Analysis of the prospects for Ethereum protocol technology upgrades (1): The Merge

Written by: Ebunker

Since October this year, Ethereum co-founder Vitalik Buterin has published a series of articles on the future possibilities of the Ethereum protocol, covering six parts of the Ethereum development roadmap: The Merge, The Surge, The Scourge, The Verge, The Purge, and The Splurge. This article will interpret the first part of the roadmap (The Merge) and explore what other technical designs of PoS Proof of Stake can be improved, as well as ways to achieve these improvements.

Vitalik believes that "Merge" refers to the most important event in the history of the Ethereum protocol since its launch: the transition from PoW Proof of Work to PoS Proof of Stake. Today, Ethereum has been a stable and operating PoS system for nearly two years, and this proof of stake has performed very well in terms of stability, performance, and avoiding centralization risks. However, there are still some important areas for improvement in proof of stake.

Ethereum's 2023 roadmap breaks it down into several parts: improvements to technical features (such as stability, performance, and accessibility to smaller validators), as well as economic changes to address centralization risks. According to Vitalik, this article is not an exhaustive list of improvements to proof of stake, but more of an idea that is being actively considered.

The main goals of the merger are as follows:

1. Single Slot Finality (SSF): Typically Ethereum blocks take about 15 minutes to finalize. However, the time required for finalization can be drastically reduced by improving the efficiency of Ethereum's consensus mechanism to verify blocks. Blocks can be proposed and finalized in the same slot, without waiting for 15 minutes.

2. Confirm and complete transactions at the fastest speed while maintaining decentralization

3. Improve the feasibility of staking for individual stakers

4. Improve robustness

5. Improve Ethereum's resistance and recovery capabilities against 51% attacks (including finality reversal, finality blocking, and censorship)

Single-slot finality and staking democratization

Currently, it takes 2–3 epochs (about 15 minutes) to complete a block, and 32 ETH is required to become a staker. This was originally a compromise to strike a balance between three goals:

• maximize the number of validators participating in staking (minimize the ETH required to stake);

• minimize the time to finality;

• minimize the overhead of running a node.

These three goals conflict with each other: in order to achieve economic finality (i.e. an attacker would need to destroy a large amount of ETH to recover a finalized block), every validator needs to sign two messages for each finalization. Therefore, if there are a large number of validators, it either takes a long time to process all the signatures, or very powerful nodes are required to process all the signatures at the same time.

This all depends on a key goal of Ethereum: ensuring that even a successful attack will impose a high cost on the attacker. This is what the term "economic finality" means.

There are counter-examples. Blockchains that do not have "economic finality", such as Algorand, solve this problem by randomly selecting a committee to finalize each time slot. But the problem with this method is that if the attacker does control 51% of the validators, the cost of the attack is extremely low: only some of the nodes in the committee will be detected as participating in the attack and punished. This means that the attacker can repeatedly attack the chain many times.

Therefore, if Ethereum wants to achieve economic finality, then the simple committee-based approach will not work, and the participation of the full set of validators is required.

Ideally, Ethereum wants to improve on the status quo in two ways while retaining economic finality:

1. Finalize blocks in one slot (ideally, keep or even reduce the current length of 12 seconds) instead of 15 minutes

2. Allow validators to stake with 1 ETH (from 32 ETH to 1 ETH)

The first point ensures that all Ethereum users can benefit from the higher level of security achieved through the finality mechanism. Today, most users cannot enjoy this guarantee because they are unwilling to wait 15 minutes; with a single-slot finality mechanism, users can see the finalization of transactions almost immediately after the transaction is confirmed. Secondly, if users and applications do not have to worry about the possibility of chain rollbacks, then it simplifies the protocol and the surrounding infrastructure.

The second point is to support individual stakers. According to multiple polls, the main factor preventing solo staking is the 32 ETH minimum. Lowering the minimum to 1 ETH would solve this problem.

There is a challenge: both the goals of faster finality and more democratic staking conflict with the goal of minimizing overhead. In fact, this fact is why Ethereum did not adopt single-slot finality in the first place. However, recent research has proposed some possible solutions to this problem.

How it works:

Single-slot finality involves using a consensus algorithm that finalizes blocks within one slot. This is not a difficult goal in itself, and many algorithms (such as Tendermint consensus) have achieved this.

A desirable property unique to Ethereum is (i.e., inactivity leaks): this property allows the blockchain to continue to operate and eventually recover even if more than 1/3 of the validators are offline.

Single-Slot Finality Proposals

There are several leading solutions to the problem of how to make single-slot finality work for very high validator counts without incurring extremely high node operator overhead:

Option one is brute-forcing, implementing a better signature aggregation protocol, possibly using ZK-SNARKs, which would make it possible to handle signatures from millions of validators in a single slot. For example, Horn is one of the proposals put forward for designing a better aggregation protocol.

Option two is the Orbit committee, a new mechanism that allows randomly selected medium-sized committees to be responsible for chain finality, but needs to retain the attack cost characteristics. Orbit exploits pre-existing heterogeneity in validator deposit sizes to achieve as much economic finality as possible while still giving small validators a matching role.

As shown in the figure below, between the range x=0 (Algorand committee, no economic finality) and x=1 (the current state of Ethereum) — — Orbit SSF carves out a middle ground:

1. The cost of doing evil is still high to ensure extreme security;

2. But at the same time, only a medium-sized random sample of validators is required to participate in each time slot, reducing the burden on nodes. Option three is dual staking, a mechanism with two classes of stakers, one with a higher deposit requirement and the other with a lower deposit requirement. Only the tier with the higher deposit requirement will be directly involved in providing economic finality. Various proposals have been made for what rights and responsibilities the lower tiers of deposits should have, including: the right to delegate stake to higher tier stakers; the random selection of lower tier stakers to attest and finalize each block; the right to generate inclusion lists, etc.

Each solution has its pros and cons and trade-offs for Ethereum's security experience and staking centralization: brute force can solve the problem, but it requires a large number of signatures to be aggregated in a very short time, which is extremely technically difficult; the Orbit committee needs to verify its security and characteristics, and formalize and implement it; the two-layer staking mechanism faces centralization risks, which largely depend on the specific rights obtained by the low staking layer.

In addition to single-slot determinism, single secret leader election is also an important issue in Ethereum's proof-of-stake system. Today, it is known in advance which validator will propose the next block, which creates a security vulnerability. An attacker can monitor the network, determine which validators correspond to which IP addresses, and launch a DoS attack on the validator when it is about to propose a block.

The best way to solve this problem is to hide the information about which validator will generate the next block, at least until the block is actually generated.

Single Secret Leader Election

Currently, which validator will propose the next block can be known in advance, which creates a security vulnerability: an attacker can monitor the network, determine which validators correspond to which IP addresses, and launch a DoS attack on the validator when it is about to propose a block.

The single secret leader election protocol solves this problem by using some cryptographic techniques to create a "blind" validator ID for each validator, and then giving many proposers the opportunity to shuffle and re-blind the blind ID pool.

However, implementing a sufficiently simple single secret leader election protocol is not trivial.

The simplicity of the Ethereum protocol is crucial, and it is undesirable to increase its complexity further. Simplified SSLE using ring signatures takes only a few hundred lines of canonical code and introduces new assumptions in complex cryptography.

How to implement sufficiently effective quantum-resistant SSLE is also a question. It may eventually be the case that the "marginal additional complexity" of SSLE will only drop to a sufficiently low level if we dare to try for other reasons and introduce a mechanism for performing general zero-knowledge proofs in the Ethereum protocol on L1.

In addition, faster transaction confirmation is also one of the problems that the Ethereum proof-of-stake system needs to solve.

It is valuable to further reduce Ethereum's transaction confirmation time (from 12 seconds to 4 seconds). Doing so will significantly improve the user experience of L1 and rollups, while making DeFi protocols more efficient. It will also make L2 more decentralized, as it will allow a large number of L2 applications to operate on rollups, reducing the need for L2 to build its own committee-based decentralized ordering.

There are roughly two techniques: reducing the slot time, down to 8 seconds or 4 seconds; and allowing proposers to issue preconfirmations during a single slot. However, it is not clear that reducing slot times is feasible.

Even today, stakers in many parts of the world have difficulty getting proofs fast enough. The 4 second slot time attempt risks validator centralization, and it is impractical to become a validator outside of a few geographically advantageous regions due to latency.

The weakness of the proposer preconfirmation approach is that it can greatly improve the average case inclusion time, but not the worst case. There is also the unresolved issue of how to incentivize preconfirmations.

In the face of possible quantum computing threats in the future, Ethereum needs to actively develop quantum-resistant alternatives. Every part of the Ethereum protocol that currently relies on elliptic curves needs to have some hash-based or other quantum-resistant alternatives. This proves that the conservatism in the performance assumptions around proof-of-stake design is reasonable, and is also a reason to more actively develop quantum-resistant alternatives.

Conclusion

The Ethereum proof-of-stake system is full of challenges on the road of technological evolution. Due to the high threshold for Ethereum's single staking, staking service providers led by Lido have become the first choice for Ethereum node staking, and the two-tier staking scheme also has a certain degree of centralization risk. In order to meet these challenges, single-slot finality and staking democratization, single secret leader election, faster transaction confirmation, and the development of quantum-resistant alternatives are all important issues that Ethereum needs to deal with.

Vitalik has comprehensively considered the "The Merge" upgrade and proposed as many technical solution combinations as possible. He discussed the design potential of Ethereum's PoS technology and the potential technical upgrade paths that are currently feasible.

In the process of technological upgrades, Ethereum is still working hard to explore and innovate, weighing and choosing between different technical solutions to find the most suitable development path and achieve higher security, performance, and decentralization.