Skip to content
This repository was archived by the owner on Nov 15, 2023. It is now read-only.

Conversation

@gavofyork
Copy link
Member

@gavofyork gavofyork commented May 29, 2021

This used statemint repo commit 9664809ad5de6ce43b6b78a6b3d12fbfece7f147.

Comment on lines +22 to +24
//! The Collator Selection pallet manages the collators of a parachain. **Collation is _not_ a
//! secure activity** and this pallet does not implement any game-theoretic mechanisms to meet BFT
//! safety assumptions of the chosen set.
Copy link
Contributor

@JoshOrndorff JoshOrndorff May 29, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Collation is not a secure activity.

I agree with this for some definitions of "secure" but not for all. I agree that no matter how badly collators behave they can't cause the relay chain to finalize invalid parachain state transitions. That's a really cool and important aspect of Polkadot.

But there are still important ways in which a collator set can misbehave to cause nontrivial problems for a parachain:

  1. A collator can skip slots.
  2. A collator can censor transactions.

If this is coupled with an author-selection mechanism that selects only one author per slot in the consensus layer (like Aura), then a single malicious collator can cause the parachain to produce no block in that slot. The more collators do this the more the chain throughput decreases.

Regarding censorship, if the collator set ever becomes entirely colluding, they can retain unilateral control forever by censoring any transactions that would bond other accounts as collators.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actualy, I think we could construct a minimal liveness proof that a block will be authored eventually from the kick_mechanism and an assumption that the chain is launched with at least one honest collator. But the practical concern still exists. One whale could stake a lot of accounts and skip all the corresponding slots.

Adding a slash to the kick mechanism would ensure that this whale attacker would eventually bleed enough stake to not be a problem, but there would still be an unstable transient period after launch before settling down to a steady state.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There could be a slash, but it work similarly to the relay-chain staking where the slash is non-zero only for when a threshold go offline at once (and can be superlinear afterwwards).

@gavofyork
Copy link
Member Author

Regarding censorship, if the collator set ever becomes entirely colluding, they can retain unilateral control forever by censoring any transactions that would bond other accounts as collators.

We generally assume at most 33% byzantine.

Worst-case, relay-chain governance can jump in, forcibly alter the state to one which kicks (and slashes, perhaps) all the bad collators.

@apopiak
Copy link
Contributor

apopiak commented May 31, 2021

Looks fine to me, can you mention the Statemint repo commit that you copied so we can determine which other changes we need to move as well?

@xlc
Copy link
Contributor

xlc commented May 31, 2021

So statemint will live here instead of its own repo?

@joepetrowski
Copy link
Contributor

So statemint will live here instead of its own repo?

yes

@apopiak
Copy link
Contributor

apopiak commented Jun 1, 2021

@gavofyork @bkchr Correct me if I'm wrong, but:
I don't see the statemint node changes from https://github.com/paritytech/statemint/pull/80/files#diff-594440db8adfc5d1b37711309312bfa06b49e488309186ad062a896778cf9fbfR84-R96 anywhere so I don't think the transition to AuRa would work smoothly using the polkadot-collator

@apopiak apopiak self-requested a review June 1, 2021 09:27
Copy link
Contributor

@apopiak apopiak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@bkchr bkchr merged commit 9d9ed1b into master Jun 1, 2021
@bkchr bkchr deleted the gav-statemint branch June 1, 2021 19:31
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants