Automatic recovery from a 51% attack: healing from a majority attack
Strawmap Beyond that (Long term) · 51% attack auto-recovery
This research aims for the protocol to detect an attack and return itself to a normal state without people having to coordinate a response, when a majority of validators collude to block transactions or try to revert the finalized chain.
Why it is needed
Ethereum finalizes the chain by having validators vote on blocks with staked ETH at stake. If an attacker holds more than half of the total stake, they can censor by continually delaying certain transactions, and if they hold close to two thirds, they can even attempt to revert blocks that have already been finalized. There are defenses today. Reverting finality requires casting contradictory votes, and doing so carries a penalty (slashing) that costs a large part of the stake. If more than one third of validators stop voting so that finality cannot be reached, the inactivity leak gradually reduces the stake of the side that stopped, and the remaining validators resume finalizing. However, there is no automatic response inside the protocol to censorship in which a majority votes but leaves out certain transactions. Today the community must confirm the attack and manually coordinate a minority fork that does not follow the attacker's chain. This is slow, and the judgment of who the attacker is is also left to people. This item is research aimed at bringing that detection and response into the protocol as far as possible. The specific method has not been decided, and it sits in the furthest long-term column of the Strawmap, so its content may change.
How it works
- Notice the attack When a majority of validators keep omitting certain transactions or try to revert finalized blocks, people are the ones who confirm it today. This item starts from having nodes detect such signs on their own.
- Do not follow the attacker's chain Honest nodes reject the chain the attacker built and continue their own chain among themselves. On this chain, the attacker's validators appear as not having voted.
- Attacker stake drains and finality returns The inactivity leak reduces the attacker's stake, and once the share of honest validators exceeds two thirds, finalization restarts. Votes that reverted finality are penalized separately through slashing.