Simulating a Fraud-Proof Blockchain

2019-02-19

Edit: This work was posted in the Ethresearch forum and was appreciated by Vitalik Buterin!

In a previous article, I wrote a summary of a paper about Fraud Proofs written by Mustafa Al-Bassam, Alberto Sonnino, and Vitalik Buterin. They propose a secure on-chain scaling solution that gives strong security guarantees.

This article aims to verify their results regarding the data-availability section by simulating the system. The paper uses well-known combinatorics formulas to prove the network's security in various setups. Since the model is probabilistic, we can make a program to simulate it. After running the simulation enough times and averaging the results, we hopefully see that we get the same results.

I decided to do this not because the mathematics of the paper didn't convince me but because I think it would be fun to see if simulating the system would yield the same results. Moreover, simulating the system may be another way to compute results faster than calculating a particular resource-intensive formula. In particular for populating Table 1 in the paper.

Before talking about the simulation, let's first have a minimal intro about the relevant part of the paper for the simulation.

In a nutshell, a fraud-proof tool lets light nodes receive a proof that some block is invalid. An honest full-node pack includes the minimum amount of information necessary to challenge the light node to check the block and be convinced that something is wrong. Doing this in a scalable way involves making tradeoffs between proof succinctness and real information density in the block.

However, to make fraud proofs, block data is a fundamental requirement. If we don't have the data to prove that a state transition is wrong, how could we have all the necessary information to convince another node that this happened? (For the moment, forget about mathemagics).

The paper solves the data-availability problem with two fundamental ideas:

The paper combines these two ideas towards closed formulas to calculate data-availability probabilities for some set of parameters of the network:

Remember these parameters since they are used in the rest of this article.

To understand what the simulation is doing is essential to understand what light-nodes random sampling means. You can find a detailed explanation in section 5.3 of the paper. However, here's the main idea so you can imagine what we're trying to do.

Given a new block, the most important interest for the honest nodes in the network is having guarantees that the block data is available. It doesn't necessarily mean forcing each honest node to have all the shares, but just knowing they could reconstruct it as a team.

First, the light nodes pull a random set of s shares from the new block. The light nodes have no coordination in what shares to ask, so the possibility of many of them pulling the same shares is reasonable. As an analogy, you can think of getting pieces of a puzzle. The light nodes aren't trying to pull the whole puzzle, just some random pieces. The full nodes are interested in the complete puzzle.

Finally, the light nodes interact with other full nodes they're connected to via gossiping. First, the light nodes notify the full nodes connected to the pulled shares. Keeping this running between light nodes and full nodes and between full nodes and other full nodes allows the set of honest full-node to reconstruct the whole puzzle (block data).

Doing the random-sampling has many advantages:

Using erasure codes in block data makes each extended share less important individually for block reconstruction, which is essential to the random-sampling and gossiping goals.

In the full picture, the light nodes an extra check. Each share comes with the Merke Proof that proves that the current share is from the block data. Since the paper discusses 2D coding, this proof could be from the row or column dimension of the encoding. If we use an N dimension erasure code, it could be a proof of the N possible Merkle Trees from which the share lives.

Generally, a Montecarlo method is a way of doing calculations in complex systems where formal proofs are hard or where complete computation is intractable. Its applications are so broad that I guess the term is often abused.

The basic idea is to use random sampling to calculate an empirical mean of the desired output of the model with the goal of, hopefully, getting close to the actual mean.

We can apply the same idea to find results by simulating a probabilistic system. We run many simulations and calculate the empirical mean that should match the desired real mean. As a verification tool, we can compare the simulation result with the results obtained in another way, e.g., a formal proof.

However, the simulation idea is, in fact, more powerful. We could start playing with the system, tuning parameters, or introducing new ideas and quickly see how it reacts. How easy it is to play with the simulation depends on how resource-intensive is running a simulation instance and the minimal amount of iterations we want for calculating a reliable empirical mean.

The paper's authors analyze multiple properties of the solution using closed mathematical formulas. Most heavy-lifting math goes around calculating probabilities because light nodes randomly sampling the blocks' shares.

To check those closed formulas, we could make a program that simulates the light-nodes and full-nodes behaviors, let them interact, and see what happens. If we run this simulation multiple times, we could analyze the interesting metrics statistically and see if they match the closed formulas from the paper.

A full node starting in every simulation instance makes a new block composed of 4k² shares available. A number c of light nodes try to pull s distinct random shares from the full node. The full node accepts to give shares to light nodes up to a point where he already shared 4k²-(k+1)² distinct shares; this is the worst-case scenario for light nodes.

When a simulation iteration reaches a point where the full node rejects the response share request, the iteration is considered successful (meaning the full node was exposed). By running many iterations, we can estimate p by calculating the ratio of successful iterations of a setup.

The simulator is a program written in Go and publicly available; anyone is invited to see the details or improve it. It has a CLI which has three commands:

My initial motivation was only doing the first command. Still, after some thoughts and emails with Mustafa and Alberto, I decided to go further and implement the last two.

Running the program without commands gives some helpful info about how to use the CLI interface:

You can see the three mentioned commands but also two available flags:

I'm going to show each command and discuss the results. All the runs are on my laptop, i7–4710HQ, and 8GB of RAM. Not powerful hardware for running simulations.

The idea of this command is to verify the results of Table 1 in the paper:

As the footnote mentions, evaluating Theorem 4 is extremely resource-intensive:

The verifypaper command has baked in the setups corresponding to each case in the table.

Some notes to understand these results:

In all the cases with k less than 128, we see that the estimated p is always close to .99. This means that the simulation results agree with the ones in Table 1.

For k=128 we see that p isn't always close to 0.99. For s=50, we can see that we have good results, but for other values, we have lower probabilities than expected. This result is reasonable since the table gave some approximate results. I left these setups intentionally optimistic to see that the value p is coherent.

So these results are significant since we can safely say that the simulation results match the results obtained by the paper using the closed formulas. Moreover, we can see that the running times for each setup are pretty short, which is nice too.

Instead of fixing c and calculating p, we can use the solve command, as I'll show below.

Generally, verifying results is cheaper than finding them. The verifypaper above tries to verify p for k, s, and c. But we could also populate Table 1 by solving c for k, s, and p. This is what the solve command does.

In particular, it finds c doing a binary search in some reasonable domain space. For each candidate c, p is estimated. If the estimated p is greater or lower than the desired p, the value of c is binary-searched.

If we see in Table 1, for k=64 and s=10 and p=.99 the value of c is 2258. Let's solve for this setup and see what happens:

In each line, we can see:

As we can see, we found a value of c quite close to the exact result. The threshold parameter is used to solve for p within a range.

Let's try with a smaller threshold and a lot more iterations for calculations:

The found solution is the same, but we can see that the total running time is greater.

The reason for this is twofold:

Now we'll try to calculate the estimated solution for the >40000 scenarios in the Table 1:

Good, pretty in line with the Table 1 estimation.

Let's force the simulation to find a solution for a k that doubles the biggest analyzed in the paper, and a number s that makes the worst-case scenario for k:

We can see that we found the solution in some reasonable time 2min and 22s. Alberto confirmed that these times are several of orders faster than computing Theorem 4 for Table 1 in the paper.

The paper put discusses the soundness property of the solution. This means understanding if any light nodes would complete pulling their shares before being alerted of a data unavailability problem.

In summary, the Standard models allow the full node to recognize which light node is asking for each share. Thus, a full node can select which light nodes to reply to satisfy the maximum possible number of light nodes.

The Enhanced model implies not allowing the full node to recognize which light node is asking for each share. Thus, the full node can't know how many full nodes are close to being satisfied.

In the simulation, each time the full node receives a share request, it has the option to accept or reject it. If the latter happens, the full node is considered malicious, meaning it probably intends to make data unavailable.

When simulating with the Standard Model, the _c+ light-nodes run serially. This model the worst-case scenario for the light nodes because it violates soundness as much as possible. The first z light-nodes, each asking for s shares, produce a total of z*s share request. While this number is small enough compared with the full-node rejection criteria, all appear to run smoothly. However, the full node probably starts rejecting requests when z comes to the critical point close to c.

On the other hand, when the simulation runs in Enhanced Model, a random light node is elected to ask for the next share. Since the light nodes are selected randomly, on average, they all progress evenly in their journey of asking for their corresponding s shares. Thus, fewer of them will complete their journey before someone notices the data unavailability.

To understand this better, we have the compare command. This command compares the two models for a k and s setup for various c. Each simulation calculates how many light nodes finished asking their s shares before the full node makes a rejection.

It automatically generates a plot as a png file to understand the results:

The #points parameter is the number of points we want to generate to make the interpolation.

Let's compare for a setup:

The first thing it does is to solve for c for a p=.99. This is done to plot for values of c within .50 and 1.5 of c.

Let's see the generated plot:

The result of the compare command for k=64 and s=10

Interesting!

For values of _c_ß lower than the one for .99 guarantee, we see that both the Standard and Enhanced model have the same result. All the light-nodes finish asking their s shares successfully even when the full block isn't guaranteed to be available. This is reasonable; thinking of an extreme case of c=1 then it's evident that asking only for s shares will be successful.

Something interesting happens when we reach and exceed the critical point of c (=.99) light nodes.

In the Standard model, if we keep adding light nodes, the total number of fooled light nodes is bounded. This sounds reasonable since c*s shares were already asked and the full-node is pretty doomed to reject any more share requests if interested in making the block unavailable. This means that no more light nodes can be tricked.

In the Enhanced-model we see something different. The more light nodes we add from c, the fewer total light nodes finished asking for their s shares. Since each share requests the full node receives comes from a random light node, when the full node reaches the critical point of share rejection, not many light nodes have yet finished asking for their shares. The light nodes share the risk evenly.

If the network has more than the minimum amount of c light nodes, then rapidly fewer and fewer light-nodes complete pulling their s shares before someone finds out that the full node is malicious and alerts the rest of the network.

For other setups, we see the same shape. Intuitively we expect that s will influence how fast the Enhanced model improves soundness. Let's check this intuition.

With the same k=64 and a bigger s (also more calculated points which don't affect anything but the plot interpolation):

And the plot:

Result of the compare command for k=64 and s=50

Yes! a bigger s in the Enhanced Model is much more aggressive in the soundness guarantee in respect of c.

Finally, let's see for a smaller s:

Result for the compare command for k=64 and s=2

We can appreciate that with a smaller s, soundness is guaranteed much slower.

The running times of the simulation depend on three factors: s, k, c, and the number of iterations.

I profiled the code using pprof multiple times to find where is the bottleneck in the simulation. It turns out that the bottlenecks are when the light nodes decide which s shares to ask from the 4k² shares. I've made multiple implementations of this part to improve the running times.

In summary, I noticed a locking-contention issue within the default rand library. After some research, other people already noticed that within rand standard-library, there's a mutex, something quite reasonable when using a singleton random seed for a concurrent library.

Then I decided that each light node would make its random seed to avoid locking contention between different goroutines. After another pprof, I discovered this was quite computer-expensive; better than the original lock-contention, but expensive. Concurrency in the simulation is at the iteration level, so generating a random seed for each operation instead of light nodes significantly improved.

Profiling the code and finding these things was fun too. Maybe I will explain all this in more detail in a further article.

A bunch of things could be improved/enhancements in the simulation.

In the solve command, I do a binary search for c until the explored domain is exhausted or the desired p lies within a chosen threshold. There may be other ways to implement the solve command or reduce the search domain.

The full node makes the first share request rejection when 4k²-(k+1)² are shared. That number corresponds to the maximum number of shares the full node could give, making the block unavailable.

This is the best-case scenario for full nodes where the light nodes ask for a particular subset of shares. Since the data is encoded in 2D-Reed-Solomon, each unavailable share could be reconstructed from a row or column point of view. This full-node best case happens when the unshared shares are always in the rows and columns that are still unrecoverable from the block. In other words, unshared shares contribute as much as possible to block unavailability.

This implies that the simulation is pessimistic, so it lies on the safe side of the claims it makes. Saying it differently, most of the time, the block will be recoverable even when the simulation continues considering it isn't.

This aspect of the simulation could be improved if each time the full node makes a new share available, it calculates what remaining shares are unrecoverable since they can't still be reconstructed with the already shared shares using the 2D Reed-Solomon encoding. After the last unrecoverable share is shared, the full node can be considered doomed. Notice that unrecoverable and unshared are different things. An unshared share could be reconstructed if enough shares of its column or row are available.

The simulation already has some moderate optimizations resulting from multiple pprof profiling. Since the simulation is cpu-bound and only needs enough random seeds depending on the number of cores in the CPU to avoid locking-contention issues.Init() method could be improved.

Also, there could be a better solution to generate the random subset of s distinct elements of a set of 4k² elements (shares to pull). The actual solution is nice since it exploits the fact that s is much smaller than (2k)².

I've made no memory profiling, so I'm convinced there are many things to be improved in this direction.

The simulation configurations in the simulation are fixed and correspond to the ones proposed in the paper. This could be easily changed and be useful to search for a configuration that matches some required criteria.

Mustafa suggested that it may be interesting to include network bandwidth usage or latency. Similarly, we could scan for network configurations that optimize or establish bounds of these metrics within some minimum security requirements. The possibilities are broad, and we could play a lot with it.

Another idea mentioned by Mustafa was considering the impact on the network when using other codings for the block data. For example, adding more dimensions with Reed-Solomon or using even other codings.

The simulation verified the mathematical calculations in the paper and provided several orders of magnitude faster to estimate model values than computing the closed-mathematical formula.

This helps to get better intuition on how the Standard and Enhanced model impacts the soundness property of the system.

Further work could be done to improve the simulation in various directions.

Finally, I'd like to thank Mustafa and Alberto for their opinions and suggestions. Special thanks to Mustafa for various ideas for the article and for kindly reviewing a draft.