Anyone interested in this topic should do a deep dive into how UMA's priceless oracles work and how it processes liquidation. The system is already live and has proceeded many liquidations + resolved liquidation disputes.

Many of your will be surprised at how it can provide timely liquidations similar to Chainlinks but with the crypto-economical guarantees Vitalik suggests.

https://mbroome02.medium.com/uma-liquidations-what-to-know-b02db66a3b28

Anyone interested in this topic should do a deep dive into how UMA's priceless oracles work and how it processes liquidation. The system is already live and has proceeded many liquidations + resolved liquidation disputes.

Many of your will be surprised at how it can provide timely liquidations similar to Chainlinks but with the crypto-economical guarantees Vitalik suggests.

https://mbroome02.medium.com/uma-liquidations-what-to-know-b02db66a3b28

What about a "virtual token" of fixed amount (say, 1 billion or trillion TOKENS or whatever makes sense) that's bound by a smart contract to the value of all the liquidity pools. The pool value can be calculated in any currency available on the exchange. ETH makes sense as the largest currency on the network, but any stablecoin could be good too. Then the price is a simple $POOL_VALUE/TOKEN_QTY and the total pool value is the token's market cap. The token should not be tradable, only used as price reference within the protocol the liquidity pools exist in.

Additionally this could allow new features, like providing liquidity against multiple tokens with single asset with the "virtual token" serving as an intermediary in calculating the exchange rate.

If it's not obvious by now, I'm very new to the crypto market, so disregard if this makes no sense. On the other hand, if this is the most brilliant simple idea no one else thought about before, glad to help :slight_smile: and feel free to take it wherever it can go. Cheeeerss

I am the original conceiver and designer of Augurs oracle system. Wanted to add some information not in this thread yet.

-- Augur security margin (assuming it is still designed the same) comes from the universe forking where the oracle service is frozen while the two versions of REP compete for market cap. The one with the higher market cap at the end of the competition gets control of the existing markets. This requires an attacker to not just have n/2 of the market cap, but to have enough to inflate a worthless crypto at a price for an extended period of time. I forget some specifics, but assuming all holders of the fake REP sell (as is rational to do) at slightly above full market value of the real REP (as is required for the attacker to win), the cost of attack in actually n. Its possible to extend this into an infinite security margin by having multiple rounds where the attacker must double the amount of money honest holders have each time. This infinite security margin comes at the cost of arbitrary long amount of time to freeze the oracle services.

-- Chainlink V2 has serious security margin issues as laid out in the V2 whitepaper. It seemed suspicious when I skimmed the paper originally, but it was not until a writeup made the week in ethereum news making a convincing case that a second tier does not help at all with the security and it is not actually n^2. That said, I am completely confident Chainlink will resolve this design issue. After all, they had to make it in secret with NDAs and a bit too many non crypto university professors. Now that they are able to get wider community input I am confident Chainlink v2 will be a quality product with many capabilities. Makes me wonder though if Chainlink V2s multi hundred page paper with huge ambitions and complexity as well as security margin issue was why Vitalik chose to make this plea to Uniswap instead. He probably just wanted a high market cap erc20 that was not Chainlink to make the request to since a high market cap is a prerequisite to a secure oracle.

-- Augurs model can be sped up close to real time if the data at hand is simply a price number because it doesnt require human interpretation. A node can be coded to just automatically contest and stake against incorrect prices with a single block delay, doubling until a fork. Because it can be automated it wont be as slow as Vitalik and others in this thread are assuming. It would even be fast enough (1 block delay almost always) for liquidation, although someone can delay the price update a few blocks in a row by frivolous contesting. This frivolous delay would probably not be able to be more than several blocks though because of the bond doubling each time. Another catch is that all services relying on this oracle would have to be able to gracefully handle the price feed being delayed, or potentially frozen for a long time if a fork happens.

-- I agree with the general sentiment that this is orthogonal to Uniswap raison d'être. While it would add value to the UNI token, it is a pretty serious 'side project' to do an upgrade that includes UNI tokens splitting in a fork. It may also for security add requirements for UNI token holders to take action in the event of a major contentious event. It may also be a waste of resources if Chainlink delivers a high security margin solution with the ability to contest and lose increasingly staked amounts. I expect that a sped up and automated version of Augur oracle but for price feeds that typically resolves in a single block will eventually exist, and Chainlink will probably take it. Still if Uniswap governance has a huge amount of money to throw around, this has a chance of adding value to the UNI token, and perhaps this is worth doing, but really think they probably have better value propositions.

I can expand upon Chainlink's cryptoeconomic security for clarity. Chainlink oracle networks are cryptoeconomically secured today through implicit incentives. Each Chainlink node in the network holds and is paid in LINK tokens for their oracle services. The value of LINK itself is derived from the health, adoption, and reputation of the network as a whole, creating a strong economic incentive for each node to provide a secure and reliable source of external data (e.g. ETH/USD) in order to uphold the value of not only their current LINK holdings but also their future revenue (which is denominated in LINK).

We see implicit incentives in existing networks like Bitcoin and Ethereum. Because Ethereum miners hold and are paid in ETH, they operate the protocol faithfully because a corrupted network would result in the devaluation of ETH due to the destroyed trust of the network, creating financial harm to themselves. In the Chainlink Network, a successful collusion attack between the most reputable and profitable nodes that ends up results in a significant loss/exploits for DeFi protocols would likewise destroy trust in the network, resulting in a devaluation of the value of LINK.

In addition, each individual Chainlink node is a publicly identifiable entity with their individual future revenue, reputation, and off-chain business on the line. Chainlink nodes operated by enterprises like Deutsche Telekom and data providers like Kaiko have significant revenue both within and outside of the Chainlink network, which would be forfeited through malicious activity. Therefore, for economically rational nodes, it is more profitable to be honest, which is why the honest majority assumption works for networks like Bitcoin, Ethereum, Chainlink, etc.

What you noted about the gold price feed from a year ago wasn't an attack on the network but a misconfiguration of a single feed that resulted in minimal issues. If tens of billions of dollars had been stolen as a result, the value of LINK would have certainly been significantly affected here, creating a financial penalty. The devaluation of the native token depends on the severity of the network issue/attack. The Chainlink network has been significantly hardened since then and uses an entirely different oracle network model, so such issues have not occurred since, but the security of the Chainlink network is not static and continues to evolve.

The Chainlink 2.0 whitepaper was recently published which modeled an explicit staking mechanism where nodes stake their LINK tokens in a service agreement and can be slashed for providing manipulated data. Here, a two-tier oracle network model is used, with a low-cost first-tier that continuously generates oracle reports and a higher-cost maximum-security second tier used for settling disputes, which creates a super-linear staking impact where the cost of attack is significantly greater (quadratic in the number of first-tier nodes) than the sum of all deposits within that network.

The first-tier consists of nodes explicitly staking LINK while the second-tier consists of the most reputable, reliable, and profitable nodes in the Chainlink network who have the greatest financial exposure to LINK and as rational economic actors resolve the rare disputes accurately in order to uphold the value of their LINK holdings, LINK staked in other first-tier networks, future LINK revenue, and individual reputation. The whitepaper goes much deeper into this mechanism than I can cover here, but this mechanism would provide slashing-based cryptoeconomic security in addition to the existing implicit incentives-based cryptoeconomic security.

research.chain[dot]link/whitepaper-v2.pdf

What about a "virtual token" of fixed amount (say, 1 billion or trillion TOKENS or whatever makes sense) that's bound by a smart contract to the value of all the liquidity pools. The pool value can be calculated in any currency available on the exchange. ETH makes sense as the largest currency on the network, but any stablecoin could be good too. Then the price is a simple $POOL_VALUE/TOKEN_QTY and the total pool value is the token's market cap. The token should not be tradable, only used as price reference within the protocol the liquidity pools exist in.

Additionally this could allow new features, like providing liquidity against multiple tokens with single asset with the "virtual token" serving as an intermediary in calculating the exchange rate.

If it's not obvious by now, I'm very new to the crypto market, so disregard if this makes no sense. On the other hand, if this is the most brilliant simple idea no one else thought about before, glad to help :slight_smile: and feel free to take it wherever it can go. Cheeeerss

I am the original conceiver and designer of Augurs oracle system. Wanted to add some information not in this thread yet.

-- Augur security margin (assuming it is still designed the same) comes from the universe forking where the oracle service is frozen while the two versions of REP compete for market cap. The one with the higher market cap at the end of the competition gets control of the existing markets. This requires an attacker to not just have n/2 of the market cap, but to have enough to inflate a worthless crypto at a price for an extended period of time. I forget some specifics, but assuming all holders of the fake REP sell (as is rational to do) at slightly above full market value of the real REP (as is required for the attacker to win), the cost of attack in actually n. Its possible to extend this into an infinite security margin by having multiple rounds where the attacker must double the amount of money honest holders have each time. This infinite security margin comes at the cost of arbitrary long amount of time to freeze the oracle services.

-- Chainlink V2 has serious security margin issues as laid out in the V2 whitepaper. It seemed suspicious when I skimmed the paper originally, but it was not until a writeup made the week in ethereum news making a convincing case that a second tier does not help at all with the security and it is not actually n^2. That said, I am completely confident Chainlink will resolve this design issue. After all, they had to make it in secret with NDAs and a bit too many non crypto university professors. Now that they are able to get wider community input I am confident Chainlink v2 will be a quality product with many capabilities. Makes me wonder though if Chainlink V2s multi hundred page paper with huge ambitions and complexity as well as security margin issue was why Vitalik chose to make this plea to Uniswap instead. He probably just wanted a high market cap erc20 that was not Chainlink to make the request to since a high market cap is a prerequisite to a secure oracle.

-- Augurs model can be sped up close to real time if the data at hand is simply a price number because it doesnt require human interpretation. A node can be coded to just automatically contest and stake against incorrect prices with a single block delay, doubling until a fork. Because it can be automated it wont be as slow as Vitalik and others in this thread are assuming. It would even be fast enough (1 block delay almost always) for liquidation, although someone can delay the price update a few blocks in a row by frivolous contesting. This frivolous delay would probably not be able to be more than several blocks though because of the bond doubling each time. Another catch is that all services relying on this oracle would have to be able to gracefully handle the price feed being delayed, or potentially frozen for a long time if a fork happens.

-- I agree with the general sentiment that this is orthogonal to Uniswap raison d'être. While it would add value to the UNI token, it is a pretty serious 'side project' to do an upgrade that includes UNI tokens splitting in a fork. It may also for security add requirements for UNI token holders to take action in the event of a major contentious event. It may also be a waste of resources if Chainlink delivers a high security margin solution with the ability to contest and lose increasingly staked amounts. I expect that a sped up and automated version of Augur oracle but for price feeds that typically resolves in a single block will eventually exist, and Chainlink will probably take it. Still if Uniswap governance has a huge amount of money to throw around, this has a chance of adding value to the UNI token, and perhaps this is worth doing, but really think they probably have better value propositions.

I can expand upon Chainlink's cryptoeconomic security for clarity. Chainlink oracle networks are cryptoeconomically secured today through implicit incentives. Each Chainlink node in the network holds and is paid in LINK tokens for their oracle services. The value of LINK itself is derived from the health, adoption, and reputation of the network as a whole, creating a strong economic incentive for each node to provide a secure and reliable source of external data (e.g. ETH/USD) in order to uphold the value of not only their current LINK holdings but also their future revenue (which is denominated in LINK).

We see implicit incentives in existing networks like Bitcoin and Ethereum. Because Ethereum miners hold and are paid in ETH, they operate the protocol faithfully because a corrupted network would result in the devaluation of ETH due to the destroyed trust of the network, creating financial harm to themselves. In the Chainlink Network, a successful collusion attack between the most reputable and profitable nodes that ends up results in a significant loss/exploits for DeFi protocols would likewise destroy trust in the network, resulting in a devaluation of the value of LINK.

In addition, each individual Chainlink node is a publicly identifiable entity with their individual future revenue, reputation, and off-chain business on the line. Chainlink nodes operated by enterprises like Deutsche Telekom and data providers like Kaiko have significant revenue both within and outside of the Chainlink network, which would be forfeited through malicious activity. Therefore, for economically rational nodes, it is more profitable to be honest, which is why the honest majority assumption works for networks like Bitcoin, Ethereum, Chainlink, etc.

What you noted about the gold price feed from a year ago wasn't an attack on the network but a misconfiguration of a single feed that resulted in minimal issues. If tens of billions of dollars had been stolen as a result, the value of LINK would have certainly been significantly affected here, creating a financial penalty. The devaluation of the native token depends on the severity of the network issue/attack. The Chainlink network has been significantly hardened since then and uses an entirely different oracle network model, so such issues have not occurred since, but the security of the Chainlink network is not static and continues to evolve.

The Chainlink 2.0 whitepaper was recently published which modeled an explicit staking mechanism where nodes stake their LINK tokens in a service agreement and can be slashed for providing manipulated data. Here, a two-tier oracle network model is used, with a low-cost first-tier that continuously generates oracle reports and a higher-cost maximum-security second tier used for settling disputes, which creates a super-linear staking impact where the cost of attack is significantly greater (quadratic in the number of first-tier nodes) than the sum of all deposits within that network.

The first-tier consists of nodes explicitly staking LINK while the second-tier consists of the most reputable, reliable, and profitable nodes in the Chainlink network who have the greatest financial exposure to LINK and as rational economic actors resolve the rare disputes accurately in order to uphold the value of their LINK holdings, LINK staked in other first-tier networks, future LINK revenue, and individual reputation. The whitepaper goes much deeper into this mechanism than I can cover here, but this mechanism would provide slashing-based cryptoeconomic security in addition to the existing implicit incentives-based cryptoeconomic security.

research.chain[dot]link/whitepaper-v2.pdf

Thank you! I didn't assume that btw. And I still don't understand. If majority ~ >50% corrupted, then the minority forks the old chain to have the new chain and issue new tokens. I assume that the value of the new tokens = the value of the old tokens of the minority which is <50% of the old tokens market cap.

Cool proposal, and I think it could get some traction/ some decent usage for the UNI token, but I think it fails for the same reason Augur sort of hasn't taken off or Gnosis for that matter. The way I envision it working from vitaliks post would be:

• simple uniswap oracle (twap)
• if someone thinks it's corrupted, you can pay a fee to dispute the result
• goes to a 1 day vote
• if that vote is still wrong (or right), someone can pay more of a dispute fee to push it to the next vote (like a 2 day vote)
• the next vote costs more to initiate and is longer....and so on and so on eventually you have everyone in the system "staking" which is the right value (which is why the cost to break is 51% of the mkt cap)

I run Tellor and we use roughly the same thing. I think you could make the argument (like Gnosis did)...why not just use a bigger mkt cap coin of ETH? The reason is that you hope a community that votes and is active in what a "proper" value is will be a better oracle than just allowing ETH whales (exchanges) to control the vote.
Overall it never really comes down to these scenarios though. The real "oracle" problem is figuring out how to find the tradeoffs between speed, decentralization/liveness and slight manipulability (moving the price by 1%). The current Uniswap twap oracle really bangs on the first 2, but sort of falls sort on the last one. LINK rocks on 1/3 and others like Tellor find different mixes. Handling for the long tail of preventing 51% attacks of oracle coins is a job that should be done at the user level as there are a range of appetites depending on use case for waiting weeks vs liquidating or adding penalties.

I’m the co-founder of UMA. I think the ideas Vitalik presents here are very good.

Some context: UMA is based on Vitalik’s Schellingcoin idea from 2014. UMA implemented this idea because we think this is a critical piece of DeFi infrastructure, for many of the same reasons Vitalik already mentioned.

The UMA system has been in production for about a year now, and we've shown that this type of oracle design really does work in real life, for real world DeFi contracts.

A number of very smart folks (@g_dip, @Micah, adamscochran) have commented that the type of voting oracle Vitalik is suggesting doesn't work well with current DeFi design patterns. The biggest concern is generally around how to liquidate contracts if you have to wait for a price to get verified. UMA has spend the last ~2 years figuring this out, but we haven't done a good job communicating to the broader DeFi community how these "priceless" contract designs work.

What I would like to propose is that we (UMA) write a proposal for how a mature protocol like Maker or Compound could be written "optimistically" and be enforced with an UMA-like oracle system. This may be clarifying for this broader discussion, and help articulate the advantages of this approach.

Agree with the concept and importance here.

A few points to consider:

#1 - What can we expect users to responsibly and rationally dispute on:

#1A - Irrationality in dispute outcomes:

Even in cases like Augur where they have binary non-ephemeral outcomes (like who won the election) we've seen users dispute the outcome for far longer and to far higher a cost to them than is rational.

#1B - Exactness in ephemeral disputes:

Since oracles are commonly used for liquidation points, and each user has different positions on different protocols where collateral value down to the cent could mean the difference between liquidation or not, it seems likely that any average 'real world' price of the USD/ETH rate averaged from multiple sources (and excluding of spurious outliers) would still likely be contested at times when it is economically of value to that user.

Let's imagine a scenario where there are 10 price points being used, and 9 of them are $4000 - $4002 but one of them is at $3960, and the average price shows $3996.

A user in turn disputes the price, and argues the price of ETH was clearly $4000 and that the other source had failed to update, lacked volume, or simply wasn't representative.

Is that user right?

By the letter of the law, no.

But, by the spirit of what the oracle is supposed to represent? Maybe.

Oracles of non-binary outcomes should not expect that the vast majority of users act in a rational, letter of the law, technical code as law kind of manner. It's much more of a subjective jury trying to interpret "what is real and accurate as they understand it"

Given the points in #1 I think you likely don't want users being able to dispute the specific price. Instead the minimal governance path is probably the election and removal of acceptable providers.

Or, we need to begin to rethink not only how we think of oracles, but also smart contracts, and take a lesson from finance where we aren't just returning a single price and saying "this was the price in this moment" but giving an OCHL (open, close, high, low) bounds and letting defi contracts deal within a range.

#2 - How can disputes be secured and yet accessible?

#2A - Engagement vs Thresholds We can say that the cost to attack a system of disputes that involves staking requires a >51% of the token supply but this can be done of two ways:

A) Hard voting threshold conditions. B) Subjective voting threshold conditions.

In hard voting conditions we say that you must have >XX% token vote in favor of adoption of a change resolution for it to be enacted. This is commonly denounced in the token space right now because it sets thresholds that are too high and make it hard to enact governance change.

But, the flip side on the dispute case is >51% of votes in favor of the corrupt price for it to be corrupted, which is extremely secure.

The hard voting thresholds have some issues:

• They assume that all tokens still exist, are accessible and in circulation.
• They assume all tokens are held by individuals who are aware of their governance authority, obligation and have a willingness to participate.
• They assume that current holding of the token means a wallet is the token owner and has the right to vote with it (cough cough - exchanges)
• They assume that a token holder always wants the positive outcome for the ecosystem (cash and carry shorts, etc)
• In the event a bad actor needs to be removed from the system it creates an extremely high bar to enact.

In subjective voting thresholds we say, the majority out come of all voters who vote (usually over some small quorum threshold) decide the outcome. Most projects set that governance threshold far too low so that most of the time their day to day governance can be managed by the fractional set of users who actually become engaged.

In such a governance model, you'd likely want subjective threshold voting, but on a fairly high (but still accessible) minimum quorum. This should act as a model to motivate small governance itself where in disputes aren't for minor infractions or inaccuracies, but for clear malicious behavior and such the governance votes will only take place when it truly matters.

#2B - Incentive Models vs Demographics

Assuming that the desire is for a readable price feed, we would assume that elected producers are writing prices to the feed, paying a gas fee, and the read result is just returning the most recent price average.

As we've seen with Chainlink, this creates a set of sponsored feed providers who have some other broader ecosystem interest, such as exchanges and protocols.

This is not a bad thing per se, but it does create a poorly representative interests system.

If we ask ourselves "Could we imagine a scenario in which the price interest of exchanges (many of whom have futures) and defi protocols (who use collateral) could diverge from the interests of users (who have open those positions) by even just a few basis points?" the answer is yes.

It's entirely feasible that the interests of millions of dollars could be divided by such a small amount of market movement that it would be in the interest of a few providers to under report the price within an acceptable variance bounds so that it is almost undetectable or undisputable, but still meets their needs.

The penalty models of stake and slash producing, and of paying recurring gas fees make being a provider inaccessible for communities or users (whom to be fair, may lack the technical expertise to maintain an oracle provider). But it does create a lopsided interest group managing the price feed.

#3 - Liveness of dispute vs Liveness of outcome and how it can still encourage corruption:

As a final footnote, perhaps more for defi protocols than for the oracle itself, it raises interesting debates about a liveness/finality of oracles.

In either example, where users can dispute on producers or price, we run into this interesting condition of deciding "If a bad actor influenced the price in a corrupt manner, should protocols a) ignore it, b) settle it based on the report live price that as corrupt, c) settle it based on the outcome price after the dispute"

The only manner I can consider in which C) is possible is if a protocol held liquidations delayed by two days, which would take on a signifgant amount of risk.

So then this creates a state in which a protocol must subjectively ignore an oracle and is thus no longer centralized, or it must act on a corrupted price which will later be corrected.

Imagine we have an oracle feed in which two producers open up massive shorts across collateralized assets. In turn, they both report the ETH/USD price as $1 in a block. The system doesn't view it as outliers since there is more than one report (or whatever theoretical threshold) and inturn the Ethereum price massively under reports.

Being the most popular defi oracle service by a major provider, this sets off a cascading impact of liquidations and sells across the sector.

Users vote to contest the price and to remove the corrupt producers. They do so in a successful manner.

But, the corrupt actor still made off with their payday and users still suffered large losses.

Now this is an extreme theoretically and something that is probably a similar risk model with current day oracles, but if we are talking about designing a better governance minimized oracle, then it is worth considering how that is prevented.

Chainlink and UNI holder here

I disagree with people saying the Chainlink staking mechanism already solves what Vitalik outlines in his proposal. The CL 2.0 staking mechanism is clearly an improvement over their current system and a step in the right direction, but ultimately depends on the Tier 2 robustness, which as of right now and with the little information we have about it does not seem to offer the same cryptoeconomic guarantees than the mechanism proposed by Vitalik here (no Augur style token voting for tier 2), to the benefit however of a greater flexibility that this mechanism could not offer. Like mentioned in the proposal, different use cases = flexibility vs laser-focused. This might change with future development about Chainlink Tier 2, though.

And to answer Kiba’s point, I would think UNI is better for token voting as a large amount of LINK tokens would already need to be staked in DONs, requiring tier 2 operators to unstake their tier 1 tokens each time there is a vote, which would probably be an issue if they have to vote often (possible if they act as tier 2 for several tier 1s).

My doubts are more about time/ressource allocation, possible voters apathy that could be higher than we might anticipate thus decreasing the perceived amount of cryptoeconomic security, questions related to the collateral needing to be provided by liquidators, and also Micah’s points raised above.

I don’t have a strong opinion for now but I’m interested in seeing these details ironed out.

These two statements seem in opposition to each other:

If the main way to keep the system honest is coordinating hardforks that is a much more involved and energy consuming process for oracles than Chainlink's token slashing and reputation systems. This is one monolothic oracle network vs the isolated and customizable oracle networks of Chainlink so also less minimalistic from an architecture standpoint as well.

Your design works with LINK token as well which has a bigger market cap and would therefore be more secure so why not propose using that token?

Thank you! I didn't assume that btw. And I still don't understand. If majority ~ >50% corrupted, then the minority forks the old chain to have the new chain and issue new tokens. I assume that the value of the new tokens = the value of the old tokens of the minority which is <50% of the old tokens market cap.