CIP Stake Decentralization: Using Pledge as a Bidding Parameter to Determine Saturation Limit

Dear Community,

Greetings to everyone!

I am relatively new here, and this is my first time posting on this platform. So, I hope everyone will forgive me for my shortcomings. I have written a proposal that may potentially solve the ongoing stake centralization, and a copy of the proposal is provided in the link below. I am eager to hear your opinion, and I wish you all well!



welcome @jcamp … very interesting; thanks for preparing & posting this here :sunglasses:

1 Like

Thank you for the warm welcome, @COSDpool!

1 Like

well written. would definitely be in favor of this. the equation just makes more sense that way wit all variables accounted for, also in theory i would think it should stabilize rewards, or make them more consistant PE? please correct me if i am wrong. man if i could just write my ideas into a format such as this…

1 Like

Hey @RJ.adapptation, thank you for your kind words! The optimal pledge is the glue that binds things together as heavy penalties are imposed on pools that cause the ecosystem to significantly drift from its optimal pledge. So, yes! You are correct in saying that the proposed mechanism may potentially bring stability to rewards. Thank you for your feedback!

I am finding it a little difficult to understand your motivations from the article.

For example there is this quote:

However, an over-pledged pool is penalized with an exponential decrease of its saturation limit.

So in your system, more pledge is not always better. That seems a little counter productive to me since pledge is “skin in the game” for the stake pool operator. Note that I will concede that it might be a good idea to limit the benefits of pledge over a certain level in order to limit the power of OGs with the most pledge available. However, I don’t think it is a good idea to somehow turn pledge into a negative factor even at any level.

Furthermore, I would point out that pledge and stake are interchangeable since stake pool operators stake to their own pools and they can easily split wallets to apportion pledge vs stake as they see fit.

Maybe I am misunderstanding your motives?

1 Like

Hi @7.4d4!

Thank you for spending some of your time reading my proposal, and I appreciate your feedback! Sorry if my reply is too long!

Pool over-pledging is not penalized when the whole ecosystem itself is not over-pledged (i.e., ecosystem average pledge <= optimal pledge). We encourage that the ecosystem average pledge = optimal pledge because under this condition, all ADA in circulation has just enough pools to stake to without risking oversaturation. Notice that I highlighted “just enough”. This is because an exuberant saturation limit can be exploited and can lead to centralization as I pointed out in the introduction of my proposal. However, if there are just enough total saturation limits, stakes will be distributed fairly in proportion to pledges.

The penalty (a decrease in saturation limit) on over-pledged pools is only imposed when the ecosystem itself is over-pledged. The reason is so that:

the sum of all pools’ saturation limits will always be equal to or just a little more than the total ADA in circulation (we can call this a close system). To achieve this, we must deduct some portion of the saturation limit from over-pledged pools and redirect that portion to under-pledged pools if these under-pledged pools so desire to acquire more saturation limits by increasing their pledges to optimum pledge. In other words, under-pledged pools are simply taking back the saturation limits borrowed by the over-pledged pools. In this manner, the ecosystem always maintain “total saturation limit ~ ADA in circulation”. This mechanism prevents anyone from getting way ahead of everyone unless small pools voluntarily give up their right to optimal saturation limit by under-pledging.

In addition, yes I do realize that some pools split their ADA into pledge and stake. It’s only a matter of how we define “pledge”. Do we define “pledge” strictly as pledge or as pledge + stake? I will leave it up to IOG if this proposal gets through the hurdles.

Lastly, here I am trying to prove mathematically that equation 3 leads to a close system. I think the second factor in the second term (green text) is flawed, and I am working on it. But I would really appreciate it if someone can provide the correct factor, especially with accompanying proof.

Thank you!

As I said above: More pledge is a good thing. It indicates skin in the game. I can accept that it might be necessary to put an upper limit on pledge benefit, but I cannot accept that there could be any scenario where having more pledge could have a negative effect.

In any case, causing some negative effect for higher amounts of pledge would be ineffective because:

  • It is not possible to tell if a pool operator is staking to his own stake pool in addition to his pledge.
  • It is not possible to tell how many wallets he has nor what proportion of his total Ada is in each wallet.

Thus the pool operator can just convert pledge to stake to be optimised for your rules and/or create multiple pools with optimised proportions.

Hi @7.4d4,

Thank you for the feedback!

I guess we are interpreting “penalty” slightly differently. So, I’ll just have to give you a very simple example:

Alice, Bob, and Charlie are pool operators, and each is entitled to 3 saturation limits (SL, ecosystem has a total of 9 SL). However, they need to make a pledge to get any SL in a 1:1 ratio.


a) Alice pledged 1, Bob 3, Charlie 3 (ecosystem is under-pledged).
b) Alice maintains pledge, Bob adds 1, and Charlie also adds 1 (ecosystem in equilibrium). Alice can still pledge to gain more SL because she is under-pledged, but any additional pledges from Bob and Charlie will no longer give them any more SL.
c) Alice decided to pledge 2 more. So, Bob and Charlie need to return 1 SL each to Alice (Bob and Charlie were “penalized” because the ecosystem is over-pledged). Now, Alice has 3 SL, Bob 3, and Charlie 3.
d) Additional pledges from Alice, Bob, and Charlie will no longer allow them to gain any more SL nor will it decrease their current SL.
e) Under the new proposal, the only way Bob and Charlie can take away some of Alice’s SL is to set up more pools, but the expense/SL ratio will make such a strategy unrewarding as discussed in the document (a moneyed operator need a combined pledge in millions, in fact, to gain any substantial SL).

Let me know if this helps. I may need to re-word a portion of the document to properly reflect the idea in the example given above. Thank you!

Hey everyone,

I finally found the correct penalty factor that will guarantee a close system. I included its complete and easy-to-follow derivation and logical proof.

I hope this proposal if implemented, will finally solve the ongoing stake centralization.


1 Like

yes i agree about the glue aspect. which is why when i start my pool i will have all proceeds minus operation cost alone go directly to my pools pledge until i reach at least 100k ada pledge. im just a blue collar pee-on so that is quite a bit of cheddar for me to invest in something. however i believe that this mechanism and its constituents wil change the way the world uses money.

Hey buddy, thanks for the support! I even have less ADA than you have. I bought near the top, but I ain’t selling! :sweat_smile: WGMI!

I think I am beginning to understand your proposed scheme better.

In the example you provided above, Bob and Charlie get penalised because they have pledged more than Alice. However, if they split their pools to have the same pledge amount as Alice per pool then they won’t get penalised.

You probably need to explain why this pool splitting strategy would be unrewarding. In the example you gave, if Bob and Charlie maintain their pledge level per pool to be the same as Alice, then they could just run multiple pools at this pledge level. Then if Alice increases her pledge, she would get penalised rather than Bob and Charlie.

Consequently this scheme would result in a race to the minimum pledge level that is cost effective to maintain and operators will just spin up many pools at this pledge level.

At the end of the day, if you do succeed in inventing a scheme that relatively disadvantages large Ada holders, then they will just move their capital elsewhere. Such an outcome would not be beneficial for Cardano.

Think of it this way: If a new billionaire decides to adopt Cardano, you actually do want there to be a continual advantage for him to convert more of his capital. If there is only high benefit for the first million and declines after, then he will put his other 999 million into some other crypto. He will just do the cost-benefit analysis to determine the split. Is that the outcome you want to achieve?

Whether talking about stake pool operation, voting power, or general economic power, the broader philosophical question is: How to limit the power of the most wealthy? I think a better way to deal with this is with something like “Multi-resource blockchain consensus”. See the Minotaur paper:

Even in this Minotaur paper, benefit still increases with increasing proportion of a particular resource. But, total power is limited by using multiple resources for the consensus algorithm.

Hey @7.4d4 ,

You raised a really good point here, and I’m liking how deep your analysis is. You are right! The more pools, the lower the optimal pledge would be. However, this does not mean that it is going to get cheaper for MPOs.

Let’s calculate and use some real numbers:
An MPO currently has 60 pools and controls 2.8B in ADA. If he wants to keep operating all 60 pools, it will cost him 2.8M in total pledge, but he is only going to capture 6.3M in stake.

To capture almost all of his current stakes, he needs to set up 265 pools. This increase in the number of pools will lower the optimal pledge to 45.2K and decrease the saturation limit to 9.75M. This means that SPOs will lose about 7.8% of their saturation limit. However, this MPO has to pay 12M (323% increase) in pledges to keep 2.58B in stake (75% increase). As the number of pools increases, this MPO needs to set up more pools and put up more pledges just to keep most of his stakes. It won’t get cheaper for him as the number of pools increases.

Going back to our Alice, Bob, and Charlie example: Yes, Alice’s saturation limit decreases as Bob and Charlie create more pools. However, the proposed mechanism would not make it cheaper for Bob and Charlie to do so, as outlined above. It will actually be more expensive to run multiple pools under the new mechanism.

We do want the millionaires and billionaires to invest in Cardano, and there are plenty of ways they can do so, i.e., dapps, dexes, defi, among others. What we don’t want is for a few entities to have a significant influence on the very aspect that secures the Cardano blockchain. We actually want the staking mechanism to be almost fully controlled by middle-income operators because 1) individually, they do not have the capacity to overpower anybody, and 2) they are more likely to secure the very source that provides a decent income stream for them.

Thank you for providing the link to the Minotaur paper. I will definitely read it at some point!

Hmm, this is only targeted at MPOs that get their power from other people delegating to them.

Binance totally controls the ADA parked with them. For them, it does not matter if you call it pledge or stake.

They can fire up as many pools as needed and completely saturate them and if they have to label some of that stake as pledge (or remove that label again) to get the optimal result, they can just do that instantaneously.

Hey @HeptaSean,

Thanks for dropping by, and you brought up a really good point here.

What you just said is very true at the current condition. However, as Cardano attracts more and more dapps, dexes, and users. We are not only going to be talking about 3K operators but 10s of thousands. At around ~10K operators, an MPO that wants to keep his 2.8B ADA needs to maintain around 800-900 pools. He may still be able to manage this large number, but it is likely to take a huge amount of expense, i.e., computers, infrastructure, and employees. This is aside from the fact that he needs to pay his delegators. In essence, the proposal inherently imposes an expense for anybody who wants more of the stake.

At 10K operators, the saturation limit would be around 3M. This number, although lower than the 10M when there are only about 3K operators, is still better than the amount of stake that a vast number pools currently has. This decrease in saturation limit is compensated by the increase in transaction volume - the more dapps, dexes, defis, and users, the more blocks to produce. So, from the perspective of a middle-income SPO, this is still going to be a profitable enterprise. And because stakes are likely to be evenly distributed under the new proposal, the profit is highly stable and predictable.

Hey @HeptaSean and @7.4d4,

My CIP (CIP-0045? | Pledge-Based Saturation Limit Under a Closed System by jycappucino · Pull Request #229 · cardano-foundation/CIPs · GitHub) is up for review on Tue. I was reminded of your comments when I read a thread in this forum that multiple pools can actually be created using just one hardware. When I formulated my CIP, I was under the assumption that 1 hardware = 1 pool.

I feel that being able to create multiple pools on one hardware maybe the Achilles’ heel to decentralization. That any proposal to improve decentralization would prove to be ineffective because of the weakness I just mentioned. So, to compliment my recent CIP, I was planning to create a new one outlining how 1 hardware = 1 pool can be imposed. The idea runs like this:

  1. A software, installed in the pool’s hardware, designed to collect the PHYSICAL MAC addresses of the hardware may be used.
  2. the software generates a single hash for the collected addresses.
  3. the hash is then used to authenticate pool identity (maybe as part of KES key/VRF key/metadata/certificate for example). Therefore, one hardware = one hash = one pool.
  4. if the operator adds another network interface card to his hardware (hence a new additional MAC address if I am not mistaken), this addition will change the hash of the hardware and therefore will invalidate the pool because this is tantamount to tampering.

The Cardano network need not be concerned whether the set of MAC addresses are fake or authentic. The hardware just has to have the same set of MAC addresses throughout the pools’ operation. Otherwise, if one of the addresses is changed or if another address is removed/added (fake or not), the hash (proposed above) for the hardware’s set of addresses will change. This will then invalidate the pool because this is tantamount to tampering.

Would love to hear your expert opinion on the matter. Thanks!!!

As @COSDpool already partly told you in

Trying to force pools to fingerprint their hardware to ensure uniqueness, to make starting up new pools “expensive enough”, does not seem effective to me at all.

Just two reasons:

  • Virtualisation: A lot of pools will already run on virtual machines, because the majority of network servers are virtual servers nowadays, anyway. But the virtual hardware and its fingerprint will not change at all if you put another virtual machine next to it on the same hardware and it will also not change if you put 100 virtual machines next to it. (If I wanted to start a sybil attack based on lots of pools, I would patch the cardano-node software, so that they can all share the same database, though, drastically reducing the cost of additional nodes.)
  • Patching the software: Your proposed hardware fingerprint would have to be done by the node software. But we can hardly control, which software runs on the nodes. They could just patch it to always return the “correct” fingerprint. And, in the future it should also be possible to run alternative implementations of the protocol. The security should never depend on a specific software executing the protocol, but always only on the protocol itself.

Got it, and thanks for your input. I got no good idea to counter your arguments. So, I guess the CIP will only affect the public pools but not those who have full control of their ADA (Binance for example) simply because of the problem with pool splitting. However, creating more pools would also mean increasing total pledge, and this is the mechanism that may be enhanced in the CIP to counter pool splitting.

If someone can solve pool splitting, he solves decentralization. This is my impression.

Thanks again…

1 Like

I don’t disagree.

I think it is impossible to prevent splitting or countless pools on the same hardware. A single instance of a custom patched version of Cardano node could create blocks for hundreds of different pool keys. If you wanted to use MAC addresses I would create as many virtual network devices with different MAC’s as needed.

The approach I wrote into CIP-50 for enforcing Sybil defense was a pledge leverage limit. The total pledge of a group would limit the total delegation a group could attract in one or more pools.