Proof of stake slashing fails to stop risk-free double signing attacks
Too Late to Slash: Coordinating a Risk-Free Equivocation Attack
Computer Science and Game TheoryCryptography and Security
Summary
Proof-of-stake blockchains try to keep validators honest by taking away their stake if they misbehave, especially if they sign conflicting blocks. The usual belief is that this punishment makes cheating too risky to succeed. The authors show, however, that validators can coordinate so no one loses anything by cheating, even when not everyone joins in. This means the usual slashing penalties do not guarantee the security level people expect. The paper reveals fundamental limitations of these punishment methods because the blockchain itself enforces them and attackers can control the consensus.
What this means in practice
- •For blockchain protocol designers: Avoid relying solely on slashing to ensure economic security; design protocols considering coordinated risk-free attacks.
- •For cryptocurrency security teams: Re-assess security guarantees of proof-of-stake systems and develop monitoring to detect coordinated equivocation behaviors.
A theory result. No direct application yet.
Authors
Hao Chung, Chen-Da Liu-Zhang
Abstract
Slashing is commonly argued to secure proof-of-stake blockchains by confiscating the stake of misbehaving validators. The usual justification is that, without slashing, validators can solicit an equivocation attack by signing conflicting blocks: if enough others join, the attack succeeds; otherwise, the attempt incurs no loss. Slashing is intended to make such attempts costly and thereby guarantee the security of applications whose economic value is comparable to the bonded stake. This rationale, however, rests on heuristic arguments rather than a formal game-theoretic guarantee. We challenge this rationale by constructing a risk-free coordination protocol for rational validators under algorithmic slashing. We show that the prescribed strategy profile, in which rational validators solicit other validators to equivocate, constitutes an ex post Nash equilibrium, even when validators do not know in advance how many others will participate. The equilibrium holds for any gain $ε>0$ from successful equivocation, however small relative to the bonded stake. Thus, slashing alone does not guarantee economic security proportional to the value of bonded stake. Our results expose a fundamental limitation of algorithmic slashing. Whereas conventional collateral arrangements in many real-world scenarios can rely on external enforcement, for example through courts, algorithmic slashing depends on the same consensus process that the attackers control. These findings call for a formal analysis of slashing's security, rather than overly simplistic arguments drawn from financial systems with independent enforcement.