Possible beacon chain changes for phase 1

[vbuterin]

Here are some proposed changes that have to do with the contents of the phase 0 file, but which should be delayed until phase 1 either to respect the "don't change phase 0 anymore unless it's security-critical" taboo, or because there is no need until phase 1+ in any case. Nevertheless, these changes are arguably long-term important-to-have.

• (addressed in Phase 0 v0.12 via #1830) Fixes to rewards during inactivity leak: when the chain is in an "inactivity leak" stage, validators should get full rewards (ie. no discounting based on what percent is online). This is to maintain the invariant that during an inactivity leak, a perfectly behaving validator should see their balance hold constant, not slowly decrease. See also ethereum/eth2.0-specs#1370
• Disallow exits for ~1 week after activation: this was in the protocol before, but was recently changed to 1 day (using "week" to mean 2**11 epochs ~= 9 days and "day" to mean 2**8 epochs ~= 27 hours). The longer duration is needed to mitigate various classes of attacks involving repeatedly activating and exiting (though note that this is not urgent because re-activation after exit is not possible until The Merge)
• Establish and maintain a formal invariant bounding validator rewards, specifically that if validators are behaving perfectly, the per-epoch total reward rate equals BASE_REWARD_FACTOR / sqrt(total_deposits). This is true today (correct head + correct target + correct source + optimal inclusion 7/8 + proposer 1/8 = 4 = BASE_REWARDS_PER_EPOCH) but the invariant should be maintained especially keeping in mind phase 1 objects that get incentivized (eg. custody secret submissions, replies to chunk challenges). This helps to make calculation of validator rewards easier.

[mcdee]

"Fixes to rewards during inactivity leak" should be addressed before phase 0 goes live. The idea that a validator can act perfectly and still lose funds due to the actions (or inactions) of others is abhorrent, and a great basis for a discouragement attack.

[q9f]

should be addressed before phase 0 goes live

FYI see #1830

[djrtwo]

"Fixes to rewards during inactivity leak" addressed in #1830 and removed from this issue

[SatoshiNakamotogmx]

Someone working on this? Vitalik? My name is Christopher soper I am from California 43 yeah yeah born August I don't want to step on anyone's toes. Let's chat vitalik 🤷🏻‍♂️

[SatoshiNakamotogmx]

Identity prob or a verification?

[dankrad]

I think we should add withdrawal key exits (#1578) in phase 1. It is essential for staking operations. It was ok to skip for phase 0 but will be a major hassle if we leave it out now.

[dankrad]

* **Establish and maintain a formal invariant bounding validator rewards**, specifically that if validators are behaving perfectly, the per-epoch total reward rate equals `BASE_REWARD_FACTOR / sqrt(total_deposits)`. This is true today (correct head + correct target + correct source + optimal inclusion 7/8 + proposer 1/8 = 4 = BASE_REWARDS_PER_EPOCH) but the invariant should be maintained especially keeping in mind phase 1 objects that get incentivized (eg. custody secret submissions, replies to chunk challenges). This helps to make calculation of validator rewards easier.

I'm now wondering if this is a good idea: In case that there is "overstaking", it may be that the institutional investors are in it because they are holding Eth anyway and just looking for "icing of the cake" return (e.g., exchanges, exchange traded funds, etc.); whereas private stakers might be driven toward negative returns due to costs at small scale staking. So I feel there is a danger that this encourages centralization of staking.

[dapplion]

Any notes of the attacks mentioned here?

The longer duration is needed to mitigate various classes of attacks involving repeatedly activating and exiting