Original Title: 《How to think about risk in restaking》

Proofreading: tiao

Compilation: loxia.eth

Preface

This article is a translation of a speech given by Tarun Chitra at the Restaking Summit in Istanbul on November 13, 2023. He systematically explained the definition of restaking, the essential comparison between restaking and existing staking models, and the analogy of restaking's position in traditional finance. He provided an in-depth yet accessible explanation of the nature of risks associated with restaking and the specific differences in risks borne by other staking models. The aim is to help everyone better understand the principles of restaking and the details of the risks involved, as only by thoroughly understanding the risks themselves can taking risks become "less scary"!

Main Body

This article is approximately 4000 words long and consists of 5 sections. Reading through this article is expected to take 10-15 minutes.

1. What is restaking?

2. Restaking and… traditional finance?!

3. How can we mitigate these risks?

4. What risks does restaking bring?

5. Visualizing restaking risks

1. What is restaking?

When people first hear about restaking, they find it interesting but confusing, as they are unclear about where the additional risks come from. We hope to attempt to explain some of these risks here, as well as the different mitigation methods, overall making the risks seem less daunting. We have heard a lot of discussions related to restaking today, including its applications in relevant scenarios. I want to look at this from a more macro perspective. Next, I will briefly discuss some things similar to traditional finance while discussing risks, and I will ensure not to write down mathematical equations; we will look at some charts and then talk about how to mitigate these risks.

This is Vitalik's definition; note that he uses a hyphen, which is different from other usages. But in reality, this idea refers to someone having a way to reuse their stake while adding additional slashing rules that are entirely unrelated to network activity and are only used for security purposes.

As a high-level schematic, you can imagine yourself as an ETH holder. You participate in the network through LST (liquid staking, hereinafter referred to as LST) or by directly running a validator, creating a feedback loop between transaction fees and slashing income. This is the situation without restaking.

By introducing restaking, we have these new networks, such as MEV auctions and FHE (Fully Homomorphic Encryption). They introduce new slashing elements when handling transaction fees. These elements are triggered by the restaking delegation contract, which deposits funds into the staking contract. During the restaking process, the ETH holder's earnings consist of the principal plus L1 fees and restaking fees, minus any L1 and restaking slashing penalties.

Assuming an ETH holder has 100 ETH and wishes to earn a 10% return through staking. They deposit ETH into a staking contract, such as Lido, and agree to Ethereum's slashing rules, such as sending contradictory messages (equivocation) and double-signing. In this way, they support the Lido validator and earn a 10% return, but they may also face slashing.

When the holder withdraws, they receive 107 ETH. If they restake 100 ETH, they not only earn 10% from staking ETH but can also gain an additional 5% from the restaking application. However, at the same time, they face new risks. Now, slashing events present a tree-like structure with three possibilities. For example, people may be slashed on Layer 1, rollup, or both Layer 1 and rollup. This indicates that users and validators are choosing different risk paths. Compared to the past, where there was only a fixed set of L1 slashing events, the current state space has expanded, and users need to have a new understanding of risks.

2. Restaking and… traditional finance?!

This may sound like a less interesting concept: linking restaking to traditional finance, but why not?

Restaking applications and AVS (Actively Validated Service) are somewhat similar to verifiable corporate bonds. Emerging networks seek Layer 1 security, which is somewhat like companies using another company's national financial system to issue bonds to protect their assets. Corporations and sovereign nations issue bonds based on the highest security and liquidity.

For example, Argentina still chooses to issue dollar-denominated bonds because the dollar market offers the highest liquidity and the broadest collateral purchasing opportunities. From this perspective, if we consider ETH Layer 1 as this type of sovereign currency, then restaking applications are akin to borrowing from this sovereignty and then repaying the principal and interest.

So, people do not issue bonds everywhere. If you look at the history of the corporate bond market, you will find it is very concentrated in a few jurisdictions. People are willing to cross their legal jurisdictions to issue bonds somewhere else because the liquidity and exit opportunities are much better there.

In the repo market, people can use government bonds or securities as collateral for loans: by pledging bonds, someone lends you money; over time, you gradually repay the loan (for example, through profits earned from operating the company). For instance, Airbus or Boeing keeps most of their cash in sovereign bonds and then pledges those bonds for loans when needed to build factories or other projects.

In 2023, Ethereum is the only sovereign entity capable of supporting such a repo market. But I would argue that one of the distinctions between restaking and traditional finance types is verifiability, namely default events, which occur when someone fails to pay. In reality, this is one of the default slashing rules you triggered, incentivized by cryptography and can be independently verified through Layer 1.

If it is a government transaction (for example, I buy a bunch of government bonds and then use them as collateral for a loan, but later I do not repay the loan), that person is unlikely to complain to the U.S. government. They might try to file a lawsuit, but they have no way to prove that I did not pay, nor can they say that my credit should be slashed or that immediate penalties should be applied. Therefore, the economic incentives between bond issuers and borrowers are not aligned.

In the case of AVS, this is not the case. To some extent, this makes the process less like DeFi lending and more like bonds and the bond market.

3. What risks does restaking bring?

Alright, the next question is, what are the risks that restaking brings? Of course, we will skip over smart contract and operator risks here.

Among the three financial risks of restaking, the most severe is slashing risk, which is the only way you directly lose your principal. The second is liquidity risk; many restaking protocols have locked LST (liquid staking tokens), and now if a large portion of LST is locked in the restaking pool, the loss of liquidity means that the price of LST becomes more volatile relative to ETH. The security of AVS is measured by LST, so for end users, the implied volatility is higher. This liquidity risk arises when a certain type of LST is overly concentrated in AVS.

Finally, there is centralization risk. Taking the DAO hacking incident as an example, suppose one-third of ETH is in a single AVS, exceeding the traditional BFT security threshold. Now suppose this one-third of ETH can be slashed by rules that are not ETH consensus rules, for example, I did not submit proof of fraud, and I was slashed, rather than due to double-signing or similar issues. So, in a sense, centralization also means that these two systems are coupled.

4. Visualizing restaking risks

These charts show the value of a certain position over time, where the Y-axis represents the value of the position, and the X-axis represents time. The red line indicates the point at which a default is triggered; in all these cases, default is the worst-case scenario, meaning the principal goes to zero. We will compare a series of scenarios across different applications and observe their default situations.

In on-chain lending, default is a style where an indicator function jumps to zero; you have a position value that falls below a certain liquidation threshold and then jumps to zero. But this jump is singular and occurs at a random time, so it is a random stopping time determined by the actual process, resulting in a one-time drop to zero.

Then we consider the perpetual case, whether on-chain or off-chain perpetual components, which have periodic funding rate updates, but it may not be easy to see these funding payment times. The net payments between longs and shorts, or from shorts to longs, will lead to changes in position value, so you have these periodic jumps, and these time points are almost close to the default time points.

Now consider regular staking, so in a sufficiently decentralized network with enough isolation, such as many different nodes, many different overlay networks, different data centers, and different houses, slashing events should be IID (Independent and identically distributed); for example, a collapse somewhere in AVS should not lead to everyone being slashed simultaneously. Of course, whether it is actually IID is an empirical question. But in this model of staking, it is sufficiently decentralized, and the losses due to slashing are IID events. So the idea is that the value of my locked principal usually goes up, and you can see that I have a slashing event, and it goes down, so there is this situation where my principal value jumps to zero, but they are independent and random.

The last question is, what does restaking look like?

In restaking, you now have these correlated jumps; the idea here is that when you consider restaking, you cannot view it as an isolated world like you would with lending or perpetual options.

Because in lending, you are actually only concerned with a fixed threshold and a price, for example, the time point when the purple line crosses the red line; in perpetual options, what you really care about is the maximum deviation of prices within these periodic intervals. And in regular staking, if it is IID, you are only relatively safe when the time scale is long compared to the value scale, but it is not that simple here. You need to seriously consider the interaction between these two factors.

So interestingly, in restaking, you can actually replicate all the previous returns, plus some returns that you cannot replicate.

5. How can we mitigate these risks?

So, this leads to the natural final question: what exactly should you do to mitigate these risks? What can you do to ensure that these correlated events are not too correlated and that these jumps are not too large?

In fact, you have two tools at your disposal. The first is parameter optimization; each AVS has some parameters that control the security of the AVS, whether it is the TVL cap or the choice of slashing rules.

As you noted in the chart, if you observe that the slashing in AVS is roughly the same size, you can construct some slashing rules that may gradually increase or decrease under certain conditions. You have more freedom in choosing how to slash, whereas you do not have as much freedom at the L1 consensus layer.

For example, if you agree with my assertion that AVS is essentially analogous to corporate bonds, then liquid restaking tokens (LRT) are a type of bond fund. The question is how to rebalance this bond fund and how to decide to reallocate funds between AVSs.

In fact, both of the above actions are about adjusting this picture to make it look (to investors) more favorable.

That's it, thank you all.