[Proposal] PBS: Proposer Builder Separation

Aztec
,
1

Update 10/10: added header availability attestations
Update 9/28: removed provers, added hybrid sequencing

(an adaptation of Ethereum Hybrid-PBS)
This is a new sequencer selection proposal. The current block proposer role in Fernet gives advantage to centralized MEV operators and prover pools over unsophisticated stakers, requiring stakers to make out-of-protocol market connections to compete. Proposer/builder separation (PBS) splits block proposer into proposer, and builder roles. This allows proposers to be stateless and run on low-cost hardware, improving decentralization and censorship resistance.

proposers are assigned L2 slots using RANDAO. Bonded builders submit bids alongside blinded block headers for the current proposer to accept. The winning block data is then published to L1 (soft finality), followed by a proof within MAX_PROVER_TIME.

Staking

Stakeholder tokens are deposited/withdrawn on L1 alongside proposer public keys, with fixed-rate queues to limit churn.

Protocol phases

Blocks are first proposed, then proved. Transactions achieve soft finality when proposed.

--------------------------------------------------------- L1 blocks ->
|proposal|      proving      | 
          |proposal|      proving      |
                    |proposal|      proving      |
                              |proposal|      proving      |


--------------------------------------------------------- L1 blocks ->
|proposal|      proving      |
    |     |proposal|      missing      |
    |               |proposal|      proving (orphan)|
    |                         |proposal|      proving (orphan)|
     ---------------------------------->|proposal|      proving      |

During each slot:

  1. A proposer is chosen using the L1 RANDAO two epochs prior (like L1)
  2. The proposer broadcasts an inclusion-list that builders must include
  3. builders broadcast block headers with bids + bond
    • the required bond amount adjusts dynamically as proof slots are missed
  4. proposer signs and broadcasts the winning header
    • Unselected candidates attest to timely availability of the winning header
      • Majority signed headers can be submitted to slash builders if the block is not posted
  5. builder publishes the block data to L1 (proposal phase)
    (up to MAX_PROVER_TIME later…)
  6. builder publishes the block proof to L1 (proving phase)
  7. builder bond released

Batching

Fernet batching can be added by replacing:

  • builder publishes proof to L1

with:

  1. builder broadcasts proof
  2. the next-block builder broadcasts a signature of the proof

If at the end of M slots a final proof fails to hit L1, all builders have bonds burned unless they publish these signed messages.
If the next-block builder does not broadcast a signature, the builder must submit proof data to L1.

Hybrid L1 Sequencing

Every other block, anyone may submit block data (with bond) directly to L1.

76 Likes
2

Do you think the PBS (proposer-builder) separation can be managed out of protocol rather than enshrined, as it works today in Ethereum? If so, then this design would be compatible with Fernet as it is today. When writing it, we made the design decision to explicitly keep PBS out of protocol, considering it’s still an active area of research and bound to keep changing fast, and we didn’t want to constrain it by whatever protocol upgrade rules we set.

As for the prover separation, proving is still an area open of research (with some discussions already happening), and this would be an interesting proposal to put forward.

Also, I’m curious about the choice of the builder being the one who picks the winning prover bid, as opposed to the proposer. Why this decision?

75 Likes
3

No, because block-data privacy is required for builders during the auction. The current Ethereum situation is undesirable, requiring trusted centralized third parties (relays).

After a proposer has accepted a bid for the block it has nothing at stake and may refuse to sign prover bids. It is the builder’s bond at stake if a prover is not found.

84 Likes
4

Agree that the current situation is undesirable in Ethereum, but in Fernet I wanted to avoid enshrining PBS explicitly given I felt it’s still somewhat of an open problem, so we could have it out of protocol and iterate on it faster than the rest of the network, just to minimise the number of problems we’re tackling at a time. Not sure if we’ve created new ones unwittingly though…

65 Likes
5

After consideration, I now believe in-protocol provers are required in order to meet sequencer decentralization requirements (builders may be optional) [1]:

  • Hardware requirements for sequencers must be similar to those of Ethereum validators
80 Likes
6

Bond Pricing

S = single sequencer required stake
B = blocks produced per MAX_PROVER_TIME (historical average)

base_collateral = S + S * floor(B)

The collateral is equal to the sequencers stake, plus an additional stake for each potentially affected block. If blocks are produced slowly, the additional stake will be 0, while if blocks are being produced quickly additional stake may be required for every slot in MAX_PROVER_TIME (e.g. 50, assuming 12s L1 and 10min window).

Additionally, if a proof is missed the collateral requirements multiply by max(floor(sqrt(B)), 2), and then come back down over N blocks. This is to reduce the number of consecutive blocks missed.

This puts a lot of centralizing pressure on builders, and so is compatible with PBS but not Fernet.

5 Likes
7

To address Profitable Censorship MEV, I propose replacing hybridization with an L1-fallback, using a “halting period” of 1 block.

Fallback L1 Sequencing

If a proposer fails to propose a block, 1 L1 block is skipped, after which anyone may submit a valid L2 block.

2 Likes