警惕潜在风险：用Geth进行质押，可能会失去所有资产？
Original author:Labrys
Original compilation: Deep Chao TechFlow
This article discusses a glitch encountered by the client Nethermind on the Ethereum network, which caused all validators using Nethermind (about 10% of the network) to go offline. The article highlights the Geth client’s super-majority position in the Ethereum network and the potential risks it brings. Although Geth is a stable and reliable client, if there is a serious failure, due to its widespread use in the network, it can have a significant impact on the entire network. The article calls on the community to pay attention to the diversity of execution clients to reduce the risk of centralization faced by the network.
introduce
This week, Nethermind, an executive client of the Ethereum network, experienced an outage that caused all validators running Nethermind (about 10% of the network) to go offline.
This is a smaller event as Nethermind is run by a small number of stakeholders. Below is a graph of the total balance of my own validator running Nethermind. You can see that the validator went offline around 4am local time when the failure first occurred. The team released a patch about 4 hours later, and by the time I installed it, the validator was back up and running around 9am local time. During this time, my validator was punished by the same amount of rewards it was receiving. At 1pm on the same day, the validators balance was higher than before the outage. Overall, this is a minor glitch.
Many people mistakenly assume that if a similar failure occurs when running Geth, the penalties will be similar. This is not true. Its not about Geth or how Geth is built, its about the number of people running Geth.
According to ClientDiversity.org, about 84% of validators on Ethereum are running Geth. Now in the defense of these holders, Geth is undoubtedly the best and most stable client. While a handful of clients like Nethermind have been plagued by glitches and outages this week, Geth has been running well since the merge (and even before that). From my own experience, when switching from Geth to a minority client, I found that the validators required more resources and missed more validations.
This article is not an attack on Geth. I have a lot of respect for their team. Unfortunately, due to Geths widespread use, we need to have an honest discussion about the risks of running Geth when Geth holds the vast majority of the stakes.
No one wants to leave Geth if they know they are more likely to experience more missed attestations and more downtime, especially those with business models that rely on uptime to advertise the highest yields, such as professional staking operators.
As of last September, the largest operator, Lido, was estimated to be running around 76% of validators on Geth.
But Im happy that Im running a minority client, even if I lose out on some additional rewards, not because Im an altruist sacrificing personal gain for the decentralization of the network, but because I know my ETH will be lost as a result Free from most bugs.
What happens if there is a bug in Geth?
It depends on the bug itself.
Because more than two-thirds of Ethereum validators run Geth, any critical failure in Geth would immediately prevent chain finalization. This does not mean that the chain is stopped or interrupted. The chain will continue to run as long as other clients are still running. Approximately 84% of blocks will be missed, meaning a new block will only be proposed every approximately 75 seconds instead of a block time of approximately 12 seconds. These blocks will be prone to reorganization, so the transactions contained in these blocks are not guaranteed to still exist when the chain is completed again. This sounds bad, but let’s remember that for years Ethereum never had the concept of final confirmations before the merger, and the same is true for Bitcoin today – that’s why exchanges make you wait for 6+ block confirmations to reduce the risk of restructuring and loss of funds.
Some may recall that this already happened to Ethereum in May 2023, when a bug appeared in some consensus clients. In two days, the chain stopped ending twice, resulting in many blocks being missed, and at one point only 40% of the network was still running. After the network was restored, most DApp users did not notice any issues other than slightly slower transaction block confirmations.
But what happens to validators?
inactive leak
When a handful of clients fail, the penalty is losing ETH at the same rate as they gained it (as you can see in my validator graph above), but if Geth fails as it immediately prevents the chain from finalizing, So the punishment will be more severe. This increased penalty is called the inactivity leak and is applied to offline validators when the chain stops finalizing for 4 cycles (~25 minutes) or more. This harsher penalty is intended to encourage offline validators to come back online as quickly as possible, or in the worst case, destroy the offline validators stake until their stake accounts for less than 1/3 of the total stake, allowing online validators to complete Chain confirmation.
During an inactive leak, a validator that is offline for just 2 days will lose 0.6% of its stake, or the equivalent of 2 months of staking rewards!
Just being offline for 5 days will consume an entire year’s staking rewards (3.5%)! This means that it will take more than 2 years of staking to restore the balance that the validator had before the event.
Within 1 week of being offline, 10% of your equity, or 3 years of rewards, will be lost. In approximately 20 days, 50% of equity will be lost, and in approximately 40 days, 90% of equity will be lost.
By comparison, a validator that goes offline due to a handful of client failures will only lose 0.4% of its stake over 40 days.
How long will the inactivity penalty last?
It depends on the bug.
If the bug can be patched, the penalty will last for as long as it takes for the Geth team to patch the bug and apply it to your validator (or for the time it takes to switch to another executing client).
In fact, we expect this issue to be resolved within a few hours or, at most, a few days. If it takes the same amount of time to fix the bug as the recent Nethermind incident, validators will lose 0.004% of their stake, which is not a big deal.
Things can get ugly if a bug causes a validator to produce an invalid block, and Geth considers it valid and authenticates it. This will cause the chain to fork. The chain will be split into two branches, one containing invalid blocks (Geth chain) and another branch ignoring invalid blocks (non-Geth chain). The validator running Geth will consider both branches to be valid and therefore decide to build on the heaviest chain. 84% of the validators authenticate their interests to the Geth chain, and only 16% of the validators authenticate their interests to the non-Geth chain. Therefore, Geth validators will choose the Geth chain as the most heavily weighted chain and continue to build on it.
Of course, once all these issues are resolved, blocks on the Geth chain will be deprecated (which will cause its own problems), but the bigger issue is that the Geth chain will have enough stake (greater than 2/3) to confirm the invalidation chain.
Once the Geth chain is finalized, if a validator certifies the Geth chain, it cannot participate in the construction of non-Geth chains (until the non-Geth chains are also confirmed), otherwise it will be slashed. Essentially, the validator running Geth has committed to an invalid chain and is locked on that chain until the non-Geth chain is confirmed. This is where the key risk lies that many people misunderstand.
Because Geth validators are stuck on an invalid chain, they are considered inactive on non-Geth chains and will suffer from inactivity leaks. No software update or bug fix can save these validators. They will be depleted until their stake represents less than 1/3 of the network, allowing non-Geth chains to be confirmed.
There are currently 28,976,695 ETH staked on the network. 84% of this (approximately 24 million ETH) can be attributed to validators running Geth, and 16% (approximately 5 million ETH) can be attributed to validators not running Geth. In order for non-Geth chains to be confirmed, validators running Geth need to destroy their stake until they account for less than 1/3 of the total remaining stake. This means that approximately 21.5 million ETH (about 90% of the total equity) need to be destroyed from these validators, reducing Geth equity to approximately 250,000 ETH, less than 1/3 of the total (2.5 million + 500 10,000 ETH). The ~5 million ETH controlled by non-Geth validators will now represent more than 2/3 of the stake, allowing them to confirm the chain.
This will be an extremely painful process that will take approximately 40 days to complete. It will cause the total supply of all ETH to decrease by approximately 18%, bringing the total supply below 100 million ETH.
Fighting for exports
An important point here is that a validator on an invalid chain is unlikely to sit idly by. They still have the option to opt out of their stake, and if they fail to do so, the network will forcibly evict them when their effective balance reaches 16 ETH. But that doesn’t mean their losses were limited to 16 ETH.
When you exit a validator (even if you are forced to exit), you will enter the exit queue, and while you are in the exit queue, you will still lose ETH!
We know that in the worst case, it will take about 40 days for inactive leaks to allow valid chains to start confirming again. So how long does it take to exit the queue?
The exit queue has a churn limit that limits the number of validators that can exit the network per epoch (~6.4 minutes). The churn limit is defined as follows:
The current exit rate is 13 validators exiting every 6.4 minutes. If every validator running Geth wanted to exit, it would take at least about 260 days for all validators to exit. Given that 90% of stake will be burned in approximately 40 days, most validators balances will be depleted before they are able to exit the chain.
The initial 2% of Geth validators that initiate withdrawal will withdraw within the first 5 days, and the maximum loss will be approximately 1 year of staking rewards.
You need to be among the top 3% of exit validators to limit losses to less than 10% of your stake.
Only the top 8% of exiting validators can limit losses to less than 50% of their stake. At this time, anyone who has not manually initiated an exit will be forced to exit and added to the exit queue with an effective balance of 16 ETH.
After 40 days, when 90% of their stake is burned, over 85% of validators will still be in the queue.
The ability to exit will not save you, and your downside risk is not limited to your loss from being forced out (16 ETH).
What about cuts?
Some people mistakenly believe that if a bug arises, stakers running Geth will not only suffer from inactivity leaks but also be slashed. This is wrong.
The slashing penalty only applies to double-signing events, which is entirely controlled by the consensus client. Bugs in Geth should not cause consensus clients to make reducible errors. Geth generates invalid block not cuttable error.
Only the penalty for inactive leaks applies to Geth bugs.
What should you do?
Stakers running Geth today may not fully understand the risks associated with running a supermajority execution client. Many people mistakenly assume that once a bug occurs, a patch will be released to fix the problem within hours, and very little ether is lost in the process.
Many people dont understand that the risk of proving an invalid block will lock them into an invalid final chain, almost certainly destroying most of their ETH. This is a real risk that could become a reality.
Staking Ethereum is not a risk-free return. Would you invest at least $75,000 in an instrument with a maximum potential return of 3.5% per year? But is it possible to incur a 100% loss? Probably not, but that’s exactly what 84% of Ethereum stakers are doing today.
By moving to a smaller number of clients (assuming the same bug doesnt show up in multiple clients), you can limit your losses to a maximum of 3.5% annualized.
With this knowledge, anyone still running Geth seems crazy. I can only assume that those running Geth dont fully understand this risk.
If you hold LST (e.g. stETH, cbETH, etc.) and the LST is running Geth on its validator, please understand that your Ethereum is at risk and consider unstaking or switching to another LST until Geth no longer holds the super mainstream status.
