Ethereum randomness manipulation grows with complex rewards
RANDAO Manipulation in the Presence of MEV
Computer Science and Game Theory
Summary
Ethereum uses a system called RANDAO to create random numbers, but this system can be influenced or manipulated by participants. Previous work measured how often manipulators can control blocks, but not their actual rewards. The paper introduces a new way to calculate rewards from different sources like transaction fees and arbitrage opportunities. They show that if rewards depend on multiple blocks or increase faster than linearly, manipulation becomes more profitable. They also explore a penalty mechanism that can encourage honest behavior.
What this means in practice
- •For blockchain protocol designers: Design reward schemes that reduce incentives for RANDAO manipulation by evaluating payout structures and penalties.
- •For cryptocurrency exchange operators: Assess risks of MEV-related manipulations affecting blockchain randomness influencing arbitrage and trading fairness.
Authors
Kaya Alpturer, Nicholas Hope, S. Matthew Weinberg
Abstract
Ethereum's randomness beacon (RANDAO) is well-known to be manipulable, and prior work [AW24] computes the precise fraction of blocks a strategic proposer can propose. The fraction of blocks proposed, however, is only a proxy for participants' rewards. We propose a generalized reward model capturing many canonical forms of rewards: consensus reward rollover, multi-block MEV, CEX-DEX arbitrage, oracle manipulation, and others. We provide a methodology that computes an ε-optimal strategy for any reward scheme in our model (and in particular, any combination of the above rewards). Finally, we apply our methodology to several canonical examples, and establish the sensitivity of RANDAO manipulation to the underlying rewards. We find that if rewards partially roll over, or scale super-linearly with consecutive blocks, the incentive to manipulate RANDAO is amplified. Lastly, we investigate tail-slot slashing, which can be modeled as a reward function, and show that honest equilibria can be recovered.