Thanks to @nashqueue for discussions that led into this.

In this post we will discuss how Proof-of-Governance (PoG) is the natural conclusion of staking derivatives. By separating security from REV, PoG would allow the protocol to reduce issuance by a factor of 20, from ~5% to ~0.25%, without reducing security.

Background

Required Reading (for real)

• Endgame: Proof of Governance
  • Video: Endgame: Proof of Governance - Jon Charbonneau
• Defending Against LST Monopolies

Optional Reading

• Moving toward safer and more aligned TIA liquid staking
• Principal–agent problem
• Slashing is Not Required to Solve Nothing-at-Stake
• Competitive Equilibria Between Staking and On-chain Lending

Preamble

Expanding on Charbonneau’s analysis of Proof-of-Governance (PoG), we will see in this post how PoG is one natural conclusion of Liquid Staking Tokens (LSTs), i.e. staking derivatives.

Intuition #1

Speedrunning:

1. Staking yield competes with DeFi yield.
2. LSTs will inevitably arise, even in protocols that don’t support in-protocol delegated staking, so that token holders can capture DeFi and staking yields simultaneously. LSTs by construction provide the ability to delegate stake, even if the underlying blockchain doesn’t support this.
3. In a sufficiently mature system, we should expect the bonding rate to approach 100%. This is especially the case if stake delegating and LSTs do not come with smart contract risk—for example if these features were natively provided by the protocol.
4. If bonding rate is 100%, then the staking APY isn’t actually the issuance rate; it’s actually zero, since new issuance is paid to all stake proportionally!
5. While net issuance to token-holders is zero, validators are paid real issuance from their commission on delegations.

Intuition: net issuance vs on-paper issuance tends towards zero in the limit of 100% bonding rate. And since LSTs will inevitably exist, bonding rate is expected to tend towards that limit.

Intuition #2

The second intuition we need is that economic security from staking is a meme.

B11XISQEgl1290×643 95.9 KB

Source

Stake delegation inevitably will exist (whether in-protocol or out of protocol), and by the power law, the supermajority of stake will be delegated rather than self-staked. Indeed, even in Ethereum today, approximately a dozen entities have delegated stake that exceeds 2/3 of the voting power.

Therefore, security is not derived from the ability to slashing stake, but rather from the ability to deny future fees paid to validator operators (short: validators). Similarly, the cost to attack is derived from those fees, not the stake delegated to the validators. This is consistent with the position that slashing is not actually required for PoS. The idea that slashing stake is required is a misconception from a blog post that is now more than a decade old—a decade outdated, perhaps.

Importantly, this is how PoS blockchains actually work today. This is not a suggested change. PoS blockchains today are secured by the fees paid to validators, and the threat of denying future fees, not by stake and not by slashing stake.

Intuition: slashing stake is not needed; denying fees paid to the validators is sufficient.

Intuition #3

The last intuition needed is that PoS is actually permissioned, not permissionless. A common critique by PoW maximalists is that PoS is not permissionless since you need intrinsic permission from existing validators to become a validator. This is actually correct! Proof-of-Stake is simply Proof-of-Authority, where the authority set assents to changing itself on some on-chain actions (staking/unstaking). However, since off-chain governance can always supersede anything that happens on-chain, off-chain governance can always replace an authority even in a strictly PoA protocol.

Intuition: PoS is actually PoA.

Dual Governance and Proof-of-Governance

As described by Charbonneau, the two endgame paths are Dual Governance (DG), and PoG.

In DG, validators are selected through token voting. While Charbonneau vaguely prescribes that this must involve a second token, we contend this doesn’t have to be the case. On-chain voting with the single token is sufficient, so long as validators aren’t censoring. But if validator are censoring then we have other problems that must be solved separately. Regardless of the specifics, DG involves voting by the holders of the tokens to select the validator set.

In PoG, governance decides on the validator set. This can be on-chain token-voting governance (which is actually DG above), or an off-chain governance mechanism.

Proposal for Proof-of-Governance

We will now propose how PoG would look like in the context of LSTs.

Since net issuance would tend to zero for stakers but not validators, we simply need to separate these two concepts, so that changes can be made to one without affecting the other. Coupling them was always an incorrect abstraction in a delegated-PoS system.

Concretely, this means skipping redundant steps, and reducing the issuance to stakers to zero. Issuance would then only and solely go to validators, for the service they provide to the network. An analysis of the economics of this change is provided in the next section.

With issuance to stakers at zero, staking is then used for two things: selecting the validator set, and collecting REV. Again, these two are coupled, but they don’t have to be! We can replace staking to select the validator set with PoG, analyzed in a later section. Collecting REV can be replaced with burning all transaction fees. In the case of 100% bonding, distributing fees or burning all fees provides identical value accrued to identical participants.

Now that we’ve removed issuance to stakers (but retained issuance to validators), removed validator selection from stakers, and removed direct REV collection from stakers, we land on the question: “what’s the point of staking.” And the answer is: nothing.

We can actually remove the notion of staking entirely from the protocol! Moreover, in the absence of staking, we also don’t need LSTs; the token itself is isomorphic to an LST in terms of value capture, since fee burning accrues to all tokens all the same.

Economics

We also propose concrete economic numbers on the issuance to validators.

With CIP-29, the issuance rate is being reduced to ~5%. With a commission rate of 5% (the lowest and most common commission rate currently) and 100% of tokens staked, this would give a payout to validators of 5% of the issuance rate (or 1/20th). Under PoG, this means that issuance could be reduced by a factor of 20—from ~5% to ~0.25%—while still providing validators the same payout.

Governance

We propose here a concrete governance mechanisms, which could be used to instantiate the protocol.

Why Not On-chain Governance?

With on-chain governance, token-holders would vote on-chain for the validator set. However, since Celestia does not support execution in its state machine, it is expected that the vast majority of LST tokens would be exported to off-chain DeFi, and likely owned by users would may not even own the underlying staking TIA.

Therefore it would be challenging to construct a protocol for voting that actually involves end-user voting vs large validator operators—the very entities we don’t want capturing all votes since they would simply vote for themselves.

Thus, off-chain governance is preferred.

Note: an alternative would be actual dual-governance, as proposed by Charbonneau originally, with a second token. But this is undesirable for other reasons.

Off-chain Governance

Celestia’s governance is backstopped by off-chain governance. In other words, off-chain governance trumps on-chain governance.

A simple method of applying off-chain governance to selecting the validator set for PoG is fixing the validator set in the node software. Then the validator set could be changed through CIPs.

Conclusion

We propose Proof-of-Governance as a way to drastically reduce issuance by a factor of 20 while maintaining security, and supplant the need for complicated LSTs.

Implementing this change will place Celestia on the path to more directly prioritizing REV and value accrual for TIA token holders.

adlerjohn:

With CIP-29, the issuance rate is being reduced to ~5%. With a commission rate of 5% (the lowest and most common commission rate currently) and 100% of tokens staked, this would give a payout to validators of 5% of the issuance rate (or 1/20th). Under PoG, this means that issuance could be reduced by a factor of 20—from ~5% to ~0.25%—while still providing validators the same payout.

Fully support this, especially as it maintains the same payout to validators. Celestia is vastly over-paying for its security currently.

I’m generally super supportive of innovation in staking designs. Celestia’s core useful property is that if provides abundant data dissemination in a way that doesn’t rely on the cloud account of a single provider and I think Celestia should start figuring out how to charge for the service rather than having emissions.

I think that all current staking designs of major assets which are basically all derivatives of the Cosmos hot tub in Mexico design which was all created via thought experiments.

We should start with empirical reasoning about these systems based on what we have.

1. Empirically there is a substantial limit on users willingness to hold LSTs. Market making on LSTs is underserved especially because the main venues are defi. Incorporation of LSTs in DeFI has under performed expectations.

2. Incremental yields do seem to matter to some marginal buyers. Evidence from SIMD-228, ATOM etc. Staking yields are very well distributed and widely perceived as low risk. There have been few slashing events in the last 5 years. Defi yields are more complex to access and reason about.

3. Short term censorship resistance. We have some examples. SUI Cetus exploit, Thorchain validator rotations during periods of increased DPRK activity. Solana sandwhich attacks. I generally feel like we pay way to much for short term CR properties that could be achieved with a wider pool of nodes with FOCIL type designs.

all proof of stake systems are under pressure from co-located/ single sequencer systems.

zmanian:

Empirically there is a substantial limit on users willingness to hold LSTs.

While I don’t disagree, I wouldn’t over-index on this. Indeed, in the OP I said that in a sufficiently mature system we should expect bonding and LST rates to tend towards 100%. Current systems are far from that level of maturity.

Possible explanations are things like smart contract risk and dual-governance risk, and general friction when dealing with LSTs, as you mentioned. The nice thing about the proposed change here is that…there’s no friction or smart contract risk. There’s just one token, and its ticker is $TIA.

zmanian:

I generally feel like we pay way to much for short term CR properties that could be achieved with a wider pool of nodes with FOCIL type designs.

Agreed, and all this paying has shown to not actually guarantee short-term censorship resistance, for some definition of “short.” MCP is the way to get censorship resistance, and that can be built on top of this proposal separately.

Quite a mindblowing post. It’s an elegant solution to so many token-economic problems simultaneously that seems obvious once you see it:

• eliminates the need to overpay for security with high inflation
• establishes a clear mechanism to distribute protocol revenue
• eliminates the complexities and risks of LSTs, including competition with DeFi yield and LST monopolization

The one part I’m least sure of is the PoG mechanism. Offchain governance to establish the validator set sounds like it could be extremely messy. At the same time I see all the problems with trying to do this via an onchain process or with a second token. Maybe it’s simply that we need to better define what this offchain governance process should be. Any more concrete ideas here?

Another thing I worry about eliminating staking altogether is the perception that there’s no “economic security” securing assets on bridges that rely on Blobstream. I totally get the point that slashing the value staked is not actually what deters validators from colluding, but nonetheless the industry seems to place a lot of weight on this model of security. Perhaps developing models to quantify the future value of validator revenue would solve this problem, but even then I think the numbers would be a lot smaller than the seeming billions at stake securing the network today.

We lack empirical evidence of economic security based attacks so I think we really have no idea what the staked amounts are really doing for security.

This is a very interesting post. I just created my account to ask a question that came to mind after reading it.

Isn’t there a risk of on/off-chain bribery to become part of the validator set? This would lead to exactly the same outcome as LSTs. It would be somewhat similar to the veToken model in DeFi.

Sorry if this is a stupid question.

adlerjohn:

Importantly, this is how PoS blockchains actually work today. This is not a suggested change. PoS blockchains today are secured by the fees paid to validators, and the threat of denying future fees, not by stake and not by slashing stake.

probably just midcurving this, but in socially slashing / blacklisting delegators seems like a valid punishment for picking a validator set. This was actually my understanding of why we DAS. In the case of hidden data, we can quickly find and slash the delegates that enabled a malicious valset. If that’s true, then it seems like PoS chains are also secured by that and not only future fees.

[ unrelated to above comment]

generally am a fan of only directly inflating to validators and not to delegators. Even if there is social slashing of delegators, I still think all token holders should be forced to pick an honest validator.

Don’t think the proposal itself is a bad mechanic, but one thing I’d consider when evaluating this is Celestia’s credibility as a platform to build on.

There are a handful of teams that invested considerable resources into building LST platforms on Celestia (similarly with bridging and sequencing). And Celestia seems to be slowly internalizing more and more functionality. This is not the most platform friendly signal.

evan:

This was actually my understanding of why we DAS. In the case of hidden data, we can quickly find and slash the delegates that enabled a malicious valset. If that’s true, then it seems like PoS chains are also secured by that and not only future fees.

Oh sorry, I wasn’t clear. When I was referring to “security,” you could call it the “security budget” or the “penalty.” Detection of malicious behavior (i.e. DAS) is orthogonal to that, but is a facet of security.

This is a really compelling proposal, simplifying the staking model, cutting unnecessary inflation, and focusing on validator-level rewards makes a ton of sense. That said, a few open questions keep nagging at me:

• If we remove staking and move validator selection off-chain, how do we actually hold validators accountable? Without any on-chain mechanism to remove bad actors (e.g. for downtime or censorship), we’re relying a lot on off-chain governance to act quickly and decisively, that can get messy.
• The economics assume a healthy level of DA fee demand, but what happens in a bear market? If activity drops, can validators still operate sustainably with just 0.25% issuance? Curious if anyone’s modeled worst-case scenarios here.
• There’s also the concern around governance capture. With validator selection happening off-chain, what’s to stop well-connected actors from lobbying their way into the set? Feels like it could turn into a veToken dynamic without the transparency as @nolanv-be mentioned
• Also as @eljhfx stated, this might create a panic among the builders on Celestia. need to restate what areas celestia might not consider inclusive.

Overall, love the direction but worth thinking through how to build in some safeguards as we shift toward PoG.

I have a thought how to stop off chain collusion.

To stop collusion we need to insert mistrust. If we make the one exposing collusion or bad behavior get X% of cheating partys bond, the trust and expected value of collusion collapse.

If the rev is used to buy back tokens the bond value posted by validators increase with network value. Thus scales with network value.

This creates incentives for validators to be watching other validators, and no validator can trust another validator

adlerjohn:

Why Not On-chain Governance?

With on-chain governance, token-holders would vote on-chain for the validator set. However, since Celestia does not support execution in its state machine, it is expected that the vast majority of LST tokens would be exported to off-chain DeFi, and likely owned by users would may not even own the underlying staking TIA.

Therefore it would be challenging to construct a protocol for voting that actually involves end-user voting vs large validator operators—the very entities we don’t want capturing all votes since they would simply vote for themselves.

Thus, off-chain governance is preferred.

I don’t follow this explanation. Isn’t the point of this proposal that you wouldn’t have LST tokens? So why would that prevent on-chain governance?

A lot of interesting observations. I think it’s very interesting to think about but also I want to caution about a few things:

adlerjohn:

Therefore, security is not derived from the ability to slashing stake, but rather from the ability to deny future fees paid to validator operators (short: validators). Similarly, the cost to attack is derived from those fees, not the stake delegated to the validators. This is consistent with the position that slashing is not actually required for PoS. The idea that slashing stake is required is a misconception from a blog post that is now more than a decade old—a decade outdated, perhaps.

Just to be clear: I don’t completely disagree with this, but I also think it is oversimplified and risks throwing out the baby with the bathwater. A staker who delegates to a bad operator (that is later slashed) is equivalent to a staker-operators who runs bad infrastructure (that gets hacked and leads to their validator being slashed). So we need to consider:

• Stakers making different (and more risk averse) decisions and taking out of band information into account (e.g. public reputation of operators) that they would not be incentivized to gather in a pure governance decision without value at risk
• Bad stakers (who make poor decisions and allocate to bad operators) eventually losing their capital (does not matter for the first ever attack but any future attacks)
• I also think it would be pretty interesting to look for example at STAKESURE which might point towards a future where stake is used in a more productive way

These would be what you are losing by completely giving up on slashable stake.

adlerjohn:

Thus, off-chain governance is preferred.

I think this is probably the most dangerous part of this proposal. The problem now becomes that the existing off-chain governance process is overloaded with important economic decisions. A process that in successful protocols is already at the risk of constant politics will be considerably more strained. Even if successul, it will probably take away a lot of energy from protocol governance institutions.

adlerjohn:

The last intuition needed is that PoS is actually permissioned, not permissionless. A common critique by PoW maximalists is that PoS is not permissionless since you need intrinsic permission from existing validators to become a validator.

Not really relevant for this post, but the analysis is equally true for proof of work, where a majority of miners can always exclude a minority (They can theoretically be replaced if someone else assembles more mining power, but in practice this will rarely be economically viable)

It seems like a critical underexplored assumption that this post makes is that eliminating staking will drive the previously staked TIA to DeFi to occupy the market penetration that would otherwise be enjoyed by LSTs (current and future).

Practically, and as noted by @zmanian , that market penetration is next to nil today, and mostly incentivized with token emissions and unsustainable points programs. LSTs make up 0.38% of TIA’s total supply today, broken down as follows:

• Milkyway: 1.92m TIA, liquidity marginally incentivized with MILK tokens
• Stride: 1.27m TIA, liquidity previously incentivized with a points program
• Drop: 1.19m TIA, liquidity and DeFi heavily incentivized today with a points program

The numbers get worse when you consider that the overwhelming portion of the supply of these LSTs are simply held rather than actively put to use in DeFi. None of these has been successful as of yet in increasing TIA DeFi penetration. A large reason for this, imo, is that DeFi infrastructure capable of accepting a large portion of TIA demand simply does not exist yet. This played out with Stride and Milkyway TVLs, which evaporated after the points programs ended because the TIA had nowhere to go. The same is likely to be true of the Drop points program.

adlerjohn:

zmanian:

Empirically there is a substantial limit on users willingness to hold LSTs.

While I don’t disagree, I wouldn’t over-index on this. Indeed, in the OP I said that in a sufficiently mature system we should expect bonding and LST rates to tend towards 100%. Current systems are far from that level of maturity.

It’s true that we could expect this to change in the future (and if this post is aimed at addressing a change to be made several years from now I’d agree we shouldn’t overindex on this now), but if this is to be implemented in the near future it’s worth considering how strong the assumption is that TIA currently staked will simply migrate to admittedly the immature DeFi infrastructure that currently exists.

The state of the world today is that a TIA holder can earn 12% against an inflation of 7% by staking, soon to be ~8-9% against 5% inflation.

This proposal, when implemented, would change that dynamic to 0% earned against 0.25% inflation (i.e., 0.25% annual dilution). So we’ll need to assume that a TIA holder is either fine with accepting dilution for holding the asset, or is fine with accepting the various risks incumbent in DeFi to earn enough yield to offset that dilution (even assuming the current defi infrastructure could accommodate a 0.25% yield at the current level of TIA staked supply, which it cannot).

All of this is to say, if we’re wrong about the assumptions outlined above, the end result is likely to be a massive TIA supply glut and selloff. It’s possible that for the purposes of this post that this is irrelevant, but it’s worth considering given the protocol doesn’t exist in a vacuum and that this will likely lead to a CIP at some point in the future.

I also loosely agree with @eljhfx that this is an unfriendly move for builders looking to invest resources in Celestia’s ecosystem (and disclosure, I’m a contributor to Stride, a Celestia LST provider), but I don’t think the platform’s roadmap is, or should be, beholden to commercial interests that don’t directly align with the stated goals of the platform, and I’m under no illusions that staking / LSTs are one of those goals.

I’m mostly concerned that we’re not doing enough to consider the actual, real-world implications of such a significant change to the protocol’s security model.

anilcse:

If we remove staking and move validator selection off-chain, how do we actually hold validators accountable?

Staking isn’t how validators are held accountable. Detecting malicious behavior is through DAS. Ejecting a minority of validators (e.g. for downtime) can happen automatically. It’s independent of staking. Ejecting a majority of validators always requires a hard fork if the validators are malicious and censoring. So, removing staking doesn’t change any of this.

anilcse:

If activity drops, can validators still operate sustainably with just 0.25% issuance?

Given that validators are paid for their services that are denominated in some stable currency, ideally they should actually just be paid in stablecoins.

musalbas:

I don’t follow this explanation. Isn’t the point of this proposal that you wouldn’t have LST tokens? So why would that prevent on-chain governance?

Sorry, this wasn’t clear. It has to do with the bonding requirements to make a proper voting protocol. Most LSTsTIA would be bridged out of the Celestia state machine, so they can’t be bonded in the Celestia state machine for voting purposes.

You could develop a protocol (hence, “challenging,” not “impossible”) that does all the voting tallying and bonding etc. across all major chains that have LST- TIA on them, but that’s non-trivial.

I think you mean TIA bridged to other chains, not LSTs. Also, I think it would be fine if the protocols that that TIA is bridged to does the voting (eg via interchain accounts or zk accounts).

dankrad:

A staker who delegates to a bad operator (that is later slashed) is equivalent to a staker-operators who runs bad infrastructure (that gets hacked and leads to their validator being slashed)

From the pov of the slashed, yes. The issue is the principle-agent problem, where the validator isn’t the one getting slashed.

dankrad:

Stakers making different (and more risk averse) decisions and taking out of band information into account (e.g. public reputation of operators) that they would not be incentivized to gather in a pure governance decision without value at risk

In practice, I don’t think many people actually gather information. They just delegate to the Lido and Coinbase, which is why you end up with a very small number of very large validators.

Also, the selection of validators under PoG would absolutely be incentivized to get the best value out of the issuance paid to validators, both in terms of performance and alignment. Those positions wouldn’t just be given out to anyone. A better argument would be the opposite, that those positions would be lobbied and bribed for!

dankrad:

Bad stakers (who make poor decisions and allocate to bad operators)

The presumption here is that stakers that delegate to a bad validator behaved poorly, but I’ll contend that’s not necessarily true. For example, are stakers that delegate to Lido bad if Lido, with a perfect track record, decides one day to attack Ethereum? The attack came out of nowhere, the stakers had no way to know.

Aside from this, but if you want slashing for misbehavior then just make validators bond some tokens. Then they also get value accrual from REV, so they’re even more economically incentivized by the protocol to behave correctly.

dankrad:

A process that in successful protocols is already at the risk of constant politics will be considerably more strained.

This is where I kind of agree. Off-chain governance can be tricky. However, I think this proposal allows us to explore a more democratic and meritocratic way of selecting validators, rather than the purely plutocratic ways of current PoS chains.

dankrad:

but the analysis is equally true for proof of work

musalbas:

Also, I think it would be fine if the protocols that that TIA is bridged to does the voting (eg via interchain accounts or zk accounts)

Once that’s fully available, if there’s consensus to adopt that as the governance process for deciding validators, then it’s always possible to swap out the governance process! But it’s not a blocker to deploying PoG with off-chain governance first.

Great post – think this approach mitigates a lot of issues we’ve seen with PoS. Couple questions on implementation details:

1. Will quorum weights (and thus inflation incentives) be fixed per operator across the valset?

• Assuming yes, probably should mention the potential for CR improvements as measured by increasing the nakamoto coefficient (along with the more evenly distributed economics that come with it).

1a) Downstream of that, how do you decide what size the validator set needs to be in order for the super minority number to be considered sufficiently censorship resistant?

• This is super subjective and a moving target, but imo demand side considerations should be weighted against operator profitability requirements. That said, it seems like the number could be much higher than current (6) but also should be much lower 33 if current rollup operators are happy with status quo (ie don’t need to copy/paste the existing set and making their quorum weights equal). This matters as it relates to what the updated emissions rate will be ofc, 0.25% might be enough for 10-15 operators but not for 33 (I have no idea to be clear).

What do you see as the tradeoffs in making the valset social consensus gated?

• ie if Blackrock wants to run a rollup but would feel better if they also ran a validator for risk mgmt purposes, it doesn’t feel great asking them to write a post in some offchain governance forum vs having the set gated by collateral requirements (ie they can buy TIA or get a delegation from the foundation). Practically speaking, do you envision the devco/foundation stepping into the social consensus process on their behalf to get them in the validator set?

Last question: how does the demand side of the network get a seat at the decision making table, if/when they need to in the future? (This is not just a Celestia problem to be fair)

• Lets say rollup adoption takes off (CLOBs on Blobs!), and to make it fun we’ll say it takes off before sticky features are implemented ie issuance for assets beyond TIA on Celestia + zk accounts, so these are by and large rollups with native L2 assets that require very low fees driving network usage. What happens when revenue hungry token holders want to go into profit mode prematurely and ask operator to jack up per-byte blob data fees, but the devco/foundation sides with the demand side in optimizing for long term growth maximization?
• I think this is the champagne problem that @dankad is pointing to, and I’m not sure there’s a great answer unless there are 1) incentives baked into the protocol for the demand side to run a validator and 2) the valset is not social consensus gated by operators that do not want to share issuance revenue with demand side operators, and side with token holders by default

Thank you so much for sharing this. The vision is super thought-provoking and makes a lot of sense, especially the insight that staking yields become redundant as LSTs push bonding to ~100%.

One point I’m curious about and hoping to understand better from the community is how a fully off-chain validator selection aligns with Celestia’s social consensus philosophy and the goal of credible neutrality.

Would it make sense to keep some lightweight, transparent in-protocol criteria (like a scorecard for uptime/performance) to prevent centralization risks, while still keeping issuance minimal and removing redundant stake yields?

I’m just exploring how to keep this aligned with Celestia’s social layer values. Would love to hear others’ thoughts before I think more concretely about it.

Thanks again for pushing this discussion forward. Really appreciate it!

mylesoneil-repyhlabs:

Will quorum weights (and thus inflation incentives) be fixed per operator across the valset?

Yes, that was the expectation. And yes, this would increase the Nakamoto coefficient (in fact, it would make the Nakamoto coefficient optimal given Tendermint as a consensus protocol).

mylesoneil-repyhlabs:

Downstream of that, how do you decide what size the validator set needs to be in order for the super minority number to be considered sufficiently censorship resistant?

That’s a good question. Not sure I have a good answer for that for a single validator set. However, I believe that censorship-resistance is better achieved through Multiple Concurrent Proposers, rather than just a large validator set, so perhaps the question is moot.

mylesoneil-repyhlabs:

but would feel better if they also ran a validator for risk mgmt purposes

mylesoneil-repyhlabs:

Practically speaking, do you envision the devco/foundation stepping into the social consensus process on their behalf to get them in the validator set?

Don’t see any reason why anyone would want to run a validator for this reason. A full node sure, but a validator doesn’t really add anything. No, I don’t envision Labs or Foundation stepping in in such a situation (speaking for myself, not either entity).

mylesoneil-repyhlabs:

(This is not just a Celestia problem to be fair)

I think this is the correct conclusion. Why don’t Ethereum validator jack up the fees today? It would be in their short-term rational best interest. Turns out they don’t, because validators and token holders have longer-term views.

Koara:

Would it make sense to keep some lightweight, transparent in-protocol criteria (like a scorecard for uptime/performance)

Yes, I suggest that possibility here:

adlerjohn:

Ejecting a minority of validators (e.g. for downtime) can happen automatically.

It could work the same way jailing for downtime works today. That doesn’t have to change, because jailing for downtime is a consensus thing, not a staking thing.

Thanks for the clarification. To build on that, I wanted to share a draft idea I’ve been thinking. It is basically a “middle path” that keeps the insight you have shared.

I definitely love the idea that we can drop issuance to stakers to basically zero and rely on validators earning fees + future income. But removing staking and choosing validators fully off-chain or hardcoding them feels like it might lean too much on opaque processes over time. (Please do educate me if I misunderstood it).

I know we have consensus-level downtime jailing (which you clarified), but I wonder…

• Could we keep that and add a super simple, open validator scorecard like uptime, inclusion, maybe infra diversity… so the community has a clear, shared signal?
• And maybe tie issuance more directly to DA usage, so it scales naturally with demand?
• And still have a protocol-native LST for capital efficiency, but with no governance power… so we avoid LST monopolies messing with selection (as you described)

The goal would be to to keep it transparent and merit-based while still hitting your original goal of minimum issuance.

So, the rough sketch I’m imagining is

• Issuance only goes to validators, not stakers. And the amount adjusts automatically based on DA activity (may be ~0.25–5% band. Instead of fixed).
• Consensus jailing for downtime stays exactly as today.
• Optional scorecard for extra signals (uptime %, inclusion %, maybe community check-ins).
• Protocol-native LST so people get capital efficiency without governance power attached.
• Most fees burned, rest rebated to validators, node runners, or other contributors.

So basically, your core idea + more explicit transparency + usage-linked economics.

I’m genuinely not trying to push an alternative for the sake of it. I’m still pretty new around here and I am just sharing where my head’s at in case it sparks ideas or helps refine PoG further.

If this direction sounds useful, I’m happy to write it up a bit more and can help polish the details together. Or if you think it overcomplicates things, totally fair.

Thanks so much for reading my wall of text

adlerjohn:

In practice, I don’t think many people actually gather information. They just delegate to the Lido and Coinbase, which is why you end up with a very small number of very large validators.

Right, but Lido and Coinbase are actually very conscientious operators. Now imagine the case where a new operator is started completely anonymously and some rumours about ties to Lazarus. Do you think a lot of people would delegate to them? I don’t think they would, given slashing penalties. So people do use out of band operation to make this decision. The process is far from perfect, but it probably does work.

adlerjohn:

Also, the selection of validators under PoG would absolutely be incentivized to get the best value out of the issuance paid to validators

Yes, but the incentivization is global, not local, so it suffers more from the tragedy of the commons problem. If Lido went rogue, specifically those who “voted” for Lido by delegating their stake would be punished. If PoG had chosen Lido as one of the operators, it would not fall back on voters in the same way (they may lose some reputation but not their coins).

This is a very pragmatic piece that we believe could mend some of the structural supply issues burdening Celestia, while also creating a clear path to accelerate the chain’s development.

From a business case, since Q1 2024 to Q2 2025 Celestia Validator Commission on TIA Issuance and Transaction Fees topped $120m, while across the same time REV has only garnered a grand total of $1.3m, 50% of which originated in Q1 24’ and was non-blob fee related.

1600×233 126 KB

When annualizing the latest REV from Q2 of this year, you get 114,106 TIA. Assuming annual inflation of 0.25% on a 1.13bn supply, that’s 2.82m annually. Therefore, REV would need to ~24x from where it is currently for the token supply to go net-deflationary. We’ve outlined other REV growth multiples in the table below, all the way to 50x REV which would lead to a net deflationary rate of -0.25% annually.

Further, assuming all new issuance goes to validators, this would translate to 28,250 TIA per validator on an annual basis - this assumes that new issuance is split evenly and the validator count remains at 100. In dollar terms using the current price of $1.58, that is $44,635. If you view validator / operator commissions as a cost to the network, this would reduce that cost drastically, as in Q2 25’ alone operators were paid $6.4m (44% higher than the proposed annual issuance proposed in OP).

In our point of view, there is very little reason or rationale to justify the inflation that Celestia currently has. While CIP-0029 is a step in the right direction, it still does not address the core question of why the network needs to issue new tokens at all. Additionally, REV would have to increase by ~495x to become net deflationary at 5% inflation. Even at the terminal inflation target rate of 1.5% in CIP-0029 which would theoretically be reached in year 14, REV would still have to scale 149x to turn deflationary.

For added perspective, given Celestia does not have a native execution environment, we can assume non-blob fees will not be a forward looking driver of network REV, and the focus will be on blob fees. If you take Celestia’s best ever week for Blob fees which was 5,682 TIA, annualized it comes out to 295k TIA. This would only account for 10% of the newly proposed issuance. To get a more clear, realistic view point on how the community, investors, and other parties can underwrite their respective thesis in the network, it’s also important to understand how much DA usage is subsidized via grants, which at this time is unclear.

In summary, we think this approach is not only appropriate, but necessary in order for Celestia to realize its goals. We also believe offchain governance can lead to faster results, but transparency on decision making should be made public - whether it be open calls anyone can join, or transcriptions of meetings etc. From the validator side, we believe we can provide rational decision making grounded in reality to help steer the network in the right direction, to maximize token value accrual via REV, and dominate DA market share. We are one of the fastest growing validators on both Solana, and Babylon, and will be genesis validators of two high-performance networks soon to launch.

Our focus from the research side has always been around protocol mechanics and market dynamics, and we believe we could be a value add validator in the set if the PoG is to take shape.

Following up on the question whether validators would still be able to operate sustainably with only 0.25% issuance.

You mentioned that, ideally, validators should be paid in stablecoins.

Are there any forecasts or calculations available regarding the potential payment rate for validators if PoG is implemented? Thanks in advance!

I think we all agree that self-delegated stake is not a meme, so if we want to preserve some notion of economic security for the protocol, could we potentially keep self-delegated staking?

Not sure what the incentive would be for validators to self-stake unless it was part of the governance process to be elected or included some additional amount of rewards which might not be worth the cost.

Or does removing delegation but keeping self-staking just put us in the same awkward position as Ethereum?

everstakevalidator:

Are there any forecasts or calculations available regarding the potential payment rate for validators if PoG is implemented? Thanks in advance!

The point of the 0.25% number is it’s the same number that validators get (on average) today. It’s not less. So any questions around if this number is enough also apply today, and are thus orthogonal to this proposal (even if they’re valid questions).

Thanks for the answer! However, we’d still appreciate further clarification regarding how the proposed changes will affect validator revenue (if available, any supporting calculations, charts, or forecasts outlining the expected validator earnings after PoG implementation).

Additionally, we wanted to share a few concerns:

1. Centralization of governance: off-chain governance introduces non-transparency and potential centralization in validator selection, deleting one of the core blockchain features.

2. Reward reduction for validators: reducing issuance to 0.25% while maintaining the current validator set (100 validators), as we see it, would lead to decrease in rewards. 70+ validators from the current set, would see decreased rewards earnings. Only a small number of community validators might benefit from these economic changes, which over time could degrade the overall network quality.

3. Removal of staking: closing the staking option removes an important mechanism for involving token holders. We believe this could result in the loss of active users, potential mass sell-offs, and a shift in validator incentives. This removes the competitive element between validators, which will negatively impact engaging with users, promoting the network or educational efforts.

4. Loss of community participation. Without staking, token holders no longer contribute to network security or earn yields, also weakening decentralization and engagement.

5. Security model: from our point of view, without staking and slashing mechanism, validator accountability is weakened. The proposal suggests replacing slashing with a mechanism that denies fees paid to validators. However, since this process relies on off-chain governance, it potentially introduces risks of manipulation. Therefore, clear requirements and guidelines need to be provided regarding this.

everstakevalidator:

Thanks for the answer! However, we’d still appreciate further clarification regarding how the proposed changes will affect validator revenue

quite literally the exact same number of tokens that a validator would get now if they had 1% of the voting power. 80 validators would get more tokens than they get currently. For example, your validator would almost double since it would go from .64% of the voting power to 1%.

everstakevalidator:

off-chain governance introduces non-transparency and potential centralization

off chain might not be the best wording. the gov process will likely be posted on chain, just not in the celestia-app state machine. presumably a rollup etc. Also, all node operators including light clients ultimately choose the valset by choosing a binary.

Each accusation of “centralization” or “validator accountability” or “loss of community pariticipation” etc must be taking into context of the other inevitability, an LST with a large amount of voting power. Would this process be more opaque or more hidden or involve fewer people than an LST w/ a large portion of the voting power?

I’m curious what the point of holding TIA would be after staking is disabled. TIA isn’t like a stock that represents a share of Celestia and it’s not like an LST that captures rewards and has a price that directly reflects value outside of speculation. What is a governance token after you remove governance?

It’s not like we’re burning through TIA from fees and in the proposal you say those will be burned anyway, not part of any revenue sharing system.

After reading this I can’t find a reason to hold TIA and worse, it makes me very sceptical of the projects future because where is the revenue coming from for operational expenses if TIA goes to like 1 cent or even 10? It obviously wouldn’t take long before losses set in because the massive sell pressure would crush the price.

My other concerns are that 1) it’s usually the beginning of the end when a team suggest removing power from the holders 2) anytime off-chain is preferred to onchain there’s premeditated corruption gears spinning. Neither of these actions are in the spirit of blockchain that I’ve been apart of since neckbeards dominated the scene.

slacker:

It’s not like we’re burning through TIA from fees

we’re not meaningfully burning TIA in fees so far, no. nfa, but most of the time eth and sol inflate more than they burn . The advantage here is inflation goes down to .25%, so that’s a lot easier to burn more than what is inflated.

slacker:

it’s not like an LST that captures rewards

the end game for LSTs is for everyone to use it and not use the native asset. if everyone is being inflated equally, then what’s the point? Some jurisdictions tax those rewards as income, which is further defeats the purpose. This proposal is just speed running Lido’s and Jito’s end game, alongside recognizing that social consensus must cover LST logic that has controls large portion of the voting power.

slacker:

My other concerns are that 1) it’s usually the beginning of the end when a team suggest removing power from the holders

The gov mech is not proposed here, and similar to Lido would presumably account for all parties. If you believe LSTs will be the dominant form of holding PoS tokens, then this isomorphic. This proposal is simply skipping all the BS in between that. Beyond existing LSTs, celestia light clients will verify all protocol changes and rules, including changes to the validator set.

slacker:

1. anytime off-chain is preferred to onchain there’s premeditated corruption gears spinning.

governance will almost certainly still be posted onchain for verifiability, just not in the celestia-app state machine! Sorry to be the bearer of bad news, but every blockchain inherently relies on social consensus for security against censorship or dishonest majorities.

fwiw everyone here care’s deeply about the mission. assuming malice arbitrarily, on the research forum of all places, is toxic. be well friend, but take that elsewhere.

IMO validator set election is too important to the core protocol to not be in the Celestia state machine. What’s the argument for why it shouldn’t be?

My understanding of this proposal is that the “allow list” would be hardcoded in the binary.

Who’s in the active set of that allow list would still be in the celestia-app statemachine.

This proposal doesn’t prescribe an allow list selection process, but if one follows the example of Lido, then a lot of difficult to prove onchain properties such as geo location, if they run bridge nodes, have a high bandwidth connection, or other desirable properties could be incorporated in the decision making process.

If we could move the allow list selection outside of celestia-app, we could remove a large portion of the cosmos-sdk and start a migration to a more performant and more provable stack.

Fwiw, I could see a longer term outcome where the allowlist process is proved or enshrined and it is no longer hardcoded. It would still involve the difficult to prove properties listed above, and presumably try to avoid the original downsides from token voting in PoS.

good job celestia.

Just to confirm my understanding - am I correct in thinking that the 0.25% issuance will be distributed evenly among the 100 validators?

If so, with the supply of 1,134,118,575 TIA, the annual issuance at 0.25% would be 2,835,296 TIA, and that would be around 236,274 TIA per month.

Assuming an even distribution across 100 validators, that would come out to roughly 2,362 TIA per validator per month.

Please let me know if I’m missing anything here.

Thanks so much!

Overall I think this is a very interesting take on staking, validation and security (or the assumption thereof) for POS blockchains.

Some pointers that you make that I think should be considered “truths” at this time:

• Value leakage to custodians, LSD providers, validators and consortium by high issuance is significant
• Theoretical impact of inflation is limited to the net difference in staking APR → inflation but practically there is a lot of liquidity impact that should be considered.
• In delegation models security is largely a meme, the total staked assets is almost irrelevant as only branding and offchain contracts/SLAs are at risk.
• High staking yield is a drain on any DeFi activities with the same token.
• offchain governance in a way can be stronger than on-chain governance

However, I am not sure everything in this model works or makes sense.

• LSTs carry risk, native staking has certain benefits (airdrops, custody support and what not) so assuming 100% bonded rate is ever reached is unlikely. As issuance drops its actually more logical for people to be willing to lend out or just hold the base asset and it happens on mature systems a lot. The bonded rate increases and increases until a point where there is less and less locked/OG holders and it starts decreasing. I dont believe 100% will be reached any time soon. This means staking APR != inflation so there and will remain a real cost/benefit on whether you stake or not.
• Paying every validator exactly the same will mean there is truly no alignement for them to do any work for the chain besides the bare minimum to remain in the set through governance. Celestia would basically be fully POA as you mention where governance is the authority setter. This is a fine security model (see Noble for example) but in this model validators should really only be infrastructure providers and not expected to hold or perform other duties in the ecosystem. This means other real costs will appear from RPC, bridge nodes, testnet, marketing and so forth. Likely outsourcing these things separately is indeed more cost efficient but its something worth considering. You are reducing the total number of aligned parties on the chain.
• Governance on a user by user basis is known to be incredibly faulty, even in the OG world there are examples of this (hi Brexit). Governance nowadays is largely a popularity contest between the few active voices and has created turmoil in and outside of Cosmos for a long while. I don’t necesarilly believe that removing validators from voting (although it would be great not to have to be a decider on non-technical matters) is the ultimate solution here.

Nonetheless, This is a concept worth iterating on. It is drastic in many ways but also spot on with regards to the (economic) problems plagueing POS. There is no need to make certain parties rich in other to be succesful, minimizing leakage is always the best option for the chain in the long run.

best,
Ertemann

Dynamic emissions + low inflation + burn mechanism + keep onchain governance.

Why not adopt Ethereum tokenomics model and move on. The copied Solana tokenomics was never a good idea to begin with.

Given this proposal, can someone please explain to me, as a staker on Celestia, why should i keep my TIA tokens and not sell them right now?

I see a problem here. The post and arguments are made with the inherent assumptions that current security model in crypto is sufficient, thus only talking about the implementation details

I agree with the points the author makes and they are black pilling, everything is off chain governance, bitcoin et al.

But I want to illustrate and encourage to look to solve this weakness in crypto rather than accept current state as good

Here is why:

A media company have internal communication etc and structures that is equivalent to on chain, when state actors influence it or take them over, its done outside them, by coercion and incentives, they are done off chain

The same is for our political systems.

But fundamentaly its a problem of incentives not aligned, further as argued by Nassim Taleb about most if not all our current systems failings are lack of skin in the game, but I would also argue it lowers the threshold for incentives misalignement and influencing or coercion

Fundamentaly we cant be satisfied with current state of crypto at least if you carry an cypher punk ideals, we need to improve the state

Hi everyone! We’ve been closely following the Proof of Governance proposal and see it as a positive step for the Celestia network.

PoG shifts focus from staking rewards to governance participation, helping reduce inflation to 0.25%, strengthen decentralization, and better align validator incentives. We believe these three factors will bring benefits both economically and for the ecosystem as a whole.

We’ve also reviewed community discussions around potential risks. Off-chain governance could be influenced by the most active voices, and uniform validator rewards may reduce incentives to contribute beyond the minimum. These concerns could be mitigated through staggered rewards, hybrid governance models, or performance-based incentives.

As an active validator on Celestia, deNodes supports the goals of Proof of Governance. We are ready to adapt our infrastructure to any changes and remain committed to providing secure, reliable network support.