Transaction Censorship Feud on Ethereum Leads to User Activated Soft Fork
Latest posts by Sayantani Sanyal (see all)

Ethereum proof-of-stake validators may be forced to censor transactions on the Ethereum blockchain itself.

The Ethereum community, which is known for its sunny rainbow-and-unicorns vibe, has become unusually serious. Following a recent move by the U.S. Treasury Department to target a batch of crypto-related open-source code, one word keeps coming up in Ethereum circles: censorship. Ethereum’s long-awaited transition from proof-of-work to proof-of-stake, might actually happen soon. Or we can chew on the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) adding Tornado Cash to its Specially Designated Nationals list because North Korean hackers allegedly used it to launder money.

The Tornado Cash sets a worrying precedent and now ETH users are concerned that centralized entities running Ethereum proof-of-stake validators may be forced to censor transactions on the Ethereum blockchain itself. The primary problem is that if the largest network validators decide to censor transactions, the rest of the Ethereum validator community or even the minority will have the option to destroy the censored validators’ funds.

Bitcoin advocate, Eric Wall recently conducted a poll on whether the Ethereum community should burn the stake of large validators attempting to comply with the OFAC sanctions. Around 9,000 users participated and almost 60% of them voted ‘yes’. VitalikButerin was also one of them who voted ‘yes’. Large validators who have already staked ETH into the beacon chain may be left with few options. But after the Merge, staked ETH tokens will be locked in until 2023, which means validators will not be able to withdraw their staked funds from the ETH network. Now, it is quite evident that after Ethereum gets censored, a lot of investors and validators are going to be in trouble.

 

What Is The Threat Model?

The first question to ask is, what is the economic model under which we are operating? Who are the censors, how much can they do, and how much does it cost them? We will split this up into two cases. In the first case, the censors are not powerful enough to independently block transactions; in the Tendermint case, this entails the censors having less than 33% of all validator positions, in which case they can certainly restrict transactions from their own blocks, but those transactions would simply make it into the next block that does not censor them, and that block would still get its requisite 67% signatures from the other nodes. In the second case, the censors are powerful enough; in the Bitcoin case, we can think of the top five mining firms and data centers colluding, and in the Tendermint case a group of very large stakeholders.

 

Cost

The first, and simplest, way to discourage censorship is a simple one: making it unprofitable, or at least expensive. Notably, proof of work actually fails this property: censorship is profitable, since if you censor a block you can (i) take all of its transactions for yourself, and (ii) in the long run take its block reward, as the difficulty adjustment process will reduce the difficulty to ensure the block time remains at 10 minutes (or 15 seconds, or whatever) despite the loss of the miner that has been censored away. Proof of stake protocols are also vulnerable by default, but because we can keep track of the total number of validators that are supposed to be participating there are specific strategies that we can take to make it less profitable.