[Discussion] Mantle LSD
This discussion post is authored by Cateatpeanut, the Mantle core contributor team, and advisors including Jordi (@gametheorizing). Thank you to all the LSD and node operator teams who have provided valuable advice and cooperation offers.
The purpose of this post is to gather feedback and initiate discussions, while a separate post will be made for the budget proposal.
1. Discussion Summary
-
LSD Protocol: A Liquid Staking Derivatives (LSD) Protocol facilitates the pooling of ETH deposits for staking on the Ethereum Proof-of-Stake (PoS) consensus layer (Beacon Chain), and provides ETH depositors with a tradable receipt token that can be utilized in other applications.
-
Rewards: Rewards are provided by mechanisms on the Ethereum network for PoS validation services performed by node operators. These rewards come in the form of issuance, execution layer fees, and MEV. There is risk of slashing if validation services are not performed correctly. Rewards are shared among ETH depositors, the LSD, and node operators.
-
Mantle LSD and mntETH: We introduce Mantle LSD a liquid staking protocol deployed on Ethereum Mainnet, fully governed by Mantle. Users, including the Mantle Treasury, can deposit ETH and receive yield-bearing mntETH receipt tokens. Validation services are outsourced to external node operators.
-
Mantle Ecosystem Synergies: Mantle LSD aims to leverage product synergies with Mantle Network, including the adoption of mntETH on Mantle Network (an Ethereum layer 2) and partnerships with node operators and DeFi applications. It aims to be the preferred solution for the liquid staking of ETH from the Mantle Treasury and Mantle Ecosystem supporters, reducing deposit acquisition costs. Strategic synergies can be implemented through the Mantle Governance process.
-
Operational Advantages: Mantle LSD aims to provide a simple and secure architecture that strategically benefits the Mantle Ecosystem, and is a product primitive that third party applications can adopt and extend permissionlessly. It can leverage the existing capabilities of the Mantle Ecosystem, such as community, governance processes, brand, social presence, development, and growth capabilities.
For further information on LSDs and the Ethereum Staking Landscape, please refer to the following resources: Nansen - Landscape Article, Jon Charbonneau - Landscape Article, Dune Analytics, and DefiLlama Analytics. For further information on decentralized LSD architectures, please refer to the following resources: Lido Techdocs, FraxETH Techdocs, Stader Litepaper, and Rocket Pool Techdocs.
2. Next Steps
-
Review feedback and general sentiment on this forum post.
-
Evaluate other proposals and options.
-
Prepare a budget and authorization proposal, similar to the BIP-19 Mantle Network Budget.
Note: Development is estimated to take 12-16 weeks, with 4-6 weeks for audit. Given the timeline constraints, early architecture and development have already commenced.
3. Strategic Analysis
3.1 Objectives
Maximize Mantle product synergies.
Potential pathways include:
-
Be the preferred solution for ETH staking requirements of the Mantle Treasury and Mantle Ecosystem supporters.
-
Adopt mntETH as a version of ETH on EigenLayer, facilitated by EigenDA as Mantle Network’s data availability partner.
-
Promote mntETH adoption in Mantle Network’s DeFi applications.
-
Explore mntETH as Mantle Network L2 gas fees.
-
Enhance convenience for Mantle Network users through access to yield-bearing mntETH.
-
Enable deeper cooperation with node operators across Mantle Ecosystem such as Mantle Network DA, TSS, and RPC nodes.
-
Position Mantle LSD under Mantle Governance.
3.2 Advantages
The competitive differentiation of Mantle LSD lies in the following advantages:
-
Strategic ETH Depositors: Mantle LSD benefits from relationships with significant ETH depositors, including the Mantle Treasury with approximately ~270k ETH, institutional partners, and supporters within the Mantle Ecosystem. This advantage reduces Phase 1 deposit acquisition costs and can position mntETH as a top 3 ranking within the decentralized LSD category.
-
Mantle Product Synergies: Mantle LSD is designed to capture benefits beyond the LSD service fee by leveraging synergies with the Mantle product suite. These synergies result from shared narratives, the impact on the $MNT token, and the common governance structure between Mantle Network and Mantle LSD.
-
Lower Overhead and Risk through Simplicity: Mantle LSD aims to be a simple and secure primitive that other applications can adopt and extend permissionlessly. Mantle LSD also benefits from modern design principles and a post-withdrawal-queue landscape. Simplicity reduces risks and costs.
-
Mantle Operational Synergies: Mantle LSD can capture significant operational cost advantages by leveraging the existing community, tools, distribution, brand, and core contributor team capacities of the Mantle Ecosystem.
-
Mantle Governance and Roles: Mantle LSD operates within the framework of Mantle Governance, ensuring competitiveness and discipline. The Mantle LSD Operator is not responsible for Mantle Treasury decisions, and the Mantle LSD Administrator role will be nominated by Mantle Governance.
Note: If the anticipated advantages do not materialize, the Mantle community can utilize the Mantle Governance process to explore project deprecation, restructuring, or alternative options.
3.3 Economics
As shown in the table below, while Mantle LSD operations can be self-sustaining through the LSD service fee, to make this project worthwhile, we must achieve strategic benefits with Mantle products and $MNT.
4. Additional Technical Details
The purpose of this section is to provide readers with additional information on the mechanics of LSD, highlight areas of risk, and preliminary recommendations on technical architecture.
4.1 Simplified Diagram
4.2 Descriptions
4.2.1 LSD Administrator
-
The Administrator has the authority to update parameters and enable upgrades in LSD smart contracts, which affect permissions and asset flows.
-
The Administrator will be nominated by Mantle Governance and may also serve as the Administrator for other Mantle products. Depending on stage of maturity, the Administrator will be a multi-sig, the Mantle Security Council, or an on-chain Mantle DAO controller.
-
This is similar to other decentralized LSDs where the Administrator role is a security council or an on-chain DAO controller with security council override.
-
The Administrator’s expected involvement is during initial deployments, upgrades, and emergency situations.
4.2.2 LSD Operator
-
In general, the Operator can initiate fund movements between the preset smart contract addresses, but can not change these addresses.
-
The Operator is a key managed by the LSD core contributor team.
-
The Operator can be replaced by the Administrator.
4.2.3 Asset Flows
Who controls the staked ETH?
-
The ETH stake principal is managed by LSD smart contracts. The Operator can initiate fund flows between LSD smart contracts, but requires Administrator signatures to modify destination smart contract addresses.
-
Staking involves two types of keys: validators keys and withdrawal keys. Validator keys are used for cryptographic signing of attestations, while withdrawal keys are used to set reward and withdrawal addresses. For Mantle LSD, the rewards and withdrawal address will be the LSD smart contract at the time of validator creation. This means the node operators (validators) do not have control over the staked ETH.
4.2.4 mntETH Token Model
-
There are two main types of receipt token models: Rebasing and Value Accumulating. The rebasing model maintains a loose 1:1 peg to ETH, while the value accumulating model is designed to increase the mntETH:ETH ratio over time, aligned with the weighted rewards APY.
-
Our recommended token model for mntETH is the value accumulating model, following the standard ERC-20 format. This model provides maximum composability and technical familiarity across DeFi, omnichain, and centralized applications. See commentary on implementing rebasing tokens within applications: Lido Techdocs: stETH Booking Shares.
-
It is worth noting that the current most widely adopted receipt token is Lido stETH, a rebasing token model.
4.2.5 Users
There are two ways users can interact with Mantle LSD and mntETH.
-
Direct Staking and Redemptions: Users can directly deposit into and redeem from the Staking Contract. As of June 10, 2023, there is a delay of 40+ days for Beaconchain activations (staking) and 2 days for withdrawals (redemption). For more details, please visit: https://www.validatorqueue.com/. The protocol may have to implement delays on withdrawals to prevent a griefer from staking and immediately withdrawing, causing the protocol to exit validators to the detriment of all mntETH holders.
-
Trading for mntETH on Secondary Markets: Users have the option to convert between ETH and mntETH directly on applications such as DEX and CEX. The exchange rate on these markets is determined by price discovery and slippage. In theory, the exchange rate should follow the exchange rate for direct staking and redemptions due to market makers and arbitrage opportunities.
4.2.6 Staking Contract
-
Staking involves depositing ETH and receiving minted mntETH receipt tokens. Redemption involves depositing mntETH (to be burned) and receiving principal ETH along with accumulated rewards.
-
The Staking Contract is the core component of Mantle LSD, and needs to ensure the integrity of the staking and redemption process and the accuracy of the mntETH:ETH exchange rate. More information about the exchange rate and associated risks can be found in the subsequent section.
-
Stake Limits: During the initial stages of Mantle LSD, implementing global deposit limits can provide stability and help mitigate potential risks. This approach allows for controlled growth and ensures the resilience of the system before transitioning to an unlimited stake mode.
4.2.7 Exchange Rate and Oracles
-
The accuracy of the stake and redeem exchange rate is crucial for the integrity of Mantle LSD. If the mntETH:ETH exchange rate is inaccurately quoted too high or too low, it can create opportunities for arbitrage that could negatively impact all mntETH holders.
-
The challenge of ensuring an accurate exchange rate is amplified by the lack of native data feeds between the Consensus Layer, where the staked ETH principal is held, and the Execution Layer, where LSD smart contracts are deployed. To address this, the use of exchange rate oracles is necessary. It is worth noting that future EIPs are being considered to address this issue.
-
There are multiple approaches to mitigate exchange rate risk, including:
-
Multiple Oracles with Quorum: Implementing a system where multiple oracle daemons provide exchange rate data, and a consensus mechanism ensures the final rate. See LidoOracle as an example.
-
Merkle or ZK Proof systems: Verifying the oracle exchange rate against Consensus Layer state.
-
Exchange Rate Bounds: Establishing upper and lower bounds for periodic exchange rate movements. The upper bound has predictable exchange rate growth expectations of ~6% per year, while the lower bound is less predictable due to slashing events.
-
Guardians: Introducing guardians who have the ability to pause and unpause the Staking Contract. More details on guardians are provided in the subsequent section.
-
Request Finalization Window: Implementation of a time window (based on oracle update time with some buffer) where withdrawal requests can be rejected or repriced by the protocol, requiring users to resubmit their request. This would only happen in an emergency scenario where a major slashing event occurred.
-
Exchange Rate Margin: Implementing a different exchange rate for staking and redemptions, to account for the asymmetry between Beacon Chain stake activation time and withdrawal time.
-
4.2.8 Guardians and Pausing
-
In the event of instability or unintended-performance by the exchange rate oracle, node operators, and Ethereum, the staking contract can be paused by Guardians to prevent exploitation.
-
Immediate action is crucial in scenarios such as Example Scenario 1: A mass slashing event occurs due to an Ethereum or node operator upgrade. If the oracle fails to promptly update the exchange rate, there may be a window where the real mntETH:ETH exchange rate will be lower than the one quoted by the oracle. This difference in exchange rates can be exploited by users of the Staking Contract.
-
Example Guardian Controller Logic: We recommend implementing the following guardian setup:
-
1 guardian key held by the LSD Operator.
-
3 guardian keys held by external parties with their own monitoring systems. These external parties can include node operators, centralized exchanges, LSD focused dApps in Mantle Ecosystem, etc.
-
Any guardian has the ability to immediately pause the Staking Contract.
-
A quorum of guardians is required to unpause the Staking Contract, with a time delay.
-
The guardians can only be replaced by the LSD Administrator.
-
-
The impact of a temporary pause on the user experience is not expected to be significant. Most users will not directly interact with the Staking Contract, and instead, will be exchanging mntETH:ETH on secondary markets. The temporary pausing of the primary subscription and redemption mechanism for several days can be observed in other protocols such as USDC and wBTC.
4.2.9 Node Operators
-
Node Operators perform validation services on the Ethereum network, but do not control any stake principal.
-
Target performance of validation services results in Consensus Layer rewards (issuance), and Execution Layer rewards (priority fees and MEV). Poor performance may result in slashing of the stake principal. The performance of node operators can be seen on various tracking sites such as: https://www.rated.network/ .
-
Node operator selection can be permissioned and permissionless, and each node operator can provide a degree of stake principal protection measures such as slashing insurance or a bond.
-
Our recommendation for Mantle LSD Phase 1 is to select 3 top-tier node operators with a proven track record of reliably providing validation services for portfolios of $500M or more. We will look for node operators who offer SLA guarantees, insurance coverage and are strategically involved in other areas of the Mantle product suite, such as Mantle Network RPC/DA/TSS nodes.
4.2.10 DeFi, CeFi Applications
-
Our recommendation is for Mantle LSD to maintain focus on the core protocol, particularly the integrity of the Staking Contract and exchange rates. It is a simple and secure primitive that other applications can adopt and extend permissionlessly.
-
Potential applications may include:
-
Collateral Markets: This involves mntETH being recognized as collateral for applications such as borrowing-and-lending, perpetual exchange portfolio margin, self-repaying loans, and other advanced structured products.
-
LST Alliances: This involves pooling multiple LSTs (receipt tokens) together to create a common receipt token. The goal is to concentrate otherwise fragmented liquidity, potentially leading to better adoption of the common receipt token among applications. However, it is important to note that the common receipt token shares the accumulated risk of its underlying components.
-
Onboarding Channels: This involves users being able to indirectly interact with the Staking Contract via L2 applications, omnichain applications, centralized exchanges, and multi-currency routers.
-
-
In the above scenarios, the Mantle LSD team can support integration and adoption efforts, noting that usage of the Mantle LSD Staking Contract is permissionless. Further incentives can be made via the Mantle Ecosystem Grants program and the Mantle EcoFund. The costs, risks, and rewards of developing those applications are to be borne by the application teams themselves.
4.2.11 Other LSD Smart Contracts
-
Deposit Contract: ETH deposited in the LSD contracts will be pooled until such a time that deposits reach 32 ETH or more. At this point, an off-chain component calls the contract to initiate the validator staking process. The ETH will be transferred to the Consensus Layer deposit contract, and the withdrawal address will be set to the LSD Rewards contract. The validator will then join the queue to start earning rewards.
-
Reward Aggregator: The Rewards contracts accumulate rewards from both the Consensus Layer (issuance) and Execution Layer (tips and MEV). These rewards will then be periodically sent back to the Staking Contract for compounding.
-
Fee Collection: The oracle update contains information about which Consensus Layer withdrawals are rewards and which are returned principals. The rewards contracts will use this information to deduct the LSD service fee from the rewards and transfer it to a fee collection contract. Node operators receive their service fee from these contracts based on their share of validators and/or performance.
4.2.12 Other LSD Offchain Systems
-
Initiator: The Initiator is responsible for triggering requests to deposit new ETH in the contracts. It monitors the staking deposit pool and waits until there is more than 32 ETH pending. It will then select a new validator from a Node Operator (through their API) and submit the stake request. The smart contracts verify on-chain that the withdrawal address for the validator is correct.
-
Oracle for Rewards Calculation: The Oracle service computes a few pieces of information that smart contracts do not have direct access to. These include: the portion of withdrawals that are rewards and principals; the total “in-flight” ETH deposited in the Beacon contract but not yet created on the Consensus Layer; the total balance of ETH in the Consensus Layer validators; and statistics about the protocol which enable sanity checks on the incoming data (e.g., number of active validators), with a more frequent schedule providing more up-to-date exchange rates. If any report from the oracle falls outside of the sanity check bounds, the update enters a pending state until the Oracle team reviews and approves or rejects it.
-
Node Management: This service monitors the unstake request queue and decide when and which validators to exit from the network to return principals. To maximize protocol yield, and given the current long activation queue for re-staking ETH, validators are exited in a just-in-time fashion. The criteria for deciding which validator to exit may be dynamic based on timing or validator performance.
, since EngineLayer is thier partner