POLKADOT: VISION FOR A HETEROGENEOUS MULTI-CHAIN FRAMEWORK DRAFT 1 10 • which accounts have placed stake nominating to Each session, nominators’ bonds are dispersed to be a validator; represented by one or more validators. The dispersal al- • properties of each including staking volume, ac- gorithm optimises for a set of validators of equivalent total ceptable payout-rates and addresses and short- bonds. Nominators’ bonds become under the effective re- term (session) identities. sponsibility of the validator and gain interest or suffer a It allows an account to register a desire to become a punishment-reduction accordingly. bonded validator (along with its requirements), to nom- inate to some identity, and for preexisting bonded val- 6.2.3. Bond Confiscation/Burning. Certain validator be- idators to register their desire to exit this status. It also haviour results in a punitive reduction of their bond. If includes the machinery itself for the validation and canon- the bond is reduced below the allowable minimum, the icalisation mechanism. session is prematurely ended and another started. A non- exhaustive list of punishable validator misbehaviour in- 6.2.1. Stake-token Liquidity. It is generally desirable to cludes: have as much of the total staking tokens as possible to be • Being part of a parachain group unable to provide staked within the network maintenance operations since consensus over the validity of a parachain block; this directly ties the network security to the overall “mar- • actively signing for the validity of an invalid ket capitalisation” of the staking token. This can easily parachain block; be incentivised through inflating the currency and hand- • inability to supply egress payloads previously ing out the proceeds to those who participate as valida- voted as available; tors. However, to do so presents a problem: if the token • inactivity during the consensus process; is locked in the Staking Contract under punishment of re- • validating relay-chain blocks on competing forks. duction, how can a substantial portion remain sufficiently liquid in order to allow price discovery? Some cases of misbehaviour threaten the network’s in- One answer to this is allowing a straight-forward de- tegrity (such as signing invalid parachain blocks and val- rivative contract, securing fungible tokens on an underly- idating multiple sides of a fork) and as such result in ef- ing staked token. This is difficult to arrange in a trust- fective exile through the total reduction of the bond. In free manner. Furthermore, these derivative tokens can- other, less serious cases (e.g. inactivity in the consensus not be treated equally for the same reason that differ- process) or cases where blame cannot be precisely allot- ent Eurozone government’s bonds are not fungible: there ted (being part of an ineffective group), a small portion is a chance of the underlying asset failing and becoming of the bond may instead be fined. In the latter case, this worthless. With Eurozone governments, there could be a works well with sub-group churn to ensure that malicious default. With validator-staked tokens, the validator may nodes suffer substantially more loss than the collaterally- act maliciously and be punished. damaged benevolent nodes. Keeping with our tenets, we elect for the simplest so- In some cases (e.g. multi-fork validation and invalid lution: not all tokens be staked. This would mean that sub-block signing) validators cannot themselves easily de- some proportion (perhaps 20%) of tokens will forcibly re- tect each others’ misbehaviour since constant verification main liquid. Though this is imperfect from a security per- of each parachain block would be too arduous a task. Here spective, it is unlikely to make a fundamental difference in it is necessary to enlist the support of parties external to the security of the network; 80% of the reparations possi- the validation process to verify and report such misbe- ble from bond-confiscations would still be able to be made haviour. The parties get a reward for reporting such ac- compared to the “perfect case” of 100% staking. tivity; their term, “fishermen” stems from the unlikeliness The ratio between staked and liquid tokens can be tar- of such a reward. geted fairly simply through a reverse auction mechanism. Since these cases are typically very serious, we envi- Essentially, token holders interested in being a validator sion that any rewards can easily be paid from the con- would each post an offer to the staking contract stating fiscated bond. In general we prefer to balance burning the minimum payout-rate that they would require to take (i.e. reduction to nothing) with reallocation, rather than part. At the beginning of each session (sessions would attempting wholesale reallocation. This has the effect of happen regularly, perhaps as often as once per hour) the increasing the overall value of the token, compensating the validator slots would be filled according to each would-be network in general to some degree rather than the specific validator’s stake and payout rate. One possible algorithm party involved in discovery. This is mainly as a safety for this would be to take those with the lowest offers who mechanism: the large amounts involved could lead to ex- represent a stake no higher than the total stake targeted treme and acute behaviour incentivisation were they all divided by the number of slots and no lower than a lower- bestowed on a single target. bound of half that amount. If the slots cannot be filled, In general, it is important that the reward is suffi- the lower bound could be repeatedly reduced by some fac- ciently large to make verification worthwhile for the net- tor in order to satisfy. work, yet not so large as to offset the costs of fronting a well-financed, well-orchestrated ”industrial-level” criminal 6.2.2. Nominating. It is possible to trustlessly nominate hacking attack on some unlucky validator to force misbe- ones staking tokens to an active validator, giving them haviour. the responsibility of validators duties. Nominating works In this way, the amount claimed should generally be no through an approval-voting system. Each would-be nomi- greater than the direct bond of the errant validator, lest a nator is able to post an instruction to the staking contract perverse incentive arise of misbehaving and reporting one- expressing one or more validator identities under whose self for the bounty. This can be combated either explicitly responsibility they are prepared to entrust their bond. through a minimum direct bond requirement for being a