Veil’s Framework: A Data-Driven Strategy for Asset Selection, Incentive Mechanisms and Privacy Considerations (MASP)

Mainnet Ops
21

Here you are very confused. Stride has no MASP, Stride is a liquid staking protocol. The way it works is, you have some NAM, then you can go to Stride and liquid stake this NAM via Stride. Then Stride will stake these NAM natively to Namada validators and give you the LST stNAM. Then, if stNAM is approved by governance in the shielded pool, you can go ahead, deposit stNAM in Namada’s shielded pool, contributing to the privacy guarantees of Namada and in doing so, you earn both the staking rewards for natively staking NAM plus the native Namada shielded pool rewards.

What difference this makes? If possible better privacy for the staker, but you are still staking NAM and getting the NAM rewards. But this could be a new idea, @Stride could it be possible something like ‘shielded liquid staking’ combining Namada and Stride?

When I said staking and DeFi I was referring to sources of yield, not use cases. I don’t see any yield possible from transacting NAM or shielding NAM, and other use cases? In all PoS networks the yield is from staking and DeFi and I never saw any network were 100% of supply is put into staking and DeFi, there are many risks involved in locking tokens and similar, some people more risk averse may want to invest or use some network without wanting to participate in staking or yield. Moreover, Namada has a mechanism in place like most other PoS network for the inflation mechanism (I think similar for the MASP rewards too) than once staking ratio go above a certain value the inflation starts decreasing, the further it goes from the target staking ration the faster it goes to 0, this ensure an equilibrium around the staking ratio target, that’s what most/all PoS networks do with a target staking ratio around 60%

There are many ways of trading, traders could go to a perps exchange with USDC to trade NAM, without needing the underlying NAM asset. In fact, derivatives exchanges have the highest trading volume by far. And since the target staking ratio I think is around 60% there will be plenty of NAM available to trade

This is the mechanism also to keep the target staking ratio.

What do you mean by this? As mentioned above, Stride has no MASP. Stride just takes unstaked NAM, gives you the LST stNAM and they stake the NAM, they don’t give any rewards, you get the staking rewards via stNAM and if you want to get also the shielded set rewards then you can put the stNAM in the shielded pool

1 Like
22

Here you are very confused. Stride has no MASP, Stride is a liquid staking protocol. The way it works is, you have some NAM, then you can go to Stride and liquid stake this NAM via Stride. Then Stride will stake these NAM natively to Namada validators and give you the LST stNAM.

I am certainly not confused. NAM supplied to Stride will not be shielded, but staked. Staked NAM cannot be shielded and shielded NAM cannot be staked, because staking has to be done from a transparent address. Shielded stNAM cannot function as a replacement for shielded NAM’s “blending into the crowd” mechanism, because stNAM is a different token from NAM. The result is that the potential size of the “crowd”, the NAM shielded set, shrinks when staking with Stride is more lucrative.

Remember that NAM is a special case, since it is Namada’s native transaction fee token, and stNAM is not.

What difference this makes? If possible better privacy for the staker, but you are still staking NAM and getting the NAM rewards.

To simultaneously increase the shielded set and the proof-of-stake pool, instead of having to pick one over the other.

But this could be a new idea, @Stride could it be possible something like ‘shielded liquid staking’ combining Namada and Stride?

In that case Stride would have to shield NAM on behalf of the user and give staking rewards on top of Namada’s shielded rewards. How would Stride finance those staking rewards though?

1 Like
23

Let’s say initially only ATOM is approved by governance for the shielded set rewards. Are you implying that in this case only ATOM can benefit from the MASP and get privacy, and no other IBC asset? This is not how I understood MASP, my understanding is that some assets are incentivize to be added to the MASP to increase the assets in the MASP and the overall privacy guarantees, but then any IBC assets can use the MASP for privacy, not only the few assets incentivized in the MASP is this correct? @cwgoes

If my understanding is correct, then it doesn’t matter whether you add NAM or stNAM in the shielded set, both would contribute to the overall privacy guarantees and you could use the MASP to get the same privacy for NAM or stNAM. Otherwise, according to you, if for example in the MASP 20% is ATOM and 80% INJ, then only ATOM and INJ can get privacy and INJ gets 4x more privacy? I don’t think this is how the MASP works

How can you participate both in staking and shielded pool if not using some liquidity provider? With NAM you can only stake or deposit in the shielded pool. But with stNAM you can do both

By shielded I meant privacy in the process of liquid staking. Stride doesn’t give staking rewards, Stride stakes NAM on behalf of users and gives them a staking derivative called stNAM that if approved by governance users could then deposit also in the shielded set

1 Like
24

Let’s say initially only ATOM is approved by governance for the shielded set rewards. Are you implying that in this case only ATOM can benefit from the MASP and get privacy, and no other IBC asset?

Indirectly, because there is no financial incentive for token holders to keep tokens that are not eligible for shielded rewards in the shielded set. Because of the opportunity cost, they would rather stake or trade those non-incentivized tokens elsewhere.

if for example in the MASP 20% is ATOM and 80% INJ, then only ATOM and INJ can get privacy and INJ gets 4x more privacy?

Okay, now I understand where you are coming from. Yes, through chain analysis there is bigger chance of deducing who moved which tokens if the shielded set is small. But also the transaction volume. That is why Aztec’s zkPay used to visualize their transaction batches as a crowd of people where you try to blend into, and depending on the size and the circumstances you could stand out too much.

Now I read in the documentation the following line that insinuates the MASP is one amorphous blob. In that case I can see why you would suggest it does not matter which assets are in the MASP, just the total amount of them. Following that logic I can see the benefit of shielding stNAM.

All assets in the pool share the same anonymity set – meaning that the more transactions are issued to MASP, the stronger the data protection guarantees for all users.

If you bear with me for a moment that stNAM cannot fulfill the role of NAM in the MASP, I can answer the next question:

How can you participate both in staking and shielded pool if not using some liquidity provider? With NAM you can only stake or deposit in the shielded pool. But with stNAM you can do both

Penumbra supports native shielded staking. The reasons and explanation are explained in this blog post:

https://penumbra.zone/blog/shielded-staking-on-penumbra/

2 Likes
25

But the MASP purpose is not to reward tokens deposited, but to provide privacy right? Like if AKT is not incentivized to deposit in the shielded set, people will still want to use the MASP for privacy, that’s already a value for them. The incentivized assets are just to help increase the privacy guarantees of the MASP

Yes I was getting confused already. If you have ATOM, NAM, INJ, stNAM incentivized, ok people deposit these assets into the MASP and all of these assets contribute to the overall privacy guarantees. Then any IBC asset can benefit from this privacy. So, if you have NAM, you liquid stake via Stride, get stNAM and put the stNAM in the shielded set. You will get the staking rewards, the shielded set rewards, you will be contributing to the security of Namada with staked NAM, and to the privacy guarantees of the shielded pool with stNAM deposited. Then someone with AKT or other IBC assets can use the MASP for privacy. The incentivized assets in the MASP are to increase the overall privacy for all IBC assets that can then use and benefit for the MASP

Shielded staking just means you stake with privacy doing the staking. It doesn’t mean you earn the staking rewards and shielded pool rewards like with stNAM, it means you earn only the staking rewards in Penumbra but just that you did the staking privately

‘First, without private staking, holders of the staking token would have to choose between maintaining privacy or helping to secure the network’ maybe you got confused by this sentence in the blogpost, when they said betwen privacy or staking, they meant between not staking and keeping privacy or staking and losing the privacy. Then they mention that in penumbra they can stake privately. But 'privacy" in that context doesn’t mean shielded set rewards

1 Like
26

But the MASP purpose is not to reward tokens deposited, but to provide privacy right? Like if AKT is not incentivized to deposit in the shielded set, people will still want to use the MASP for privacy, that’s already a value for them. The incentivized assets are just to help increase the privacy guarantees of the MASP

Correct, there may be people who will choose shielding over other opportunities. I exaggerated to simplify the discussion and identify risk in the worst case scenario, because I think most people will choose earning money over keeping it in the shielded set. But I could be wrong.

all of these assets contribute to the overall privacy guarantees

It would be revolutionary if it worked that way. If all tokens share the same anonymity set and it works as we hope it does, then you could send hypothetical $COSMIC tokens that only you own into that blob that also contains a ton of $ATOM and $OSMO. And you could unshield the $COSMIC tokens while breaking the link with the identity that deposited them.

But there seems to be conflicting information.

The shielded value pool can be an Namada established account with a validity predicate which handles the verification of shielded transactions. Similarly to zcash, the asset balance of the shielded pool itself is transparent - that is, from the transparent perspective, the MASP is just an account holding assets.
Namada Specs - Storage Interface Specification

If I’m the first depositor, it’s easy to infer that any claim on the pool of assets is mine. A second depositor doesn’t help much, but each additional depositor makes it harder and harder to infer who is making claims on the asset pool to withdraw or transact with assets held by Namada.
Namada: Incentivizing Privacy – Knowable – ecosystems, not monopolies

A thought experiment then: if I am the only one who has shielded NAM, 1000 tokens, and any amount of those are unshielded, it is for any observer clear that I must have been involved. Even if there are 500 accounts shielding 100 million stNAM, the NAM will be linked to my identity. In order to protect me, it is therefore necessary that many individuals shield NAM so my tokens can blend into the crowd. Consequently, assuming NAM holders seek to increase wealth over holding shielded NAM at rest with no rewards and facing up to 10% yearly inflation, shielding NAM must likely be subsidized in order to grow a big enough crowd.

1 Like
27

I have just completed a little experiment.

I shielded NAM and SCHNITZEL tokens on Housefire. Then I queried the balance of the MASP account. If the MASP is an amorphous blob, the balance should only show 1 asset.

namadac balance --owner masp --token nam
nam: 4780.928101

namadac shield --source hf44 --target pay44 --token schnitzel --amount 123

namadac balance --owner masp --token schnitzel
schnitzel: 123

1 Like
28

Hey. Thanks for making this thorough incentive framework! I have a quick comment to make regarding liquid staking.

I’ll be referring to the table: “Determining Incentives to Deposit and Stay.”

According to the table, in year one of Namada the proposed incentive spend is $4,714,800 worth of NAM tokens. Unfortunately, over 50% of this incentive outlay would be wasted because it would be competing with existing staking rewards.

For example, the proposed outlay for ATOM is $1,870,000. Of which, only $420,750 is used to cover the assumed 5% risk premium for depositing on Namada, while the other $1,449,250 is used to compensate for the forgone staking reward. Thus, the vast majority of ATOM incentives in year one will be effectively wasted.

Instead of devoting such high incentives to ATOM, the Namada community should consider using more incentives on stATOM, because stATOM has no forgone staking yield that must be compensated for.

Looking at the numbers, one unit of NAM incentives is roughly 4x more effective when it comes to incentivizing stATOM as compared with ATOM.

Over the long term, it is unsustainable for the Namada community to incentivize the usage of unstaked tokens, because with unstaked tokens you have to compensate for foregone staking rewards. Whereas with liquid staked tokens you only have to pay the risk premium of depositing on the Namada platform.

Moreover, while the incentive framework proposed here considers ATOM and stATOM as separate tokens with separate circulating supplies, instead the framework should consider them as the same token, since all stATOM is backed 100% by ATOM. So even if a high amount of incentives relative to the current supply of stATOM is deployed, it should be assumed that new ATOM will be liquid staked in order to deposit on Namada.

As I mentioned, this would be the most efficient and sustainable way of spending incentives, and would be in the best interest of Namada’s long-term viability L=

1 Like
29

The issue is, as @Rigorous correctly pointed out, if only there is stATOM in the MASP then only stATOM will have good privacy guarantees. To offer good privacy guarantees to ATOM (and other unstaked tokens) there has to be enough ATOM also in the shielded pool. To make this simple to understand, it is true that with LSTs users can earn both staking rewards and shielded pool rewards, but if we only have LSTs in the MASP then only LSTs would have good privacy guarantees and we want also good privacy guarantees for ATOM, OSMO, INJ, etc

1 Like
30

I hear what you’re saying, but the problem is it’s not economically viable to maintain privacy guarantees for unstaked ATOM, OSMO, and TIA. The staking reward that users forfeit by leaving their tokens unstaked is just too high. We’re talking double digit staking APRs. So in order to get people to deposit unstaked tokens, you have to compensate them with a lot of NAM tokens.

I think it’s unwise for the Namada community to perpetually subsidize ATOM, OSMO, TIA privacy with NAM incentives. It’s not a good business decision, and will cause constant sell pressure for NAM.

On the other hand, privacy for stATOM, stOSMO, and stTIA just might be sustainable, since depositors don’t have to forfeit staking rewards. Subsidize these LST deposits at the beginning, and once deposits are big enough maybe Namada will generate some kind of fees which can be used to pay depositors. After all, since LST depositors keep all their staking rewards they should only need 1-5% APR in yield to make it worth while to continue depositing on Namada.

31

Some people want to stake assets directly without using a liquid staking provider, they are ok with the unbonding period and not extra DeFi yield. Other people don’t like the unbonding period and prefer solutions like Stride to avoid unbonding period and earn additional DeFi yield. However, there is also a major group of holders of unstaked tokens who want to hold these tokens but don’t want to take the risks to stake or use a liquid staking provider. However, this subset of people maybe actually like using their unstaked tokens for Namada’s MASP because there is no locking like in staking, no slashing risks, no impermanent loss like in LPing, or liquid staking risks. Of course given the lower risks involved the yield would be lower but some people would like this risk/reward. Some people want the highest reward and then take the highest risk of liquid staking and DeFi, other people are really risk averse and just hold assets without getting involved in staking, liquid staking or DeFi. But there are also people risk averse but that the risk/reward profile of the MASP maybe be reasonable for them and they may put their unstaked assets into the MASP. You are assuming that all users want to maximize rewards and take the highest risk, this is empirically not correct otherwise liquid staking protocols would control most staked tokens, I didn’t see the liquid staking cap limits being reached

32

Hey @CosmicValidator, thanks for your thoughtful response.

We had originally purposefully overlooked ETH and BTC derivative assets for a few reasons. However, we’re taking a second look and will provide a proper update soon on whether or not they make sense to include.

Regarding NAM (you’re likely aware, but clarifying for others), there are two types of incentives to consider:

  1. Incentives for NAM stakers, which aim to encourage staking NAM to secure the chain. Bootstrapping security from scratch is indeed a challenging task, and increasing the value and demand for NAM is essential for the network’s robustness.
  2. Incentives for asset depositors in the MASP, designed to encourage users to deposit various assets into the MASP, contributing to the overall privacy and utility of the network.

Initially, we believe it makes the most sense to focus on NAM staking incentives to quickly establish a strong security foundation for the chain. As the network matures and the security requirements are met, the DAO can reassess and potentially shift some focus toward incentivizing the use of NAM within the MASP. However, if you have a strong case for why NAM should be included in the initial set and why incentivizing both NAM stakers and depositors makes sense, we’d love to chat.

1 Like
33

It wouldn’t make sense that Namada offers privacy for all IBC assets but NAM itself doesn’t have privacy? I agree bootstrapping NAM security is key but NAM should be also the first asset benefitting from the MASP privacy for obvious reasons

1 Like
34

However, if you have a strong case for why NAM should be included in the initial set and why incentivizing both NAM stakers and depositors makes sense, we’d love to chat.

If NAM is not shielded, then nothing is shielded.

Then Namada becomes just a transparent chain with more hoops and an illusion of data protection.

Because NAM is the gas token of the Namada chain, without being able to pay gas with shielded NAM, shielded actions of any assets can be traced back to the source.

Shield ATOM from nam1abc → znam1xyz, pay gas from nam1abc
Unshield ATOM from zvknam1xyz → nam1def, pay gas from nam1abc

What you should do:

Shield ATOM from nam1abc → znam1xyz, pay gas from a disposable gas payer (an ephemeral shielded address)
Unshield ATOM from zvknam1xyz → nam1def, pay gas from a disposable gas payer

But that is only effective if there is enough NAM in and going into the MASP. If the MASP is empty, then unshielding ATOM can be linked to the source’s gas fee payments by looking at the transaction timestamps.

35

A priori I don’t see the need to directly incentivize unstaked NAM token via shielded set rewards as long as there’s enough amount of it so as to provide reliable privacy guarantees in terms of in/out obfuscations.

In the same way, privacy guarantees for an external IBC asset can be bootstrapped without the need to add it into the shielded set rewards list.

E.g., projects like Sentinel or Akash may want to leverage data protection from Namada. That means that in their respective communities they would need to discuss about to spend community funds so as to deposit them into Namada’s MASP - finally making data protection a reality for their dApps/use cases, thanks to the multiple assets capability that MASP offers. Plus IBC, of course.

That being said, and returning to the stNAM topic, privacy guarantees for the unstaked NAM token could be bootstrapped in first instance by the protocol itself via PGF inflation (CPGF could be a good choice) or individual/organization allocations - that would leave the way free for incentivizing stNAM via shielded set rewards without having to split %s with the unstaked NAM token.

The overall scenario would look better, as the mentioned potential additional yield for shielding stNAM wouldn’t get lost. And, at the same time, the protocol native token NAM would provide enough privacy guarantees in the first stages.

Native shielded staking would be a great feature to see in the future, and may eliminate the need to rely on external LSTs providers and its risks.

3 Likes
36

If enough NAM is deposited in the MASP without incentives as you suggest and there is enough privacy for NAM then what you suggest makes sense. People could choose to either stake NAM directly to get a staking yield, or stake via Stride to get both staking yield and shielded set yield, and this could also increase the amount of NAM staked, because maybe some people are not sure about staking NAM because of the unbonding period or missing other yield, but if they can earn staking and shielded set yield and without unbonding period many more may choose to stake. And the NAM would be staked via Stride with the unbonding period so if stNAM grows then also the amount of staked NAM grows which is the initial goal. The issue was that if only stNAM is in the MASP and not NAM, then there are no privacy guarantees for NAM but if as Daniel mentions NAM in the MASP is added without incentivizes then this wouldn’t be an issue.

This is also correct, if Namada can offer in the future a way to participate in both staking and shielded set and earn both yields natively then it would be an even better solution, but until this is ready solutions like stNAM could be a good idea. @JohnGalt could you update us on the stNAM progress? Also @Veildev in this case you should include stNAM in the incentives? You can’t apply your framework to stNAM since it is not launched yet but definitely if NAM won’t be incentivized in the MASP initially at least stNAM should be, I think we can all agree on this?

37

@Veildev with the upcoming IBC v2 Ethereum or other VM L1s will be part of the IBC ecosystem natively without any bridges, therefore in this case ETH, SOL and other major assets should have priority for incentives in the MASP when IBC v2 is implemented? For BTC I’m trying to clarify but given it has probabilistic finality/longest chain rule as consensus, not fast finality consensus, I’m not sure IBC v2 would make Bitcoin part of the IBC ecosystem that would be insane and unlikely, but Ethereum definitely will be so need to plan well for this I think, IBC v2 is expected to launch around the first half of 2025 shortly after the phase 5 of the Namada mainnet launch

EDIT:

  • IBC v2 will launch in Q1-Q2 2025 initially with support for the Ethereum L1

  • Bitcoin, other L1s and L2s could be possible but additional research/work is needed

  • This means the research/analysis you did in your initial post about IBC ecosystem assets should be also done about Ethereum L1 assets to identify the best candidates? ETH for sure and potentially some other assets. When incentives start in the MASP, IBC v2 likely won’t have launched yet so ok to focus on your initially proposed IBC assets, but the other research about Ethereum L1 should also be done now so that as soon as IBC v2 is launching incentives are added for ETH and the other selected assets

38

Native IBC USDC seems to be the top 1 volume in Osmosis, why shouldn’t it be incentivized? It is not staking token meaning like Stride’s LSTs it doesn’t have a hurdle rate. Moreover, it doesn’t have volatility risks. And shielded USDC is a great use case of Namada? Zcash has privacy but only for ZEC which is volatile, can’t really be used for payments, similarly the assets suggested are great but all of them are volatile, not really suitable for payments. In contrast, shielded USDC would be like bringing cash on-chain, it would have the properties of payments without volatility but also rather than transparent it would be shielded like when transacting with physical cash, this allows use cases like on-chain cash like payments and private savings similar to swiss bank accounts before, what do you think? @Veildev @cwgoes @Daniel @Rigorous

1 Like
39

To be honest, I think initially incentivizing USDC is an unnecessary political risk. USDC is uniquely tied to the US banking system, and although I personally understand the use of data protection technology like Namada as a constitutionally protected right, there is still a lot of flux in the legal treatment of this kind of technology, and I think Namada stands the best chance of a good relationship with the involved parties here if we first gradually demonstrate many uses of USDC with Namada’s technology for normal, pro-social purposes before adding incentives or trying to grow big quickly.

1 Like
40

I agree, I think @Veildev’s suggestion for the initial incentivized IBC assets is great