[DRAFT] The effect of ePBS on reorg probabilities

# [DRAFT] The effect of ePBS on reorg probabilities *by [mike neuder](https://twitter.com/mikeneuder) & [francesco d'amato](https://twitter.com/fradamt) <DATE>* *tl;dr; Evaluate the impact of ePBS on reorg probabilities.*  --- ## Pure ex-ante reorgs __Definition 1__. *A length-$\ell$ pure ex-ante reorg occurs when an attacker, who is selected as the proposer for $\ell$ slots in a row withholds their attesations to orphan the subsequent honest block.* __Example attack today__ For simplicity, assume that the committee size is $n=10$. --- <img src="https://storage.googleapis.com/ethereum-hackmd/upload_ce23b2ffee689b7f3aa0d10f6bf2f834.png" width=80%> **Figure 1 –** *The attacker produces a malicious block (`MB1`) with timing such that the honest attester for that slot (green clouds) are split between the empty block and `MB1`. The attacker continues the balancing with a second malicious block, `MB2`. When the honest block, `HB1`, is proposed in the subsequent slot, the attacker releases their withheld attestations (red clouds) and reorgs `HB1` despite proposer boost (green triangle).* --- __Probability calculation__ We can analytically calculate the probability pure ex-ante reorgs being feasible for an attacker controlling $\beta$ of the stake. Let $\Pr(\ell_n)$ represent the probability of a pure ex-ante reorg of length $n$ being feasible. Let $k=19000$ denote the committee size (corresponds to a full validator set size of $608000$). $$\Pr(\ell_1) = \beta \cdot \Pr(X > 0.4 k), \quad \text{where } X \sim Binomial(k, \beta)$$ Generalizing this, we have $$\Pr(\ell_n) = \beta^n \cdot \Pr(X > 0.4 k), \quad \text{where } X \sim Binomial(n\cdot k, \beta).$$ Thus the total probability of a feasible pure ex-ante reorg is $$ \sum_{i=1}^n \Pr (\ell_i) $$ The figure below shows these probabilities for various attacker stakes. <img src="https://storage.googleapis.com/ethereum-hackmd/upload_57c523a41f9952a9c96efec46b9bb8f9.png" width=77%> ### ePBS analysis ePBS as proposed in [Why enshrine Proposer-Builder Separation? A viable path to ePBS](/capk1uukTI-3LcXWBY53Dg) contains proposer blocks and builder blocks. For this argument, say we partition the attesting committee of each slot in half. The first half attests to the proposer block and the second half to the builder block. The builder block receives proposer boost and is still part of the fork-choice rule. Because of this, proposer boost for the proposer block is now only worth 20% of the full committee weight (40% of half of the attesting committee). Because of this, pure ex-ante reorgs are more probable under this scheme. To see why, we present an example where pre-ePBS, a reorg would not be possible, but post-ePBS it is. __Pre-ePBS__ The committee size is still 10. --- <img src="https://storage.googleapis.com/ethereum-hackmd/upload_90dd1b235478b576f1dd1aba4e9dc38b.png" width=90%> **Figure 3. –** *The attacker tries to execute an ex-ante reorg, but their attestations are not enough to outweight the proposer boost of HB1.* --- __Post-ePBS__ --- <img src="https://storage.googleapis.com/ethereum-hackmd/upload_0a03d45b4a69a7816a8df32b950357e0.png" width=90%> **Figure 4. –** *In this case, we now have Malicious Proposer Blocks (`MBB`) and Malicious Builder Blocks (`MBB`). These blocks each get attested to by half of the committees for each slot. The honest attestations are distributed in the same way over the two malicious slots, and now that 3 malicious attestations that the attacker collects over those slots are sufficient to overwhelm the proposer boost of 2.* --- **Key takeaway –** *Partitioning the attesting committee weakens proposer boost making ex-ante reorgs easier to execute.* The probability calculation is quite similar to before, just with 20% being the proposer boost. $$\Pr(\ell_n) = \beta^n \cdot \Pr(X > 0.2 k), \quad \text{where } X \sim Binomial(n\cdot k, \beta).$$ We can similarly plot these probabilities. <img src="https://storage.googleapis.com/ethereum-hackmd/upload_748ece5b490ae39381854f5282c772d6.png" width=90%> Comparing pre- and post- probabilities is the key comparison. <img src="https://storage.googleapis.com/ethereum-hackmd/upload_6436aba565d195dd46e87818d5122fc3.png" width=90%>