Discussion of Kenric Nelson's proposed voting scheme

[Quantumplation]

We've been discussing @kenricnelson's proposed voting scheme (now captured via PDF in this repository) over on CIP-1694; Given that this PR is already closed, and has pages and pages and pages of discussion already, it's probably noisy and ineffective to continue the discussion there, so I propose moving this discussion and analysis to this issue; Then, when the case for adopting this system is strong, we open a targeted pull request explaining and defending the voting mechanism directly, with the conclusions of the discussion. This may be as a revision to CIP-1694, if the change is small enough, or as an entirely new proposal that can compete with CIP-1694.

[Quantumplation]

Copying over my last major point from the other thread:

For example, the PDF you linked is nearly incomprehensible to me; I'd like to do my own analysis, but the one major impediment to that analysis is how you propose deciding quorum.

That is, you've outlined how voting power is computed; for example, in the current CIP, a proposal is considered to have passed once it has reached some percentage of the total "Active voting stake": with 20m ADA participating in governance, you need to reach 60% yes votes to pass a proposal, for example.

How is this threshold decided in your proposal? is it simply a percentage of the total "Votes" cast by dReps (we have 500 'yes' votes and 400 'no' votes, so it passes)? is it a percentage of the total "votes" that could be cast by dReps (we have 500 'yes' votes and 400 'no' votes, but 1000 dReps haven't cast a vote, and 26% isn't enough to pass), etc?

Please help me make this concrete so that I and others can help with the analysis, because the PDF you provided is not sufficient argument in favor of this proposal.

[Quantumplation]

@kenricnelson responding here, rather than on the CIP thread.

I don't think what you have now is appropriate or sufficient for a cardano-wide conversation, it would just be wasting people's time. You are missing critical details and a thorough argument for the advantages of your proposal.

What I'm suggesting is we take this closer to the source, where you documented the proposal, flesh out your analysis, in detail, and then come back to the CIP repository with an actuall pull request and the strongest argument that can be made; rather than just going back and forth forever on a closed pull request that most people are going to ignore. This is, tactically, the best way to build support for your proposal in my opinion.

Please see above for the concrete question you need to answer to make this a productive conversation.

Regarding thresholds, the work on CIP-1694 can be a guide. The base would be the total eligible votes, rather than the total delegation of ADA.

This is not concrete enough. I don't know what "total eligible votes" means; what makes a vote eligible?

Perhaps it'd be more constructive to answer with reference to a spurious hypothetical:

Imagine there is 45 billion ADA total. Of that, 35 billion ADA is in circulation. There are 100 dReps, Alice with a deposit of 1 million ADA, Bob with a deposit of 500,000 ADA, Charlie with a deposit of 50,000 ADA, and the rest with deposits of 5,000 ADA.

The minimum deposit is 500 ada.

The voting caps of each person are: Alice - 400,000,000 VP (which would equate to 1.6e+17 ADA from one person, 1.6e+14 ADA from 100 wallets, or 1.6 trillion ADA from 100,000 wallets) Bob - 100,000,000 VP (1e16 ADA from one person, or 100b ADA from 100,000 wallets) Charlie - 1,000,000 VP (1 trillion ADA from one wallet, or 10,000,000 ADA from 100,000 wallets) others - 10,000 VP (100,000,000 ADA from one wallet, or 1,000,000 ADA from 100 wallets, or 100 ADA from 100,000 wallets)

(My first observation is that there is not actually a strong incentive to include a deposit; even modest deposits effectively eliminate the cap on voting power you can receive)

Lets assume that, after delegations, they each have the following voting power:

Alice - 1 million VP (100,000 wallets with 10,000,000 ADA collectively) Bob - 800,000 VP (100,000 wallets with ~6,500,000 ADA collectively) Charlie - 2 million VP (200,000 wallets with 20,000,000 ADA collectively) Rest - 0 VP (for simplicity)

Alice has voted "Yes", Bob has voted "No", and Charlie and everyone else haven't voted yet.

Would this reach quorum? it's 55% of the cast votes, 26% of the delegated voting power, 0.2% of the possible voting power by deposit, 27% of the delegated ADA, 64% of the voting deposit weight.

I assume by "eligible votes" you mean the 2nd, as that's what makes the most sense to me, but I just wanna be sure.

[Quantumplation]

From the above, I'm not sure the deposit does much to dissuade splitting.

Lets assume it costs 1 ADA to split a blob of ADA into 100 different wallets (it's actually less than this, but even over-estimating this)...

Lets say I have 1,000,000 ADA; As an honest actor delegating to a single DRep I hope votes in my interest, I get 1,000 voting power.

You've said before:

Thus the delegates are incentivized to spread their ADA across many [DReps]

But I'm not sure why this would be desirable. Why does forcing a user to split their wallet / vote increase the security of the system?

If I want to be a dRep, then with one wallet, my optimal split is determined by solving

x + y = {wallet balance}
sqrt(x) = (10 * y/500)^2

If I have 1,000,000 ADA, this is ADA and 998,419 ADA, for a total voting power of 999.209.

For the cost of 1 ada, I can split my wallet into two; Then, the optimal strategy is determined by:

x + y = 999,999;
2 * sqrt(x / 2) = (10 * y / 500)^2

Or, in general

x + y = 1,000,000 - floor(n / 100)
n * sqrt(x / n) = (10 * y / 500)^2

For my 1,000,000 ADA, here's the first couple of optimal values of N, and their corresponding voting power

n	deposit	per-wallet	spent-ada	voting power
1	1580.51	998419.49	0	999.21
100	4993.74	9950.0526	1	9974.99503759
200	5937.19	4970.30405	2	14100.0766665
300	6569.53	3311.4249	3	17263.4944609

As a reminder, the voting power I had prior to splitting was 1,000, so by splitting into 300 wallets (for the cost of 3 ada), I've multiplied my voting power by 17.

Perhaps if we assume delegating has some additional cost for each wallet, that changes things, but I doubt it; Lets assume we pay 1 ada to split a wallet 100 ways, and then 1 ada per wallet to delegate to your DRep; Then, my un-split voting power would be 999.9995 ADA (because I also had to pay to delegate to someone), and the optimal split is determined by

x + y = 1,000,000 - floor(n / 100) - n
n * sqrt(x / n) = (10 * y / 500)^2

n	deposit	per-wallet	spent-ada	voting power
1	1580.51	998419.49	1	999.21
100	4993.62	9949.0538	101	9974.49
200	5936.89	4969.31	202	14098.66
300	6594.04	3310.42653333	303	17260.89

No material reduction in my force multiplication.

Ok, perhaps charging a higher fee, making it more expensive to split the wallet, will help; lets assume it's 10 ada to delegate to someone:

x + y = 1,000,000 - floor(n / 100) - n * 10
n * sqrt(x / n) = (10 * y / 500)^2

n	deposit	per-wallet	spent-ada	voting power
1	1580.51	998409.49	10	999.20
100	4492.49	9945.07	1001	9972.49
200	5934.2	4960.32	2002	14085.90
300	6564.57	3301.44	3003	17237.45

It doesn't seem like this materially prevents wallet splitting; instead, it creates an incentive structure where, by splitting your wallet for relatively cheap, a whale can get 17 times the vote they would otherwise.

If you impose a maximum deposit, you can just repeat this same analysis, splitting the deposit across multiple DRep registrations as well.

Basically, someone with 1,000,000 ADA has the same voting power as 300 people with 3301.44 ADA (990432 total) (and this can be pushed further; it basically converges on one coin one vote). So, there's a slight advantage for "the masses", but by your previous standard, this seems basically just as "plutocratic" as CIP-1694.

[Quantumplation]

(Do let me know if you can spot a flaw in my reasoning, I was excited by the idea of your proposal)

[Quantumplation]

@Willburn You might also be interested in the above analysis, considering it sounded like you'd discussed it in depth with Kenric.

[kenricnelson]

@Quantumplation Thank you for putting time into the analysis. I need to be clear about the scope of this analysis. It is not my intent to initiate a new CIP. As a solo investigator volunteering my time, I'm am only trying to show that premise undergirding CIP-1694 is fraudulent. The Federation and the community will have decide whether they want to proceed with the fraud.

CIP-1694 starts with a statement that identity is not possible for on-chain governance and that without identity 1c1v is the only possible voting system. Both premises are false.

There are many viable identity systems for safely credentialing the DReps. IOG is selling systems themselves. There are many others on the market.

There are many alternatives to 1c1v without identity. Cardano currently uses saturation in both the SPO operation and the proposed DRep program for Catalyst. Buterin has published correlation measures to control against Sybil attacks.

The sketch of a design and the accompanying analysis are not a specification. They are to show that if the Federation had wanted to work on a decentralized governance plan solutions are possible, not impossible as fraudulently stated in CIP-1694.

A plutocracy requires a cover story to justify the inequitable distribution of power. That's the purpose of CIP-1694 and that's why it's starts with fraudulent claims that other solutions were not possible.

For now, all that can be done is clearly document the fraud. Others in the Federation and the community will have to decide whether to proceed with the fraud or restart a real effort to design a generalized governance system.

[Quantumplation]

@kenricnelson Whether you want to submit a revision to CIP-1694 or a whole new proposal, what you have here isn't sufficiently detailed or defended enough for either.

I've told you before, I'm not interested in discussing your political agenda, which I view as largely propaganda and theater. You've outlined a deeply flawed proposal, late in the game, and then called people frauds for not pursuing it earlier. It's ludicrous, frankly.

I'm interested in discussing your proposal, that's it. If you want my time and assistance in refining the proposal, please stay on topic. This is my last attempt to build this bridge with you before I spend my time on more productive things. And given the way your rhetoric seems ineffective at building a coalition or consensus, and given the weak and ill-defined nature of your proposal, having a well refined, specific, and strong argument in favor of your proposal is the only chance in hell you've got.

CIP-1694 itself doesn't include the word "impossible" anywhere; Indeed, it simply says that enforcing identity verification without some centralized oracle is very difficult. Most of us on CIP-1694 aren't saying it's impossible to design a governance system centered around decentralized identity, simply impractical to halt the world, spend 5 years on research and deployment of a widely used, trusted, decentralized, and tamper resistant identity system before we dismantle the totalitarian system we have now. Calling that difference of opinion fraud is disingenuous, disrespectful, and damaging to your case.

As for quadratic voting without a system of identity, you keep making the claim that it is possible, without even remotely justifying it. I was hopeful for this proposal, but from my perspective it fell apart after less than a day of thought. If you are, indeed, smarter than every researcher and community member who is skeptical of your claims, you have to demonstrate that. But that doesn't make our skepticism fraud.

As it stands, you keep making statements like "there are many alternatives to 1c1v without identity", and not backing those statements up. The one you presented above is (so far as I can tell) deeply mathematically flawed, but feel free to pick apart my analysis. You provide the example of SPOs, but block production very much is 1c1v, simply with a mild soft-cap (which most people in Cardano seem to think is not working).

I'm totally behind the ideals of quadratic voting and dismantling power, hence why I'm trying to push through your rhetoric; I was hoping your proposal would hold water, and maybe it does and I'm just misunderstanding it. So if you can point out where I'm wrong, if you can convince me that the proposal (or any other) is sound, I'll help you get it from sketch to specification and then fight like hell for it, that's what I'm good at.

But you're not going to convince me with all the bullshit, you're simply going to erode away my patience.

(EDIT: Perhaps the above is a tad harsh; like you, I'm volunteering my time and trying to get things done. But please, for the love of god, just engage and stay on topic, the accusations and theater do nothing to get shit done.)

[kenricnelson]

Regarding the analysis, it would be better to work in a common analytical document, rather than the text messages. Is Mathematica suitable for you? I know Python is More common these days, and our team develops in Python but I prefer to do my own design work in Mathematica.

I'd like to review your tables more carefully but this week I'm over booked. I can give you my own observations regarding three regions of behavior:

For low delegation size, there is benefit to splitting the wallets as long as the DRep spends a modest amount. Nevertheless, this is limited in effectiveness since it assumes low delegation.

With high delegation, the DRep will prefer to use one wallet.

The dangerous case, and where parameter adjustments may be needed, is with high delegation and high deposit. Here the key is to make sure significant gains are not achieved unless more than a thousand wallets are used. Above this, other controls can help. Namely, if DReps are selected by being among the top regarding delegation.

I also think in each of these cases it's important to compare with the 1c1v case. So if a DRep chooses to run multiple pools within limits that may be okay, just as today we accept multi-pool operation. Not ideal, and further mitigation is desired in the future, but a better starting point then allowing unsaturated SPOs or purely 1c1v Voting.

[Quantumplation]

Unfortunately I'm not familiar with Mathematica at all, but I could try to capture my analysis in Python going forward.

With regards to the three regions, I think that mostly makes sense. I don't agree that "with high delegation, the DRep will prefer to use one wallet", since the square scaling on the deposit makes it trivial and cheap to raise the ceiling on their voting power, meaning there's not an incentive to pool the rest of their voting power: there is an explicit inflection point where someone can calculate the exact deposit needed to allow the rest of their stake to be delegated. Then, with wallet splitting, there's no incentive to try to build consensus and attract delegators, the purported benefit of this system.

Unfortunately, given the severity of the problem, I don't see how you "make sure significant gains are not achieved", without completely destroying the ability for the average voter to participate; It didn't seem to me like playing with the parameters in reasonable ways effected the split-scaling much. After work tomorrow I may code up a python example, or try to parse your Mathematica code.

Note that if "DReps are selected by being among the top regarding delegation", this exacerbates the issue IMO. We can't tell the difference between other people delegating, and a large whale delegating to themselves, that's the whole issue. So, suddenly it becomes very easy for a whale splitting their wallet not only to amplify their voting power, but to suddenly guarantee themselves a slot and crowd out other legitimate voters, rather than only having an increased influence.

And the analysis above isn't even considering splitting multiple "pools"; it's all with one pool, but self-delegation. If you limit the size of a pool, then the same exercise can be repeated, just splitting each time you reach the maximum pool size.

Relying on people avoiding wallet splitting because it's inconvenient would be really insufficient; It's trivial to generate millions of private keys per second, they don't take up an onerous amount of space, and managing a few thousand addresses, for the increase in power it provides, is not difficult at all when scripted. The deterrent needs to be economic or protocol enforced to be effective.

[Willburn]

First of all appriciate the discussion and in particular the last sections that where focused on the idea and criticism & identifying things that need refinement for this idea to work.

For my 1,000,000 ADA, here's the first couple of optimal values of N, and their corresponding voting power

n deposit per-wallet spent-ada voting power 1 1580.51 998419.49 0 999.21 100 4993.74 9950.0526 1 9974.99503759 200 5937.19 4970.30405 2 14100.0766665 300 6569.53 3311.4249 3 17263.4944609 As a reminder, the voting power I had prior to splitting was 1,000, so by splitting into 300 wallets (for the cost of 3 ada), I've multiplied my voting power by 17.

Not sure you got this one right (or maybe I am misunderstanding). So deposit voting power is X to the power of 2. Since delegation voting power is sqrt logically it follows it is better to be a DRep than a delegator with all your Ada to maximize voting power. It should not pay for you to split wallets since you still have the power of 2 in each case and you have the activity requirement of being a DRep to account for as well.

Unfortunately, given the severity of the problem, I don't see how you "make sure significant gains are not achieved", without completely destroying the ability for the average voter to participate; It didn't seem to me like playing with the parameters in reasonable ways effected the split-scaling much. After work tomorrow I may code up a python example, or try to parse your Mathematica code.

This is as far as as I can see is a valid criticism of the idea and means that it is important to have a ceiling on deposits so the idea needs refinement.

Note that if "DReps are selected by being among the top regarding delegation", this exacerbates the issue IMO. We can't tell the difference between other people delegating, and a large whale delegating to themselves, that's the whole issue. So, suddenly it becomes very easy for a whale splitting their wallet not only to amplify their voting power, but to suddenly guarantee themselves a slot and crowd out other legitimate voters, rather than only having an increased influence.

Yes this is also valid criticism so if we have a simple limit of number of DReps than a very large whale could crowd that limit of dreps by splitting up. However I think if we have a ceiling on deposit and the limit is based on DRep total voting power it become a matter of delegation and then we can start to crunch some numbers as with sqrt it will not easily pay off for a whale to try to crowd any Drep limit.

Appreciate your look on this one Quantumplation. Also Kenric thank you for persevering and trying a novel approach that takes us (IMHO) very close to a solution. Quadratic voting has promise and we are not that far off figuring this out. I think this is achievable with some more considerations. By pure math logic if DRep gives you more voting power and delegating gives you less, while splitting up the Drep wallet gives you no more then we are on to something. The question then becomes to find a balance between the increase in voting power of the DRep vs the delegators to make sure we don't introduce new attack vectors such as 51% attacks or as you now identified "crowding" of the DReps if a set number of Dreps during a bootstrap phase.

[Quantumplation]

Not sure you got this one right (or maybe I am misunderstanding). So deposit voting power is X to the power of 2. Since delegation voting power is sqrt logically it follows it is better to be a DRep than a delegator with all your Ada to maximize voting power. It should not pay for you to split wallets since you still have the power of 2 in each case and you have the activity requirement of being a DRep to account for as well.

Because we take min[(10*deposit/minDeposit)^2, sqrt(delegation)], any deposit above what you receive in delegation is useless. So it's not better to be a DRep than a delegator, unless you have the delegation to take advantage of that extra voting power.

Additionally, they aren't mutually exclusive. So, absent any external delegations, the optimal strategy is to allocate just enough of your ADA to a deposit that you can leverage the rest of your voting power by delegating to yourself.

Depending on how many wallets you're willing to split your ADA into, you can begin to amplify your voting power, setting aside just enough deposit to take full advantage of that splitting benefit. That's what the numbers in my table demonstrate.

[kenricnelson]

@Quantumplation If you're able to join this afternoon's town hall discussion it would be great to have your input. While I appreciate that reading the Mathematica graphs without adequate annotation is difficult, the last example does explore the trade-offs of the solo DRep operating multiple pools. My analysis showed that the wealthy solo DRep would benefit from running 100 - 1000 pools; however, their influence would still be 2-3 orders of magnitude less than the 1c1v solution. Beyond 1000 pools, the size of the delegation can be designed to go below a minimum required total delegation for a pool, say 100,000. A minimum total delegation might be a better criterion than picking the top 10,000.

Regarding the deposit parameters. I started with 500 ADA since this is the Catalyst minimum; however, 1000 or 5000 would be more secure. The point of squaring the deposit it to make it positively sensitive to the deposit while not requiring huge deposits to fully participate. I'll use 1000 ADA as the minimum deposit in this note just to make the numbers simpler. The minimum deposit still starts at 10^2 votes. If 10^10 is considered the largest possible delegation to single pool, that would require a deposit of ~32,000. That's still a modest size. Is these kinds of trade-offs that need to be examined. It may very well be that making this range large would be benefitial. I have fully analyzed this but my intuition is that a large minimum makes it more expensive to start a new pool, while a small range makes it easy to accept more delegates on a single pool.

Actually, here's an interesting thought experiment. Given the factor 10 multiplying the deposit, the minimum deposit results in 100 votes. This corresponds to 10,000 delegates ADA. What if 10,000 was set as the minimum total delegation? Each delegate could still have a minimum of 10 ADA but the total for a pool must be above 10,000. I'm not sure that would change my initial analysis dramatically but it would help to explain how the system works. I also think 100,000 as the minimum total delegation would be more sensible. Then the multiplying factor should be ~17.78.

[Quantumplation]

If you're able to join this afternoon's town hall discussion it would be great to have your input

I'll try to be there, do you have a link?

While I appreciate that reading the Mathematica graphs without adequate annotation is difficult

I understand what each axis represents, and what the graph is trying to communicate; what's not clear is what the different colors represent.

My analysis showed that the wealthy solo DRep would benefit from running 100 - 1000 pools

Again, I haven't even gotten to analyzing the multiple pool situation. Even if someone runs a single pool, they can increase their voting power relative to everyone else: at 300 wallets, it's x17 advantage; at 1000 wallets, it's x30 advantage; at 5000 wallets, it's a x68 advantage; Even with a 10 ada fee to register each wallet, that's only 50k ADA spent. If the vote in question is a 10m ada treasury grant, the recipient would likely gladly spend that.

The fundamental assumption you seem to be making is that a person has to devote their ADA entirely to either their deposit or wallet splitting. What my analysis considers is someone who devotes just enough ada to a deposit to unlock the potential of their ability to split their wallet.

If I repeat the analysis with 1000 ADA, it doesn't materially change things:

n	deposit	per-wallet	spent-ada	voting power
1	3159.77	996829.23	10 (0.001%)	998.41
100	9972.45	9890.2655	1001 (0.1%)	9944.98
200	11850.7	4930.7365	2002 (0.2%)	14043.84
300	13107.4	3279.632	3003 (0.3%)	17180.42

The amplification isn't materially effected. And this is just with 1,000,000 ADA. It gets worse for larger whales, because a smaller fraction of their assets are going towards the fees for wallet splitting. For example, with this scheme, the Fardano Coundation (an evil Cardano Foundation), which controls 500m ADA, the table looks like this, with percentages of funds added:

n	deposit	per-wallet	spent-ada	voting power	multiplicative
1	14953.4	499985036.6	10 (0%)	22360.35	0.99
100	47285.9	4999517.131	1001 (0.0002%)	223596.00	9.99
200	56232.5	2499708.83	2002 (0.0004%)	316209.35	14.14
300	62231.3	1666449.22	3003 (0.0006%)	387273.07	17.32

their influence would still be 2-3 orders of magnitude less than the 1c1v solution

I don't see where in your materials you justify this statement.

[kenricnelson]

In the mathematica code, I replaced the constant 10 with the function (minDelegate)^0.5. This seems to work out nicely. And I used 100,000 as minDelegate.

[Quantumplation]

if minDelegate is constant at 100,000, all you've done is set the 10 constant to a constant of ~316. This doesn't materially change the table above (in fact, it'll mean that around 30 times less ADA needs to be devoted to the deposit to achieve the same voting power cap).

Here's one of my tables above updated to include the total amount of ADA "delegated" to the DRep (my table only includes the per-wallet amount, but remember that they have hundreds of wallets with the same size):

n	deposit	delegation	per-wallet	spent-ada	voting power	multiplier
1	49.99	999940.01	999940.01	10	999.97000455	0.99997
100	158.06	998840.93	9988.41	9994.20	9.99
200	997810.073	4989.050365	14126.6420143	14.126712648
300	207.922	997790.078	3325.96692667	17301.3590044	17.3014455118

Notice that in each case, the delegation to the wallet is greater than 100,000 ADA, meaning the minDelegate doesn't go into effect, and the scaling is unchanged (and in fact, a little better for the attacker)

[kenricnelson]

My analysis also shows that a wealthy individual willing to run many pools can benefit. The issue that will require further analysis is how this benefit compares with their original voting weight under the 1c1v system. The benefit is sensitive to the minimum delegate size per pool. I'll review this example this afternoon. A difficult aspect of the analysis is the difference between passive delegation and active sending of a deposit. Especially if there is a risk of losing the deposit under particular circumstances, which adds to the security analysis. I'm not sure how to quantify that difference.

[Quantumplation]

My suggestion would be two metrics:

• x axis: wallet size; y axis: "effective voting power", the percentage of the voting power that someone has, relative to the circulating supply; one series for each of a number of splits (1, 100, 1000, 5000). For 1c1v each of these would be a linear slope, all overlapping, since splitting your wallet doesn't impact your percentage of the vote; for quadratic voting, you'll see larger wallets give you diminishing returns, but splitting will nullify that pretty quickly is my guess.
• x axis: wallet size; y axis: "number of voters displaced", which is the number of people with 1000 ADA that have equivalent voting power to the wallet; and then a series for different number of splits. For 1c1v, you'd again expect this to be a linear slope; I'm not sure what this proposal would exhibit.

My other main concern is that even if this dampens the "percentage of the voting power", it directly incentivizes those who are dishonest. An honest actor who doesn't want to bother with splitting their wallet (or a small ADA holder for whom the wallet splitting would cost a larger percentage of their holdings) has 1/60th the vote of a determined attacker.

[kenricnelson]

The first metric is important. How are you defining wallet size? I'm not sure I understand the second metric. Why are voters displaced? You can always delegate to pool since there is no limit. There are interesting dynamics regarding the differential impact of adding 1, 10, 100 ADA.
I don't think "cheating" is the right way to think of this. We accept multipool operation. Although its a profitable option, we recognize that upgrades to the protocol are needed to limit this. Not only are MPOs not shamed as cheaters, they are some of the most respected members of the community.

[kenricnelson]

I do think adding a cost not just a deposit for the DRep would further assist the security. This would have to be done as part of the reward design. For instance, if 10% of the deposit is treated as an annual fee and is regularly subtracted from rewards that would further incentives DReps to keep their deposit to the minimum necessary to have one successful pool.

[Quantumplation]

The first metric is important. How are you defining wallet size?

Wallet size is the initial accessible ADA, before splitting; so, in the examples I was providing above, I was working with 1,000,000 ADA.

I'm not sure I understand the second metric. Why are voters displaced?

Another way to think of it: how many "average size" / "small" voters are needed to counteract the vote of a malicious actor.

I don't think "cheating" is the right way to think of this.

Operating stake pools and voting are different activities; Someone who is just doing casual defi from one wallet, and wanting to vote on governance should not have 1/60th the voice of someone who is trying to game the system, splitting their wallet thousands of times to amplify their voice. That's what I mean: the casual voter is dramatically disadvantaged compared to someone with the tools to wallet split.

If we want to say "well, the expectation is that you split your wallet thousands of times, that's just part of how you vote", then we just converge on 1c1v anyway.

[Quantumplation]

I do think adding a cost not just a deposit for the DRep would further assist the security. This would have to be done as part of the reward design. For instance, if 10% of the deposit is treated as an annual fee and is regularly subtracted from rewards that would further incentives DReps to keep their deposit to the minimum necessary to have one successful pool.

Again, all of my above analysis is assuming a single DRep; what's changing is the number of fake self-delegations; so adding a cost per-DRep ("pool") doesn't materially change my analysis. If you add a cost to delegate, it might, but again, you're just driving away people for whom that cost would be prohibitive, without materially impacting a whales ability to swing the vote.

[Quantumplation]

Not only are MPOs not shamed as cheaters, they are some of the most respected members of the community.

Also, MPOs are relentlessly shamed by a large portion of the Cardano community :sweat_smile:

[kenricnelson]

@Quantumplation As I go forward with this work, I'll put together a method to measure the cost of Influence. That way we can have a concrete measure rather just a label of what's considered cheating or not cheating.

The foundation for this will be the Banzhaf Power Index, which measures the probability of being the decisive vote in a coalition. BFI can be translated from a probability to a measure of Power or Influence by Power = 1 - ln P_BPI. By this measure a dictator has infinite power and a dummy Voter has no power.

One of the first goals of decentralized governance would be to make sure that achieving Dictator control over decision-making has a cost that approaches infinity, and that getting beyond a Dummy role is not expensive.

For reference, the definitions are Dictator has a P_BPI = 1 and a Dummy has a P_BPI = 0.

[Quantumplation]

I think it's definitely good to be concrete, and I don't know much about this;

When I started to read up on the BPI, I saw that there are some criticisms of the BPI treating voting like a pure coin flip, and that when you apply it to empirical voting data, you get sometimes dramatically different results.

The same source mentioned the Shapley–Shubik power index as an alternative. Do you have any thoughts with regards to the comparison of the two?

[kenricnelson]

The Shapley-Shubik index is very similar but considers particular sequences of coalitions, whereas BPI considers all combinations of a coalition. The criticism you mention has to do with whether each persons choice is considered independent. While accounting for correlation can improve measures of power that's a substitute that's harder to quantify.

On the cost side, I believe a good starting point would be the percentage of ADA normalized by the current supply. And again 1 - ln P_supply would be a unitless measure of cost. So for instance, it's a reasonable estimate to say that acquiring 100% of the supply would be an infinite expense, since an attempt to acquire a complete monopoly would escalate the price dramatically. I'm not sure how accurate this cost metric is but it would give a start.

[Quantumplation]

As you're calculating BPI, or SSPI, make sure to take into account the splitting strategy I outlined above; just considering actors who keep their ADA collected isn't sufficient; You should consider the fact that someone can increase the probability of being the swing vote by splitting their wallet.

Still, my main concern with using this metric alone is I don't know if it captures/measures what I consider a highly undesirable property: the bias/advantage of those willing to put in the effort to split their wallet.

Lets assume, for example, that your proposal gives "an order of magnitude improvement" on either BPI or SSPI, and we implement it;

Now, the average user, who just wants to keep 1 wallet, or a few wallets for different purposes, becomes disenfranchised from governance; they have 1/70th the voice of someone who has equal ADA, but goes through the hassle to (and can afford to pay the tx fees to) split their wallet by 5000.

Even if you disgard the moral judgement of this, we're very strongly incentivizing behavior that damages and clogs the network; You get "governance by those who can automate, go through the effort to do so, and for whom the fees make up a smaller marginal percentage of their total wealth".

The tx fee cost of someone splitting 100 ADA into 5000 wallets to leverage that "amplification" effect is much higher than it is for someone splitting 1m ADA across 5000 wallets.

So, while asymptotically it may give better measures on the BPI, without also having a concrete way to capture this effect, I fear we won't have the full picture. Do you have any ideas for how we can make this concrete, so we can weigh the trade-offs for the (as of yet undemonstrated) advantage in BPI?

[kenricnelson]

Yes, the point will be to have a common quantitative metric rather than a subjective judgement of what constitutes cheating the system.

Then different Sybil resistance strategies can be evaluated based on the cost of expanding your votes by splitting your wallet.

[kenricnelson]

The third chapter of this report provides Banzhaf Power Index analysis of the Catalyst program. For instances, the top 10% of wallets have the capability to form a Dictator consortium.

https://docs.google.com/document/d/1LXtBMIk9NjvsrEMZkD2LvZO15giPDoJZj1xROUgDwl4/edit

[Quantumplation]

I was thinking about this more;

If I understand your argument correctly, it's that even if wallet splitting gives an advantage, it's still less dangerous than 1c1v, because it becomes 1c1v only in the limit, when everyone splits their wallet into 1 lovelace fragments: before that limit, everyone's voting influence is still dampened relative to 1c1v.

However, I thought of a new way to articulate why this is unconvincing to me.

An interesting metric to track, I think, is "cost to super-linear"; that is, how much would it cost (as a percentage of wealth) for different actor sizes to achieve more voting power than the median voter power. For example, consider a scenario where the median wallet size is 1000 ADA (my super informal methodology of asking on twitter suggests that it might be around 1500 ADA). In 1c1v, a wallet with 5M ADA has 5000 times the votes as the wallet with 1000 ADA, and in quadratic voting, this is only 70.7 times the votes as the median wallet size.

However, for fairly cheap as I was showing above, the 5m ADA voter can split their stake into wallets smaller than the median, at which point they have more than 5000 times the votes of the median vote.

Even (especially) if your argument is that voting influence scales non-linearly, and you want to use a more sensitive metric, giving effectively worse than linear vote scaling to large actors seems dangerous.

The only defense against the above would be to lower the median wallet size, making it more expensive to execute the attack.

I think the thing that would go the furthest towards convincing me is to demonstrate that, for a decent range of real world median wallet sizes, and for a range of realistic "large wallet sizes", this "cost to super-linear" is a significant percentage of someone's wealth.

[kenricnelson]

The kinds of metrics you describing are relevant. That's what I was trying to get at in the previous post regarding the cost of Influence.

A frame of reference to consider is the success of Saturation for SPOs. As the Edinburgh research has shown, Cardano achieved an impressive level of decentralized consensus. The saturation of pools was a big factor, and the contrast with insecurity Ethereum is facing is important.

While there are issues to resolve regarding the multi pools, the social pressure to spread stake to single SPOs has worked. Nothing like the scenario you describe has actually played out, despite the fact that the flat saturation curve is far more severe than the power 1/2 curve.

Something else I learned at the workshop is that the IOG team has designed Saturation for the DRep programs. While the Catalyst team is still moving forward with this. The Voltaire team changed the design and removed the saturation. This reinforces my concern that the purpose of Voltaire is to consolidate centralized control.

I originally thought the DRep program was like a legislative body. With saturation this would be true, since the largest stakes would be equal, and the DReps would have a democratic relation to each other.

For Voltaire, the DReps will be more like a Board of Directors. The Chairmen of the Board will be the largest DRep. Others in the community will be required to acquiesce to the Chairmen or else risk losing the ability to get support for their own priorities.

[kenricnelson]

Another aspect of the design you may want to consider is the ability to adjust the power parameters. If for the moment we put aside the deposit requirement and just look at the votes based on the delegates. The MVG could be programmed to be ADA^powerDelegate, with powerDelegate initially set between 0.75 and 0.9. That way the design would have flexibility, while start with a mild variation from 1c1v so that it's not as sensitive to Sybil attacks.

Also, post-MVG I plan to focus off the preferential voting aspects of Plural Voting. This was original focus of Glen Wyel's design. This would give DReps the ability to focus investment on the issues their constituents care about rather then having to respond to every proposal.

[kenricnelson]

@Quantumplation At the Edinburgh Workshop there were some conversations regarding use of the age of an eUXTO to guard against exchanges participating in the governance. Have you given any consideration to this mechanism?

It occurs to me that it would also serve the purpose of an initial Sybil resistance mechanism. This would be more attractive then the deposit mechanism, which requires careful balancing with the pledge function.

If the Sybil resistance mechanism is independent of the pledge voting function, it makes it easier to define a flexible function and a modest starting point.

For instance, we could start with ADA^x with x=0.75. The CIP or possibly the constitution could require monitoring of both the centralization of voting power and the detection of Sybil attacks. The Sybil attacks can be monitored through measurement of correlation in voting.

Over time, x could be updated depending on whether centralization or Sybil attacks are the bigger threat. And over time stronger Sybil resistance can be developed. The key is to a have a simple approach for MVG so we don't lock ourselves into a centralized governance policy.

[Quantumplation]

I think one big difference between pool saturation and voting is that dividing your stake, unless you have >64m ADA, doesn't give you an advantage; 64m ADA vs 2x32m ADA leaves you with roughly the same expected return. And in fact, what we've seen is that it exactly incentivizes people to split their ADA and run multiple pools right up to that limit. So, you don't see people fragmenting pools down to 1000 ADA each, because it doesn't provide any advantage, but you do see binance running 60+ or 80+ pools, depending on what the latest count is.

Your proposal is the opposite: it gives people direct advantage for splitting their wallet for a vote, and that return doesn't cease to diminish, so more splitting always gives you more power within governance, and it becomes just a matter of how much do they want to automate, how much do they want to (can they) spend in fees, and how much can the chain support.

The UTXO age idea is an interesting one that I don't have an in depth analysis of; it suffers from the same effects in the long term, and arguably may make things worse (the biggest whales are more likely to be those who bought earlier on, and thus have ancient UTXOs with millions of ADA in a cold wallet sitting around), but it at least requires some time investment for a new actor. It might be interesting to explore such a mechanism with the added criteria that in order to vote, you had to spend the UTXO holding the voting power you wanted to use, thus resetting your timer. It's not clear to me at first blush whether that's a good or bad idea, so I'm just saying it's interesting.

The biggest problem I see with that approach is that the UTXO currently doesn't track that information (it's stored on disk, but not in the in-memory state that a node would have convenient access to when processing votes); There are 10 million records in the UTXO currently, meaning adding any overhead to every single UTXO has to be considered very carefully. The ledger team would be the ones to weigh in on the real impact of this.

[kenricnelson]

The spending rather than allocation passed on held ADA is also interesting. While not for MVG, requiring people to invest in public decisions would cut down dramatically on random, uninformed voting.

If you haven't looked at Weyl's Quadratic Voting protocol, it's worth taking a closer look. It actually passed on spending and distributing funds in a way that lets people pay for influence at a fair price and then compensating those who keep there views modest.

[kenricnelson]

I'm supportive of saturation. I would not have been so concerned about the design of saturation has been maintained.

In fact, one option would be to have it be linear up to a point and then a power function after that. That would further reduce the desire for wallet splitting.

[Quantumplation]

Specifically, I was just referring to spending the UTXO to reset it's age; you don't give up the ADA, but you give up the age which gives it voting power. Might be a middle ground between making people pay to play, for example.

[kenricnelson]

In reflecting on why the saturation was removed from the Voltaire DRep program, it becomes clear that the SPO and DRep functions are fundamentally different.

Consider the perspective of a wealthy ADA holder wishing to delegate these responsibilities. For the SPO delegate, choosing 10-100 pools is not a big deal, since the returns will be approximately equal. But choosing many DReps rather than one DRep to represent your governance views is much harder.

If you delegate a large amount of ADA to one DRep it's easy to control that persons voting. On the other hand if your pledge is diluted to many DReps, they are not as beholden to you and it's harder to replace them.

Thus, the opposition to saturation has nothing to do with Sybil attacks, rather it is active opposition to decentralized governance. There's already a community of wealthy ADA holders who will actively oppose any attempts to create a decentralized governance system.

There fine with a participatory cover story, as long as it doesn't actually distribute power. But any design that would be successful in distributing power will be opposed.