LZ Research paper argues validators can coordinate a risk-free equivocation attack on proof-of-stake

Proof-of-stake security rests on one inequality. An attack is supposed to make sense only when its payoff exceeds the value of the stake the attacker puts at risk ^[5]. The protocol needs that price because a validator's work is mostly signing messages, and signing a second, conflicting one costs almost nothing computationally ^[8]. Slashing supplies the price by automatically destroying some or all of a cheater's staked funds ^[2]. A 2023 a16z crypto report emphasized slashing as the way to raise the cost of corruption and collusion among validators ^[13].

Chung and Liu-Zhang go after the loss side of that inequality. According to the paper, their protocol solicits equivocation so that validators lose nothing if the attack falls short of a critical threshold. With too few signers, nobody is slashed; with enough, the attack proceeds ^[3]. Combine that with the authors' claim about gains and the attacker's condition changes from a payoff larger than the stake to any payoff above zero, with a failed attempt costing nothing ^[1]. Crypto Briefing interprets the title to mean that by the time the protocol can punish anyone, the attack has either succeeded or quietly dissolved without consequence ^[9].

The deal term I find most interesting is the size of the bond. The authors say the gain stays positive however small it is relative to the amounts staked ^[15]. In their model, then, a network that raised its collateral requirement would lock up more capital (capital stakers could otherwise deploy elsewhere) and leave the attacker's decision unchanged ^[2].

It could go two ways from here. The practical steps the model may abstract away, validators finding each other, trusting the coordination process and acting in concert ^[7], may be where any real attempt breaks down, and the result stays on arXiv. Alternatively, someone runs the protocol against a named chain's actual slashing rules and it holds, and the paper becomes a specific engineering problem for that chain.

I think the first outcome is more likely in the near term. Every one of those steps requires validators to trust strangers before a single conflicting block exists. The counter-case is that the paper's protocol exists precisely to handle coordination, so the hurdle may be smaller than it looks. This view is wrong if a follow-up paper or a live test shows the protocol working against an existing network's rules.