04.05.2024

Welcome welcome. New York. today. thank you. hi everyone. um so you know I'm not sure how much. everyone is familiar with kind of our. research over the last few years. um we kind of. are working in broadly in this field. that we kind of call it crypto economics. which is applying mechanism design to. distributed systems problems we. basically want to use like incentives to. take distributed systems and secure them. and make them available to the public. internet. um kind of like Bitcoin did for. consensus but for all sorts of types of. problems and basically out of this. research you know it's come a bunch a. bunch of different work and like one of. which is like proof of stake right where. we want to kind of apply you know uh. kind of reasoning about economics and. incentives and mechanism design which is. like the design of incentive systems to.

Consensus protocols and we've come out. with like a whole bunch of results in. our research and. um you know I think today we're going to. give you kind of an a. you know a current state of the kind of. art like or slash bleeding edge. uh and and and and talk about and maybe. feel like any questions that you have uh. so proof of sake is specifically you. know a problem about consensus which is. a kind of very difficult thing and about. like you know incentivization and. mechanism design which is also a very. difficult kind of thing and so you know. things you know we might get in into the. weeds. um but you know if you have if you have. a question that you don't think will you. know derail too much like please go and. ask. um so you know I would say that like. kind of uh nominally speaking the way. we're kind of talking about a lot of.

These a lot of Casper stuff now as we're. talking about you know Casper the. Friendly what because there's like. different. things that are coming out of it and so. we haven't kind of Casper the Friendly. finality Gadget which is kind of what. Carl spends a lot of time implementing. on on Pi ethereum nowadays. um and it's kind of the first part of. our rollout plan and this basically is a. overlay on top of a blockchain that. finalizes the state of the blockchain so. it can't be reverted. um and then a lot of my research focuses. on uh these these kind of. um correct by construction consensus. protocols that are designed to have like. asynchronous safety and certain certain. properties. um you know in in term in terms of the. safety proof that they that they that. they satisfy uh and and I kind of you. know. have worked on a few like you know I.

Have like Casper the uh the friendly. binary consensus protocol Casper the. Friendly ordinal consensus protocol. Casper the Friendly Ghost and now I have. like a new one uh Casper the Friendly. arbitrary rewrite system replication uh. not that you know that's a great name. yet. um vitalik also has this great result. that I think it's like a significant. contribution to consensus literature. that shows how to uh rotate validators. in real time very very very quickly and. with the safety proof. um. um and so kind of those are high level. some of the stuffs that we've done on. the consensus front. um and then tying consensus to economics. is kind of a tricky thing. um because like the consensus protocol. space corresponds to like the strategy. space for the the the various players. normally because those Protocols are.

Defined in terms of like a certain fault. tolerance assumption. um and. you know we we to some extent we we also. do that like I was in the finality. Gadget but we have to make sense make. sure that when there are faults that we. know who's done them right we care kind. of deeply about fault attribution we. want to know that when there is a fault. we know exactly who uh committed the. fault and in order to make sure that. like say if there's an attack people who. are guilty pay the cost of in their lost. deposits and this kind of the security. model right so now I'm kind of moving a. little bit absolutely moving from like. consensus stuff to talking about more. like incentive stuff right so the way. proof stake works and like the security. deposit world is you place a security. deposit to participate maybe you have to.

Queue up first and get selected out of a. or select get selected out of a pool but. eventually you end up in this game where. you're kind of playing the consensus. game you know you're trying to come to. consensus with everyone and uh you know. if you if you're observed to behave in a. faulty way that's gonna lead to some. penalties which going to mean like some. loss of your security deposit and the. security model basically is that like a. normal case we kind of pay interest for. like normal Baseline like all honest. nodes like very minimal loss and. security deposits but when an adversary. comes along and like attacks the network. they end up creating a lot of faulty. behavior and end up bearing a very large. cost themselves and so this kind of. shows you a big asymmetry between. you know proof of stake improve work or.

Proof work people are always consuming. more than the attacker ever might as. opposed to here we're consuming a little. bit and then the attacker could spend a. lot of money when they attack. and so somehow this is like the high. level picture you know you play security. deposits do we detect deviations from. the consensus protocol you get penalized. for them. um you know for a whole bunch of. different consensus protocols uh and so. so now like you know I'm gonna pass the. mic to Carl and maybe we'll get some. updates or something. so before we will get some updates but. first disclaimer I just had two wisdom. teeth removed so please bear with my oh. man so I do need the mic dang it okay. I'm gonna try to speak really loud and. not rupture get a dry socket however. um the the other thing is I just wanted. to ask a question to Vlad which is.

Commonly asked and I think it's an. interesting result which is. um why are we using security deposits. and then taking them away versus like. rewarding Behavior right so in other. words you can have like a consensus. protocol where people are coming to. consensus because they're continually. being rewarded for coming to consensus. or you can have a consensus protocol. which has some kind of you know security. deposit which can then be taken away and. you know if they don't come to consensus. right so like I I think it's an it's you. know interesting little tidbit which you. kind of mentioned. sure. so basically for any given fixed amount. of Revenue I can make like a protocol. that uses deposits that is like kind of. strictly speaking more robust than one. that doesn't use deposits for like the. same amount of Revenue and so to me like.

You know if you if you say how much. revenue you want I can like say okay. we'll provide deposits to earn it and. it's like somehow more robust. um and and you know. um I I think I risk sometimes getting. caught in some jargon. um uh and so I think I think maybe like. you know we should take a step back and. see. um whether people uh you know whether. people like understand certain terms and. maybe we can like Define them. um so so that you maybe maybe we're. have a little more grounding. um so here so here's kind of a question. do people know what we mean when we say. something like. um. uh consensus finality or like a. finalized block who thinks they really. know for sure what we mean. um who who knows for sure they don't. know at all. okay so we're not we're not doing that. badly. so so basically uh there's there's.

Traditionally consensus protocols you. know when concerned Support called. literature we don't talk about finality. and so we just have this notion of. decision where like a node decides on a. value and somehow whenever a node. outputs a value it's kind of a final. decision and all and the safety property. that consensus protocols normally have. is like any two nodes that are following. the protocol will output the same. decision and that's kind of like this. trademark of consensus traditionally. speaking but blockchain's kind of kind. of you know didn't do this right. blockchains had these kind of these. things that aren't really quite. decisions they're more like estimates or. guesses that maybe will be reverted. later if you see like some more proof of. work chain. and and and and and when we're talking. about finality in the blockchain space.

So we're really talking about is like. the same thing that consensus protocol. researchers normally call decisions. namely they are like. um commitments to values of the. consensus that are not going to be. reverted by that node ever and so to. understand finality you have to. understand that finality is somehow. foremost a subjective. decision for that your node will not. revert behind some block imagine if you. reprogrammed your Bitcoin node to say. like after six confirmations I will. never revert like I'll never accept any. block any blockchain that has more than. like you know that starts from from more. than like six blocks down. um now now you know to be making these. like kind of decisions that kind of. irreversible decisions and you would. have finality however you know whenever. you have finale this is there's this.

Risk that's called consensus failure. where maybe two nodes will make. different conflicting decisions. um and and then and then you know. um we kind of have throw around this. notion of like economic finality which I. know that uh Carl wants to talk about. uh. sure so. um the we have this concept of economic. finality and so I. um basically the the one liner that. actually credit vitalik for this is that. economic finality. um. is basically that you cannot revert. changes. um in the blockchain state you know like. you can't revert the history without. paying some really high cost right so it. basically costs a lot of money to revert. the history and and you know you can. there's some there's some clear. intuition why this is the case or why we. would want this because essentially if. we're using the blockchain as a shared.

Distributed Ledger we don't want our. history to suddenly change right you. don't want like suddenly Napoleon didn't. lose Waterloo or something like that you. want to make sure that your history is. consistent so. Casper is very different from Bitcoin in. that Bitcoin does not actually have any. builtin guarantees around economic. finality so what Vlad was just talking. about where um you know you could have. it in your Bitcoin node that after six. confirmations you'll never change so. that's like you know your choice but it. would require a hard Fork to make that. those rules well maybe software but make. those rules. um you know. widespread that everyone agrees on that. so instead Casper actually has and that. would provide some kind of like finality. but that wouldn't even be economic. finality that would just be kind of.

Weird. um but really what's happening in. Bitcoin is you can actually revert any. history as long as there is a longer. proof of work chain right and with. Casper that is not the case in Casper if. you were to change the history AKA. equivocate then you will lose uh there. will be at least one third of the. validators deposits get slashed so I. don't know there's not going to be. enough context for that but just like. the general idea of like you will lose. money and like the reason why Bitcoin. doesn't have economic finality is. because there is it requires a budget to. change the history right so it requires. mining a bunch of blocks and so it does. require some kind of budget but it. doesn't actually incur any economic cost. to revert the history that is like the. key difference right so there is a. there's an explicit cost in the protocol.

For Casper. the the sense in which it doesn't. require a cost in Bitcoin is that you. can be profitable and conductable spend. so like if you have a majority Coalition. you can you know mine a lot heavier. chain and revert some blocks at a kind. of at an economic kind of game. um and and you know uh so and even if. you say believe that no adversary will. ever have more than 50 percent somehow. six blocks is doesn't isn't actually. that that high of a cost compared to say. something like uh something on the order. of the total amount of deposits placed. for the same amount of Revenue. um if you would imagine like 12 and a. half Bitcoins per block as revenue for. like as interest on reposits like that's. potentially like a ginormous amount of. deposits. um and like I you know I hope no one. ever pays that much for consensus.

Because I think at some point uh you. know you if you pay too much for. security becomes a security racket. and I think that's kind of like a. concern so like one of the things we. argue about is like how you know to to. like how much. security is enough security like how. much do we want to pay for security you. know like because people have different. appetites for failure like I'm kind of. relatively happy to have the consensus. protocol fail because like we understand. the failure modes and we can recover and. if and imagine if like okay we choose. between like paying 100 100 times more. and having a failure every like six. years or paying 100 times less and. having like one every like six months. you know somehow. there's a big it's a big factor there. like it would be maybe nice to like have. a big discount uh and so we kind of we.

Do we do kind of argue about some of the. you know how much we should how like. what is what should be the cost of. consensus but in terms of like the basic. principle that like you know. um when consensus failure happens there. needs to be a huge amount of like. security deposits lost I think is kind. of very much like you know uh I mean we. all we all very very much agree on that. um and and you know so so I kind of. tried to tell you about like finality as. it relates to traditional consensus. protocols and now all kind of bosses it. relates to the economics of of this kind. of proof of stake protocols. um where basically like instead of. thinking just about uh say like the. number of faults we think about the. amount of like cash that needs to be. lost. so that's that that's kind of like maybe. some key terms.

Um another another kind of interesting. um. uh key key kind of concept is uh that of. like griefing and nonattributable. faults. um so there's there are fundamental. limits to the attribution of faults in a. distributed system you can't always know. if Alice was meant to send a message to. Bob whether and it didn't appear to have. happened whether it was Alice who who. failed to send a message or whether Bob. received a message and omitted it. and so we basically have this kind of. fundamental limit to the attribution of. certain types of Byzantine faults. and this means that if we want to. penalize these faults. um that we're going to have to sometimes. penalize people who you know may not. have done it. um and and so so we kind of have this. this interesting tradeoff where if we. want to have any kind of robustness.

Against. um against like an adversary that is. that can bribe our participants then uh. we have to introduce some amount of. unfairness with respect to uh people. getting penalized even though they're. they're they're kind of uh acting in. good faith. uh so it's kind of it's kind of like you. know uh when an elementary school. teacher holds the whole class and. penalize the whole class one because. they when they won't mess up as to who. you know put the gum in the in her glass. you know uh is it's effective it's an. effective deterrent uh but uh you know. it's it's it's it's also like you know. some students feel like it's unfair and. so we have this tradeoff and ends up. being a super interesting tradeoff. because basically fewer security. deposits will show up if you hold them. more to account for behavior that uh may.

Not be actually their their fault right. um and but if you don't hold them to. account at all all of a sudden you have. a scenario where uh censorship is free. actually because like we can't tell if. these nodes who are off the line have. been censored or have or are just. offline in good faith you know and so. somehow. um or like you know on of their own. accord as opposed to being appearing to. be offline because there being censored. by the cartel and so we can you know we. kind of need to choose between uh. penalizing the cartel. and between uh you know or and if we do. that sorry if we or and not penalizing. them if we don't penalize them there's. no security but if we do penalize them. then suddenly an adversary couldn't say. take some control of a minority of nodes. take them offline and penalize everyone.

Else. and that's kind of introducing this kind. of unfair Factor where you think the. protocol thinks you're censoring but. really you're not and so you kind of get. penalized right and so it turns out that. like we can in in like any adversary in. like a particular class of adversary. models we can optimize this tradeoff in. order to like maximize the robustness of. the protocol. um and so that's actually another key. term I wrote with the robustness so so. um we talk so sometimes we talk about. let's let's talk about stability first. so now we're talking this is we're. talking about kind of like more. mechanism design game theory Notions so. so like uh we're gonna say that like a. crypto economic kind of protocol is. stable if following the protocol is an. equilibrium under some notion perhaps. like a national equilibrium or strong.

Nash equilibrium or perhaps some other. notion of equilibrium. so and then the next one is kind of. robustness which has to do with uh how. big of a perturbation to the payouts can. the protocol withstand while still being. in equilibrium. um and and and so basically if the. highly robust protocol you need to spend. a lot of money to change the equilibrium. um and and what we want well there's. kind of this great result that says that. like you know um. in an incentive model for people to. deviate from the protocol. um there has to be an external. external incentive at least the size of. the robustness. so somehow the robustness place is like. a minimum amount that must kind of be. spent by an adversary in order to. compromise the protocol and so. maximizing the robustness maximizes the. size of the extra protocol incentive.

Required to undermine protocol. guarantees and so somehow we can pull. against pull away from X protocol. incentives just by looking at the. robustness without actually thinking. about explicitly what is going on next. protocol. um and so you know Etc except for in our. adversary model which may involve stuff. like a distribution of like. um interest rates which validators will. accept I.E for it to be individually. rational for them to participate. um so that we can kind of model the fact. that like fewer of them will show up if. we penalize more. uh and so somehow there's this ideal. attack uh where basically the attacker. what they do is they they first they. enter the market and they and they. operate at a loss in order to make. everyone else operate at a loss and then. when the size of the market gets smaller.

They kind of jump in and take and have. and have like a huge huge control like. you know super majority and then execute. there's like censorship attack or. whatever whatever they're kind of up to. and this actually turns out to be like a. relatively Universal kind of attack like. you can pull this attack off on like any. cryptocurrency where people have. significant expenses because like you. can operate at a loss make them operate. at a loss shake the mining pool until. you get to a point where you know you. have a majority and and you don't. actually necessarily need to incur that. big of a loss to do this. um it can actually be a super super. efficient attack and you also see it. kind of in you know. economies outside of the of. cryptocurrency or people where people. will engage in kind of um competitive. pricing or anticompetitive pricing more.

Like where they'll kind of operate at a. loss in order to put their competitors. out of the market. um in order in order to like be able to. take a majority majority of the power in. the market. and so we have like a similar attack. model here and we want to like kind of. so so kind of like take this take this. attack model and try to maximize our. robustness against it in order to. parameterize these kind of payouts. there's like one way that's kind of the. max payouts way but vitalik actually has. this other type of analysis that he. calls briefing factor analysis what he. prefers to do is to kind of like. maximize maximize security but also not. keep the unfairness too bad right. Metallica is quite quite a lot about. fairness and I think so do many many. people and so we can measure fairness by. looking at these things called griefing.

Factors. so a griefing Factor refers to kind of. how much I can lose how much money I can. lose in order to make you lose money. uh so if I like to me if I lose a dollar. how many dollars can I make you lose. um and it's kind of a pretty uh. important notion because it is very. related to this attack where you drive. people out by operating at a loss. um so griefing Factor so so you the. other thing we can do is say Choose The. Grieving Factor bound that we want and. then maximize robustness. um so basically you know so these are. these are like some some of the key. terms we have like you know more. but I feel like I should open up open. the floor up to question. the questions and see see how everyone's. feeling about this so far. sure. so the question is with validators or. rotations how do we penalize people who.

Claim to be different people but are. actually one. sure. um so basically there is no like. inbuilt civil resistance right so like a. a a large Staker could technically you. know own 90 of all eth or something open. you know become a bunch of different. validators break their things up into. one percent chunks and then you know. have maybe 34 of their valid their their. security deposit chunks. um equivocate right so basically the the. the really what should happen probably. is uh like you should see. um. someone who wants to equivocate will. equivocate with the minimum amount of. loss possible. um. and so with with that kind of your your. comment in mind that's kind of evidence. that it probably will happen around 34. right or or uh I mean uh 60 67. um 34 would be the amount uh slashed. um yeah. another thing we should probably say.

About validator rotation is that kind of. what ends up happening is that each like. each validator set kind of like the. current one and the next one sign off on. the transition. um and each of them even if you're. signed off like your deposits are kind. of held for a while and so if there's. evidence that you behave badly uh that. appears kind of after a delay you could. still get you can still get penalized so. like the moment you rotate out your your. kind of scotfree. um it's more like they need to each sign. the kind of validator rotation event but. it ends up being the same block uh but. they don't need to technically sign all. of them right. yeah so so yeah essentially okay so the. way the validator rotation works really. quickly is essentially that you can you. can read up on exactly why this is the. case in the blog post uh Dynamic.

Validator rotation. um by vitalik but essentially the the. kind of intuition is you need two blocks. to be finalized in a row to have the. validator set switch so if you're so. yeah so essentially what that means is. like your block needs to be aware that. the previous epic or Epoch. um that that previous Epoch was. finalized that's why and and you need. they also that the your your Epoch also. needs to know that that Epoch is. finalized and the reason why that is the. case is because you don't want here's. what you don't want you don't want two. different validator sets being able to. like kind of be created and then Fork. the network and then you don't know like. which Fork to choose and you don't have. the ability to attribute which one is. the actual like equivocating validator. set right you need the ability to to to.

You know be attributable. um and so what that means is you just. need that like two in a row finality. there's kind of like a mutually consent. thing handshake where they kind of you. know it's clear to everyone that this is. that the torch is being passed like. everyone signs off on it and like. there's no way for someone to like kind. of say later that the torch is passed in. a different way without kind of being. shown to have like kind of lied about. lied about the process. um so any more questions I mean there. should be there should be more questions. yeah. yeah so the question was uh how much is. behavioral economics inform our research. and basically. um you know we I mean I've personally. been reading about behavioral economics. like quite a lot over the last like four. months uh especially because like I've.

Noticed that is like kind of part of the. debate and I kind of so there's there's. a few ways that it's interesting like. one of them is like you know there are a. bunch of interesting results that will. affect kind of whether humans decide to. play the game. um but there is also a way in which. behavioral economics is kind of a little. bit further removed from our setting. than is kind of usually the case because. what we're asking people to do is to. like run software without modifying it. which is behaviorally it turns out the. easiest way to get someone to run. software uh and and and if they and we. kind of also have to make it so that if. they modify the software they'll be less. profitable and so it's kind of and we. kind of like try to show that and so. that like they don't even bother to. modify the software so basically somehow.

Because the software is proxying their. behavior. you know the on the place where the. behavioral stuff really matters is the. the step where they decide whether or. not to run the software except where you. decide whether or not to be a validator. not so much the question of whether how. your validator behaves. um and and but you know more broadly. speaking. um. you know I think behavioral economics is. super important for mechanism design and. I think people really under appreciate. the kind of. um. ease of use requirements for mechanism. design in uh and you know in ethereum. contracts like people design mechanisms. that are really complex and have no you. have no real reason to believe that. behaviorally it's going to work out even. though in some kind of rational model uh. you may have some result. so I think that you know as like a.

General point for the crypto space like. looking at behavioral economics is great. as from the point of view of like the. lower level blockchain protocol where. you're not really asking people to make. sophisticated choices just you're just. asking them to like run run some. software and then keep it online. um I think it maybe matters a little bit. less so maybe something for something. like. um. for something like maybe uh a prediction. Market it would maybe matter a lot more. than for something like say. um a market for uh you know renting out. your storage space. um because like renting out your storage. space doesn't require that you really. make any decisions within flip a switch. whereas like the prediction Market. requires that you like make judgment. calls and somehow maybe default use. weird user experience quirks might lead.

To behavioral things. also like you know there's like these. effects about low probability events. yeah one one thing to like add on not. necessarily exactly related to the. question but. um generally speaking like the the the. the focus of writing these smart. contracts should be in like designing. good mechanisms and thinking about like. economics and doing this you know crypto. economics. um uh you know applied crypto economics. essentially right so you you're going to. be defining mechanisms and these the. reason why you have to think about it as. like I'm defining mechanisms rather than. I'm writing some software it's because. the actual implementation of your. mechanism is not going to be that. difficult right it's you really have to. consider it as like I am defining. legislation for you know large uh. companies right that's more like uh.

Similar to the kinds of thought. processes that you have to go you know. go in considering rather than like oh. how do I you know iterate over a loop. really efficiently. um so more questions. yeah yeah so why can't validity has. provided proof of censorship well it. kind of has to do with the kind of. fundamental limits to. um the attribution of faults that I was. kind of talking about earlier so. basically at the end of the day. there's no way that like censorship can. be can be identified or can be. distinguished from like extreme delays. um and so you know but if you if you. allow yourself some synchrony summations. then all of a sudden some of these. proofs can start to shape up and you can. start to be like okay if you manage to. post the hash of the preimage of. something that like you know somehow. maybe that will help you show that you.

Um that you would that you were censored. um but. um the other thing is that genuinely. these things are quite hard basically. locally you can tell you might be able. to tell uh but like oh look my. transaction isn't getting in but from. the point of view of a smart contract in. the blockchain. uh you only get access to transactions. that get in and so somehow you're kind. of really really Limited in a. fundamental way but you know that said I. think there are lots of I have. interesting avenues for using cool. crypto tricks and stuff but basically we. also have to make sure that like we. don't spend a lot of time on like. complex protocol features when like. there's still work to do on like more. core questions but but you know uh. sensitive resistance is really tough and. interesting uh what may be perhaps one.

Of the more interesting ways to solve it. is to use like some kind of time lock. crypto thing where like imagine if. everyone were to use timelock crypto for. publishing their transactions their. transactions would get in encrypted and. then later create an obligation to. process them by the validators after the. time lock runs out uh and if everyone. does it it's hard for the validator to. kind of know. how to censor them in a targeted way but. that's kind of like a crypto application. rather than an economic one and it's. also something where it's going to delay. everyone. um because everyone has and it's going. to cost all this like proof of work. essentially that's required for timeline. crypto. um. so yeah I guess it's just hard and uh. but you know. if there was anything really obvious and. easy to do and I think we would we would.

We would know but if but I I hope you. know you'll tell tell me anything. anyways if you have any ideas. go ahead. yeah yeah I haven't. yeah so the question is uh how does how. does like the extra protocol incentives. like said maybe like a double spend. affect the analysis for the security and. basically there's there's kind of two. two kind of layers one of them is to say. that like you know like just like I were. saying earlier with speculative. robustness like as long as the incentive. is smaller than that then it's fine and. if it's bigger than that then like kind. of we don't know and then we might have. an issue and this kind of is like. fundamentally going to be a problem for. stuff like uh these classic. nonattributable faults which we call. liveness faults. um it's going to be kind of impossible. to to do any better than that however.

For uh finality uh we can do really a. lot better uh once once once once. something's been finalized uh there's. like you know you don't really get to. double spend that I mean like kind of by. definition uh like you can't convince. these nodes that they to accept anything. else it doesn't matter how much money. you spend and so after finality the the. analysis changes completely basically it. has more to do with. um. like I mean basically at that point what. you have to do is kind of partition the. network show some people one version of. history on other people the other. version of History so that later when. the social consensus kind of discovers. that there's been a consensus failure. they Fork to the one that you want. and so you kind of need to like seed it. see disagreement in the community about. which is the finalized State and then.

Tip it in your in the in order to you. know kind of do your double spend and so. you can so we're talking about uh to to. attack finality we're really talking. about uh an attack that's like kind of. more than just uh. uh spending money in the protocol attack. right we're talking about kind of a. extra protocol decision about how. consensus failure is managed because the. only way for you to say convince someone. that their money is finalized and then. have it unfinalized is to cause. consensus failure which requires extra. protocol uh kind of boot for at least. like some half of the network and. somehow you have to kind of hope that. the community won't go against you and. basically what ends up happening is then. you have to do a supermassive. transaction like way larger than like. the total mass amount of deposits then.

You would wait not just for in protocol. finality but also for extra protocol. consensus in the community about the. fact that we all see the same final. estate because if you can get that then. the probability of someone being able to. set up a situation where the community. disagrees about which is the fine line. state that they observe first and the. picks this other one is much smaller and. so basically if if you wait for in. protocol finality and then like chat up. your friends. um then you know you're you're looking. really good in terms of and like in. terms of like arbitrary budgets being. spent to revert your state and so after. finality you know you're doing it's. great but but if you're saying like Okay. I'm trying to do the clear like a. billion dollar transaction and they're. like just doesn't get in like that can.

Happen because like maybe the incentive. to delay that transaction is higher than. the. um robustness of the censorship property. and censorship doesn't have this kind of. neat subjective finality kind of uh. property. and one one quick thing to add is. actually this is where like lightning. networks or some kind of like value. being held off chain and then settling. on chain this is where like some of the. limitations start to be shown right so. if you have some real reason to censor. the the settlement on chain then you can. you know cause Havoc. um but one good thing is that in the you. know in your smart contracts you can. just say once there is Casper the. Friendly finality Gadget and further. iterations you can just say hey has the. blockchain been finalized for this. transaction okay it has then you know. good we're set.

Yeah. okay great. oh well uh you know he's trying to make. this a show he's trying to make this a. showdown but I won't but but I won't let. him we work on different stuff I mean. you know we I don't know do we have deep. philosophical disagreements Carl. generally not I'm a huge fan of lad hard. Fork to you know save the world and like. I think and and mechanism design and you. know all that kind of stuff like I got. into proof of stake a large part because. of Vlad also vitalik and like you know. mainly because of Vlad let's be honest. um and so not really any disagreements. maybe the only difference is is like I'm. more of like implementer and you know. aspiring to to you know write some. research papers but you know we got to. get kind of stuff done so I'm like. trying to get it through and Vlad is you. know researcher and going ahead but I.

Can let him speak for himself. yeah I think Carl pretty much said it. all. anyone else. yeah in the back. though I didn't mean you Christian. yeah yeah yeah yeah I'm familiar. right so the question so so the question. is have I looked at recent papers like. algaran and Snow White and how much has. that gone into this stuff and the answer. is uh you know I've I've looked at them. like you know in a cursory way enough to. tell that they're like not solving the. same problem that I'm solving and you. know I've talked to the authors and like. they are like very kind of clear that. like they you know aren't solving a. mechanism design problem They Don't. Really Care uh if we have like an. equilibrium to follow the protocol when. all the nodes are rational they only. really care about it in the context of a. majority of the nodes being honest it's.

Kind of this there's this bifurcation in. the cryptocurrency space between people. who believe that designing blockchains. is a is a Byzantine fault tolerance. problem and people who believe that. designing blockchains is a mechanism. design problem. um these people really believe that like. the reasoning about incentives is not. core to the problem right their proofs. are not really about incentives. sometimes you know you might get like. this you know a national equilibrium in. the context of like you know. um majority honest but none of these. papers and there's like also oroboros. there's a few of them who are kind of. aiming to be like you know provably. correct for mistake protocols like none. of them use security deposits. um all of them have a majority correct. assumption. um none of them really uh are are.

Looking at this as a mechanism design. problem they're all looking at it as a. consensus and distributed systems. problem uh and and this kind of really. like this this is this bifurcation is. like something that you know where where. we kind of like split off from like this. crowd like years ago. um and so our work doesn't look a lot. like theirs sometimes sometimes it looks. a little bit similar in the sense of. like you know. you don't have any protocols for. selecting who should make a block next. um but um and then we might care about. the fault tolerance of that but like the. primary primarily it is primary design. kind of questions for us are like you. know okay is following the protocol in. equilibrium you know under independent. choice is an equilibrium under. coordinated Choice like how much like is. this withstand against like some.

Rightwing adversary that kind of tries. to pay people to deviate from the. protocol and these Proto these kind of. you know 100 rational models. um don't sit well with people who are. kind of like you know super well versed. in consensus literature because they. kind of are used to do using Byzantine. fault tolerance analysis which is really. quite different. um so you know I I think there's a big. gap between like our work and their work. and there's like a there's like a real. reason why like you know I'm not asking. these people for help. I like that response I also did. um I also wanted to just add. um I feel like there's a different kind. of sentiment when you're building a. protocol that is going to be deployed to. a network which has built which is. securing billions and billions of. dollars in value and like writing a.

Protocol which theoretically could. secure billions and billions of dollars. of value because it's like you worry. about certain things a lot more and so. it's it's terrifying to think oh you. know someone could just come in buy up a. little bit of the coins and totally. wreck the protocol right you know or. come in and you know run up a couple. minors and totally wreck the protocol. like these are considerations that are. like Forefront in Vlad and vitalik's. minds and now you know mine as well. right so. go ahead yeah. sorry the uh can you repeat that and. catch. oh yeah so the question is does proof. steak have like you know is use. broadcasting or like peerto-peer. communication and and you know at the. moment we're just using broadcasting uh. but definitely uh we're gonna need to. move to something more like uh you know.

Kind of a kind of like targeted. multicast for sharding. um but uh but you know that is. absolutely interesting and uh you know. most of the time we kind of we kind of. like think of ourselves above the gossip. layer. um. but don't really assume too much about. the gossip player but but but definitely. it's something that's interesting to me. especially especially in the context of. sharding. um in in a single blocking everyone. needs to see everything anyways and so. just the broadcast model is kind of kind. of cool. um what do you mean by Casper. sorry the question is how far do we. think Casper is going to be delayed and. basically like you know there's a bunch. of different protocols that we're. working on. and if you're talking about like you. know the one that is going to be. released the soonest I don't know not.

Very not not not as much as people think. maybe. so I answered this very delicately in a. recent talk uh relatively recent I don't. think it doesn't make sense to put. timelines on anything but we're you know. making great progress and like you know. the spec is really you know very close. to I mean it's. I'm not even gonna repeat it's just this. is such a touchy subject especially for. these kinds of things. it's soon but. how soon. yeah so the question is like do I know. what the EOS people are trying to do and. basically they have this thing called. delegated proof of stake. um you know bite master has been on it. for a while and it basically is this uh. State protocol where the coins vote on. Whose delegates are who like run the. consensus protocol and it's basically. like a small number of delegates and the. security model is basically that like oh.

If delegates are bad they'll be voted. out. and you know. um it basically is. uh there's a couple of things that I. like that like give me like serious. problems with with this protocol one of. them is like the fact that if I if I if. like in any of my models it doesn't have. any robustness because I can bribe all. the voters because it's not it's not. it's not like coercion resistant voting. it's like voting where you see. everyone's votes and so like you you can. really just pay people for votes. um another thing is like okay you know. there's basically a beauty contest to. figure out who's going to be the. um the the the delegate and you could. easily probably participate in multiple. slots in the beauty contest really the. main the main thing is that somehow the. the the the. the the system is in the hands of coin.

Holders who basically have nothing at. stake from the point of view of like. security deposits being lost all they. have is like momentary ownership of. coins as far as like the protocol is. concerned and somehow like you know I. don't trust people. you know kind of generally as like a. cyberpunk thing but also more. specifically like coin holders there's. like a there's kind of this like. power law distributed just distribution. there's like you know probably like 20. dudes at most who control like 89 of the. coins and they they basically like. you know I I I don't know that I want. them to be appointing the delegates. um I I prefer systems that are kind of. um much more. uh pessimistic about like the interests. of coin holders. uh Rick. hey Rick I need to repeat everything you. say on this mic. no all right. is this like for the internet or.

Something okay cool so to answer your. question even though you're over there. and I was closer before. um jayquan made a really good analysis. uh basically demonstrating that dpos. wasn't uh Byzantine fault tolerant. um so for me it's one of those things. where a lot of times we'll we do. analysis or we're looking at a protocol. and at some point you're like wait a. second this isn't Byzantine fault. tolerant and you're like well but it. hasn't been hacked yet right so you know. if they've made their millions of. dollars or whatever and they don't get. hacked then. you know they didn't really need the. Byzantine fault tolerance in the first. place so so I mean Vlad gave a much more. uh a less colorful. yeah thanks Rick that was great. um so basically defos apparently also. has problems on the consensus layer. rather than just on the kind of.

Incentivization layer right it's like. the like the fact that the protocol. isn't. you know business need fault tolerant. independent of the process for choosing. the delegates is like you know a. potential other issue uh and it's. probably almost surely like it means. because it's making a blockchain it's. not safe in asynchrony uh we've known. for a long time like kind of as like. collectively a society or like you know. narrowly people in this narrow field. distributed computing uh how to make. asynchronously safe consensus protocols. which basically will where like where. like after you make a decision like you. know no matter what the. time does uh it's it's kind of still. cool uh and and most blockchain. consensus protocols actually don't have. asynchronous safety and that's what I. think one of the big issues uh from the.

Point of view of like you know uh gaps. between like optimality and current. practice that we see. um yeah one more questions oh. sure so uh the bribing attacker model. Carl wants me to go over it real quick. is a model where basically like there's. a there's an adversary that what they. would they directly affect the players. payouts by by promising an incredible. way to pay them if certain things happen. um from their budget. and and these promises to pay can. sometimes lead to really efficient. attacks where you know. um so for example with work you promise. to pay them if the if the proof of work. attack fails and then like if a majority. of them go with it because they'll be. paid either way then the work attack. succeeds and the attacker doesn't have. to end up paying anything. um so the bribing attacker model is.

Super interesting and useful. um. because uh it's one of the it's like one. of the simplest like most tractable. models for thinking about Economic. Security. um so certainly the the first one that I. really you know had a had a lot of fun. with. a kind of uh note on like the great. thing about blockchains is they make it. easier for humans to coordinate and so. basically like the bribing attacker. model is just like it also makes it. easier for bad guys to coordinate and. you know creating a system where you can. deploy arbitrary code on the network. opens up these security vulnerabilities. that maybe weren't there before just. because it was too hard to coordinate. before you had these smart contracts. so this story there may be that like you. know with a smart contract you could. credibly commit to paying in these cases.

Uh you that you can maybe notify. everyone that they're being bribed. uh someone just needs to build a bribe. notification Gap I'm sure it'll catch on. right so. yeah yeah. right so the question is I talked about. like you know having maybe paying less. for security because of being able to. um recover from failure and then and you. know I kind of said like you know if we. know how to recover then we could maybe. have a cheaper time but the community. you know who's who who's we that know. how to cover is it like me is it the. community I guess when I say that I mean. that like you know I believe that we can. enumerate all the failure modes and. understand what it is that the community. must do in order to recover and now like. whether or not the community like will. read the user manual. um and or whether the like reality will.

Come into this weird Edge case where are. you where you know the only option is. contentious uh a contentious decision. uh you know uh it's kind of yet to be. seen I mean this is this is like a the I. think it's part of the area of like you. know uh this kind of like weird. Collective best practices for use kind. of guide that I think is like you know. uh. I think I think I think increasingly. over time we're going to see is like. super important right because I think. people really use blockchains uh as a. community. um. and I think I think that it's uh you. know we're gonna we're gonna kind of see. see that see that more and more or. basically blockchain startup just. because they serve a particular. community. um. yeah. yeah great so basically the question is. okay like you know you saw me on Twitter. hate on uh Tesla's coin governance model.

And then the question is like what is. better than coins well I mean basically. I I honestly think that like you know. public discourse and like you know kind. of uh you know like like I I I I I for. now I think like the best bet is this. kind of like ad hoc public discourse. kind of negotiation. um I I believe in like kind of you know. like. negotiations without a consensus on a. measure on how to weigh everyone's votes. um because like if we agree on how much. everyone's votes count and only coin. holders count basically I mean we're. going to be stuck with the Powerball. distribution and we're gonna be stuck. with people whose incentives don't. necessarily align with the other. stakeholders in the community. stakeholders which we can't actually. measure so for example like clients are. really really difficult to measure the.

Only real measure that we have on. clients is transaction fees uh other. measures are very relatively very easy. to civil attack and to to spoof. um there's there's kind of developers. you know and it's really hard to kind of. get a measure on them unless they have. like a public reputation or you kind of. are personally familiar with them. um there's the the there's you know. miners in coin holders are all the only. people who have like the kind of. privilege of being measurable uh in a. way right uh and and so you know I don't. think that we should you know give these. people a control of the protocol because. like I don't think their incentives are. aligned with user interests and like I. hope that we'll all be users one day. um you know and so so somehow like uh. but from the point of view of like like. mechanism design.

Um. if you do have a voting system then like. there's just like pretty clear tradeoff. between like safety and liveness where. like the more the more like you make the. system safer and you know by requiring. unanimity or maybe even unanimity many. times in a row and like multiple rounds. like that's like super safe but like. I'll almost never return a decision and. that would I think would be quite. representative of everyone's interests. but if you say do like a majority vote. then like you know there is really no. guarantee that a minority's interest. will be represented because there's no. way to kind of. there was no way to get that proof out. of the protocol right. um and so and so a lot of the so it's. really tough actually to design voting. systems that are uh you know that have. either have really strong guarantees and.

So what other people end up doing is. they make a voting system and then they. coordinate extra protocol to convince. all their friends to vote the right way. and then like hopefully. it works out. uh it doesn't always. yeah so so like and there's this kind of. feeling where it's nice to have votes in. an Excel spreadsheet and it's like oh we. know that the community chose to do this. because there's a majority of votes. right and that that kind of feels like a. nice thing but if you think about it. it's actually not a good thing because. the people who are going to think about. gaming that system are going to be the. people who want their interests to. overshadow all the other users interests. and so making a system that's harder to. game by making it this kind of like. social consensus at least while we don't.

Have a great governance system and we. haven't like spent years and years. iterating on chain on governance systems. it makes more sense to have this like. offchain like you guys figure it out. like how are you going to game that okay. maybe you you know get a bunch of Reddit. Bots and you kind of convince people to. that you know one chain is bad and. another one is good but like it makes it. a lot less straightforward of a you know. attack. General kind of related comment is that. these these in protocol upgrade. mechanisms remove a lot of the consent. that's involved with hard Forks when you. install a hard Fork you know you kind of. like really get a choice about like. whether or not you go like with the. community or not right if the community. is doing something you disagree with or. part of the community to do something.

You disagree with you don't have to you. don't have to go there whereas like with. an in protocol uh upgrade your mechanism. you could be none the wiser I mean you. could have a software upgrade happen in. the background like you don't you didn't. even you wouldn't even you weren't. involved in the in the in in the in the. discussion you didn't even have to. install any software like your consent. was not required right like the only. consent that's required in like a. software for example is with minors. right the only consent that's required. in Tesla is coin holders the only. dfinity also has the same thing where. like they have this like blockchain. neural network where or sorry nervous. system which which uses somehow coin. voting plus fancy mechanisms that lead. to automatic upgrades like that that you. know maybe is an efficient way to like.

Upgrade a protocol but it I don't think. it you know. um. it it it it kind of it doesn't it. doesn't like it like clients are not. King in that model right like it's not. that like you know a client will pay. fees only to the people who run the same. protocol and therefore the client says. the protocol and and the client. determines what the block validity rules. the client determines like you know uh. the the basically everything that like. can affect their estate like that isn't. something that you lose when you say. let's have end protocol in protocol uh. upgrades. quick quick question not not for. monologues you have to come up here. I actually really like teslos and. Affinity but they're really not. comparable to Casper or proof of work in. terms of their ability to service the. public right I think they're good.

Protocols for different use cases and I. think it's sort of an open question of. like exactly what those use cases are. and I think it's sort of a mistake even. though they're marketed as like. public blockchains I think it's. basically a mistake to think of them. that way for pretty much the reasons you. mentioned it doesn't it doesn't really. work. I think I think for us from investor. point of view for me to put money in. that it's actually to fit worst worst. possible case of aligapolis because. that's what it's about. and we we don't experience with that yet. and hopefully we will not because. hopefully this project will fail. but but all the Tesla CEOs it's more or. less the same you have a very small. group of people which knows exactly what. they're doing and they have a bunch of. naive Romantics that got excited about.

It and start to you know start to code. and the guys who are running this they. understand this everything so that's. that's why. I mean I just don't think it's fair to. compare something like like tezos and. Divinity to Casper once a consensus Pro. mechanism and the other is a protocol. platform and I to me what I realized. like I was pretty skeptical about kazos. as well until like last day or two it. clicked to me that like nothing none of. their consensus protocol their. governance mechanisms none of it matters. all that they're building is a protocol. platform and the consensus mechanism is. designed to be upgraded one Casper is. finished tezos can switch to Casper if. we come up with a better governance. model teslos can switch to better. governance. I think I'm going to anticipate what. vlad's going to say but but but the.

Issue with that statement is that it's. still controlled by a small group of. people right even that voting process is. is not really even pretending to be. Democratic right it's it's not they're. they're very open if you just ask the. right questions that it's that it's a. it's two people running it I mean they. just say it yeah yeah they're they're. public people if you just ask them are. you the two people running it they say. yes we are thanks for asking so. um it's uh yes it is a platform and I. think it is an interesting platform for. solving asking these kind of questions. no more questions about all coins. uh. um you're you're right it isn't it isn't. a consensus protocol we shouldn't be. talking about it oh yeah what's up. so so the question is like you know how. do we handle the phase out of the miners.

Um you know I mean I don't spend too. long thinking about this because. um. um you know I I I I I I think I think of. the miners as like no longer being. necessary after after the end of the. process but like you know I think that. minor is like will probably you know. where we are gonna do a tiered rollout. and there's gonna be a phase where they. can mine just like with like less kind. of returns but still on the way to prove. mistake and I think like at that point. like it'll be it'll be pretty clear to. them what their kind of like Revenue. projections and stuff look like and. they'll move to mining other coins a lot. of these miners are already set up to. mine multiple coins anyways and it's not. like there's. um. there aren't a lack of GPU minable coins. but but to be honest. um you know I really hope that miners.

Will go and use their Pro their their. views to provide services on uh for. various steps. um but you know I'm not sure that that. technology is really going to be there. in time for the move through stick. um yeah so I mean that's that's a tough. question. um you know I'm I'm personally a no fan. of mine are interested I don't keep that. to your secret basically because I I. think miners are like you know probably. the biggest threat to the protocol. um. and and enter the governance process. also. um. basically because they're being paid. like nine nine eight seven whatever a. million dollars a day and have a really. strong vested interest and basically. they have uh. this this kind of really uh badly. aligned incentives even within each. other uh not that they don't necessarily. know it. um so anyways another question.

Or maybe yeah hi in the back. yeah you yeah. how do I see permission Forks like. Quorum affecting the ethereum ecosystem. I mean. um that's a good question I'm not really. the guy to ask about that I'm not sure. if they're going to run Casper maybe. they will. to be honest that's like outside of my. interest area. sorry. yeah yeah. so do you mean can you so you're asking. about the safe report hybrid model but. I'm not sure which model you're talking. about. okay yeah sure so all coins with hybrid. proof say proof of work models have been. I've been around for a little while. um you know I'm not I'm not generally a. huge fan of Hybrid models because the. authentication mechanism of roof stake. is very different from improved work you. can improve work you kind of have to. count the work in the whole blockchain. whereas a proof of stake you have to.

Have recent coins or you have the long. range attack problem and so the. authentication model is kind of clash. however we are going to do this like. tiered rollout where we're just going to. add a finality Gadget type of work and. then and like change the and not use for. work authentication but use for stake. authentication but and then and then. basically just a matter of improve work. to a proof of stake block proposal. mechanism where base and basically it's. just which is an improve State block. proposal mechanisms are more complicated. than people work ones super work ones. just kind of dial the spam protection. until there's like only one every so. long. yeah in the back there. sure so I mentioned asynchronous safety. for extensive protocols and I was. wondering if I could elaborate with what. that means basically it means.

That uh the safety uh property doesn't. get violated no matter what no matter. how messages get ordered so imagine if. every time a node sent a a message on. the network instead of it going to the. destination they all went to a. centralized party. that then decided like which ones to. Dole out to who when. like that's kind of our setting but. basically and the centralized party can. take any order right and so like and so. somehow. um any pro order of protocol message. arrival is going to be possible and not. lead to safety violations. um and so basically it's kind of like a. asynchronous consensus. thing. yeah hello. yeah well so the question the question. is is the motivation for being live just. economic well that's interesting I mean. because motivation is kind of like a. kind of Behavioral kind of question but.

Definitely we have like a noneconomic. liveness proof that like you know Works. in like fault tolerance context and so. like you know but also we have. incentives to not commit liveness faults. and so like we you know we have both. the incentives and also the aliveness. proof for kind of um. a partially synchronous network with. like a relatively simple strategy with. increasing timeouts. um yeah. so the question is is there a conflict. between asynchrony and determinism and I. mean like yes to some extent but but uh. but but the thing to notice is that the. protocol specification you know uh is. kind of separate from the level of. synchrony and so somehow even though we. might get more to undeterminism it won't. be it won't be like more undeterminism. in the protocol it'll just be in the. outcomes of the protocol as taken by.

This asynchronous network and so like. you know like we will have like you know. it doesn't affect the determinism of the. protocol even though it affects the. protocol outcomes kind of this slightly. weird thing. yeah so block times would be a concrete. example. Reuben. ooh the long top three challenges for. the longterm Casper well I mean so. which Casper are you asking about. yeah yeah that's great so the ultimate. one yeah so so I'm just going to kind of. go with like my kind of like personal. kind of ultimate one I mean. um basically like the the things that. are the thing that's super exciting to. me is the idea that we can make a. because that's a protocol without any. kind of fault tolerance threshold in the. protocol but basically our clients make. fault tolerance decisions clientside. they say look I want to make decisions.

Only when I can tolerate 50 of false 60. 33 and kind of you know we know how to. do this for the most part basically pull. the threshold out of the protocol and. make a clientside and it's super cool. because it kind of gets rid of uh points. for cartelization around the threshold. points in the protocol and it has like. this really and it also kind of moves. um it moves the decisions to the edges. of the network rather than to the core. of the protocol and then and and. therefore it's like somehow much harder. to game because there might be something. asymmetry of information you don't know. what safety threshold your victim is. using that's one thing uh another thing. that I really want is like you know. um proofs I want really nice proofs of. like the correctness of the payouts. right I want to be able to say like hey.

Look somehow there's like this. relatively small bound of parameters. that like that maximizes robustness like. under like these models or somehow you. know like so so so the the actual. um like Optimal parameters proof as. opposed to something where we kind of. like show that it's not too bad you know. um and and another thing something that. I'm super excited about and something. that I've kind of uh well two other. things one one thing I'm super excited. about and that I've kind of done some. work on recently is I've been able to. replicate. um. uh rewrite semantics that has concurrent. execution and so we can have a situation. where we can have like walks that don't. need to be ordered blocks that do need. to be ordered and kind of a minimum. amount of consensus on any given uh like. computational Theory which is like yeah.

I mean so I'm super excited about that. because like it's going to be like if. I will you know maybe. maybe uh it's kind of uh. um you know it's it's kind of. complicated I'd rather do it at the end. of like an hour talk but uh uh but. basically. um somehow you know uh we were used to. replicating like a bit in like consensus. protocol literature we're used to. replicating like a virtual machine that. you like you know do transactions with. in blockchain but like every transaction. happens sequentially you could imagine. that say like uh you know a block that. affects only contracts over here and a. block that affects contracts over there. don't need to be stacked on each other. uh they can kind of kind of happen. concurrently and we don't need to agree. on their order because it doesn't matter. if we ask you one first and then the.

Other or vice versa and we still get the. same outcome. and so like somehow. um there's there's your ability to make. these decisions describes the like. concurrency that is possible in a. particular execution environment. um and so like I kind of like take an. arbitrary concurrent execution. environment like Express as a set of. rewrite rules. uh and and like make a structure where. like we kind of agree only on the. minimum amount of contentious stuff and. like don't otherwise and I'm like you. know super excited about it so I'm. sharing it but I don't expect you to. understand so I feel bad uh I'll also uh. last thing I'm super excited about. um. is like you know I mean like like. sharding stuff I think I I had something. else I don't remember sorry. so the big I mean I I would say that. Vlad definitely covered all of the real.

Like exciting things but I would say. that like subjective finality plus the. concurrent you know arbitrary rewrite. rules is really nice because then you. can see like oh my arbitrary you know. this is safe and maybe that's not safe. or you know you get this ability to like. come to finality way faster because of. it and so that's like a really cool. thing but I'm just just for fun I'm. gonna give you why subjective finality. is difficult when you're doing rotating. validators and so the reason why this is. kind of difficult this is right why it's. kind of like a one a challenge of a. future protocol is because the way that. the rotating validators work if you. remember it was like oh the consensus. knows that the handshake went off right. the the consensus knows oh this this. Epoch got finalized the next Epoch got.

Finalized we can change the validator. set so it's like a really clear because. everyone ones using the same threshold. for finality but if you start allowing. arbitrary finalization then one. validator can say this validator set is. what I see because my finality threshold. is you know 99 but then another one uh. sees oh this is a totally different. validator set is the validators that I. see because my finality threshold is you. know 30 for some reason. one of the solutions to that problem uh. in both of those uh vlads one and three. are both uh very important to scaling. right and they and they correlate to how. existing Enterprises actually scale. their infrastructure and I'm not going. to explain how uh but. um but basically what you're talking. about we can get the the epoch finality. and that can be effectively not tunable.

Right so that's sort of like your your. your Shard zero that's where all of the. shards actually have to finalize to and. then and then your other shards have. this sort of. yeah but you know you totally you don't. you don't need to have uh you don't need. to have actually because that's just on. the handshake which you can do is have. everyone have their own personal. handshake. fake track and everyone that they are. looking at actually they know is held to. account and they all have deposits in. the Casper contract but the Casper. contract doesn't really know who is. validly in this deposit set I would. respect to any particular clients. because they might each make like. different thresholds and so like it is. tricky but uh it is the dream. and this is open research as you can see. um didn't mention charting yet hi.

Yeah so so sharding uh basically. corresponds to taking the overhead of. that extensive protocol has or like the. blockchain has and giving different. pieces of it to different nodes rather. than having everyone do everything. and so you can like Shard validation by. not having everyone validate everything. Shard stores but I don't have everyone. store everything start consensus but not. happy everyone come to get citizens and. everything and kind of car eventually. like if you Shard consensus then you end. up having like a bunch of kind of. effectively concurrently executing. because this is protocols that somehow. have some contents between them. nesting kind of structure. um but there's there's the space of. sharding protocols is quite large. uh and so when someone says charting. it's not actually it's usually not.

Always understood immediately what. exactly protocol they're talking about. but they're not talking about State. channels right they're not talking about. offchain transactions they're talking. about like making the chain somehow. bigger by allowing different pieces of. it to be executed concurrently by. different sets of nodes. so Raiden is a state channels it. basically does like offchain. transactions uh which is a scaling. solution because it like lets you do. netting without settlement which means. you do fewer transactions uh but it's. not it's not sharding anyways uh yeah. oh can we talk about inflation post. report yeah so this gets down to some of. the discussion I was having earlier. about. um you know how much security is enough. security we're basically like you know. um and but the main thing I want to push.

Back against is like the notion that. like inflation is the correct term. um because like to me and like you know. uh like we're not engineering a monetary. system like this we're not doing. monetary Theory we're not doing monetary. economics like this like we're building. a platform like ether is is like you. know not like the next US dollar like. don't let anyone tell you that it is. um so you know and and and and and. neither is Bitcoin but you know they. might not admit it uh uh but somehow you. know. the question of issuance is just a. question about like what's good for. users what's good for the security of. the protocol like these are the types of. you know these are these are the. questions we're not really trying to do. monetary policy but the thing that we do. need to make sure is that the token has. a price and so if you would do too much.

Issuance the price could potentially go. to zero and that would undermine the. protocol guarantees and so like vitalik. had this nice heuristic that like. somehow issuance should be like less. than Global GDP growth which I thought. was like you know not not too. unreasonable in the sense that like. maybe if that's true the price won't go. to zero but you don't really know but. but definitely like you can avoid. hyperinflation by not having the right. of issuance be too too high but. basically. um you know I think it's misleading to. think of it as monetary policy as much. as just kind of uh mechanism design and. like you know uh Supply models for for. tokens or something. yeah hi. no this is this isn't actually. probabilistic at all uh you might be. able to understand it probabilistically. if you say add a probability model to.

Like the way the network messages. propagate but like you know uh like. asynchronously safe like subjective. finality can be done with a completely. deterministic protocol. um it's like the liveness where people. end up having to like add some some uh. some some nondeterminism in like. traditional kind of because this. protocol research. yeah. oh what would the wish for help oh I. guess like you know. um there's there's a few things but uh. mostly I guess like the the helping with. the problems is like my favorite you. know I need we need help with like you. know certain problems like certain. engineering like if you're really good. at like you know mechanism design or. like. um you know computer science distributed. systems like even if you even even if. you really want to optimize some code. that might also be helpful.

Um but uh outside of that like you know. say you know a lot like maybe you can do. some like education maybe you can help. help curate like knowledge bases. um there's it basically it's mostly. about. um kind of contributing through either. like adding to a knowledge base or. sharing the knowledge base uh that's. like the main the main kind of thing you. know maybe. um. maybe one day uh you know uh call you to. donate to the ethereum foundation but. you know. yeah so I just to just to like add on to. that one good thing is that all of our. incentives to some degree are a little. bit aligned right like in the community. you know as long as you're furthering. like crypto economic research and you're. thinking about my here's my plea and. this is kind of just a general thing is. if you're thinking about these like. problems right and you're thinking about.

Okay I can design this economic system. and my economic system will have this. property of this property and this. property then I would I would love if. you have a justification your best. justification doesn't have to be a good. justification in fact it will be a bad. justification for many many years but. like if you're if if you lie lay out. your parameters and your properties and. you justify them with like your best. shot then that does so much for. furthering everyone else's research. right because if you come up with this. cool model where you can say like oh I I. made this economic choice because these. actors are going to counterbalance this. and I'm able to plot all of the. different outcomes and you know show. where it's right like that does a lot. for everyone else because now people can. use your model so like let's use the.

Scientific method and share on the. internet open source give everything. away and you know live in harmony yeah. is and live in harmony even even if your. transaction doesn't get in for 20 hours. you know. even if like you know though we have. like scalability problems. um you know we you need to like kind of. chill out like you know freaking out. isn't actually helping. um you know we're doing our best to work. on these problems actually like. scalability has moved up the priority. list. uh and so like you know we should try to. pump out some stuff but. um anyways let's do like one more. question and then maybe we'll do a. little bit of whiteboarding maybe. yeah yeah if you want 86 is like this. this Eep it's not the best well the most. well written Eep but it it suggests that. we lower the block rewards and like I'm.

Super into lowering block Wards as a. concept I mean this is something I've. kind of been like agitated for a few. months ago but like before the price of. ether went up so high. um and and basically like to me like I. never mentioned earlier like I kind of. think that like. um if you pay people too much for. security it'll turn into like a security. Racket and there's like a certain amount. of marginal diminishing marginal returns. like every additional dollar that you. pay gets you actually like less than. like the last dollar of security. um and so and so somehow like you know. if if like I was negotiating for the. entire Community with minors and they. were trying to tell me like oh you got. to pay like seven million dollars a day. like I would you know not make my like. counter offer okay you know like yes.

Let's do it right I I would kind of like. you know probably want to scale that. back a little bit especially if like. just a few months ago I was only paying. them like five hundred thousand dollars. a day you know it was like if you could. you could you can kind of see. that like. like I definitely like the price isn't. right to me like I'm pretty pretty clear. like what is the right prices like also. like somewhere unclear because like some. extent. you know. it does like having more hash rate buys. As Time against an adversary. um. and so like it's more security but it's. also like you know it's not clear that. um. it's a more mining rewards is always. better for anyone except for minors. um great uh so I feel like we've done a. lot of questions. um let me take a look at the Times. I mean. um. what do you guys want questions or Tech.

Air conditioning we want air. conditioning. okay. um. yeah I'd be happy with it I'd be happy. with a 10 15 minute break. okay cool cheers thanks everyone. is coming through. all right. thanks for settling down. um so now we're going to go through and. do some we're going to get into like the. more nittygritty of consensus protocol. stuff. uh we're gonna have Carl give you a. rundown of the friendly finality Gadget. and then I'll give you a rundown of the. kind of correct by construction. consensus protocol approach and uh you. know progress so far so here we go Carl. Casper the Friendly finality Gadget. all right so so normally you do like the. presentation and then q a but we're like. killing it and now you get to know what. the protocol is like. so. um. okay there are two terms that are really. important this is Casper the Friendly.

Finality Gadget right so this is the. first kind of Casper uh that is going to. be you know first thing on the roadmap. essentially. um and this is something that vitalica. specked out. um the two blog posts uh you know safety. under actually I don't remember the. names right now but you can look it on. look at look at it on his medium account. um so first important term. um epoch. okay so in Epoch you can just think of. it as the passing of 100 blocks so the. way that it'll work start out is we're. going to do. hybrid proof of stake and proof of work. by the way I actually also gave a talk. recently which kind of like goes over. this a little bit and I'm just going to. do like the lightning versions so Vlad. can you know give his thing. um so essentially what we have is every. 100 blocks we're going to keep proof of.

Work so we're going to do mining we'll. not change right all we're going to do. is we're going to layer on top of the. mining a finality Gadget that's why it's. called you know Casper the Friendly. finality Gadget we're going to give the. blockchain economic finality which means. that at any one of these checkpoints so. each uh thing that we give finality each. block that we give finality is going to. be called a checkpoint right so that's. like you know think about it you're like. okay I'm saving my progress on the. blockchain. um now what this we're going to be. trying to save our progress trying to. checkpoint the blockchain once every. epic Epoch and each Epoch is going to be. you know around this can change like. around 100 blocks you know whatever. now what that means is right we have our. normal blockchain and let's say I drew.

100 of these dots right this would be. you know. this would be Epoch one this would be. Epoch II right of course there's going. to be a lot more you know blocks in. between 100 or 99. now 98.. um so the what we're going to do is. we're going to run. the consensus protocol on these two. blocks right and the consensus protocol. is defined is really what it does right. we're trying to provide finality so like. it's it's really important to like we. can go over again you know what is. economic finality economic finality. means that if the history changes that. people lose a bunch of money right so. we're this is our only goal we're just. trying to provide economic finality so. what that means is we want to say that. you know this is maybe a third Epoch. we're going to say that if. if this block right. this block were to change and it was.

Finalized by this you know magical. consensus protocol which I'm going to. kind of talk about if this was finalized. but then someone created a blockchain. and convinced everyone you know finalize. this as well finalized it according to. the protocol right so now there's like. two finalized blockchains. well then what was going to happen is. we're going to punish someone so this is. gets back to the attributable faults. this is why we did quick q a first right. we got to have these terms but um so. this gets back to the attributable. attributable faults because we're going. to based on the protocol know this you. know this set of validators equivocated. or you know someone you know some some. set and the actual set is at least. twothirds for uh. for the uh final finality guaranteed to. be broken then at least one third of all.

Validators must have equivocated slash. broken a slashing condition and a. slashing condition means that a. condition at which point you lose all of. your funds that's what like slashing. means it's like oh we know you did. something bad and we're going to take. away your money. now before you ask you can't actually if. you are an honest validator like I can. make sure with 100 certainty that I do. not break these slashing conditions so. it's like I'm always able to make to to. like look at all of the messages I sent. and like send it to you know different. people as long as. um you know you are able to get your. messages included into the blockchain. but anyway so this is kind of the. general structure right we're just. providing finality on every 100 blocks. and the actual slashing conditions I I. feel like it's better to go over those.

Slashing conditions in a uh uh in the. the kind of blog posts or in the video. that that was just posted because they. really go you know do each one of a. service but maybe questions on like the. general construction of this thing uh. foreign. yes so that's a very good question. essentially the question was what is the. difference between you know maybe a. Casper with economic finality and proof. of work right so first off proof of work. does not have finality like at all it. doesn't have any economic finality or. finality period That's because there's. always the opportunity to create a. longer chain than what is perceived. currently as a canonical chain and then. that longer chain is going to be chosen. over the shorter chain now in Casper. that is not going to be possible because. we have this guarantee and we say that.

If this reaches our economic finality. which proof of working approval work. doesn't even concern itself with. economic finality and has no gadgets to. get this economic finality if we reach. this point where there is this kind of. structure where we do have two. blockchains one that wants to kind of. like. you know be a longer chain let's say. this one you know grew you know really. long or something and we have you know. many epochs further right in proof of. work if we were just doing normal proof. of work we'd choose this chain right but. in proof of stake with Casper and a. hybrid model we are going to choose this. chain assuming that the equivocating. nodes were you know that this chain is. you know favored even when all the. slashing conditions have been you know. met and you actually total up the. balances so essentially what that means.

Is we and we have a proof. where safety can only be uh where where. we formally prove and it's actually not. we it's yoichi. um big props to him he's formally. verified that uh that there is uh safety. under these four slashing conditions and. so those slashing conditions once again. are the rules by which all validators. have to follow and if they don't follow. those rules to a t then someone can say. oh I see this validator is not following. the rules let me tell the chain let me. tell the other validators. that they've broke the rules and then I. that that validator will have their. deposits slashed or destroyed and my. deposits you know at that point will you. know have more weight essentially so. you're able to say like for sure that. proof of work does not have economic. finality and because I mean it doesn't.

Have finality period and uh proof of. stake does have this economic finality. guarantee. cool so. cool. um so recently there's been a massive. refactor to Pi ethereum so pythonium huh. oh we save the question thank you. um so so essentially the question was. what kind of languages do you use. um to uh. write this stuff or do your proof of. Concepts Etc. um so the the the the implementation a. lot of like the blockchain node is done. in pi ethereum which is the python. ethereum client but of course it's going. to be done in all of the different. blockchain uh implementations or. ethereum implementations you know Gap. parity et cetera. um and then uh you will and then we're. doing uh vitalik is writing the actual. Casper contract right now in Viper. um you know of course it's like Viper is. a really cool language. um and that's you know it makes it makes.

A lot of sense for you know the the. um you know vitalik wrote that contract. and he's writing it in Viper so it's. pretty cool. um the other thing is that we the only. other kind of. bit maybe language that's worth. mentioning is Isabel. um so yoichi's formal proofs that the. slashing conditions do in fact work are. uh is written in Isabel which is a like. a language in which you can formally. verify. um you know properties of your code. I'm really not sure about the roots of. Isabel sorry. cool so I guess we're going to go on to. vlad's theoretical. hi everyone. uh so let me just say that Isabelle is. like a model checker. um I don't know how it's like what the. back end is built on but it's like you. know it's not like High School in the. sense that. um. Haskell is more about like. doing proofs whereas like I'm somehow.

Model checking is some some something a. little bit different I mean I'm. definitely not the guy to ask about that. though. um I am the guy to ask about this uh. consensus protocol stuff that I'm about. to talk to you about though uh and and. and basically so what I'm going to do is. I'm going to give a kind of high level. overview over of the like safety proof. that um all of my kind of correct by. construction consensus protocols. um are derived to satisfy. uh and then the kind of there's like. it's relatively simple proof and the. thing that I really like about it is it. helps me think about the Bridging the. Gap between this blockchain world where. decisions aren't finalized but they can. be reverted to a world where like. decisions are final and they can't. um and basically it actually ends up. being a relatively simple kind of proof.

Um so. um basically there's there's no normally. when we think about consensus protocols. we think about decisions and this. property called consensus safety. consensus safety means that two nodes. who follow the protocol and make a. decision make the same decision if they. were to make different decisions then. like the safety condition would be the. safety definition would be violated. in a blockchain world though since we. don't have a concept of decisions our. notion of safety is actually quite a bit. different. um we have this thing called estimate. safety instead so estimate safety. um is the name that I'm kind of I kind. of go with because an estimate is not. unlike a decision maybe will be revised. later. and an estimate safety basically says is. like this node will never. revise this estimate it basically says.

That like you know kind of a local. question of whether it will ever change. its mind into the future so in Bitcoin. you would not say will I ever see a. block that has the most difficulty that. doesn't include this block. and that's kind of a very local question. of safety uh that it turns out as. actually somehow deeply related or or. related via this proof that I'm about to. show you. um to contends of safety so basically. um. I'm going to write down some of these. terms so basically so we have we have. consensus safety. which basically mean it means like I'm. I'm going to kind of write this in like. really like simple English. two nodes decide the same. this is not a very rigorous definition. um and and so consensus safety basically. says like two nodes decide the same. thing and then estimate safety is. basically like one node won't change its.

Mind. uh. so it's it's kind of interesting because. somehow they're very different Notions. right this one's entirely local about. one node State this one is about like. the output values of two nodes right. normally when we build consensus. protocols we work hard to satisfy this. because normally like we are working in. a world where we want to make decisions. which are finalized and irreversible and. when I say normally I mean like kind of. free blockchain like before Bitcoin and. now kind of post Bitcoin We Care also. about this notion of like reversible. decisions and thinking about like the. safety of that and so somehow you know. uh if like you know one block. confirmation is safe if like you'll. never. you'll never choose the blockchain that. doesn't have that block in practice it. turns out that like actually one block.

Confirmations are unsafe some proportion. of the time like you know like one. percent or like less of the time I don't. really know the the orphan rates. um. um but six blocks somehow in practice. has has turned out to be like quite safe. for most nodes or basically like we've. never really had more than six block or. version due to like a double double. spend although there was an invalid. block. um. you know some somehow. though we this doesn't give a clear. story about how this is related to that. and basically like there is actually. like a relatively simple proof that. basically says like kind of the. following. um. this is kind of I'm gonna I'm gonna. write it down as like a like a fact even. though. I haven't given you the proof basically. so decisions. on safe estimates. have consensus safety. sorry I'm trying to write down quickly.

So I'm not spending a lot of time doing. that but uh so it's maybe not the most. likable but somehow. um there's this really neat result that. says like you know. um. if if my estimate is safe. then somehow like if I decide on that. estimate then like we should have. consensus safety and there's a and. there's a really kind of simple simple. way to to prove this it basically says. it kind of go goes goes as follows. imagine Carl and I are on a network. and. um you know I'm safe. then it can't be the case that Carl can. send me something that makes me change. my estimate. so if because like if you if that were. the case then I wouldn't be safe because. the definition of safety is that like it. won't change my estimate so if I'm safe. then there's nothing Carl could send me. that will make me change my estimate if. Carl is safe there's nothing I could.

Send him to change make him change my. estimate but as long as the estimator. that we have is deterministic in the. sense that like no matter what a set of. messages we receive sorry if we each. receive the same set of messages then we. each choose the same estimates. then it's also going to be the case that. if I send all my if I send some stuff to. Carl like everything I've ever seen like. all the protocol messages I've ever. received Carl and he sends all the. protocol messages he's ever received to. me then we'll have at the end the same. stuff. um and and that means at the end we'll. have the same estimate but. it kind of we each so so but if we're. each safe at the beginning then neither. of us will will change our estimated as. a result of this operation and so if we. have the same estimate at the end and we.

Never changed the our estimates then. somehow we have the same estimate at the. beginning of this process. and kind of like that's that's the. outline of the proof so so so again if. we can't convince each other to change. our estimates. because because we're safe then that. means that if we pass each other our. views we will have the same estimate. which means that we actually have the. same estimate now because we have the. same estimate after each not changing. our estimates. so you know it's a relatively simple. proof you know like kind of. heuristically like like like you know. there's a kind of high level abstract. abstractly uh you know and Yoshi did do. like a formal verification of this proof. for a particular protocol. um. um I even helped a little bit it was. pretty exciting. um and and it but basically like it.

Turns out that this is like a very. general shape that can be satisfied by. very many different protocols where. basically what you need to do is kind of. establish okay you know what are the. data structures what are estimates what. are those like the function that says. like given a set of protocol messages. what is your estimator and then like is. is there a a a way a protocol state in. which your estimate is safe. and like if so then uh and you can. detect it then we can make this. consensus protocol that that is kind of. correct by Construction in the sense. that it will only decide on an estimate. after detecting that it's safe and. therefore uh inherent the this kind of. property that like decisions on safe. estimates have consensus safety. um and and somehow this this this this. this this property really nicely ties in.

Estimate safety and consensus safety. um and like ties in what it like what. kind of like the notion of sense that we. have in blockchain with the notional. consensus that we normally have. basically saying that okay okay if we. were to add. um a decision rule that says like okay. somehow if you wait n blocks before. deciding then like you can kind of show. that in a partially synchronous Network. there's like a big enough n so that like. improve of work. um. um that safe uh and sense of estimate. safety which means that it'll also be. safe in terms of consensus safety via. this you know relatively simple proof. that says that um if we're both safe. then we can't convince each other which. means that we have to have the same. estimate because if we can't convince. each other then we. foreign. we have the same estimate.

Like after the end of the process where. we try to convince each other and send. each other all our messages. so you know it's a little bit complex. but the really cool thing about this is. that uh is is that once you kind of set. up this the safety proof well you can. use you can make a protocol that whose. goal is to produce estimate safety and. then what if you can if you can do that. and show that there's like at least some. one state of the protocol that like has. estimate safety. um then you then then you can kind of. have like a correct by construction. consensus protocol and you know it took. me a while to kind of put this together. for the binary consensus and then I. spent like many months working on the. binary consensus where basically like. we're kind of trying to have a consensus. on like a bit and like an estimate is.

Like a bit and then somehow in the last. like six months I've been able to crank. out a bunch more consensus protocols. that also satisfy the same proof. um basically by setting up the data. structure so that. um the the. so we can define an estimator and so. that we can define estimate safety and. then and and then therefore inherence. proof and then like kind of we have to. show that there's like some nontrivial. case where estimate safety exists as at. a minimum but ideally we kind of find a. way to detect estimate safety and so. kind of um what I can do is I can show. you the data structures involved in some. of these various. um protocols that that have worked on to. kind of give you give you a feel for for. what I'm talking about. so. um in the binary consensus we have you. know these with these bets and the bets.

Have an estimate uh which is which is. either zero or one. and then they have a sender which is a. validator field used to denote the set. of all validators. and they have a justification which is a. set of bets. so the power power set of bets so. somehow you know this isn't maybe the. best definition but it's good enough to. get get across the main main point who. basically says I like it's the data. structure that we're using for the. binary considers has like an estimate. which is like zero or one a sender and. justification which is like a a set of. bets that were like seen and basically. have to justify that bet and basically. what it ends up being the case is like. unless a majority of validators by. weight as seen in the justification are. going with one. then it's invalid to put a one here. unless the minority are going with zero.

That's valid to put a zero there so. somehow. that's validity has to do with whether. or not it's justified in the. justification and so then there's there. ends up being two slashing conditions. one of them is when the bed is invalid. I.E you know you say one when really the. majority in the justification says zero. or you equivocate so equivocation we've. kind of mentioned before. um it is a certain type of Byzantine. fault where what you do is you maintain. where you kind of instead of running. just like a single thread of the program. of the protocol you run multiple. and as a result you can kind of have one. opinion and the other as far as. different nodes are concerned and would. you which can lead you to uh which leave. these notes making separate decisions. and so if all these protocols have the. same two slashing conditions uh one of.

Them is as a if lock is invalid then you. get slashed the others if you equivocate. then you get slashed and like that's it. which is another kind of nice thing. about the about these protocols and. equivocation basically says two bets. from the same validator are an. equivocation if neither of them are. inside their their justifications under. closure so basically if I have two bets. B1 and B2 from a validator which means. from the same validator which means like. the entry here is the same. and they're not in each other's. justification then they're in. equivocation they're kind of not not. single threaded there's like somehow you. can't follow the justification from one. to find another. um and it's kind of maybe that's a. little abstract but I can I can kind of. draw it. um so the way the way we would normally.

Draw this is something like this so we'd. have like maybe for three validators we. would have like V1 maybe V1 which has. like weight of three V2 which weight. which has weight of four V3 which has. weight of five and like maybe maybe. I need a different color. maybe maybe V1 had initial bet of zero. and v200 initial beta 0 and v five the. three had an initial bet of zero and so. like somehow like they should no matter. how they pass bets around be always. stuck on zero but if one of them. equivocates. and the reason that's the case is. because if there were to make any. justification out of these bets the. majority would be zero but what this guy. can do is make not instead of making an. invalid bet. it would make a bet with estimate one. that doesn't refer to as old about with. zero and so and so somehow this is a.

Valid bat just like that one is but now. uh this validator can like validly. switch to one and like this validator. can validly switch to one so somehow the. I'm using these arrows to represent the. justifications these the alignment and. vertically to represent which sender it. is and then the actual like the the. number to be the estimate and so somehow. this this Behavior here led to a. switching of the estimate from zero to. one. um and it is identifiable as. equivocation because like this one. doesn't point to that zero and the zero. doesn't point to one if they did then it. would then then this validator would. have made an invalid bet because it's. illegal to say one uh just based on. seeing Zero or if they say zero just. based on seeing one and so this kind of. behavior is is Byzantine uh and it's. called equivocation and that's what we.

Always slash for that. so all these Protocols are going to have. this kind of shape but basically there's. a rule for validity that has to do with. like what the majority of the people in. justification say according to their. most recent bets and then there's the. question about uh the validity of the. estimate. so that's kind of cool. um uh and and somehow the the main. question is like can I detect safety. well I kind of actually slipped in a. little analysis here that said like oh. if they all choose zero then it should. always be zero in the future because. like they can only choose justifications. that are zero and so and that actually. corresponds to an analysis that says. that we're safe in the context of no. equivocations because there's no no way. for them to all progress the protocol. making only valid messages in a single.

Thread that will change the value from. zero to one. uh and so you know that should give you. a hint that it is possible sometimes to. achieve and recognize safety. um the more General algorithm for that. is is totally interesting but let me let. me continue doing showing some of these. different data structures so this is. kind of for the binary now for for for. ordinal numbers I basically have like. this this basically like I'm going to. draw like. kind of like a large lowercase Sigma. to like be all ordinal numbers on on on. on the set of blocks. um and validator and justification it's. like a similar thing so this protocol. agrees on an ordinal number of all the. blocks kind of orders all the blocks and. the way that I did it is basically with. with the estimator instead of doing like. a majority on zero one I did a I do a.

Ranked pairs uh voting protocol where. everyone kind of ranks the the orders. and then we kind of get this outcome. which is another ranking and so somehow. the this is only valid if it's a it's if. it's a correct rank pairs election on. the justification. um. oh yeah so uh sorry uh an ordinal number. is so the question is like oh remind us. on normal numbers a normal number. basically says like an order it's an. order as opposed to like a count it says. like this one and that one and this one. and that one as opposed to saying like. oh five it's more like first second. third so so somehow the ordinal number. will give all of an order over like some. some set. and so somehow like the order here has. to be the outcome of the estimator. rather than the justification which. ranks which does like a ranked pairs. thing on the on the latest on the based.

On the latest messages so that's this is. kind of for the ordinal number uh so. I'll actually draw the estimates here so. like this is for the bit this is for. like ordinal numbers the more more. interesting one kind of recently is for. the blockchain. um which basically has basically here. we're gonna have the previous block. right so which is like kind of somehow. the best the best block that's seen in. the view so like also a block. and then a validator and then. justification and here basically the. estimate is a block which basically in. in the validator kind of says look this. block is the best scoring block. um out of all the forks as seen from the. justification. and and this is this requirement for. single threadedness means that you can't. unsee a block uh blockchain after you've. you've made a block that says that.

You've seen these blockchains and shows. this one you can't in the future unsee. them and this kind of will restrict. validators choices as it would change to. mine on and we can kind of find that. like even something simple like this. uh with three validators like let's. assume the same one same weight like. this validator has seen these These. Chains. these guys and so can't build the block. on this guy because he's already. committed to seeing those ones this. validator. um you know would equivocate to make a. block and on let's say this is like on. the Genesis. um this validator like you know so so. basically like it turns out like that. like this is safe and it takes like kind. of some equivocation because all of. these guys are kind of committing to see. this one. um and so like if I was to if say this. one was to create a new block here no.

One can really switch but if this guy. were to equivocate also then. we could kind of get another chain to be. to be to be chosen. um yeah please please go ahead. no. no no so what was happening here is kind. of like the third the third block was. was finalized in uh and under the. assumption of there are no Byzantine. faults and actually it's actually. finalized also under the assumption that. there are one Byzantine faults given. that there's only these three validators. but that's kind of a calculation that I. that you have to do and that I haven't. really spelled out to the satisfying. extent for you guys. um but uh basically every block when. it's posed isn't finalized but every. block kind of. constrains a validator and what messages. they can make in the future constrains. their choices of forks that they can.

Make in the future without being. Byzantine and therefore. contributes towards getting the protocol. into this kind of uh commit state where. uh where where no matter what the. protocol is kind of locked on a certain. value. and so every block even though it's not. finalized when it's published. contributes to the process of like. finalizing stuff as long as it's kind of. like you know uh on the best chain you. know and kind of synchrony assumptions. allowing that kind of thing yeah hey. John. so the question is was a valid. justification only things that are in. blocks well so justification includes. includes blocks which you kind of get. from you and get from like listening on. the gossip Network and really what it. what it needs to include is kind of any. updates to the latest blocks that you've. seen from other validators.

Uh basically because it's the latest. blocks that you've seen from other. validators that kind of determines where. the where you see the stake as being. like on this fork or that for which is. going to determine. um which which which chain you actually. go go for and so maybe actually it would. be super helpful if I showed the fourth. choice rule for Val for for determining. whether this block is valid. um and so let's do it. so basically. um here's kind of here's going to be the. story so we're gonna have. some number of validators Let's do. four validators. um and we're gonna have like this. Genesis block. and maybe validator 2 will make a block. maybe validator two will make a block. first and then maybe we're going to get. another block here and then like a block. here but maybe there's a fork here. and maybe validator two sees this one.

Again and somehow maybe the weights are. like three four. five and six so these are like all of. their weights. um and then and then the question is. kind of like okay what's the best what's. the best Fork here is it is it like kind. of like you know kind of have some hint. that it's like either this one or that. one. um no but basically like how do we make. this choice. and um you know to to make to make this. actually a little more interesting. what's that let's add another let's add. another Fork here. um. so basically you kind of start at the. Genesis block and then you like you ask. like okay out of the the last blocks. that we've seen last messages we've seen. from all the validators which in this. case are like this one this one that one. and that one. on you know how much of the weight are. on all of all Alternatives well all of.

The weight is here and so we're kind of. happy to make this Choice here similarly. we're going to ask okay where is most of. the weight and we'll find oh actually uh. there's like three plus four plus five. is on this Fork whereas only like six is. on this Fork. and so like we go this way. and then here you know there's only one. way we can just go up there and then. here we decide okay like you know the. whether we go this way or this way we. basically I need to ask again like out. of the latest messages of the blocks. where is there more weight and there's. like more weight over here and so. somehow like this is like the magic best. block and like if this is in your. justification it would be invalid for. you to say anything but this block as. your estimate otherwise you you kind of. like you would have made a valid block.

And you know you kind of like lose your. deposit right and so you know but but. say like imagine if we were to like. erase this block and pretend that it. never happened. um then um then this choice would. actually be different because here we. have like weights three and four on the. left whereas we have weights five and. six on the right and so we kind of end. up choosing this block as the best one. and so uh somehow depending on whether. this block this validator next C is this. one or that one we can kind of like. choose this like a fork on here versus a. fork on there uh and so and so this kind. of can show you also that at the moment. we don't have safety over this decision. because if this guy makes this valid. this this block here. which is totally uh a valid block. because there's more weight here than.

He's seen. uh you know here. uh now somehow the the the correct four. Choice rules on this side and so like. this Choice wasn't safe because it was. possible for this guy to make a block. that caused our choice to move onto that. side of the uh onto that onto this onto. this side of the kind of uh blockchain. and it's a little bit confusing here I. should I should draw these arrows. differently because one of the arrows. points at the preblock and the other is. just kind of like this kind of oh I'm. not equivocating Arrow like I pointed to. my previous thing. great so somehow so somehow basically. that we have a this four Choice rule. that's literally. literally ghost based in a greedy. heaviest absorber subtree where you like. go down the subtree that has the most. weight uh according to these like. security deposits.

And so and so somehow that that. constrains what is valid in terms of. so so that contains constrains like. what's valid to put here in this block. because if that block Choice here isn't. the Ghost rule in the justification then. that's an invalid block and. um you know so so so you you really. given your notification you know how. much Freedom as a Byzantine validator. what you get to do is you decide like. what do you include in your. justification right you might be able to. emit some messages in order to. play games if I choose one fork or the. over another in order to like you know. bear out your agenda but somehow if we. we do have safety then what that means. is that there's going to be some amount. of security deposits that need to be. lost due to base you know due to. equivocation or invalid blocks. um in order to cause a choice in this.

Fork to uh. you know beef B be finalized or to be. safe which means that it's kind of which. means that if we were to decide on it. then we would have we would enjoy. consensus safety for that decision. uh and so like that's kind of the. blockchain one. and and and then finally we have this. like super cool one that I'm that I kind. of only came up with a couple weeks ago. that I'm like most stoked to talk about. um and this basically does an arbitrary. reduction system. so here our blocks are going to have. this interesting structure. where basically uh I'm I'm gonna just. write this in English so this is like a. memoized memoized. rewrite. um and then an invalidator and then a. justification. so this should be interesting here the. interesting thing here is that like. you're gonna have multiple valid choices. of what rewrite to do but it has to be.

On the best concurrent schedule as seen. in the justification. um and so we end up doing very similar. thing as we did with the blockchain fork. Choice only instead of choosing a. blockchain we end up choosing between. contentious decisions in a concurrent. schedule. um and and that ends up being really. cool because you we can write blockchain. blocks concurrently to the to the to. change the state concurrently not have. to agree on the order between them. unless they are they are contentious and. if they're contentious actually we're. going to be able to see it just by. looking at the memoization. uh and and that will help and that will. like kind of feed into this this four. Choice rule process where you know well. really it's not a fork Choice rule it's. a it's like a schedule schedule. concurrent schedule a choice.

And so you know it's a bit it's a bit. cool it's a bit complex but basically. like somehow the great thing about all. this is all of these protocols have the. same slashing conditions they have the. same safety proof that they satisfy and. um they give us a lot of room in order. to uh say make tradeoffs in in. performance by talking about like how do. we recognize safety like if we insist on. only recognizing safety in a little. subset of classes we can. um make sure that this protocol is super. performant but maybe not that live if we. are if we're willing to like run an. ideal adversary which actually turns out. to be like a perfect way of implementing. a safety article or basically like. simulate the network where everyone is. kind of out to get you and like we'll do. we'll do the worst case thing to change.

Your estimate then we'll be able to tell. in every case like every day whether or. not we're safe and that might not be. computationally efficient but we'll end. up having much more liveness from from. in the sense that like there are more. possible states of the protocol that. have safety as far as our nodes are. aware. um and so and so kind of uh long story. short. um this this this kind of. this correct by construction approach is. elegant because it lets us uh derive. protocols that satisfy safety proof. basically because what we're doing is. we're gonna. Define protocols that have estimate. safety and estimate safety is like a. real it's like a local view is a local. kind of property and so therefore is. like someone easier to reason about. um and also you know one one and when we. like kind of give our nose the ability.

To reason about it. um. you know we can we can we can construct. a consent correct by construction. consensus protocol in the sense that. like nose actually decide. um and then and then basically the the. next part of the story is kind of. liveness but basically what we need to. do is somehow nodes need to try to plan. collectively in order to produce a state. of the protocol that does have safety. and the way that that is done is. basically uh well there's a true there's. a relatively trivial way to do it. um and which is basically to say like. okay this like you basically have a. prescribed order of message arrival that. you want basically like you know rounds. work perfectly every time and kind of. kind of show obviously like if you can. get all them all the ballot all the. notes to send each other messages in.

Like one round and after they all. receive them send each other messages. again then like that will move them into. like a safe State and the nice thing. about that is it Maps really well onto. like traditional consensus protocol kind. of literature but there's lots of other. potential States like for example. potential ways to get safety like for. example the blockchain like just doing. it on a blockchain will also do it. eventually and like for those ones for. example are very easy to understand how. the liveness strategy looks like we know. how to make rounds we know how to make a. blockchain from the point of view of. um reasoning about timeouts on the. network. um because like this is stuff that we've. kind of we get to inherit from from. consensus protocol research and also. somehow a blockchain has very clear.

Synchrony kind of thing requirement that. name people are able to. build the blockchain. um so uh that's kind of like the long. and short of the correct by Construction. Casper protocols that I've been working. on and you know it's kind of gotten more. exciting than like say like my Devcon. talk because like instead of the just. looking at bits we're now able to look. at other types of data structures within. the same kind of framework using the. same definitions in the same safety. proof so pretty exciting stuff I think. um you know I guess we'll open the floor. up to questions now. hello. great thank you. he just said that it's a he. um I thought it was elegant and I'm. flattered. so the question is does the safety. estimation proof require an honest. reporting no it doesn't it just it just. relies on a node's local View.

Of messages from other nodes and and. it's not the fact that those it's not. honest reporting it's just it's just a. commitment right and if you if I have a. commitment from you then like somehow if. you violate that commitment then I can. hold you to account and so it's more. about accountability and and. observability of faults than about. honesty. well any message from a validator is a. commitment because it can be used to. hold them to account uh using these. flashing conditions. um so uh so estimate safety it can be it. needs to be calculated locally if a node. wants to make a decision although the. estimated safety definition is kind of a. global definition. um the main uh so basically like though. but but in terms of whether or not. finality is subjective or whether. people's thresholds are subjective that.

Actually ends up fitting quite nicely in. here but basically like if say the. estimate safety Oracle says that you. that like oh you can tolerate like x. amount of faults then like maybe. um that's below your final threshold. then you don't decide but if it can. tolerate X greater than your finale. threshold the amount of faults then you. can you know. go for it and so it ends up you know it. doesn't doesn't conflict but it uh. actually measuring estimate safety. locally is a lot of the kind of. challenge for the for defining these. protocols but. um very notably. how you do that doesn't affect the. safety proof. anyone else. yeah hi. interesting so uh so I I I so so when. you so I don't even know if I can repeat. the question do you want. okay do you want to try again and see if. I can oh so. so actually here. so I'm basically asking you like what is.

The advantage of having an in protocol. definition uh finality when there's a. lot of advantages to having like each. user having their own definition of what. they see a safe in a problem like. finality like after X amount of blocks. I'm 99.9 percent sure that this final. therefore I'm willing to accept this is. a spinality so. so uh so so that's that's a great great. question so the question is like you. know why why do we want to have like you. know this kind of safety uh kind of. calculation in the protocol uh rather. than like letting nodes have kind of. subjective decisions based on their own. um you know their their own kind of view. and I guess I don't need to replace. repeat the question now anyways uh uh so. so basically the the there's a so at. some extent it's absolutely totally cool. for people to have their own different.

Safety calculations as long as they're. reliably detecting safety because like. as long as you're reliably detecting. safety then you get to benefit from this. proof but if you think you're safe but. you're not you don't right and so and so. somehow the reliability of the safety. proof is really kind of required the. other thing to note is that actually. none of this stuff that I described is. probabilistic only really in the proof. of work model is it have I really talked. about or alluded to probabilistic kind. of reasoning. um or like you know tangentially like. would have touched upon. um so somehow. um. the the safety calculations aren't. deterministic sorry there aren't. necessarily probabilistic they could be. and if you can make a probabilistic. safety calculation which you kind of. show is actually faithful safety.

Calculation then there's no reason why. you can't run your node like that and. that's actually I think quite cool. because let's just have kind of a. modularity and complexity kind of a. changing at the edge of the protocol. rather than being at the core but on the. same at the same at the same at the same. time we do need to ship some kind of. safety Oracle or other or else people. aren't going to have any idea of where. they're safe without until they like. come up with their own or like find one. that they like and so we do need to we. do need to ship something just just like. for example the validator strategy like. technically like don't technically like. you know they we could we think we could. accept and tolerate them to modify it. within some balance as long as they. achieve protocol guarantees you know but.

We we still need to ship some default. Behavior we can't like ship the. incentives alone we need to ship the. incentives and the strategy. um otherwise uh people won't know what. to do. um yeah good question. what's the biggest challenge you. currently face in terms of. implementing the Casper protocol on the. public chain. I mean what's the biggest challenge I. currently face implementing Castle. Republican. the sound okay great because I was going. to say like I'm not. I'm not a developer. um I mean maybe so let's throw this a. call. um. biggest challenge is probably. um being sure that when you Deploy on a. public chain which is securing a massive. amount of value that you're not going to. deploy something and like tell everyone. this is okay and it's not okay and then. you lose a lot of people a lot of money. and get people very stressed out and so.

We have to stress out especially Vlad. and Vlad has talked about this stress. out a lot about this kind of like. massive scale and trying to design. protocols that really scale up. um so I would say like I mean public. part but yeah. hopefully it helps yeah. um cool um yeah. um yeah sure so I mean like. the question is I kind of describe the. deployment and basically we have this. Casper finality Gadget uh which we're. going to deploy kind of ASAP and then. you know we have like maybe some like. like maybe we want to do some sharding. real quick to kind of let the load keep. the load off but basically like I would. like to see only you know all the stuff. implemented and like you know some of it. may be deployed to Mana but but honestly. like to me. this is I'm I'm like a researcher you. know I'm not like I'm not going to be.

Upset if like this protocol as is. doesn't get onto the main chain but if. it does like that would be great. um and so I guess like so the in the. short term that everything is the. timeline is quite clear in the long term. like we still have like lots of. discussions to have about like what. Casper 2.0 looks like. um yeah well. okay so the question is like okay how do. we like continue to make sure in future. that we tap into the various fields of. expertise that are required in order to. kind of make this success build it out. well so I mean I on one hand uh I would. hope that the output of this process. will be like you know some like proofs. and stuff that can be checked rather. without no needing to know everything. um but uh definitely like you know the. getting academics interested in these. problems framing the problems in a way.

That academics can easily come on board. and solve a welldefined closed problem. that will like is like kind of works for. them is a challenge and but it's totally. something that like we're working on I. mean basically like in the end I think. what we're going to end up seeing is. like papers published and like you know. like in relevant places and like you. know which I think will eventually uh. provide people with confidence that like. we aren't just doing Pie in the Sky. stuff but stuff that actually like. contributes to like existing like. thought. um so there's there is like uh we are. working on like a kind of documentation. for some of the research problems that. we have. um and which we use to like talk to like. show various kind of academics and. experts. um it's still working progress but you. know the these are some problems that we.

Deal with and are actually. relatively regular basis one of the. reasons why I travel around so much is. like I'm trying to convince these people. to. uh take an interest in like our our kind. of mechanism designed applied. distributed systems kind of problems. how much does ethereum foundation spend. on Research environment I don't know I. mean I'm not the guy uh we don't we I. think we have like less than 10. researchers so. uh uh maybe ballpark it from that yeah. this is one of my many reading debts I. mean I love ghost so I'm sure that. Specter is great I mean just from the. reputation of the authors but uh I. haven't looked at it but I uh have you. is it awesome. oh yeah. okay. Okay cool so so uh basically we're just. describing Specter which is protocol by. Aviv Zohar and you know Tom blocksky. again I'm not sure who the other.

Coauthors are the other time okay cool. and so and and it sounds to me like it's. kind of like an inclusive ghost where. you get to kind of do a bunch of uh. execute transactions even if they're on. different Forks as long as they're not. conflicting which is something that you. know I'm assuming that the fork with. more weight will have priority and so. like that that's totally interesting to. me I totally have looked at that kind of. thing but basically it's one of those. like you know. um second. protocol rather than first protocol type. stories yeah. can I explain the fourth condition of. the rewrite. what do you mean the fourth condition. you mean you mean the data structure. okay. um sure so let's let's do you want to. flip it around. no no I got it I got it I got it yeah. yeah you got to pull on the thing. underneath okay so so basically uh the.

It's okay Carl don't worry about it. um so basically the way to think about. the rewrite thing is is kind of kind of. like this so here's here's the way I. like thinking about it so we start off. with with some last finalized Frontier. and then every rewrite is going to take. some piece of it maybe maybe one of them. will take like this piece. and then kind of you know write and. write a new a new a new a new let me. so it kind of we'll take a piece of it. and kind of overwrite this piece and. like replace it with that piece maybe. another rewrite will like we'll take. like we'll overwrite this piece and that. piece. and uh you know uh like leave a new. piece kind of here. and like that piece is just kind of gone. now like now there's like no peace there. um so so somehow these are these and. then and then maybe I'll have like.

Another rewrite rule that like takes a. piece of this one and a piece of that. one and like produces some new state up. here. and so it's it's kind of. a slightly weird situation where uh. rather than every block having like a. single previous block it has a it has. previous rewrites that it overwritten. overwrote and so how every block is. memorized with the rewrite status over. that over Road and somehow it's only. valid if. or is only valid if the in the best. schedule is justification each of those. things that it over overwrote are. actually exposed I.E they don't actually. have like some like some block on top. that are already over overwrote them and. so somehow you know you end up we end up. like building this this crazy thing. um you know who knows I'm just I'm gonna. and and then and then and then where.

Each one of these things are kind of. blocks and they point to some other. number some number of some number of. likes you can see like say like a bunch. of them going on here but and before. like for before coming like syncing up. again somehow we end up with this dag of. rewrites where every rewrite points to. the rewrites it's overriding and and. kind of it results in a new piece of the. frontier which is kind of like the. current state of the protocol which can. be overwritten by these rewrite rules. assuming you know that a best schedule. kind of sees that sees that Frontier and. so again I ended up having a dag with. with these kind of puzzle pieces that. correspond to the uh you know the pre. that the over overrides that are being. overridden. written um and and and and somehow if. two blocks overwrite the same.

State or like all the same the same kind. of spot then they're in contention and. and and we need to pick between them so. it might be that like I have another one. here. um and and and and these two are these. these two kind of are are kind of in. they're kind of in they're kind of like. really like only one of them can really. be right and then so like based on. everyone's latest messages you can. figure out which one has more weight and. like pick one of them in order to drive. this kind of best schedule type story. um and so basically we end up having. like a imagine that a blockchain is like. a puzzle where every block fits on top. of the previous one because it has like. a hash which is the hash of the previous. one only here instead of having one. previous block we have like in previous. blocks which are like the N that are.

Being overwritten by this rewrite rule. um and we kind of get we can identify. contention based on uh whether or not. these puzzles can possibly each fit uh. because if they fit in the same spot. then somehow there's there's like a. tension between them and and so. basically in some way a blockchain is. like a a an instance of this type of. rule. uh but this is also kind of more. powerful because it lets you do kind of. concurrent uh rewrites. um and and you know at this point it's. still kind of new research I don't know. that this is the best way to draw it but. uh you know I'm sure it's all going to. come come come in time. yeah so something I haven't mentioned. about all this. tiebreaking property. where basically I just kind of uh assert. that any two sets of validators have. different weights. uh and there's lots of ways to kind of.

Guarantee this. um but basically uh what it what it. means that like we're never going to get. to one of these points and be like oh no. there's the same amount of weight on. each side like it's always going to be. broken by like at least a random Epsilon. and so somehow. um we don't have to deal with like an. edge case where there's an art where. there's an arbitrary Choice uh and that. also you know is like it really is for. every one of these protocols like from. the binary down to the. rewrite system replication. um and the cool thing about the rewrite. system thing is that like you know you. can write any. fully unambiguously specified. programming language or virtual machine. in terms of State rewrites. um and so it ends up being a pretty. pretty General thing. like you know as general as computation. so you know that's a good question what.

Are where am I documenting this so um so. so I'm embarrassingly embarrassingly. behind I've got I've got like some. incomplete paper documenting the binary. consensus I think that now though I've. I've gotten to a point where I'm better. able to like Factor things and and I'm. also getting like starting to get help. from people who like enjoy writing. papers. I enjoy doing research but I am I am. working on uh documenting it is one of. the responsibilities I have and I. apologize for not living up to it. anyone else. so so how do how to address Ray Rice. deal with with partitions. interesting yeah so so so definitely. like there is some extent to which we. won't need to agree on which. Fork to choose if they're affecting only. independent states and so that can help. a lot. um in rewrites but in if there is a. contention then like we're going to get.

The same type of story as normal where. like uh the contention is going to be. resolved in favor of like one of the. partitions. um but the nice thing actually something. that Carl mentioned earlier that I. haven't stressed enough is that like. actually calculating safety of. particular estimates that only refer to. some substate of the state it could. actually potentially be really elegant. where basically you say oh look my my. State of the State of this account is. finalized even though maybe some other. things are still in contention over on. some other piece of the state. um but yeah no this is this is this is. kind of kind of still bleeding edge. research like don't expect this to be. deployed anytime soon. um cool so are we out of time are we. good or if we ran 15 minutes over I. think. so. cool. cheers thanks everyone.

and I'm purely economic foreign. foreign. you know really. what's up to me. five years. decide to avoid the policies. what. is. amen. noted that because