximum capacity. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total reward allocated to all operators, 20% of the **reward pot** is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.616% per epoch (or 4.5% annually) regardless of which pool the delegators are staked, except if they are in oversaturated pools. If there remains an undistributed reward, this must be redirected to the treasury or returned to the reserve. The 4.5% reward declines exponentially for delegators in an oversaturated pool according to the following equation: +Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pool operators are paid for each block they minted. First, the **reward per block** is calculated by dividing the **reward pot (reserve + fees)** by the number of blocks in an epoch. Then, the reward for the pool operator for any block he mints is a FEW PERCENT of the **reward per block** multiplied by the "fullness" of the minted block - _i.e.,_ if the minted block is only 80% filled, then the operator reward for that block is multiplied by 0.8. This multiplier has an effect of decreasing the operator reward if the pool fails to completely fill the block to maximum capacity. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total pool reward from the reward pot, 20% of the **reward pot** is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.0616% per epoch (or 4.5% annually) regardless of which pool the delegators are staked, except if they are in an oversaturated pool. If there remains an undistributed reward, this must be redirected to the treasury or reserve. The 4.5% reward declines exponentially for delegators in an oversaturated pool according to the following equation: ![reward](https://drive.google.com/uc?export=view&id=1B32FcDnIPnkl2aqMLTv-Ul2Sfc7QBsDy)
where @@ -211,14 +209,14 @@ where * **_α_** is the pool saturation limit * the factor 10 in the exponent ensures that the reward drops by ~60% when pool delegation exceeds by 10% of the saturation limit. -The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward is structured in the current protocol. This bias causes centralization of stake towards pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked - all delegators are getting the same reward of 4.5% unless they are staked in oversaturated pools. Finally, the delegator reward should increase as Cardano adoption increases. This increase in the reward is expected to encourage more and more delegation which will further enhance the security of the ecosystem. There may come an instance when Cardano is able to increase the delegator reward to a point when it becomes more profitable to delegate ADA than to use it as a medium of exchange. Thereby, reducing the amount of liquid ADA in the ecosystem. This mechanism is akin to coin burning but in a rather more meaningful manner. Under this instance, ADA is then used as a security coin, and the medium of exchange will shift to stable coins. +The mechanism described above further enhance decentralization. In the current protocol, delegators are biased towards nearly saturated pools because these pools generate better rewards just because of how the reward mechanism is structured in the current protocol. This bias causes centralization of stake towards pools that are at near saturation. In this CIP, such bias is eliminated because it no longer matter which pool a delegator is staked - all delegators are getting the same reward of 4.5% unless they are staked in an oversaturated pool. Finally, the delegator reward may be increased as Cardano adoption increases, making delegation more attractive and allowing better security for the ecosystem. # **Rationale** The steady centralization of stake concentrated to only a few MPOs primarily arises from the substantial saturation limit (68M) allocated for each pool. This large allocation allows moneyed MPOs to gain substantial delegation simply by setting up multiple pools and offering lucrative rewards. If left unchanged, the current state of affairs deters would-be SPOs from setting up pools and discourages current SPOs from continuing to operate because, for a significant number of them, the cost/reward is economically disadvantageous. This only leads to further centralization. -To mitigate the problem outlined above, we recognized that saturation limit needs to get decreased to some minimum that allow fair distribution of stake but avoids the potential risk of oversaturation. We may do this by allocating saturation limit based on pledge. This idea was first explored by Casey Gibson in his CIP which you may find here. We found that there may be potential weaknesses to his ideas, but the same weaknesses are addressed in our proposal. These weaknesses are: +To mitigate the problem outlined above, we recognized that saturation limit needs to get decreased to some minimum that allow fair distribution of stake but avoids the potential risk of oversaturation by guaranteeing that the total saturation limit is always equal to the circulating supply. We may do this by allocating saturation limit based on pledge. This idea was first explored by Casey Gibson in his CIP which you may find here. We found that there may be potential weaknesses to his ideas, but the same weaknesses are addressed in our proposal. These weaknesses are: * **The Gibson proposal appears to be less effective at solving stake centralization.** -To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA in pledge. Therefore, each pool from this MPO requires 65.5M to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stakes is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M (43*500,000) but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it. +To illustrate this argument, let's detemine how the Gibson proposal would affect a current MPO that has 60 pools and controls 2.8B ADA. First, we take note that this MPO has total control of the stakes delegated to it. The Gibson proposal, in its current form, allocates 100% of K (65M in stake) for every 500,000 ADA in pledge. Therefore, each pool from this MPO requires 65.5M (65 M in stake plus 0.5 M pledge) to setup and get fully saturated. The number of pools that this MPO needs to retain all 2.8B stake is just 43 pools ($\frac{2.8B}{65.5M}$), which is lower than the MPOs current number of pools (60 pools). The total pledge would amount to 21.5M (43*500,000) but this pledge is irrelevant for this MPO because it has total control of the stake delegated to it. The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows @@ -239,7 +237,7 @@ Since the Gibson proposal rely on parameters that can only be changed when there Finally, **this CIP effectively increases the **_keffective_** parameter.** The **_keffective_** is a parameter that attempts to measure decentralization, and is defined by the equation shown as follows: ![k-effective](https://drive.google.com/uc?export=view&id=1A_foc_uYzkbSG3lJlcQt5F2IMh5T-e1z)
-The parameter **_keffective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases. This is due to the fact as the number of pools increases, the saturation limit (**_α_**) decreases. This decrease in the saturation limit, in turn, should decrease the ratio of group stake to total stake in Equation 14, which then leads to the increase of **_keffective_**. +The parameter **_keffective_** should increase as decentralization increases. However, recently it had plateaued between the values 40 to 43. The strategy described in this CIP effectively increases this parameter as the number of pools increases. This is due to the fact that as the number of pools increases, the saturation limit (**_α_**) decreases. This decrease in the saturation limit, in turn, should decrease the ratio of group stake to total stake in Equation 14, which then leads to the increase of **_keffective_**. # **Copyright** This CIP is licensed under [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/legalcode) From ce1329d1099ce3fc10ef8c1b6e397f4824117ed2 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Thu, 4 Aug 2022 15:33:54 -0400 Subject: [PATCH 17/28] Update README.md Updated the nonmathematical description section. --- .../README.md | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 011ef01952..220fd22fa5 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -16,15 +16,21 @@ With the current saturation limit set at 68 M per pool and with 3119 pools (epoc # **Specification** ## **Nonmathematical Description** Under this CIP, there is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. -* Individual pool saturation limit increases/decreases exponentially when **pool pledge < optimal pledge**. -* Individual pool saturation limit increases **only incrementally** when **pool pledge > optimal pledge**. -* The ecosystem is **under-pledged** when the **total saturation limit < circulating supply**. Under this condition, pools can over-pledge to “borrow” additional saturation limit unclaimed by the under-pledged pools. If there is still unclaimed saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. However, the distributed unclaimed saturation limit can still be claimed by any pool by continuing to pledge. -* The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit allocated for them. The over-pledge pools’ excess saturation limit, on the otherhand, will continue to decrease as under-pledge pools continue to pledge until all excess had been returned. This and the proposition from the previous bullet point ensures that: - - a **close system** is maintained, _i.e._, the total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. +* The ecosystem **total saturation limit is always equal to total ADA in circulation**. +* The optimal pool saturation limit is **total ADA in circulation divided by the total number of pools**. +* Individual pool saturation limit is optimal when **pool pledge = optimal pledge** +* Individual pool saturation limit decreases exponentially when **pool pledge < optimal pledge**. +* Individual pool saturation limit increases **only incrementally** past the optimal saturation limit when **pool pledge > optimal pledge**. +* The ecosystem is **under-pledged** when the **ecosystem total saturation limit < circulating supply**. The saturation limit unclaimed by under-pledged pools is equal to the circulating supply minus the ecosystem total saturation limit. + - Under this condition, pools can over-pledge to “borrow” additional saturation limit unclaimed by the under-pledged pools. + - If there is still unclaimed saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. + - However, the distributed unclaimed saturation limit can still be claimed by any pool by continuing to pledge. +* The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit that was supposed to be allocated for them. The over-pledge pools’ excess saturation limit, on the otherhand, will continue to decrease as under-pledge pools continue to pledge until all excess had been returned. This and the proposition from the previous bullet point ensures that: + - a **close system** is maintained, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. * Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: - optimal pledge becomes expensive when the total number of pools decreases, thereby increasing the expense to conduct a Sybil attack. - - expense to conduct Sybil attack also increases as the total number of pools increases because although the optimal pledge decreases, the attacker needs to setup a large number of pools in order to obtain 51% of the total delegated ADA. + - expense to conduct Sybil attack also increases as the total number of pools increases because although the optimal pledge decreases, optimal saturation limit decreases as well. Therefore, the attacker needs to setup a large number of pools in order to obtain 51% of the total delegated ADA. ## **Mathematical Description** ### _**Calculating Optimal Pledge**_ @@ -55,7 +61,8 @@ If we set **_n_** =15, **case 1: _pa ≤ popt_** ![equation2](https://drive.google.com/uc?export=view&id=1vwM9i8voMM6AnNtlxIzuwu8mQj1ntgi5) -where: +where:
+**_φ_/_k_** is the optimal saturation limit
**_pa_** = actual pool pledge **_popt_** = optimal pledge **_αunc_** = saturation limit left unclaimed even after some pools have over-pledged. This variable is defined in Equation 7. From 26d7ee17515af2ac1a6ca9473c8d11b1dbcf26e2 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Thu, 4 Aug 2022 15:44:07 -0400 Subject: [PATCH 18/28] Update README.md --- .../README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 220fd22fa5..def9fa6973 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -28,6 +28,7 @@ Under this CIP, there is no barrier to entry to set up a pool, but there exists * The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit that was supposed to be allocated for them. The over-pledge pools’ excess saturation limit, on the otherhand, will continue to decrease as under-pledge pools continue to pledge until all excess had been returned. This and the proposition from the previous bullet point ensures that: - a **close system** is maintained, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. + - since the ecosystem total saturation limit is always equal to ADA in circulation, the ADA delegation per pool will be more or less even. * Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: - optimal pledge becomes expensive when the total number of pools decreases, thereby increasing the expense to conduct a Sybil attack. - expense to conduct Sybil attack also increases as the total number of pools increases because although the optimal pledge decreases, optimal saturation limit decreases as well. Therefore, the attacker needs to setup a large number of pools in order to obtain 51% of the total delegated ADA. From a8084d32d400620f7a5c75a4e67d74f07e263cfb Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Thu, 4 Aug 2022 20:14:09 -0400 Subject: [PATCH 19/28] Update README.md --- .../README.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index def9fa6973..15db0d1d34 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -17,7 +17,7 @@ With the current saturation limit set at 68 M per pool and with 3119 pools (epoc ## **Nonmathematical Description** Under this CIP, there is no barrier to entry to set up a pool, but there exists an **optimal pledge** which is used as a yardstick to determine pool saturation limit in proportion to pledge. * The ecosystem **total saturation limit is always equal to total ADA in circulation**. -* The optimal pool saturation limit is **total ADA in circulation divided by the total number of pools**. +* The optimal pool saturation limit is equal to the **total ADA in circulation divided by the total number of pools**. * Individual pool saturation limit is optimal when **pool pledge = optimal pledge** * Individual pool saturation limit decreases exponentially when **pool pledge < optimal pledge**. * Individual pool saturation limit increases **only incrementally** past the optimal saturation limit when **pool pledge > optimal pledge**. @@ -31,10 +31,11 @@ Under this CIP, there is no barrier to entry to set up a pool, but there exists - since the ecosystem total saturation limit is always equal to ADA in circulation, the ADA delegation per pool will be more or less even. * Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: - optimal pledge becomes expensive when the total number of pools decreases, thereby increasing the expense to conduct a Sybil attack. - - expense to conduct Sybil attack also increases as the total number of pools increases because although the optimal pledge decreases, optimal saturation limit decreases as well. Therefore, the attacker needs to setup a large number of pools in order to obtain 51% of the total delegated ADA. + - expense to conduct Sybil attack also increases as the total number of pools increases because although the optimal pledge decreases, optimal saturation limit decreases as well. Therefore, the attacker needs to setup a very large number of pools in order to obtain 51% of the total delegated ADA. ## **Mathematical Description** -### _**Calculating Optimal Pledge**_ +### _**Calculating Optimal Pledge**_
+
![equation1](https://drive.google.com/uc?export=view&id=1O_gmZ9LwpVV3xs2RVNqaXLh3um3zfFKs) @@ -136,9 +137,9 @@ Here, we will provide the derivation for the penalty factor (**Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. Under this condition, the excess saturation limit of over-pledged pools are unaffected. In essence, they are not yet "returning" any of the borrowed excess. * **Δ** ⟶ 0, when the ecosystem is over-pledged and under-pledged pools keep pledging. Under this condition, the excess saturation limit of over-pledged pools decreases and approaches zero. In essence, they are "returning" the borrowed excess. -We first calculate the total saturation limit (**_αtotal_**) excluding: +Using Equation 2, we first calculate the total saturation limit (**_αtotal_**) excluding: - saturation limit from over-pledges. - - unclaimed saturation limit (**_αunc_**, see second term in Equation 1). + - unclaimed saturation limit (**_αunc_**). ![Equation5](https://drive.google.com/uc?export=view&id=19VQyenWAntcKh8VavMpJxscc4scqT6_O) @@ -154,7 +155,7 @@ Solving for **_αovp_** we have, ![Equation8](https://drive.google.com/uc?export=view&id=1NnoNPLEhp8cihYNvscXdXKP8lPikuADQ) -Now, we have to remember that the second term in Equation 3 calculates the excess saturation limit of an over-pledged pool. Therefore, the total excess saturation limit (**_αovp_**) can also be expressed as the sum of the second term of Equation 3 of all over-pledged pools and is given as follows: +Now, we have to remember that the second term in Equation 3 calculates the excess saturation limit of an over-pledged pool. Therefore, the total excess saturation limit (**_αovp_**) can also be expressed as the sum of the second term in Equation 3 of all over-pledged pools and is given as follows: ![Equation9](https://drive.google.com/uc?export=view&id=15FezfQXXCskq6rblQdauD1jJOEtCFSpH) @@ -162,7 +163,7 @@ where _j_ is any over-pledging pool. Plugging in Equation 9 into Equation 8, we ![Equation10](https://drive.google.com/uc?export=view&id=15iwumKXAAhPy6t98uHZpiJk0CsltAWkd) -Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simplifying, we have: +Dividing both sides of Equation 10 by the left-hand side and simplifying, we have: ![Equation10](https://drive.google.com/uc?export=view&id=1lQYewlKuCotMs0QQ8I3xJcc4rfddyHk3) @@ -173,7 +174,7 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp **Δ** **⟶ 0**, when the ecosystem is over-pledged, and under-pledged pools continue to pledge.

-**Case 1**: Ecosystem is under-pledged and over-pledged pools keep over-pledging to borrow additional saturation limit: the total excess saturation limit is going to increase (red arrow) while unclaimed saturation limit is going to decrease (blue arrow), thereby increasing the numerator by the same magnitude as the denominator. +**Case 1**: Ecosystem is under-pledged and over-pledged pools keep over-pledging to borrow additional saturation limit: the total excess saturation limit is going to increase (red arrow) while unclaimed saturation limit is going to decrease (blue arrow). Therefore the numerator is going to increase (because the third term is negative) by the same magnitude as the denominator. ![logic1](https://drive.google.com/uc?export=view&id=1-vvc_xUd8KSY5zmkR9xXP8ebZ_re3y6h)

@@ -183,7 +184,7 @@ Dividing both sides of Equation 10 by the right-hand side of Equation 9 and simp ![logic2](https://drive.google.com/uc?export=view&id=1XK1F2zG1zyaLPn2sz8rrISKPFEI0_r8B)

-**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the saturation limit borrowed by the over-pleding pools: the total saturation limit of under-pledging pools increases (red arrow) which causes a decrease in the numerator and, therefore, a decrease in the penalty factor (blue arrow). The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. +**Case 3**: Ecosystem is over-pledged (**_αunc = 0_**) and under-pledged pools keep pledging to take back the saturation limit borrowed by the over-pledged pools: the total saturation limit of under-pledged pools increases (red arrow) which causes a decrease in the numerator (blue arrow) and, therefore, a decrease in the penalty factor. The decrease in the penalty factor, in turn, causes a decrease in an over-pledged pool’s excess saturation limit (see Equation 3). In this scenario, an over-pledged pool is simply returning the “borrowed” excess. ![logic2](https://drive.google.com/uc?export=view&id=182u2H0u72eDxSX04vjulPkeXWzjEdZmW)

From 2fcb0ea4896565751215e90c951f06b3eeaa6b1d Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Thu, 4 Aug 2022 21:04:27 -0400 Subject: [PATCH 20/28] Update README.md --- .../README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 15db0d1d34..c88ba42ea1 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -188,7 +188,7 @@ Dividing both sides of Equation 10 by the left-hand side and simplifying, we hav ![logic2](https://drive.google.com/uc?export=view&id=182u2H0u72eDxSX04vjulPkeXWzjEdZmW)

-**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of an over-pledge pool but leave the saturation limit of all non-overpledging pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent over-pledged pools from continuing to over-pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, any continuing pledge from an over-pledged pool should be rejected. +**Case 4**: Ecosystem is over-pledged (**_αunc = 0_**) and fully-pledged and over-pledged pools keep over-pledging even when there’s no longer any saturation limit left for them to borrow: the denominator increases which causes the penalty factor to decrease. This, in turn, decreases the excess saturation limit of over-pledged pools but leave the saturation limit of all non-overpledging pools unaffected. This situation will cause the total saturation limit to go below the circulation supply (**_αtotal < φ_**) even if the ecosystem is over-pledged. This decrease should be sufficient to prevent fully-pledged and over-pledged pools from continuing to pledge when **_αunc = 0_**. However, such weakness may possiby be exploited. Hence, when **_αunc = 0_**, continuing pledge from fully-pledged and over-pledged pools should be rejected. ![logic2](https://drive.google.com/uc?export=view&id=1j45ZEEhqwDDJoXcVxs4p1NqixegXGbmM) From ba8c55459e78639e09e71e93461518c816a11405 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Fri, 5 Aug 2022 12:11:59 -0400 Subject: [PATCH 21/28] Update README.md --- .../README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index c88ba42ea1..50497ace6c 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -1,5 +1,5 @@ --- -CIP: TBD +CIP: 0045? Title: Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit Author: Jay Pseudonym Cappucino Comments-URI: https://forum.cardano.org/t/cip-stake-decentralization-using-pledge-as-a-bidding-parameter-to-determine-saturation-limit/95936 @@ -8,7 +8,7 @@ Type: Process Created: 2022-02-28 --- # **Abstract** -This proposal attempts to solve the ongoing stake centralization by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations which allows the staking mechanism to operate without the need for frequent network consensus. +This proposal attempts to solve the ongoing stake centralization by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully-pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations which allows the staking mechanism to operate without the need for frequent network consensus. # **Motivation** With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack under this CIP is millions in pledge and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools **only**. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. We, therefore, posit that this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. @@ -26,7 +26,7 @@ Under this CIP, there is no barrier to entry to set up a pool, but there exists - If there is still unclaimed saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. - However, the distributed unclaimed saturation limit can still be claimed by any pool by continuing to pledge. * The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit that was supposed to be allocated for them. The over-pledge pools’ excess saturation limit, on the otherhand, will continue to decrease as under-pledge pools continue to pledge until all excess had been returned. This and the proposition from the previous bullet point ensures that: - - a **close system** is maintained, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully pledged, or over-pledged. + - a **close system** is maintained, which means that the ecosystem total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully-pledged, or over-pledged. **TRULY OUROBOROS**. - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. - since the ecosystem total saturation limit is always equal to ADA in circulation, the ADA delegation per pool will be more or less even. * Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: From fec6af2105a9733c5ae45dc045d181515aa45f1f Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Fri, 5 Aug 2022 21:22:53 -0400 Subject: [PATCH 22/28] Update README.md --- .../README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 50497ace6c..651ad118c9 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -1,6 +1,6 @@ --- CIP: 0045? -Title: Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit +Title: Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System. Author: Jay Pseudonym Cappucino Comments-URI: https://forum.cardano.org/t/cip-stake-decentralization-using-pledge-as-a-bidding-parameter-to-determine-saturation-limit/95936 Status: Draft @@ -11,7 +11,7 @@ Created: 2022-02-28 This proposal attempts to solve the ongoing stake centralization by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully-pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations which allows the staking mechanism to operate without the need for frequent network consensus. # **Motivation** -With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Here, we describe a mechanism that uses pledge as a stake-bidding parameter under a close system, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack under this CIP is millions in pledge and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools **only**. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. We, therefore, posit that this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Staying true to the nature of **Ouroboros**, we describe a mechanism that uses pledge as a stake-bidding parameter under a **close system**, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack under this CIP is millions in pledge and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools **only**. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. We, therefore, posit that this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. # **Specification** ## **Nonmathematical Description** From 8557e2d2058d15619a2008ecb3adcd76b029f687 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Fri, 5 Aug 2022 21:33:18 -0400 Subject: [PATCH 23/28] Update README.md --- .../README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index 651ad118c9..a4cf6cf19c 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -198,7 +198,7 @@ We can calculate the total pledge to conduct a Sybil attack using the following ![cost](https://drive.google.com/uc?export=view&id=1cqZJ7y9oBi1bA6rOYWzlseUAIyOH3avg) -We consider a scenario where some pools turn adversarial (**_kadversarial_**), and we can give the best scenario for the attackers by assuming that their pools are fully saturated. We can then plot the total pledge to conduct a Sybil attack as a function of the number of pools (**_k_**). +We consider a scenario where some pools turn adversarial (**_kadversarial_**), and we can give the best scenario for the attackers by assuming that their pools are fully saturated. We can then plot the total pledge to conduct a Sybil attack as well as (**_kadversarial_**) vs the number of pools (**_k_**). ![costfuncpools](https://drive.google.com/uc?export=view&id=1lW93crB3YIFeOd4Y8iG0fxkmKHZKlrgr) From 81b9dbda13abe1dbb8c057e6e120c0c341b85a72 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Fri, 5 Aug 2022 23:37:59 -0400 Subject: [PATCH 24/28] Update README.md --- .../README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md index a4cf6cf19c..33b1e05180 100644 --- a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md +++ b/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md @@ -198,18 +198,18 @@ We can calculate the total pledge to conduct a Sybil attack using the following ![cost](https://drive.google.com/uc?export=view&id=1cqZJ7y9oBi1bA6rOYWzlseUAIyOH3avg) -We consider a scenario where some pools turn adversarial (**_kadversarial_**), and we can give the best scenario for the attackers by assuming that their pools are fully saturated. We can then plot the total pledge to conduct a Sybil attack as well as (**_kadversarial_**) vs the number of pools (**_k_**). +We consider a scenario where some pools turn adversarial (**_kadversarial_**), and we can give the best scenario for the attackers by assuming that their pools are fully saturated. We can then plot the total pledge to conduct a Sybil attack as well as **_kadversarial_** vs the number of pools (**_k_**). ![costfuncpools](https://drive.google.com/uc?export=view&id=1lW93crB3YIFeOd4Y8iG0fxkmKHZKlrgr) -Notice the existence of a minimum in the plot at around 1600 pools. The total pledge to conduct a Sybil attack at this minimum is 45 M ADA in pledge (when **_n_** = 15) and at least 600 pools turning adversarial. The total pledge to conduct a Sybil attack increases as the number of pools either decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the total pledge to conduct a Sybil attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the total pledge to conduct a Sybil attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. +It is not surprising that the number of pools needed to attack the ecosystem (**_kadversarial_**) increases linearly with the number of pools (left figure). This observation is in line with the expectation that an ecosystem's security should become more robust as the number of pools increases. Unfortunately, this expectation is **not true** for the protocol currently implemented in Cardano. Notice the existence of a minimum in the plot (right figure) at around 1600 pools. The total pledge to conduct a Sybil attack at this minimum is 45 M ADA in pledge (when **_n_** = 15) and at least 600 pools turning adversarial. The total pledge to conduct a Sybil attack increases as the number of pools either decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the total pledge to conduct a Sybil attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the total pledge to conduct a Sybil attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. ## **_New Reward Structure_** This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair to all. Currently, pool operators are paid a fixed cost of 340 ADA plus a margin per epoch. As long as a pool is minting even just a block in an epoch, the pool gets the fixed cost plus the margin of which both are subtracted from the total reward before the rest is distributed to the pool delegators. This mechanism appears to be not sustainable for small pools because the pool reward erodes the already meager delegators reward - _i.e._, a fixed cost of 340 ADA plus a margin is going to take a significant portion from the delegators reward since small pools mint fewer blocks. -Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pool operators are paid for each block they minted. First, the **reward per block** is calculated by dividing the **reward pot (reserve + fees)** by the number of blocks in an epoch. Then, the reward for the pool operator for any block he mints is a FEW PERCENT of the **reward per block** multiplied by the "fullness" of the minted block - _i.e.,_ if the minted block is only 80% filled, then the operator reward for that block is multiplied by 0.8. This multiplier has an effect of decreasing the operator reward if the pool fails to completely fill the block to maximum capacity. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total pool reward from the reward pot, 20% of the **reward pot** is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward capped at 0.0616% per epoch (or 4.5% annually) regardless of which pool the delegators are staked, except if they are in an oversaturated pool. If there remains an undistributed reward, this must be redirected to the treasury or reserve. The 4.5% reward declines exponentially for delegators in an oversaturated pool according to the following equation: +Because we no longer need the current reward structure and it is expected that pools would have more or less the same delegation under this CIP, we propose that pool operators are paid for each block they minted. First, the **reward per block** is calculated by dividing the **reward pot (reserve + fees)** by the number of blocks in an epoch. Then, the reward for the pool operator for any block he mints is a FEW PERCENT of the **reward per block** multiplied by the "fullness" of the minted block - _i.e.,_ if the minted block is only 80% filled, then the operator reward for that block is multiplied by 0.8. This multiplier has an effect of decreasing the operator reward if the pool fails to completely fill the block to maximum capacity. In this manner, pools are encouraged to fill each block up to maximum capacity. Then, after deducting the total pool reward from the reward pot, 20% of the **reward pot** is then allocated to the treasury and the rest are allocated to the delegators with the delegator reward fixed at 0.0616% per epoch (or 4.5% annually) **regardless** of which pool a delegator is staked, except if he is in an oversaturated pool. If there remains an undistributed reward, this must be redirected to the treasury or reserve. The 4.5% reward declines exponentially for delegators in an oversaturated pool according to the following equation: ![reward](https://drive.google.com/uc?export=view&id=1B32FcDnIPnkl2aqMLTv-Ul2Sfc7QBsDy)
where @@ -229,7 +229,7 @@ To illustrate this argument, let's detemine how the Gibson proposal would affect The numbers from our proposal would be 282 pools and 12.8M in pledge to retain all 2.8B in stake at **_n_** = 15 and **_k_** = 3119 (epoch 321). The calculation is as follows - **_popt_** = 33B*$e^{1-15*(1+erf(-100/(3119-60+pools)))}$ + **_popt_** = 33B\*e^(1-15*(1+erf(-100/(3119-60+pools)))) **_α_** = $\frac{33B}{3119-60+pools}$ **_pools_** = 2.8B/(**_α_**+**_popt_**) From f9e522ef52dc042cba0ec6b40517cdc37d43b45e Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Sat, 6 Aug 2022 19:33:32 -0400 Subject: [PATCH 25/28] Rename CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md to Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System/README.md --- .../README.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename {CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit => Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System}/README.md (100%) diff --git a/CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md b/Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System/README.md similarity index 100% rename from CIP Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit/README.md rename to Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System/README.md From db9882910a4f0462f02691e5ce38a7f89037f53d Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Sat, 6 Aug 2022 21:28:10 -0400 Subject: [PATCH 26/28] Update and rename Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System/README.md to Pledge-Based Saturation Limit Under a Closed System/README.md --- .../README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) rename {Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System => Pledge-Based Saturation Limit Under a Closed System}/README.md (93%) diff --git a/Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System/README.md b/Pledge-Based Saturation Limit Under a Closed System/README.md similarity index 93% rename from Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System/README.md rename to Pledge-Based Saturation Limit Under a Closed System/README.md index 33b1e05180..df466b9a9a 100644 --- a/Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System/README.md +++ b/Pledge-Based Saturation Limit Under a Closed System/README.md @@ -1,6 +1,6 @@ --- CIP: 0045? -Title: Ouroboros Julius: Using Pledge as a Bidding Parameter to Determine Saturation Limit Under a Close System. +Title: Pledge-Based Saturation Limit Under a Closed System Author: Jay Pseudonym Cappucino Comments-URI: https://forum.cardano.org/t/cip-stake-decentralization-using-pledge-as-a-bidding-parameter-to-determine-saturation-limit/95936 Status: Draft @@ -11,7 +11,7 @@ Created: 2022-02-28 This proposal attempts to solve the ongoing stake centralization by allocating pool saturation limit in proportion to pool pledge while at the same time guaranteeing that the total saturation limit is always equal to the circulating supply regardless of the number of pools and pledge status, _i.e._, whether the ecosystem is under-pledged, fully-pledged, or over-pledged. The specification under this proposal is governed in a very dynamic manner using a set of well-defined equations which allows the staking mechanism to operate without the need for frequent network consensus. # **Motivation** -With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Staying true to the nature of **Ouroboros**, we describe a mechanism that uses pledge as a stake-bidding parameter under a **close system**, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack under this CIP is millions in pledge and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools **only**. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. We, therefore, posit that this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. +With the current saturation limit set at 68 M per pool and with 3119 pools (epoch 321), the current staking mechanism can accommodate a total stake of 212.1 B ADA (68M*3119). This amount of ADA is 543% in excess of the current circulating supply of 33B. Because of this substantial saturation limit, one can set up a few pools and offer lucrative rewards to capture a sizeable amount of stake (_e.g._, Binance APY is 17.7%). This leads to centralization and weakening of the ecosystem against Sybil attack. Staying true to the nature of **Ouroboros**, we describe a mechanism that uses pledge as a stake-bidding parameter under a **closed system**, _i.e._, the ecosystem total saturation limit is always equal to the total ADA in circulation. The proposed mechanism ensures that no single entity can get away with excessive stake without putting up a hefty pledge and expending for computing and related infrastructure. This expense, likewise, confers the ecosystem a very high resistance against Sybil attack. For epoch 321, the cost to conduct a Sybil attack under this CIP is millions in pledge and at least 1108 adversarial pools. We dare say that the cost to conduct a Sybil attack under the current protocol is 0 pledge in ADA and at least 177 adversarial pools **only**. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can be readily saturated using lucrative ISPOs and had been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. We, therefore, posit that this CIP is not only fair to all but also enhances decentralization and better security than the current protocol. # **Specification** ## **Nonmathematical Description** @@ -26,7 +26,7 @@ Under this CIP, there is no barrier to entry to set up a pool, but there exists - If there is still unclaimed saturation limit even after some pools have over-pledged, the unclaimed saturation limit will be distributed in accordance with Equation 1. - However, the distributed unclaimed saturation limit can still be claimed by any pool by continuing to pledge. * The ecosystem is in **equilibrium** when the **total saturation limit = circulating supply**. Under this condition, only the under-pledged pools can continue to pledge to take back the borrowed saturation limit that was supposed to be allocated for them. The over-pledge pools’ excess saturation limit, on the otherhand, will continue to decrease as under-pledge pools continue to pledge until all excess had been returned. This and the proposition from the previous bullet point ensures that: - - a **close system** is maintained, which means that the ecosystem total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully-pledged, or over-pledged. **TRULY OUROBOROS**. + - a **closed system** is maintained, which means that the ecosystem total saturation limit is always equal to the total ADA in circulation regardless of the pledge status of the ecosystem, _i.e._, under-pledged, fully-pledged, or over-pledged. **TRULY OUROBOROS**. - no single pool has a saturation limit that dwarfs other pools’ limits, encouraging decentralization. - since the ecosystem total saturation limit is always equal to ADA in circulation, the ADA delegation per pool will be more or less even. * Optimal pledge decreases down to a minimum as the total number of pools increases but increases exponentially as the total number of pools decreases. This mechanism addresses Sybil attack: @@ -133,7 +133,7 @@ Plugging in the values,
**Example 2**: **ecosystem is over-pledged**. -Here, we will provide the derivation for the penalty factor (**Δ**) and we will prove that it leads to a close system, _i.e._, the total saturation limit is always equal to the circulation supply no matter how under-pledged or over-pledged the ecosystem is. The penalty factor (**Δ**) has the following characteristics: +Here, we will provide the derivation for the penalty factor (**Δ**) and we will prove that it leads to a closed system, _i.e._, the total saturation limit is always equal to the circulation supply no matter how under-pledged or over-pledged the ecosystem is. The penalty factor (**Δ**) has the following characteristics: * **Δ** = 1, when the ecosystem is either under-pledged or at equilibrium. Under this condition, the excess saturation limit of over-pledged pools are unaffected. In essence, they are not yet "returning" any of the borrowed excess. * **Δ** ⟶ 0, when the ecosystem is over-pledged and under-pledged pools keep pledging. Under this condition, the excess saturation limit of over-pledged pools decreases and approaches zero. In essence, they are "returning" the borrowed excess. @@ -168,7 +168,7 @@ Dividing both sides of Equation 10 by the left-hand side and simplifying, we hav ![Equation10](https://drive.google.com/uc?export=view&id=1lQYewlKuCotMs0QQ8I3xJcc4rfddyHk3) -**Now, we will prove that Equation 11 guarantees a close system, _i.e._,** +**Now, we will prove that Equation 11 guarantees a closed system, _i.e._,** **Δ** **= 1**, when the ecosystem is either under-pledged or at equilibrium. **Δ** **⟶ 0**, when the ecosystem is over-pledged, and under-pledged pools continue to pledge.
From 6d10f5faee85152900a4a934c23dedd3cb9a2e13 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Sat, 6 Aug 2022 22:11:07 -0400 Subject: [PATCH 27/28] Update README.md --- Pledge-Based Saturation Limit Under a Closed System/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Pledge-Based Saturation Limit Under a Closed System/README.md b/Pledge-Based Saturation Limit Under a Closed System/README.md index df466b9a9a..507cf101d1 100644 --- a/Pledge-Based Saturation Limit Under a Closed System/README.md +++ b/Pledge-Based Saturation Limit Under a Closed System/README.md @@ -202,7 +202,7 @@ We consider a scenario where some pools turn adversarial (**_kadversarialadversarial_**) increases linearly with the number of pools (left figure). This observation is in line with the expectation that an ecosystem's security should become more robust as the number of pools increases. Unfortunately, this expectation is **not true** for the protocol currently implemented in Cardano. Notice the existence of a minimum in the plot (right figure) at around 1600 pools. The total pledge to conduct a Sybil attack at this minimum is 45 M ADA in pledge (when **_n_** = 15) and at least 600 pools turning adversarial. The total pledge to conduct a Sybil attack increases as the number of pools either decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the total pledge to conduct a Sybil attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the total pledge to conduct a Sybil attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. +We found that under this CIP, the number of pools needed to attack the ecosystem (**_kadversarial_**) increases linearly with the total number of pools (left figure). This observation is in line with the expectation that an ecosystem's security should become more robust as the number of pools increases. Unfortunately, this expectation is **not true** for the protocol currently implemented in Cardano. In addition, notice the existence of a minimum in the plot (right figure) at around 1600 pools. The total pledge to conduct a Sybil attack at this minimum is 45 M ADA in pledge (when **_n_** = 15) and at least 600 pools turning adversarial. The total pledge to conduct a Sybil attack increases as the number of pools either decreases or increases from this minimum. For epoch 321 at **_n_** = 15, the total pledge to conduct a Sybil attack is 52 M ADA in pledge and at least 1108 adversarial pools. We dare say that the total pledge to conduct a Sybil attack under the current protocol is 0 ADA in pledge and only 177 adversarial pools. This number of adversarial pools needed to attack the ecosystem under the current protocol does not change even if the total number of pools increases, unless the saturation limit (68 M) is decreased. These pools can easily get saturated by implementing lucrative (and maybe fake) ISPOs. This mechanism of stake centralization had already been demonstrated during the Sundaeswap ISPO which involved 98 pools that were at or near saturation. ## **_New Reward Structure_** This CIP describes a protocol that attempts to enhance decentralization but is vastly different from the current protocol that uses a reward structure which is a function of stake, pledge, and saturation limit. The current reward structure has known issues (described below) that is actually antagonistic to decentralization. While the current protocol is formulated based on game theory, the would-be protocol from this CIP is not. The reason is because there are only two decisions that a pool need to choose: to pledge or not to pledge, and these decisions are not influenced by the decision of any other pool. Here, we propose a simple reward structure (in general terms) that is fair to all. From d20a4cb6202fb1501e092f7b292df034aa6fe7c5 Mon Sep 17 00:00:00 2001 From: jycappucino <100645156+jycappucino@users.noreply.github.com> Date: Sun, 7 Aug 2022 17:09:30 -0400 Subject: [PATCH 28/28] Update README.md --- Pledge-Based Saturation Limit Under a Closed System/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Pledge-Based Saturation Limit Under a Closed System/README.md b/Pledge-Based Saturation Limit Under a Closed System/README.md index 507cf101d1..b3f0a2cd0b 100644 --- a/Pledge-Based Saturation Limit Under a Closed System/README.md +++ b/Pledge-Based Saturation Limit Under a Closed System/README.md @@ -107,7 +107,7 @@ Saturation limit decreases exponentially when **_pa_**<**_popta_**\\**_popt_**) is an integer division (example: 4\3 = 1). +* The function /\ must be defined such that if the quotient of two numbers is not an integer, the quotient is rounded off to the **next** integer (_e.g._ 4/\3 = 2 but also 6/\3 = 2). * **$\frac{(x-|x|)}{2}$** returns 0 when x is positive, otherwise it returns the value of x. * The first term in equation 3 (**blue** text) is the guaranteed saturation limit since the pool exceeded **_popt_**. * The second term in equation 3 (**red** + **green** text) calculates saturation limit in excess of the guaranteed limit.