Overview

This report follows from Subnets - security analysis.

In that report, we detailed (1) the probabilities of a given subnet being taken over and (2) the number of subnets that need to be created in order for at least 1 subnet to be taken over with 99% confidence.

In this report, we want to dive into the “subnet grinding” attack, where a dishonest actor acts as both User and Host, repeatedly creating and settling subnets, until they land in a vulnerable subnet where they hold > 66% of the slots.

As detailed in https://github.com/gonka-ai/gonka/issues/914#issuecomment-4090483233, dishonest actors cannot profit from this attack, but they can damage other hosts by cutting their RewardCoins.

This report will be split in two parts:

1. We calculated:

   • The maximum damage a dishonest actor can do, in terms of RewardCoins lost.
   • What fee we should charge per subnet to cover the maximum damage.

2. The fees we’ll apply in practice should be monotonically increasing with the subnet size. Larger subnets offer high security, therefore we should charge a higher fee.

   In this second part, we’ll analyze how the level of security scales with subnet size.

Maximum damage

As a rough initial estimation, we could simply state the maximum damage a hijacked subnet can cause is a total loss of RewardCoins for the network. At the moment, that is about 300k tokens.

1st refinement: A dishonest actor holding e.g. 30% of the network’s total weight can only cause the loss of coins for the remainder 70% of the network. I.e. 0.7 * 300k = 210k tokens.

In other words: the percentage of tokens lost is capped by the percentage of honest weight in the network.

2nd refinement: A dishonest actor can only damage a limited number of hosts per subnet attack.

• Let’s assume:
  • A subnet with 128 slots.
  • max_host_weight: The maximum weight of any host is 10k (TODO: verify this)
  • total_weight: The total weight of the network is 988k (source)
• For it to be hijacked, the dishonest actor must occupy 86 slots, which means 42 slots will be at risk.
• These 42 slots can be occupied by a number of hosts in the range [1, 42].
  • Let's assume the worst-case scenario where they're occupied by 42 distinct hosts.