Pith. sign in

REVIEW 4 major objections 6 minor 31 references

Economic Security of Multiple Shared Security Protocols

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An AVS spanning multiple shared-security providers is only as secure as its weakest pool; the paper proves fragmentation lowers the minimum attack cost from $\theta\cdot\Delta$ to $\theta\cdot\min_j \Delta_j$.

desk verdict Useful formalization of restaking fragmentation with a plausible main result, but a missing composition premise in the central theorem and a proof error in the appendix mean it needs major revision before it's citable. read the letter →

arxiv 2505.03843 v2 pith:BHAHQPLO submitted 2025-05-05 cs.CR q-fin.RM

Abhimanyu Nag , Dhruv Bodani , Abhishek Kumar This is my paper · ORCID
classification cs.CRq-fin.RM
keywords restakingsharedsecurityprovidersactivelyvalidatedserviceseconomicattackcoststakefragmentationconvexoptimizationgametheory
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper formalizes the Multiple SSP Problem: an Actively Validated Service (AVS) that borrows security from several restaking platforms splits its stake across independent pools, and an adversary can attack the whole service by compromising only the weakest pool. The authors compare a fragmented model, Model $\mathbb{M}$, with a unified model, Model $\mathbb{S}$, and prove that the minimum cost of a successful attack is $\theta\cdot\min_j \Delta_j$ in $\mathbb{M}$ versus $\theta\cdot\Delta$ in $\mathbb{S}$, where $\theta$ is the consensus threshold and $\Delta_j$ is the stake held in pool $j$. Because the smallest pool sets the bar, fragmentation strictly lowers the cryptoeconomic security threshold. The implication is that unifying stake into a single validator set with aggregated slashing gives an AVS stronger security guarantees than running isolated per-SSP instances.

What carries the argument

The load-bearing object is the security function $S(x) = \theta\cdot\min_j x_j$, the minimum cost to corrupt an AVS in the fragmented model, together with the convex program $\max_{\omega\in\Omega} \min_j \Delta_j(\omega)$ whose optimum equalizes pool stakes. Around it sits a validator utility comparison: honest participation pays $u(v_i) = r\cdot\sigma(v_i)$ under proportional rewards, while a colluding validator earns $\gamma(v,\alpha)\pi - c(v,\alpha)$; an attack is rational only when its cost falls below the profit $\pi$. This pair drives the weak and strong security definitions, the bribery-threshold model $\lambda_j(v_i) = u(v_i)/\omega(v_i,s_j)$, and the equilibrium analysis.

What would settle it

Take an AVS secured by two SSPs with $\Delta_1 = 100$, $\Delta_2 = 1000$, $\theta = 1/3$, and attacker payoff $\pi = 200$. The paper's bound says Model $\mathbb{M}$ is insecure because $\pi > 33.3$. If this AVS's consensus rules instead demand simultaneous threshold stake in both pools, the minimal attack cost is $\theta(\Delta_1+\Delta_2) = 366.7$, making the attack unprofitable; any live AVS with such a cross-SSP quorum rule is a counterexample to the universal weakest-pool bound.

Watch

Extended reading notes

Core claim

The paper's central claim is that, under PBFT-style assumptions where a single local failure breaks global safety, an AVS spanning multiple isolated Shared Security Providers is no more secure than its weakest constituent pool. Formally, the minimum cost of a successful attack in Model $\mathbb{M}$ is $C_M = \theta\cdot\min_j \Delta_j$, so security requires $\pi < \theta\cdot\min_j \Delta_j$, whereas in Model $\mathbb{S}$ the cost is $C_S = \theta\cdot\Delta$ with $\Delta = \sum_j \Delta_j$, giving the strictly larger threshold $\pi < \theta\cdot \Delta$. The security function $S(x) = \theta\cdot\min_j x_j$ is concave, so the best feasible allocation in Model $\mathbb{M}$ equalizes all pool stakes, $\Delta_j = \Delta_\ell$ for all $j,\ell$; the authors also characterize a market equilibrium in which equal pools form a Nash equilibrium. Bribery analysis reaches the same conclusion: the per-unit bribe threshold in $\mathbb{M}$ is the minimum across pools, while $\mathbb{S}$ concentrates stake and raises coordination costs.

Load-bearing premise

The argument assumes that in the fragmented model a successful attack on any single constituent SSP is sufficient to compromise the AVS; if the AVS required the attacker to corrupt a threshold across several SSPs at once, the weakest-pool bound and Model $\mathbb{S}$'s advantage would not follow.

Editorial extensions

If this is right

  • An AVS deployed in the isolated multi-SSP model has economic security bounded by $\theta\cdot\min_j \Delta_j$; adding more SSPs without rebalancing does not raise that bound.
  • Unifying stake into Model $\mathbb{S}$ converts the guarantee to $\pi < \theta\cdot\Delta$, so consolidation alone raises the attack-cost threshold.
  • In Model $\mathbb{M}$, stake must be rebalanced so that all $\Delta_j$ are equal to reach the best possible minimum; any imbalance leaves a cheaper attack path.
  • Bribery attacks are cheaper in Model $\mathbb{M}$ because the attacker targets the pool with the lowest per-unit bribe threshold; Model $\mathbb{S}$ raises that threshold via concentrated stake and unified slashing.
  • High empirical correlations among major staking assets weaken the diversification benefit of uncorrelated restaking during market-wide shocks, so volatility reduction is limited in crises.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If an AVS instead required simultaneous threshold corruption across multiple SSPs, the $\theta\cdot\min_j\Delta_j$ bound would not apply; the paper's two-model dichotomy rests on the single-local-failure assumption.
  • The equalization result suggests a concrete rebalancing policy: move stake from large pools to small ones until all $\Delta_j$ are equal, which is a risk-parity allocation across SSPs; the paper does not design the mechanism.
  • A stress test that shocks all staking-asset prices simultaneously would show Model $\mathbb{M}$'s minimum security collapsing to the smallest pool as correlations approach 1, so the diversification benefit is a calm-market effect.
  • Protocols that already use cross-SSP quorum rules could be empirically compared: if their observed attack costs exceed $\theta\cdot\min_j\Delta_j$, the weakest-link threshold is not universal.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper formalizes the 'Multiple SSP Problem' for restaking protocols: an AVS can borrow security from several Shared Security Providers either in an isolated fragmented architecture (Model M) or in a unified shared-stake architecture (Model S). It defines validator utility, attack cost, and weak/strong cryptoeconomic security, and derives the central comparison that Model M's minimum attack cost is theta * min_j Delta_j, so security requires pi < theta * min_j Delta_j, whereas Model S requires pi < theta * Delta. It also analyzes volatility/correlation, a maximin convex program that equalizes security levels, a market-equilibrium notion, and bribery attack costs, and it reports Monte Carlo simulations. The main conclusion is that Model S provides strictly stronger economic security than Model M.

Significance. If the central comparison is accepted, the paper provides a crisp, falsifiable security criterion for multi-SSP restaking and identifies a concrete design advantage for unified pools over fragmented ones. The derivations are self-contained, no security parameters are fitted to data, and the main threshold conditions are simple enough to serve as rules of thumb for protocol designers. The paper is a useful conceptual contribution, but several load-bearing modeling assumptions and proof steps need to be stated or fixed before the claims are fully supported.

major comments (4)
  1. [Section 2, Lemma 2, Corollary 2.1] The claim that Model M's minimum attack cost is theta * min_j Delta_j rests on an unstated composition rule: that compromising any single constituent SSP instance breaks global AVS safety. The text only says that under PBFT 'a single local failure may compromise global liveness or safety' (Section 1), and Model M is defined as independent pools (Section 3.1.1) without defining the AVS-level safety predicate that connects those pools. If global safety instead requires an attacker to corrupt a quorum across multiple instances, the minimum corruption cost can be substantially larger than theta * min_j Delta_j, and the M-vs-S comparison could invert. Please make this composition assumption an explicit part of the Model M definition and discuss the class of AVSs for which it holds.
  2. [Appendix B.2, Definition 3.2] The proof of strong security (Definition 3.2) is invalid. From gamma(v,alpha)*pi - c(v,alpha) < r*sigma(vi) and gamma in [0,1] one cannot conclude pi < sum_j alpha(vi,sj) + r*sigma(vi); dividing by gamma would make the bound weaker, not stronger. The correct summation of the per-validator conditions yields pi < C(alpha) + R with C = sum_v c(v,alpha), not pi < (1/n)(sum alpha + R). Consequently the derived bound n < ((theta + r)*Delta)/pi and the accompanying 'centralization' interpretation are not established by the given proof.
  3. [Section 3.3, Lemma 5] The statement that equalizing Delta_j 'maximizes the security threshold uniformly in both models' is false for Model S. In Model S the security threshold is theta * Delta, and Delta = sum_j Delta_j is fixed by the per-validator conservation constraints, so the distribution of stake across SSPs is irrelevant to that threshold. Equalization of Delta_j is an optimality condition only for the Model M maximin problem. Please restrict the claim to Model M or redefine the objective so that it applies to both models.
  4. [Section 3.2, Theorem 4 and Appendix B.6] The proof of the equalization claim is incomplete. It asserts that whenever Delta_j != Delta_ell, reallocating a small amount of stake from the more secure SSP to the weaker one increases the minimum, but it does not verify that such a reallocation is feasible under the per-validator stake conservation constraints, nor does it account for heterogeneous asset prices p_j(t) in the definition of dollar-denominated security. Please give a complete proof that uses the constraints explicitly, or state the additional assumptions under which the maximin optimum equalizes all Delta_j.
minor comments (6)
  1. [Section 2] The problem statement contains a typo: 'How can an A VS inherit security' should read 'How can an AVS inherit security'.
  2. [Section 3.1] The phrase 'for the purposes of this with paper' is ungrammatical; please rewrite the sentence defining the reward R.
  3. [Section 3.2] The word 'incosistency' should be 'inconsistency' in the discussion following Theorem 4.
  4. [Section 5] The simulation description says 'constant sampling of pi from Uniform distribution from (10000, 80000)'; please clarify the sampling procedure, state the number of draws per configuration, and provide a random seed for reproducibility.
  5. [Appendix A / Lemma 6] Lemma 6 states that if all SSPs have equal total stake then validator utility is independent of allocation, but Appendix A already proves u(vi) = r*sigma(vi) for arbitrary allocations under proportional rewards; the condition Delta_j = Delta/k is unnecessary for the utility claim and should be reconciled with the general derivation.
  6. [Appendix C] The notation R_j (rewards for SSP j) is used in Appendix A but is missing from the table of notations; please add it.

Circularity Check

2 steps flagged · score 6.0 of 10

Lemma 2 / Corollary 2.1 encode the weakest-link result in the definition of the Model M security function rather than deriving it; the central M-vs-S comparison is partly circular by construction.

  1. self definitional [Section 3.2 (Theorem 4, Corollary 2.1; proof in Appendix B.4)]
    "Then the cryptoeconomic security level of the AVS, defined by the minimum cost S(x) := θ · min_j x_j ... In M, security requires: π < θ· min_j Δ_j, instead of π < θ· Δ. Thus, model M lowers the system-wide security threshold while S actually increases it because of increased stake control."

    Corollary 2.1's threshold 'π < θ·min_j Δ_j' is exactly the security function S(x)=θ·min_j x_j that Theorem 4 defines as 'the cryptoeconomic security level of the AVS' in Model M. The proof in Appendix B.4 only adds the inequality min_j Δ_j < Δ, which is true for any fragmented split; it never establishes from PBFT that breaching one independent pool breaks the AVS. That weakest-link rule was placed into the definition of S(x), so the headline 'Model M is weaker than Model S' restates the model's construction instead of being derived as an independent security prediction.

  2. self definitional [Section 4.1, Bribery-Based Attack Cost Comparison]
    "Total system cost for the multi-SSP model (Model M): C_multi = min_j C_j. ... Model M typically lowers the attacker's cost by allowing selection of the weakest target SSP, potentially with a low λ*_j and small validator subset."

    The formula defines the total attack cost as the minimum over pools, which already assumes the adversary only needs to break one SSP to attack the AVS. The later sentence that Model M 'lowers the attacker's cost' is a verbal restatement of that definitional choice; no independent argument shows that satisfying one pool's bribery threshold compromises the AVS as a whole. This is the same unstated composition assumption used in Corollary 2.1, now embedded directly in the bribery cost formula.

full rationale

Most of the paper is self-contained: the utility bounds, concavity of the min function, the equalization result, and the market-equilibrium arguments follow algebraically from the stated definitions, and no parameters are fitted to data; the Monte Carlo simulations are illustrative rather than used to tune the security bounds. The main circularity is narrow but central: Lemma 2 and Corollary 2.1 do not derive the weakest-link failure rule from PBFT; they build it into S(x)=θ·min_j x_j and C_multi=min_j C_j. Consequently the flagship claim that Model M has lower attack cost than Model S is a restatement of the model's construction. In addition, Section 1 says a single local failure 'may compromise global liveness or safety' under PBFT assumptions, but Lemma 2 treats this 'may' as deterministic; that is a missing-premise / correctness risk rather than a fitted circularity. The self-citations to Catalysis are promotional and not load-bearing to the mathematics. Overall score 6: the central M-vs-S comparison reduces by construction, while the surrounding framework remains independently derived.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The analytical results are elementary and rest on standard BFT and rational-adversary assumptions plus one specific protocol-design choice (proportional rewards per SSP). No new physical or mathematical entities are introduced, and no constants are fitted to data. The only hand-chosen numbers are the Monte Carlo simulation ranges, which the authors explicitly label as model-agnostic stress tests in Section 5.

free parameters (3)
  • simulation adversarial profit π = Uniform(10000, 80000) units
    Chosen by hand for Monte Carlo stress tests; acknowledged in Section 5 as model-agnostic since no real AVS data exists. Does not affect analytical claims.
  • simulation APY r = Uniform(0.05, 0.5)
    Chosen by hand for simulations, not fitted to data; stated as such in Section 5.
  • simulation total reward R = Uniform(5, 20) units
    Chosen by hand for simulations, not fitted to data; used only in illustrative figures.
assumptions (5)
  • domain assumption PBFT-style consensus with up to f Byzantine nodes and attack threshold θ = 1/3 is sufficient for a successful attack when stake share exceeds θ.
    Assumed in Section 2 and used throughout to define the attack threshold; standard in BFT literature.
  • ad hoc to paper Rewards are distributed proportionally to stake in each SSP (Appendix A).
    This protocol design assumption makes validator utility u(vi)=rσ(vi) independent of allocation, which trivializes the Nash equilibrium claim in Lemma 6 and the market equilibrium definition.
  • domain assumption Adversary has a deterministic profit π for a successful attack and rational validators weigh honest rewards against bribes minus slashing (Sections 3 and 4).
    Standard rational-adversary model; the bribery formulas depend on this utility comparison.
  • ad hoc to paper In Model M, each SSP pool operates independently and a compromise of any single pool breaks the AVS (Section 2).
    This is the defining assumption of Model M and is the direct source of the min_j Δj security threshold.
  • domain assumption For Theorem 4, the feasible set allows arbitrary fractional reallocation of each validator's stake across SSPs, so the equalization Δj = Δ/k is feasible.
    The proof assumes any validator can split stake among SSPs; if validators had SSP-specific restrictions, equalization could be infeasible.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Economic Security of Multiple Shared Security Protocols." pith.science (2026). https://pith.science/paper/BHAHQPLO

@misc{pith2026250503843,
  author       = {Pith},
  title        = {Pith review of: Economic Security of Multiple Shared Security Protocols},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BHAHQPLO}},
  note         = {Machine review of arXiv:2505.03843}
}
abstract

As restaking protocols gain adoption across blockchain ecosystems, there is a need for Actively Validated Services (AVSs) to span multiple Shared Security Providers (SSPs). This leads to stake fragmentation which introduces new complications where an adversary may compromise an AVS by targeting its weakest SSP. In this paper, we formalize the Multiple SSP Problem and analyze two architectures : an isolated fragmented model called Model $\mathbb{M}$ and a shared unified model called Model $\mathbb{S}$, through a convex optimization and game-theoretic lens. We derive utility bounds, attack cost conditions, and market equilibrium that describes protocol security for both models. Our results show that while Model $\mathbb{M}$ offers deployment flexibility, it inherits lowest-cost attack vulnerabilities, whereas Model $\mathbb{S}$ achieves tighter security guarantees through single validator sets and aggregated slashing logic. We conclude with future directions of work including an incentive-compatible stake rebalancing allocation in restaking ecosystems.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 25 canonical work pages

  1. [1]

    White paper, 1–19 (2024)

    Team, E.: Eigenlayer: The restaking collective. White paper, 1–19 (2024)

    work page 2024

  2. [2]

    Business & informa- tion systems engineering 59, 183–187 (2017)

    Nofer, M., Gomber, P., Hinz, O., Schiereck, D.: Blockchain. Business & informa- tion systems engineering 59, 183–187 (2017)

    work page 2017

  3. [3]

    : Ethereum white paper

    Buterin, V., et al. : Ethereum white paper. GitHub repository 1(22-23), 5–7 (2013)

    work page 2013

  4. [4]

    Yakovenko, A.: Solana: A new architecture for a high performance blockchain v0. 8.13. Whitepaper (2018)

    work page 2018

  5. [5]

    URL: https://bitcoin

    Nakamoto, S.: Bitcoin whitepaper. URL: https://bitcoin. org/bitcoin. pdf-(: 17.07. 2019) 9, 15 (2008)

    work page 2008

  6. [6]

    Business Review, Federal Reserve Bank of Philadelphia,(Q4), 18–25 (2011)

    Monnet, C.: Rehypothecation. Business Review, Federal Reserve Bank of Philadelphia,(Q4), 18–25 (2011)

    work page 2011

  7. [7]

    https://docs

    Symbiotic Protocol: Symbiotic: Permissionless Restaking Protocol. https://docs. symbiotic.fi/. Accessed: 2025-04-23 (2025)

    work page 2025

  8. [8]

    https://docs.babylonlabs.io/

    Babylon Labs: Babylon Labs Documentation. https://docs.babylonlabs.io/. Accessed: 2025-04-23 (2025) 14

    work page 2025

Show all 31 references
  1. [9]

    https://docs.jito.wtf/

    Jito Labs: Jito Labs Documentation. https://docs.jito.wtf/. Accessed: 2025-04-23 (2025)

    2025

  2. [10]

    In: OsDI, vol

    Castro, M., Liskov, B., et al.: Practical byzantine fault tolerance. In: OsDI, vol. 99, pp. 173–186 (1999)

    1999

  3. [11]

    arXiv preprint arXiv:2407.21785 (2024)

    Durvasula, N., Roughgarden, T.: Robust restaking networks. arXiv preprint arXiv:2407.21785 (2024)

    2024 arXiv

  4. [12]

    Chitra, T., Pai, M.: How much should you pay for restaking security? arXiv preprint arXiv:2408.00928 (2024)

    2024 arXiv

  5. [13]

    Markowitz, H.M.: Portfolio theory: as i still see it. Annu. Rev. Financ. Econ. 2(1), 1–23 (2010)

    2010

  6. [14]

    arXiv preprint arXiv:2503.00170 (2025)

    Bar-Zur, R., Eyal, I.: Elastic restaking networks. arXiv preprint arXiv:2503.00170 (2025)

    2025 arXiv

  7. [15]

    Cambridge university press, ??? (2004)

    Boyd, S.P., Vandenberghe, L.: Convex Optimization. Cambridge university press, ??? (2004)

    2004

  8. [16]

    Emerald Group Publishing, ??? (2013)

    Owen, G.: Game Theory. Emerald Group Publishing, ??? (2013)

    2013

  9. [17]

    https: //blog.catalysis.network/blog/enabling-a-future

    Catalysis Network: Catalysis: Enabling a Future with Thousands of AVSs. https: //blog.catalysis.network/blog/enabling-a-future. Accessed: 2025-04-23 (2025)

    2025

  10. [18]

    arXiv preprint arXiv:2401.05797 (2024)

    Deb, S., Raynor, R., Kannan, S.: Stakesure: Proof of stake mechanisms with strong cryptoeconomic safety. arXiv preprint arXiv:2401.05797 (2024)

    2024 arXiv

  11. [19]

    Department of Mathematics and Statistics, Queens University 40 (2016)

    Lin, J.: On the dirichlet distribution. Department of Mathematics and Statistics, Queens University 40 (2016)

    2016

  12. [20]

    Reports on progress in Physics 43(9), 1145 (1980)

    James, F.: Monte carlo theory and practice. Reports on progress in Physics 43(9), 1145 (1980)

    1980

  13. [21]

    Physica A: Statistical Mechanics and its Applications 586, 126462 (2022)

    Nie, C.-X.: Analysis of critical events in the correlation dynamics of cryptocur- rency market. Physica A: Statistical Mechanics and its Applications 586, 126462 (2022)

    2022

  14. [22]

    Management science 38(4), 555–593 (1992)

    Levy, H.: Stochastic dominance and expected utility: Survey and analysis. Management science 38(4), 555–593 (1992)

    1992

  15. [23]

    In: Game Theory, pp

    Kreps, D.M.: Nash equilibrium. In: Game Theory, pp. 167–177. Springer, ??? (1989)

    1989

  16. [24]

    In: Computer Security–ESORICS 2020: 25th 15 European Symposium on Research in Computer Security, ESORICS 2020, Guild- ford, UK, September 14–18, 2020, Proceedings, Part II 25, pp

    Sun, H., Ruan, N., Su, C.: How to model the bribery attack: A practical quan- tification method in blockchain. In: Computer Security–ESORICS 2020: 25th 15 European Symposium on Research in Computer Security, ESORICS 2020, Guild- ford, UK, September 14–18, 2020, Proceedings, Pa...

    2020

  17. [25]

    Computers & Security 88, 101502 (2020)

    Alvarez, R., Nojoumian, M.: Comprehensive survey on privacy-preserving proto- cols for sealed-bid auctions. Computers & Security 88, 101502 (2020)

    2020

  18. [26]

    Journal of mathematical analysis and applications 112(1), 129–135 (1985)

    Adomian, G., Rach, R.: Coupled differential equations and coupled boundary conditions. Journal of mathematical analysis and applications 112(1), 129–135 (1985)

    1985

  19. [27]

    https://gauntlet.network/reports/ compound

    Chitra, T., Chiang, R., Morrow, J., Kao, H.-T.: An Analysis of the Market Risk to Participants in the Compound Protocol. https://gauntlet.network/reports/ compound. Accessed: 2025-04-23 (2020)

    2020

  20. [28]

    https://arxiv.org/abs/2410.04085

    Ghosh, R., Gupta, S., Datta, A., Nag, A., Sinha, S.: Compound V3 Economic Audit Report (2024). https://arxiv.org/abs/2410.04085

    2024 arXiv

  21. [29]

    https://arxiv.org/abs/2402.15037

    Nag, A., Gupta, S., Sinha, S., Datta, A.: Multi Agent Influence Diagrams for DeFi Governance (2024). https://arxiv.org/abs/2402.15037

    2024 arXiv

  22. [30]

    https://sidecar-docs

    EigenLayer: EigenLayer Sidecar: Getting Started Guide. https://sidecar-docs. eigenlayer.xyz/docs/sidecar/running/getting-started. Accessed: 2025-04-23 (2025)

    2025

  23. [31]

    Numeracy 2(2), 4 (2009) 16 Fig

    Catalano, M.T., Leise, T.L., Pfaff, T.J.: Measuring resource inequality: The gini coefficient. Numeracy 2(2), 4 (2009) 16 Fig. A1 Simulating the reward differences in Total Stake vs Allocated Stake Reward systems - mean is same but higher variations based on different allocati...

    2009

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.