Interchain Security: Risks & Economics

Kam
14 min readNov 12, 2023

Following Chorus One’s recent piece about Consumer Chain on-boarding and centralization, in which we shared our concerns related to the economics of the current replicated security model — a fixed, minority revenue share with limited opt-out — we have decided to write a follow-up research piece to expand on points from the previous article, as we now have economic data available since Neutron and Stride have both gone live with Interchain Security.

In this upcoming analysis, we will delve much deeper into the Cosmos Hub tokenomics, the current cost of its security, the revenues generated, including those from Consumer Chains. We will also provide an analysis of the revenues of validators, and discuss the risks associated with Interchain Security.

For readers who find Interchain Security unclear, we have defined Interchain Security as its first version, known as Replicated Security. The concept of Replicated Security involves one blockchain serving as a security provider for other blockchains. The blockchain that provides security is referred to as the Provider Chain, such as the Cosmos Hub, while the blockchains inheriting the full security and decentralization of the Provider Chain are called Consumer Chains, such as Neutron and Stride.

The article unveils the following research findings:

  • The top 1% of validators on the Cosmos Hub make over $4,683,648, while the bottom 25% earn less than $11,291.
  • The Cosmos Hub is currently spending $367,361,725 annually for its security through inflation, corresponding to a daily minted amount of $1,006,470.
  • The Cosmos Hub generates $1,498.30 per day through transaction fees, $1,028.67 per day through Stride, and $12.26 per day through Neutron.
  • It would take 499,070 years for a validator like Pupmos to recover the money lost on the Cosmos Hub due to a double signing event on Neutron, considering only Neutron’s annual revenues.
  • Approximately 40% of validators within the Cosmos Hub’s active set are currently not profitable. This percentage increases as more and more consumer chains are onboarded.

Navigating the Cosmos Hub and ICS Economics

1. Validator Revenues

When it comes to Proof-of-Stake, the economics behind this model are straightforward: token holders can choose to “stake” or lock up a portion of their tokens as collateral to participate in the network’s consensus mechanism. Engaging in the staking mechanism is not just a pro-bono participation in the network, but a pathway to earning staking rewards. In contrast, those who choose not to stake find themselves on the losing end, as they miss out on these rewards, and may experience a dilution of their assets, ultimately being punished for their non-participation.

Staking rewards are typically distributed in three different forms.

The first one is through the inflation rate, where the network mints new tokens to help maintain network security. This inflation rate is subject to change and is determined by market demand with the aim of targeting a specific bonded-stake ratio, which, in the case of the Cosmos Hub, is set at 67%. As a result, the inflation rate is computed at every block, subject to certain limits such as a minimum yearly inflation rate of 7%, a maximum yearly inflation rate of 20%, and an annual maximum change of 13%. The changes in inflation are governed by the following rules:

  • It increases if the bonded ratio falls below the 67% target ratio.
  • It decreases if the bonded ratio surpasses the 67% target ratio.
  • It remains constant if the bonded ratio remains at 67%.

These rules help the network adjust the inflation rate to incentivize staking and maintain the desired level of security.

The second form of revenue comes from transaction fees, which are essentially the fees users pay to have their transactions included in a block. In the Cosmos Hub, both inflation rewards and transaction fees are distributed proportionally to all validators based on their voting power. The revenue is then further divided among delegators in proportion to their stake, after a commission is deducted by the validator.

The third one is MEV, which is derived from profits obtained through actions such as transaction reordering or censorship. However, as of now, the MEV market remains negligible on the Cosmos Hub.

Now, let’s analyze how much Cosmos Hub validators earned from the staking rewards. The data for this analysis was extracted on September 16.

  • Staking rate: 18.81%
  • Inflation rate: 14.20%
  • ATOM Price: $7.07

As illustrated in the graph above, revenue distribution appears to be disproportionately concentrated at the top of the validators’ set and among centralized exchanges like Coinbase Custody, Kraken, or Upbit Staking.

Note: For the purpose of facilitating our analysis, the commission rates employed in this study are derived from on-chain data observable on explorers like Mintscan. However, it is essential to acknowledge that determining the real commission rates imposed by validators can be a challenging endeavor. This challenge is due to the fact that certain centralized exchanges may seem to apply a 100% commission rate on-chain, apparently collecting the entire reward, while in reality, they may distribute a portion of these rewards to their clients. Similarly, some validators may show a 5–10% commission rate but may engage in private arrangements with institutional entities in which they offer a reduced commission rate in exchange for substantial delegations. These off-chain agreements are hard to monitor, and are not publicly accessible on-chain. Consequently, to maintain simplicity in our analysis, we have opted to utilize the on-chain commission rate uniformly throughout this study.

Further analysis of the validator set reveals the following findings:

At a price of $7.07 and with a staking rate of 18.81%, validators in the set collectively earn an annual revenue of $37 million. The average stands at $209,071, while the median is $29,047. This significant disparity between the mean and median indicates a positive skew in our dataset, highlighting that a select few validators earn substantially more than the majority, thus increasing the average.

Specifically, the top 1% of validators make over $4,683,648, while the bottom 25% earn less than $11,291.

Note: Within the set, we have validators who earn $0 in revenues. Some validators opt for a strategy of running infrastructure at a loss and offering a 0% commission to attract delegations and secure positions within the set, with the potential to increase the commission rate in the future

When examining the distribution within the validator set, we find the following:

As of our data as of September 16th, our analysis revealed that among 180 validators, 160 of them fall within an annual revenue range of $0 to $250,000. This constitutes around 88% of the validator set, leaving the remaining 12% earning more than $250,000.

2. Cost of Cosmos Hub Security

This section aims to provide insights into the annual security costs of the Cosmos Hub. As previously mentioned, the bonded target ratio stands at 67%. The inflation ratio would increase if we fall below the target ratio, decrease if we exceed it, and remain constant if we maintain the target ratio.

As of September 16th, with an inflation rate of 14.20% and an ATOM price of $7.07, our findings are as follows:

As of now, the current bonded ratio is 67.58%, which is close to the 67% target ratio. Assuming a constant inflation rate and price, the Cosmos Hub would mint a total of 51,960,000 ATOM one year from now.

This corresponds to a total value of $367,361,725 annually and a daily minted amount of $1,006,470.

Of this total, 10% goes to the community pool (community tax), while the remaining amount is distributed among validators and stakers.

3. Revenues from Cosmos Hub Transaction fees

When analyzing the revenues earned through transaction fees, Cosmos Hub validators receive an average of $1,498.30 per day, which is then split among ATOM stakers based on the weighted amount staked, and the 180 validators take a commission on that amount.

For a proof-of-stake network to be sustainable over time, the goal is that transaction fees would, at some point, offset what is provided through inflation. If we only consider transaction fees occurring on the Cosmos Hub directly, we would need 672 times more user activity to compensate for the daily $1,006,470 that is paid through inflation.

4. ICS Revenues

As of now, Stride and Neutron are the two blockchains using Interchain Security and sharing a portion of their revenues with the Cosmos Hub. Becoming a Consumer Chain with the Cosmos Hub works through governance, in which the community decides whether to accept the chain or not.

The outcomes have been determined as follows: Neutron shares 25% of transaction fees and MEV to the Cosmos Hub, while Stride shares 15% of its total revenues with the Cosmos Hub. The graph below illustrates the daily revenue contributions from Stride and Neutron to the Cosmos Hub between August 8th and September 23rd.

Note: The Stride rewards were stuck on Stride after an upgrade, but when the issue was fixed, everything was sent to the Cosmos Hub and distributed to ATOM stakers all at once. This is why you see large amounts received on August 31st and September 4th.

On average, daily revenues going to the Cosmos Hub from Stride and Neutron are as follows:

  • Stride: $1,028.67 per day
  • Neutron: $12.26 per day

These amounts are then shared among all ATOM stakers based on the weighted amount staked, and the 180 Cosmos Hub validators take a commission on that amount.

As we can see, we are still far from offsetting the Cosmos Hub’s inflation through transaction fees and ICS revenues.

Understanding the Risks in staking on Cosmos Hub and ICS

1. The hard slashing risk

When it comes to risks associated with delegating to a validator, stakers might encounter two types of risks.

The first one is known as soft slashing, which is associated with uptime. If the validator’s node goes offline, it could miss out on block production, resulting in missed rewards. If the validator consistently misses too many blocks, it may become subject to a ‘soft slash’. On the Cosmos Hub, this results in a penalty of 0.01% of the staked tokens being burned, and a downtime jail of 600 seconds is imposed for failing to sign at least 5% of the last 10,000 blocks.

The second risk is the hard slashing risk, also known as double-signing, which happens when a validator signs the same block twice. This action is viewed as an attack and an attempt to fork the network. On the Cosmos Hub, a validator engaging in such behavior would have 5% of the tokens delegated to its node burned, and the validator would be permanently jailed, meaning the node would no longer be able to participate in the active set.

In the following analysis, we determined how long it would take for each validator in the Cosmos Hub to break even on the 5% loss for double signing based on their current annual revenues. Here is the result:

Among the 180 validators, on average, it would take 7.35 years for a validator to fully recover from a double-signing event. The maximum recovery time is more than 26 years, and the minimum is 0.27 years.

2. An increase of risk due to Interchain Security: The Neutron case

The risk of double signing has increased with the addition of Consumer Chains, as Cosmos Hub validators can now risk 5% of the staked ATOMs on their nodes in the event of double signing on either the Cosmos Hub or a Consumer Chain.

The risk has already materialized for two validators on the Cosmos Hub, who double-signed on Neutron. As of now, the penalty for double-signing on a single Consumer Chain is determined through governance. Consequently, a governance proposal was submitted as Prop 818 to slash the two validators named Pupmos and Citizen Cosmos.

The proposal didn’t pass primarily due to the non-malicious behavior and the inclusion of incorrect parameters in the proposal. This means that even if it had passed, it wouldn’t have resulted in a double-signing penalty.

However, in the future, this process will be automated, which implies that if a validator double-signs on a Consumer Chain, 5% of the ATOM staked on their node will be burned, and the validator will be permanently jailed.

Let’s analyze the risk that Pupmos would have to endure.

As of October 15th, Pupmos has 240,000 ATOM with a voting power of 0.10%. With a double-sign, Pupmos would have incurred a loss of 5%, equivalent to 12,000 ATOM or $84,842.

On the other hand, Neutron provides an average daily reward of around $12.26 to all ATOM stakers, resulting in annual revenues of $4,474.90. Out of this total revenue, 0.10% goes to Pupmos’ stakers, which amounts to $4.47.

Pupmos, however, takes a commission of 3.75%, rewarding them with $0.17 in annual revenue from Neutron. On one hand, a double-sign on Neutron would have caused Pupmos a loss of $84,842. On the other hand, Neutron provides them with an annual revenue of $0.17.

This implies that it would take 499,070 years for Pupmos to cover the money lost on the Cosmos Hub because of a double signing event on Neutron, only considering Neutron’s annual revenues.

Note: In reality, if a double-signing event occurs, the validator would be permanently jailed and unable to earn money from the Cosmos Hub again, unless it decides to launch a new validator. However, we wanted to conduct this analysis to show that the current ICS economic model doesn’t make much sense, and the risks taken by validators do not justify the rewards received.

3. Cost of Interchain Security

In this section, we aim to explain the global expenditure related to maintaining the Cosmos Hub and two Consumer Chains, Stride and Neutron. We already previously delved into a cost analysis for Interchain Security, to reiterate our analysis, the cost of operating validator nodes depends on various factors, including the choice of service provider and the underlying infrastructure. Our estimations are the result of discussions with multiple validators, culminating in an average monthly cost of approximately $300 for one node. A prudent node provider is expected to deploy at least two nodes for one chain — a main node and one backup node for redundancy. This configuration translates to a total monthly cost of $600 for maintaining a single chain.

This cost structure applies equivalently to the Cosmos Hub and Consumer Chains. Running a node on a Consumer Chain is the same cost of operating a node on a traditional, sovereign Cosmos blockchain.

With a monthly node cost of $600 for each chain, the aggregate annual infrastructure cost for managing the Cosmos Hub, Neutron, and Stride over a year amounts to $21,600 ($600 x 12 months x 3 chains). To gauge the financial viability of running validator nodes at this cost level, we conducted an analysis based on the fixed annual cost of $21,600.

As of now, one short-term solution to address financial issues for validators in the lower set is the implementation of a soft opt-out. This means that a percentage of the smallest validators can choose not to validate a Consumer Chain without compromising the security of that chain. Currently, 5% of the validators at the bottom of the Cosmos Hub set have opted out, given the number and the fact that it is under Replicated Security, the centralization risk is negligible. Consequently, we will consider an annual cost of $7,200 for the 5% of validators at the bottom of the Cosmos Hub set ($600 x 12 months), along with a fixed annual cost of $21,600 for the remaining validators.

Our analysis reveals that out of the 180 validators currently active on the Cosmos Hub, a total of 72 validators operate at a financial loss. It’s worth noting that running multiple chains on the same machine isn’t a solution. It adds complexity and increases risks, especially if the machine goes down. However, it seems like ICS is pushing smaller validators in this direction to cut costs and save money.

This statistic shows that approximately 40% of validators within the Cosmos Hub’s active set are currently not profitable. This percentage increases as more and more consumer chains are onboarded. For example, if another Consumer Chain similar to Neutron is added, 50% of the validators within the Cosmos Hub’s active set would no longer be profitable.

This shows the financial challenges faced by a significant portion of validators in the Cosmos Hub running Consumer Chains. Another interesting point to note is that, even with the soft opt-out option, some validators who have opted out are still not profitable.

Note: Please be aware that this covers only infrastructure costs and does not include DevOps costs.

Recently, a governance proposal on the Cosmos Hub was introduced to implement a minimum commission rate of 5%. The ultimate goal was to eliminate the incentive for delegators to select validators based solely on their commission rates.

This initiative appears reasonable, particularly in light of the recent challenges arising from the increased infrastructure costs associated with Interchain Security. Taking this change into account, here are our findings:

There is indeed an improvement, especially for validators in the lower set. However, this solution does not yet make the model sustainable. For instance, the bottom 1% of validators make, on average, less than $5,810 annually, which is below the infrastructure cost of $7,200 for the 5% validators of the bottom of the set that have opted out of Interchain Security. Similarly, the bottom 25 validators have average annual revenues of less than $18,015, which is lower than the estimated cost of $21,600 for running Cosmos Hub, Stride, and Neutron.

Conclusion

The Cosmos Hub and Interchain Security are still in their very early stages, leaving ample room for improvement. Based on the analysis conducted in this article and considering that ICS launched during a bear market, it provided time for various teams to engage in discussions and find ways to enhance the current situation. Many validators are already aware of these issues but some of them have chosen to operate at a loss, viewing it as an investment in the future. However, as more Consumer Chains are added, the challenge of maintaining operations becomes increasingly difficult, especially given that Consumer Chains do not generate meaningful revenues for ATOM stakers and validators.

There are some solutions to mitigate the financial burden on validators. These include recent governance-approved measures like implementing a minimum commission rate, potentially considering the removal of the double punishment system for double signing (currently resulting in being jailed forever and a 5% burn of staked tokens), and eliminating the 5% burn. These changes would provide validators with more flexibility when accepting Consumer Chains, considering the added complexity introduced by ICS. Additionally, new architectures like Megablocks may reduce the per-chain infrastructure cost when compared to replicated security.

This is why our position is to vote ‘Abstain’ by default on Consumer Chains proposals.

We are willing to vote ‘Yes’ on a Consumer Chain if it brings meaningful revenues to ATOM stakers and validators, and ‘No’ for candidates that do not add value to the Cosmos Hub. Now is the time to work towards the improvement and prosperity of the Cosmos Hub for the coming years.

If you are interested in these matters and would like to engage in a discussion, please feel free to reach out.

Acknowledgements: Special thanks Michael Moser, Umberto Natale, Thalita Franklin, Luis Nuñez, Gabriella Sofia, Xavier Meegan and Yannick Socolov for their comments and feedback.

--

--

Kam

Researcher @ Chorus One. Interested in every aspect of finance and cryptocurrencies. Twitter: https://twitter.com/KamBenbrik