the day, and today I finally sat with the cryptographic primitive underneath babylons entire slashing model, extractable one-time signatures, becuase ive been name dropping eots for three days without unpacking it.
Start with the problem it solves. Proof of stake security requires punishing equivocation, a validator signing two conflicting blocks at the same height. On a normal pos chain the protocol simply confiscates bonded tokens sitting on that same chain. But babylons stakers bond BITCOIN, an asset living on a chain that has no idea the pos network exists and cannot be ordered to confiscate anything. How do you slash collateral the enforcing chain cant reach?
Eots answers with a property that sounds like a bug untill you realize its the whole point. The signature scheme is one-time, sign exactly one message per key usage and everything works normally. Sign TWO conflicting messages with the same key, and the two signatures together mathematicaly reveal your private key. Not to a committee, not to a court, to anyone watching.
Trace what that means. The moment a finality provider equivocates, thier own btc key becomes extractable, and the pre-signed slashing path in the staking script becomes executable. The punishment doesnt require bitcoin to understand the pos chain at all, the misbehavior itself manufactures the evidence and the weapon simultaneosly.
The elegance worth naming, this converts slashing from a governance action into a mathematical consequence. No committee debates wether you equivocated, your published signatures either reveal the key or they dont.
What im still uncertain about, the boundary between eots automation and the covenant committees consensus role, the docs describe both and the division of labor between math and majority isnt fully explicit on the pages ive read. Thats tommorows seam to inspect.
@BabylonLabs_io #baby $BABY
Start with the problem it solves. Proof of stake security requires punishing equivocation, a validator signing two conflicting blocks at the same height. On a normal pos chain the protocol simply confiscates bonded tokens sitting on that same chain. But babylons stakers bond BITCOIN, an asset living on a chain that has no idea the pos network exists and cannot be ordered to confiscate anything. How do you slash collateral the enforcing chain cant reach?
Eots answers with a property that sounds like a bug untill you realize its the whole point. The signature scheme is one-time, sign exactly one message per key usage and everything works normally. Sign TWO conflicting messages with the same key, and the two signatures together mathematicaly reveal your private key. Not to a committee, not to a court, to anyone watching.
Trace what that means. The moment a finality provider equivocates, thier own btc key becomes extractable, and the pre-signed slashing path in the staking script becomes executable. The punishment doesnt require bitcoin to understand the pos chain at all, the misbehavior itself manufactures the evidence and the weapon simultaneosly.
The elegance worth naming, this converts slashing from a governance action into a mathematical consequence. No committee debates wether you equivocated, your published signatures either reveal the key or they dont.
What im still uncertain about, the boundary between eots automation and the covenant committees consensus role, the docs describe both and the division of labor between math and majority isnt fully explicit on the pages ive read. Thats tommorows seam to inspect.
@BabylonLabs_io #baby $BABY