Veil’s Framework: A Data-Driven Strategy for Asset Selection, Incentive Mechanisms and Privacy Considerations (MASP)

As Namada approaches its launch, it is important to select suitable assets for its shielded set to maximize privacy guarantees and ultimately try to boost user participation. This draft report aims to outline a data-driven strategy for asset selection, incentive mechanisms, and privacy considerations, all while trying to prioritize IBC-compatible, liquid-staked tokens.

This post includes a high-level framework, which uses a sample dataset applied to the framework for a single asset “A”. Images of our comprehensive, multi-asset findings are attached at the bottom of this post.

Objectives

  1. Asset Selection: Identify IBC-compatible, liquid assets, particularly liquid-staked tokens, that are suitable for inclusion in Namada’s shielded set.

  2. Incentive Calculation: Determine the appropriate amount of NAM token incentives required to attract users to deposit and maintain their assets in the shielded pools.

  3. Privacy Guarantees: Calculate the minimum quantity of each asset required in the shielded pool to provide robust privacy guarantees.

Potential Methodology (Asset Selection Criteria)

The goal was to develop a multi-factor scoring algorithm. We found the following potential variables to best suit our analysis.

  1. Liquidity (LQ): Average daily trading volume
  2. Market Capitalization (MC): Total market value
  3. Number of Holders (NH): Estimated unique addresses holding the asset
  4. Alternative Yield Opportunities (AYO): Average APY available elsewhere
  5. Unbonding Period (UP): Time required to unstake/unbond
  6. Transaction Velocity (TV): Average transactions per day
  7. Time to Liquidity (TTL): Ease of depositing into Namada
  8. Asset’s Role in Ecosystem (ARE): Importance within the IBC ecosystem
  9. Integration Complexity (IC): Technical effort required
  10. Liquid Staking Status (LSS): Whether the asset is a liquid staked token

We then assigned weights to each variable. This stage is slightly more subjective; we knew we’d most likely want to prioritize speed and simplicity, so Liquidity (LQ) and Liquid Staking Status (LSS) have the heaviest weights (15 and 20%, respectively).

  • Liquidity (LQ): 15%
  • Market Capitalization (MC): 10%
  • Number of Holders (NH): 10%
  • Alternative Yield Opportunities (AYO): 10%
  • Unbonding Period (UP): 5%
  • Transaction Velocity (TV): 10%
  • Time to Liquidity (TTL): 10%
  • Asset’s Role in Ecosystem (ARE): 5%
  • Integration Complexity (IC): 5%
  • Liquid Staking Status (LSS): 20%

Next, we collected as much sample (asset specific) data as possible to analyze in our system. The data used was clean data from the web via block explorers and various chain analytics sites. This is where we included as many IBC assets (stTIA, JUNO, etc.) and their corresponding variable data (LQ, MC, NH, etc.).

We then normalized each variable on a scale from 0 to 1 and calculated the weighted scores for each asset. As an example below, we will use the test data from Asset “A” to show how we make those calculations.

Liquidity (LQ):

  • Max LQ: $250M (A)
  • Normalized LQ = Asset LQ / Max LQ
  • Normalized LQ = $250M / $250M = 1
  • Weighted LQ = 1 * 15% = 0.15

Market Capitalization (MC):

  • Max MC: $3.5B (A)
  • Normalized MC = Asset MC / Max MC
  • Normalized MC = $3.5B / $3.5B = 1
  • Weighted MC = 1 * 10% = 0.10

Number of Holders (NH):

  • Max NH: 300,000 (A)
  • Normalized NH = Asset NH / Max NH
  • Normalized NH = 300,000 / 300,000 = 1
  • Weighted NH = 1 * 10% = 0.10

Alternative Yield Opportunities (AYO):

  • Normalized AYO = (Max AYO - Asset AYO) / (Max AYO - Min AYO)
  • Max AYO: 50% (C)
  • Min AYO: 10% (E)
  • Normalized AYO = (50% - 20%) / (50% - 10%) = 0.75
  • Weighted AYO = 0.75 * 10% = 0.075

Unbonding Period (UP):

  • Normalized UP = (Max UP - Asset UP) / (Max UP - Min UP)
  • Max UP: 21 (A, F, H)
  • Min UP: 0 (Liquid Staked Tokens)
  • Normalized UP = (21 - 21) / (21 - 0) = 0
  • Weighted UP = 0 * 5% = 0

Transaction Velocity (TV):

  • Max TV: 60,000 (A)
  • Normalized TV = Asset TV / Max TV
  • Normalized TV = 60,000 / 60,000 = 1
  • Weighted TV = 1 * 10% = 0.10

Time to Liquidity (TTL):
High = 1, Medium = 0.5, Low = 0

  • High = 1
  • Weighted TTL = 1 * 10% = 0.10

Asset’s Role in Ecosystem (ARE): For this example assume A is ATOM
Core Hub = 1, DEX Leader = 0.75, Derivative = 0.5, Infrastructure = 0.5, DeFi Platform = 0.5

  • Core Hub = 1
  • Weighted ARE = 1 * 5% = 0.05

Integration Complexity (IC):

  • Low = 1, Medium = 0.5, High = 0
  • Low = 1
  • Weighted IC = 1 * 5% = 0.05

Liquid Staking Status (LSS):

  • Yes = 1, No = 0
  • No = 0
  • Weighted LSS = 0 * 20% = 0

In this example the total score for A would = the sum of the weights: 0.15 + 0.10 + 0.10 + 0.075 + 0 + 0.10 + 0.10 + 0.05 + 0.05 + 0 = 0.725

We then complete the above calculation for each asset to get the score rank.

Determining Incentives to Deposit and Stay

We now want to determine the appropriate quantity of NAM tokens needed to incentivize users to deposit and keep their assets in Namada’s shielded pools. In simple terms, we need to think through what the user gives up, and what they are willing to risk to participate in the shielded pool. For ease of calculation and consistency of variables, we will refer to the “what the user gives up” as Effective Alternative Yield (EAY), and “what they risk” as Risk Premium (RP).

The full equation:

Required Incentive Yield (RIY) = Effective Alternative Yield (EAY) + Risk Premium (RP)

or RIY = EAY + RP

  1. Required Incentive Yield (RIY): Incentive required to be attractive (somewhat of a hurdle)
  2. Effective Alternative Yield (EAY): Underlying staking yield minus liquid staking protocol fees
  3. Risk Premium (RP): Additional yield to compensate for platform risk, assumed at 5%

In practice the calculation looks like the following:

Underlying Staking Yields and Fees (Asset A):

  • Underlying Yield: 20%

  • Liquid Staking Fee: 0%

  • RP (A): 5%

  • RIY = 20% + 5% = 25%

Now, we estimate the expected deposit volumes. We will use $8M for asset A as a very conservative assumption.

Next, we calculate the annual incentive amounts.

Annual Incentive = Deposit Volume × (RIY − EAY)

Where:

  1. Annual Incentive refers to the total incentive amount paid annually
  2. Deposit Volume is the amount of capital or deposit being considered (assumption)
  3. RIY is the Required Incentive Yield (which we know)
  4. EAY is the Effective Alternative Yield (which we know)

Annual Incentive = $8M * (25% - 20%) = $8M * 5% = $400,000

The total annual Namada Incentive budget would be (the above) equation + the sum of all other asset incentives. In practice incentives will most likely be paid out in some cadence (epoch).

Minimum Quantity for Privacy Guarantees (MVP)

Next, we need to calculate the minimum deposit (amount) requirements to maintain a comfortable or “strong” level of privacy. This took some external research, as we are by no means privacy experts, so please correct anything as you see fit.

Step 1: Set our Target k-Anonymity Level; k-anonymity is a property that ensures that any individual in a dataset cannot be distinguished from at least 𝑘 other individuals based on the information in the dataset.

Based on our search a reasonably high (entry) level of privacy has a target 𝑘 = 50. This means each record in the dataset is indistinguishable from at least 49 other records. A higher 𝑘 value generally implies stronger privacy protections, as it becomes harder to re-identify an individual. This target is commonly used in industries like healthcare to prevent re-identification of individuals from anonymized datasets, and could be suitable for private asset pools as well.

Step 2: Determine the Minimum Number of Transactions - We should aim for at least 50 transactions of similar amounts for each asset within the chosen time frame (e.g., one day).

Step 3: Now we can Calculate Minimum Pool Sizes with the following assumptions

  • Asset

We are still using asset A in this example

  • Average Transaction Size (ATS): Based on typical behavior

For asset “A” we can see from the blockchain data that 100 units is the Avg. tx size

Minimum Number of Transactions (MNT) × Average Transaction Size (ATS) = Minimum Pool Quantity (MPQ)

Ex. 50 transactions × 100 Avg units = 5,000 Total units

Based on our calculation we need a minimum of 5,000 “A” units if we average 50 transactions ~100 units in size per day to maintain target 𝑘 = 50 or greater.

Lastly, Step 4: Verify Against Expected Deposits - as an additional measure, we should double check that our Expected Deposit Volumes (EDV) meet or exceed the MPQ.

Asset “A”

  • EDV

$8M (per our volume assumption) / $10 per A (current market price) ≈ 800,000 “A”

  • MPQ: 5,000 “A”

Conclusion: Since our MPQ < EDV we can rest assured that our volume for asset A is likely sufficient for privacy.

Additional consideration - While the original approach was to derive privacy requirements based on the average number and size of transactions, we also considered the opposite perspective: what maximum USD value should the protocol guarantee can be transacted in a single transaction for each asset? To calculate this, we analyzed the average transaction size ($) and then estimated what might be considered a large transaction for each asset. For consistency, we applied a multiplier of 100x to liquid-staked tokens (given their typically lower transaction sizes) and 10x for all other assets. Using these variables, we calculated the minimum pool sizes, adding additional multipliers of 100x and 10x (for LST and others, respectively) as very conservative estimates.


A few resources we used if anyone is interested in diving deeper:

  1. Namada Blog: https://namada.net/blog
  2. Namada Specifications: https://specs.namada.net
  3. K-Anonymity in Privacy: https://en.wikipedia.org/wiki/K-anonymity
  4. K-Anonymity a Model for Protecting Privacy: https://www.worldscientific.com/doi/abs/10.1142/S0218488502001648

Multi-Asset Findings

5 Likes

Couldn’t ETH or Lido’s stETH be used in the shielded set? Also, BTC could potentially be used via Babylon or Zenrock? I already mentioned this before in the forum.

Moreover, of course NAM cannot be evaluated against your criteria because the NAM token hasn’t been launched yet, but I am assuming of course that you are suggesting also NAM as the first asset in the shielded set with the largest incentives as well. I mean we want to incentivize people holding NAM and participating in the shielded set the most, we don’t want to incentivize holding stOSMO, TIA or similar more than NAM, this seems something obvious, we need to first prioritize NAM for the simple reason that for this whole system to work we need to boostrap security from 0, and boostrappring security is a hard problem, also for Bitcoin and Ethereum when they launched, and it is a problem for every newly launched Cosmos chain or other L1s. Precisely the problem that ethereum is trying to solve with fraud proofs ready rollups is allowing new L2s to have the security of ethereum so they don’t need to bootstrap security, same applies for Celestia rollups when/if they can solve fraud proofs. So, since Namada is launching from scratch as L1 and not using the large security of another L1, it is critical to quickly bootstrap a large security, which is measured by the value of staked NAM and hence the value of NAM. So, incentivizing NAM and trying to increase its value and demand it is equivalent to trying to increase and bootstrap the security of the whole Namada ecosystem

1 Like

Nam is already shielded no ?

great write-up team. have a few left curve questions.

  • how does methodology perform against historical data like Tornado Cash or Aztec. (historical data points may be useful for testing assumptions)
  • is unclear why the variable weights were chosen? (what is the intuition?)
  • what is the correlation between these variables?
  • can u link to data or research which says k = 50 is a viable entry-level target?

Overall, framework is helpful. But is difficult to understand its potential effectiveness in predicting Minimum quantity for privacy guarantees without understanding the reasoning by the assumptions in the framework.

also

where is wrapped wrapped steth gonna come from? osmosis? Lido is centralized entity owned by vcs, we should not support that cartel. wrapped wrapper reth prob better for nuetrality, security, values maximization imo.

security derived from people running boxes not value of stake.

Easiest way would be just choosing 10 top ibc supported cosmos coins from coingeiko too.

1 Like

Top Cosmos Ecosystem Coins by Market Cap | CoinGecko

Totally agree and supporting your point of view . NAM should be the first asset in the shielded set with the largest incentives.

1 Like

send NAM to 0. the purpose of the protocol is not to be NAM centric.

Who is going to run the boxes that secure the protocol when NAM is 0?

1 Like

altruists who want privacy for their assets. many such cases. almost every chain in cosmos is pure altruism, nothing is profitable.

What I meant is, ETH and BTC are the biggest and best assets obviously for the shielded set. The security guarantees depend on the value of assets deposited on the shielded set, hence, if we manage to bring ETH and BTC this would definitely maximize the security guarantees by far. I mentioned Lido’s stETH since it is a liquid staked version of ETH, otherwise to incentivize unstaked ETH the reward of the shielded pool should be higher than the ETH staking rewards?

Come on, the security in PoS L1s is the value of the tokens staked, of course also the decentralization of this stake. Namada uses the tendermint/CometBFT consesus, if someone buys 1/3 of the tokens they can halt the network. If the price of NAM is very low then easier to buy 1/3 and halt the network, let’s analyse security from first principles and the tech behind Namada

2 Likes

Oh my god really incredible to read this seriously. Do you understand the following points?

-Namada needs to BOOTSTRAP ITS SECURITY, it is not an ethereum L2 rollup in the future with fraud proofs, also not a polkadot parachain or a consumer chain of the cosmos hub
-To bootstrap its security Namada needs to have a decentralized validator set, a decentralized staked distribution and a high value staked which means a high value of NAM

Do you understand from where the value of bitcoin comes from? From its security. What is the security of bitcoin? Its hashrate, which protects bitcoin from reordering previous blocks and transactions. In PoS there is no hashrate, the security in PoS systems with tendermint/cometBFT consensus comes from the difficulty for an attacker to control/buy 1/3 of the stake value (like the 51% attack). If the value of NAM is in the billions $ then the staked value is very high, expensive to buy 1/3 of staked NAM and hence high security. If the marketcap of NAM is very low, then easy to buy 1/3 of supply and attack and halt the network

You cannot have privacy without NAM in the billions $ marketcap. If Namada is not secure and with a very low marketcap then it would be very easy to attack and not secure. Even the biggest stress for Satoshi Nakamoto was bootstrapping the security of bitcoin initially, he even had powerful hardware ready in case he had to defend the network initially from attacks while bootstrapping the security

  1. where is the eth and btc coming from? will be wrapped at least twice BTC<>cosmos chain <> Namada. no direct connections. same with ethereum.
  2. economic security is a meme. not real. only about people running boxes. study solana founder thesis, toly correct.

yes you can. show an example of a chihuahua chain dishonest majority attack.

One concern: in case NAM becomes eligible for Shielded Rewards, then shielding NAM will compete with securing NAM, since you can only stake NAM from a transparent address.

If you get 6% interest for holding NAM in the shielded set and 10% for staking, then the shielded set will be empty (unless you want to pay a premium of 4% for unlocked tokens).

If you get 10% for holding Shielded NAM and 6% for staking, then the network will not be secured.

If the staking reward rate is equal to the shielding reward rate, then since staking has an unlock period, people would prefer shielding.

So we would have to determine an optimum reward rate balance while the parameters are valued subjectively. Seems difficult.

A pity that shielded staking is not possible.

1 Like

Have you heard about Zenrock for example? They are using decentralized MPC with mainnet in Q4 to replace WBTC, also Babylon could offer Namada shielded set for the BTC depositors, it could be direct connection since Namada uses IBC like Babylon or Zenrock. For Ethereum, I believe native IBC connection to ethereum is about to be ready and Namada is building also a trustless ethereum bridge

chihuahua and similar chains are so irrelevant and low value that attackers don’t even bother to attack them. But when you have institutionals planning to move millions or billions in value you can be sure they will very carefullly look at the security. I mean look at Arbitrum or Optimism, even ethereum L2s are already bigger than many L1 and this is because projects are expecting L2s to have soon full fraud proofs and inherit the full security of the ethereum L1, then they feel confident to move large value through ethereum L2s

1 Like

Easy, Stride already announced a collaboration with Namada. People stake NAM, get stNAM liquid token and put stNAM in the shielded pool and earn the staking reward and shielded pool reward

2 Likes

I am of the opinion, that (plain) NAM should most certainly be included in the shielded rewards set. I would also ask for clarification from Veil/team if NAM is considered excluded from shielding rewards by this proposal, or if it’s simply a non-addressed issue.

-preto

2 Likes

Shielded stNAM is not the essential shielded NAM though.

Without incentives, there will not be a sizeable shielded set.

Without a sizeable shielded set, an asset cannot be protected effectively.

In order to protect other IBC assets, NAM needs to be protected too, otherwise the gas fee transactions will leak information about the origin of those IBC assets.

Therefore, NAM needs an incentivized shielded set.

The lack of natively shielded stakeable NAM is a risk for both the security of the protocol and the effectiveness of shielding. If the reward rates become too unbalanced, people will choose one or the other. The staking reward rate and the shielded set reward rate would have to be continuously balanced against each other. Both are already targeting ratios with PD-controllers. Namada Specs - Inflation System However, there are possible adverse effects.

  • Having to choose between staking or shielding, the rewards may not outweigh the opportunity cost of locking NAM. In fact, staking NAM with Stride and shielding stNAM competes with shielding NAM. The reward rate for just shielding NAM is almost guaranteed to be lower, which means the shielded set would be empty if every participant behaves financially rational.
  • Even if shielding and staking are balanced, both would benefit from native shielded staking. Let us say 50% of supply is staked and 50% is shielded. With native shielded staking, 100% is staked and 100% is shielded, doubling the effectiveness of both.
2 Likes

I think for this Osmosis is a very good example to analyze @ValarDragon. So Osmosis initially had a very low staking ratio, this is because there were many LP pools on Osmosis with very high incentives, more than the staking rewards, so many people preferred to use OSMO for LPing rather than staking (https://youtu.be/qlnjQ6V4LwM?si=vwGK3aoUatcdY7W5), still there was a good staking ratio and security, not 0 as you suggest, just much lower than other Cosmos chains, around October 2021 several months after launching the staking ratio was around 28% although the most important for the security is not the % but rather the economic value at stake, for example if only 20% is staked meaning 200M NAM and NAM price is $3 that’s $600M economic value, if 60% is staked so 600M NAM but the NAM price is $0.5 then the economic value would be $300M or half, meaning that for the economic security the value of NAM is as important if not more than the staking ratio %. Staking also had some additional benefits like potential airdrops, and more battle tested system than the new LP pools on Osmosis at that time which may explain why the Osmosis staking ratio was low but far from 0.

Superfluid staking is the reverse direction of liquid staking, instead of starting from staking and then go to DeFi, you start from DeFi (LP pools on Osmosis or shielded set in Namada) and go to staking.

In Osmosis initially it was clear that the staking ratio was much lower than other Cosmos chains, because users could choose between staking rewards and LP rewards, but although low it wasn’t 0 which is your suggestion. An important detail also is that for LP in Osmosis there were different unbonding periods also including one of the same length as the Osmosis unbonding period for staking, while for the shielded set there is no locking which means I’m not sure something like superfluid staking is possible on Namada. Let’s analyse 3 scenarios:

  1. Staking rewards for NAM > shielded set rewards for NAM
    -If the difference is not sufficient or there are additional benefits like potential airdrop for staking NAM or similar, people may still prefer the shielded set without the locking of NAM
    -But here liquid staking helps since users could earn both staking rewards and shielded set rewards
    -You liquid stake NAM means the liquid staking providers will stake the NAM and give you the stNAM. You can then put the stNAM on the shielded set. And then with other assets also in the shielded set both LSTs or unstaked tokens the privacy guarantees will be high and people could use the shielded set for shielded actions (Stride protocol integrating with Namada to build onchain data protection solutions – Stride Blog). What Stride explained in that blogpost is that for unstaked assets people need to choose whether to stake or use the shielded pool, while for liquid staked assets they can choose both. The point of liquid staking is allowing users to participate in staking and also in DeFi
    -Something like superfluid staking althougn doesn’t seem possible without a locking period in the shielded set

  2. Staking rewards for NAM < or = shielded set rewards for NAM
    -In this case it is likely most will choose the shield set for rewards
    -This should be avoided because while for the shielded set there will be many assets deposited and not just NAM to increase the privacy guarantees, for the security of the Namada L1 itself only NAM can be staked. And the priority is high economic security of the Namada L1 and then also a lot of assets deposited in the shielded set. I don’t think it makes sense to have a lot of assets deposited on the shielded set while a very low security of the Namada L1?

What do you mean by essential shielded NAM or native shielded staking? I see the possible actions as follows:

-Staking NAM for the security of the Namada L1 chain and earns the staking rewards while locking the tokens for the 14 days unbonding period
-Liquid staking NAM and receiving the LST stNAM, earning the staking rewards without the unbonding period
-Adding NAM to the shielded set and earning the shielded set rewards with the tokens unlocked
-Adding stNAM to the shielded set and earning the staking rewards without unbonding period + shielded set rewards with the tokens unlocked

Then users can use the shielded pool to get privacy for their IBC assets to perform shielded actions. Native shielded staking sound a bit like the idea of superfluid staking in Osmosis, allowing users to participate in LPing while also being also to stake part of their tokens. Instead of liquid staking tokens and then participating in DeFi, what Osmosis did was, you participate first in Defi in Osmosis LPing and then from here we allow you to stake part of the tokens, they called this superfluid staking but as mentioned I don’t think this is possible on Namada without a locking period on the shielded set

1 Like

What do you mean by essential shielded NAM or native shielded staking?

As is also explained in the Stride blog post, Namada “needs lots of liquidity in its multi-asset shielded pool. Due to the way the Namada ZK circuits work, the more assets shielded in the pool the greater the data protection for everyone. {…} Namada’s data protection guarantees improve as more assets are shielded at rest in the shielded set.” If I understand correctly, Stride has its own pool. If NAM tokens are locked in Stride’s pool, then they are not in Namada’s MASP where they would improve data protection.

Native shielded staking is delegating shielded NAM to a validator (like from a spending key). I am not sure if that is technically possible considering the way Namada’s shielding is designed.

The point of liquid staking is allowing users to participate in staking and also in DeFi

Your post made me realize there is an obvious (how could I have left it out?) third competing use-case, namely transacting, including shielding and unshielding, paying gas fees, trading and DeFi. In case of staking and shielding both tokens are at rest, rather than actively used. If staking and shielding rewards are higher than what can be earned through active use, that puts a brake on network activity. And vice versa, if there are more opportunities through for example trading, then the TVL in the staking and shielded sets will decrease.

still there was a good staking ratio and security, not 0 as you suggest

Yes, I have to go check if the first possible adverse effect I posted is actually true. When the number of tokens in the shielded set decreases below the target, the PD-controller gradually increases the reward rate. The inflation Namada pays for rewards is limited to 10% per annum, that is, 10% of the supply, not 10% interest on the staked or shielded tokens. If the amount of tokens in the set is far below the target, Namada’s effective reward rate could temporarily increase to more attractive levels than Stride’s.

1 Like