Byzantine Attacks Exploiting Penalties in Ethereum PoS

Ulysse Pavloff,Yackolley Amoussou-Genou,Sara Tucci-Piergiovanni

2024-06-07

Abstract:In May 2023, the Ethereum blockchain experienced its first inactivity leak, a mechanism designed to reinstate chain finalization amid persistent network disruptions. This mechanism aims to reduce the voting power of validators who are unreachable within the network, reallocating this power to active validators. This paper investigates the implications of the inactivity leak on safety within the Ethereum blockchain. Our theoretical analysis reveals scenarios where actions by Byzantine validators expedite the finalization of two conflicting branches, and instances where Byzantine validators reach a voting power exceeding the critical safety threshold of one-third. Additionally, we revisit the probabilistic bouncing attack, illustrating how the inactivity leak can result in a probabilistic breach of safety, potentially allowing Byzantine validators to exceed the one-third safety threshold. Our findings uncover how penalizing inactive nodes can compromise blockchain properties, particularly in the presence of Byzantine validators capable of coordinating actions.

Cryptography and Security,Distributed, Parallel, and Cluster Computing

What problem does this paper attempt to address?

This paper attempts to solve the security problems in the Ethereum Proof - of - Stake (PoS) protocol caused by the introduction of the "inactivity leak" mechanism. Specifically, the paper mainly explores the following two aspects:

1. **Finalizing conflicting chains**: In some cases, Byzantine validators may accelerate the finalization of two conflicting branch chains, resulting in a loss of security.
2. **Breaking through the security threshold**: Byzantine validators may obtain more than one - third of the voting rights through coordinated actions, thus breaking through the security threshold and causing the system to no longer meet the Byzantine fault - tolerance conditions.

### Background Introduction

In September 2022, Ethereum shifted from Proof - of - Work (PoW) to the more energy - efficient Proof - of - Stake (PoS). To deal with network outages or situations where validators are inaccessible, Ethereum introduced the "inactivity leak" mechanism. This mechanism gradually reduces the stake of inactive validators and redistributes the voting rights to active validators, aiming to restore finalization and ensure the continuous growth of the chain.

However, this mechanism also brings potential security risks. Especially in the presence of Byzantine validators, these validators can use the "inactivity leak" mechanism to undermine the security of the system. Through theoretical analysis and simulation experiments, the paper explores the impact of the proportion of Byzantine validators' voting rights on system security under different initial conditions.

### Main Contributions of the Paper

1. **Formal description of the "inactivity leak" mechanism**: The paper gives a formal description of "inactivity leak" for the first time and analyzes its impact on the Ethereum protocol.
2. **Analysis of security losses in different scenarios**: The time and manner of security losses in the system under different initial proportions of Byzantine voting rights are studied. Specifically, it includes:
- The time to finalize two conflicting chains.
- The time for Byzantine validators to break through the security threshold.
3. **Re - examining the probabilistic jump attack**: It shows how to use the "inactivity leak" mechanism to break through the security threshold probabilistically under synchronous network conditions.

### Conclusion

The paper reveals the potential security risks that the "inactivity leak" mechanism may bring under specific conditions, especially when there are Byzantine validators. Although the probability of these attacks occurring in the actual environment is low, the authors believe that these findings are of great significance for understanding and developing more robust blockchain protocols.

### Formula Summary

- **Inactivity fraction update rule**:
\[
I_i(t) =
\begin{cases}
I_i(t - 1)+4 & \text{if validator } i \text{ is inactive in the } t\text{ - th epoch} \\
\max(I_i(t - 1)-1,0) & \text{otherwise}
\end{cases}
\]

- **Stake change formula**:
\[
s_i(t)=s_i(t - 1)-\frac{I_i(t - 1)\cdot s_i(t - 1)}{2^{26}}
\]

- **Differential equation of stake change in the continuous function model**:
\[
s'(t)=-\frac{I(t)\cdot s(t)}{2^{26}}
\]

Through these formulas, the paper analyzes in detail the stake changes of different types of validators (active, semi - active, inactive) during the "inactivity leak" period.