What the Merge Means for Ethereum

After years of research, development, and testing, Ethereum is set to move from proof of work to proof of stake in the coming months. Rather than “miners” spending computational energy to verify transactions, “validators” will lock up, or stake, their assets in the network in exchange for ETH rewards. The result is stronger security and a far smaller environmental footprint for the decentralized network.

Danny Ryan is an Ethereum Foundation (EF) researcher who is helping coordinate the network upgrade called the Merge. It is one part of a broader set of upgrades, once known as Ethereum 2.0, designed to make the network more secure, sustainable, and scalable.

Ryan discusses the Merge in this interview. In Part I of our discussion, below, he describes why security and sustainability are being emphasized ahead of scalability for now, how the upgrade opens the door for liquid stakers and other new participants, and why Ethereum never really stops working.

In Part II, he discusses the features users are likely to see in later upgrades, whether on-chain voting might guide future upgrade choices, and why shadow forks are the path ahead.

---

Two out of three: Security and sustainability

What is the Merge meant to do?

DANNY RYAN: Broadly speaking, when I consider what we’re trying to do to and for Ethereum at the layer-one protocol over the next several years, we’re trying to make it more secure, sustainable, and scalable — the three S’s — while remaining decentralized (which can mean many things, but multidimensional decentralization).

Layer one (L1)A layer one is a blockchain that can handle transactions without depending on another network. Bitcoin, Ethereum, and Solana are examples.

The Merge delivers two of those goals. One aim of the Merge is to make Ethereum more secure. People will probably debate that until the end of time — whether proof of stake is more secure than proof of work, or the other way around. But based on our research, our understanding of these systems, and our understanding of attack types and related issues, the Ethereum community and researchers generally argue that proof of stake is more secure than proof of work.

[With regards to] sustainability, proof of work, in order to perform its cryptoeconomic magic, consumes a massive amount of energy. Proof of stake, because of its cryptoeconomic magic, does not. So we are getting something like 99.9, 99.95, 99.98% less energy use depending on your napkin math, but still an extremely large reduction.

[If Ethereum stayed on proof of work and] the price of ETH doubles, the new equilibrium of mining power on the Ethereum platform would eventually double as well. And in the proof-of-stake world, [if] the price of ETH doubles, the equilibrium number of nodes on the network does not really change. There could be 10,000 nodes on the network. There could even be 100,000 nodes on the network. But the energy use will be equal to 100 middle schools’ or 1,000 middle schools’ worth — not, like, Argentina or whatever.

The Ethereum white paper says, “In the future, it is likely that Ethereum will switch to a proof-of-stake model for security, reducing the issuance requirement to somewhere between zero and 0.05X per year.” You mentioned not just security but sustainability. At what point did sustainability become as important as security?

In the white paper, I’m not sure that is addressed. But in some early Ethereum.org blog posts and even in the wider world — back in 2014, 2013 — the direct link between asset price and energy used on proof-of-work networks was well understood. I would say that when the Ethereum community started to become less inward-looking and [started] bringing non-crypto-native people into interesting applications, especially in the art and NFT world, the energy issue definitely came into the spotlight because [of] rises in the ETH price, which raise total mining power. Getting attention from different communities with all sorts of different value systems definitely made it a more prominent issue. But I would say that the “waste” of burning energy to prove the cryptoeconomics in proof of work has not been something we have not known about; it has definitely been a goal for quite some time.

The third S: Scalability

A lot of people have jumped ahead and started thinking about the things the Merge will help make possible, like lower fees, less congestion, and more. But at the most basic level …

That is that third S — scalability. And we do not get that immediately with the Merge. We do establish the foundation, as you said.

So at this point, with only the move to proof of stake and no sharding until a later upgrade, we do not yet have that third S. Where does scalability stand right now?

I like to be a little tongue-in-cheek: Block times will be 12 seconds instead of an average 13 and a half seconds, but the gas limit will remain the same. So 10% scalability gain at the Merge. Take it or leave it.

That is not the sort of scalability improvement we are really after. But scalable, more advanced consensus mechanisms that can reach agreement on more are genuinely difficult to build in proof of work. There are some efforts to do things like sharding [the planned scaling mechanism for Ethereum] and other things in proof-of-work protocols, but you end up simulating a proof-of-stake protocol inside a proof-of-work protocol. So I would say that [proof of stake] is a necessary base for future scalability upgrades.

In addition, there is a scalability route moving in parallel with the Merge through layer-two constructions [using] rollups. There are paths that are already live, and that people are starting to use more and more, that provide 10-100x scalability for the current Ethereum platform with no changes. And future scalability upgrades to the layer-one platform would work alongside this and amplify it. So the good part is — although at layer one we are aiming for those first two S’s, security and sustainability — in parallel, we are getting scalability through layer-two constructions, which are buying us time and are bringing much of the need into reality. Over time, we can add to that with more scale at layer one. (See part 2 of our conversation for how L1 sharding can provide additional scale.)

If you are depending on layer-two solutions (protocols that sit atop Ethereum to increase throughput) for a certain level of scalability, what security issues does that raise?

It is very easy to build insecure layer twos, first and foremost. We believe the most general-purpose secure construction is these rollups — optimistic and [zero knowledge, or] ZK. And one of the key pieces of this is that you publish transaction data or some form of state transition data and certain ZK constructions on-chain — so you make use of the chain’s data availability. And that does, in the end, cap the amount of scalability.

Layer two (L2)L2s refer to technologies atop an L1 that assist with scalability.

RollupsRollups move transactions off the primary network, bundle them, and then submit them back to the L1 network.

Sometimes people look at that and say, “Well, let’s just not do that. We’ll basically do a rollup but we won’t publish the data, and we can, like, do side construction.” So all at once, the push to gain more scale also becomes the push to potentially shave corners on some of these layer-two constructions. Thus, I think part of the security concern here is that it’s very hard to grasp the tradeoffs. If you had a pure L2 that didn’t cut corners, then you inherit Ethereum’s security. But if you have an L2 rollup that’s like, “Well, we’re pretty much a rollup,” then you not only don’t inherit Ethereum’s security, but by many orders of magnitude the threat profile worsens as those corners are cut.

I think it’s very hard for a consumer to compare L2 “A” and L2 “B” and realize that L2 A is, like, 1,000 times more secure than L2 B — especially when the language is vague, especially when it’s hard to tell what’s actually happening. L2Beat is this independent third party that’s trying to simply catalog this information so we can better understand the security tradeoffs here. But even so, that’s definitely a problem when you have L2s that aren’t quite really what they claim to be.

Another issue would be complexity. L1 has a certain risk profile tied to the kinds of bugs that could be introduced, the software’s complexity, and so on. And so when you build an L2, you take that and then add a bunch of complexity. You add this whole derivative system, and so there’s risk there, insecurity.

And then I would also say there’s a desire and a need to keep these L2-derivative systems upgradable. It’s hard for me to design an L2 that can never upgrade if I assume that L1 might upgrade. That’s where the need comes in. And there’s also a desire. I think many people building L2s want to ship them, but they also want to improve the feature set over time. So there’s also a desire to upgrade these systems over time. Because of that, there are also possible security risks. So what are the upgrade models? Is it upgradable by, like, three dudes and they have to sign a message? Is it upgradable by a DAO? Is that safe? Is it upgradeable instantly? Or does it give you like a year of lead time?… And there’s a whole spectrum of design here. The theoretical perfect L2 inherits Ethereum’s security. There are a lot of different things that qualify that statement, though.

MEV, liquid staking, and the evolving Ethereum ecosystem

With the move to proof of stake as well as the infrastructure and incentive changes that come from the Merge, what sort of new actors or project types do you see coming to the fore?

Certainly, in with the validators, out with the miners. So that’s a shift in actor. We believe there’ll be easily an order of magnitude more distinct validating entities than there were mining entities, which I think is good.

In parallel over the past couple of years, the MEV (miner extractable value or maximal extractable value) space has created a few different actors. This is kind of independent of the Merge, though. There are now entities that specialize in searching [and] trying to find optimal configurations of blocks. Then there are intermediaries in there that help combine searchers into valuable blocks and then sell them essentially to miners or validators. So there’s this whole extra protocol construction of different actors that are playing this MEV game, which apparently, seemingly, is very high value, high stakes. That’s kind of independent, although there are things that the L1 protocol can probably do to make that whole construction in reality safer. (To hear more about how Ethereum can address MEV at the L1 level, read the second part of our conversation.)

So there’s those actors. I would say staking derivatives are very interesting. There are many different versions of this, but essentially: When you’re staking, that has a certain risk profile — somebody is staking for you or you’re doing it yourself. And then there’s some representation of that underlying staked asset, which maybe you can trade or maybe you can bring into smart-contract world and bring into DeFi and things like that.

I know LIDO is probably the most popular. There’s a handful of them, and there’s a bunch that are also up-and-coming. So there’s a lot of different players in relation to that. There are DeFi entities getting involved kind of closer into the staking world. There are DAOs governing staked derivatives, there are consortiums governing staked derivatives, there’s all sorts of fun stuff that shakes out of that world.

Right, and there was some discussion about whether LIDO, which stakes a lot of ETH to the beacon chain on users’ behalf, was hitting the max of what was good for a decentralized network.

I wrote a piece called The Risks of LSD — liquid staking derivatives. Maybe I mentioned LIDO as just an example. Some people assume that you can build these things in ways that do not have the same sort of centralization concerns that you would if it was the single operator gathering certain key thresholds. I argue in that piece that this is not the case — that you do get substantial risk when you pass one-third, one-half, and two-thirds. And that for some reason, because of the derivative nature here, we don’t recognize those risks quite the same. Thus, the market seems to be asking to exceed those thresholds.

So I make the claim that if I’m a staking derivative, DAO, or controller or whatever, it’s probably in my best interest not to exceed those thresholds because of the risk that it creates for my protocol and for my users. And I make the claim that [for] users, it’s not actually in their best interest, even though liquidity breeds liquidity and being involved with a highly liquid staking derivative can have its benefits — that the risks start to outweigh those benefits. So my claim is: Let’s not not pay attention to the risks because the benefits are so great, and let’s wise up or else something bad probably will happen and then the market will probably get wiser.

[Editor’s note: In June 2022, LIDO holders voted down a governance proposal to explore setting limits on the amount of ETH staked through the platform.]

Some of the security gains, from my understanding, are that you’re going to get increased decentralization because it’s going to become easier to participate — not necessarily as a staker, but as a non-block-producing node. How much of the security gains are from increased user participation, and how much are attributable to other factors?

You probably get some sort of decentralization gain because proof of work and proof of stake require posting some sort of particular collateral, and it’s much easier to get the collateral for proof of stake because of the open markets to buy ETH. So it’s much easier for many participants to participate with the same edge in terms of access to that capital. Whereas in proof of work, the capital required is highly specialized machinery, you know, ASICs or GPUs.

Long story short, I think there are gains in decentralization and I think there are gains due to the type of cryptoeconomic capital — making it a bit more egalitarian, reducing the economies of scale.

But a lot of what my claim would be [is] in the actual way the protocol is built: In proof of work, pretty much we can just reward. So if you do a good job, you end up making money. If you do a bad job, there’s opportunity costs. But if you explicitly attack, you don’t really lose anything. Whereas in proof of stake, if you do a good job, you make money. You do a bad job — you know, you’re offline, things like that — you stand to lose some money. And if you do explicitly nefarious things like contradict yourself and try to create reorgs and two different chains, you can lose tons of money. You can lose all of your money, depending on the extent of what’s detected.

Because the asset is in the protocol — the staked ETH — that asset can be destroyed. It’s kind of like: the protocol cannot burn somebody’s mining farm down if they tried to attack the chain, but the protocol can burn the staked ETH if they try to attack the chain. Not only do we get the rewards, but we can have punishments, so the security margin on the capital that is staked can be much higher. That’s the [explanation] for a lot of why we say it’s more secure.

Decentralization, access to the asset required, reduced economies of scale, and other stuff like that help as well.

Doing it live

This whole upgrade is happening with no pause at all in transactions. And the Ethereum.org site says: “Ethereum does not have downtime.” Why was that so important? Why not just set aside a day, announce it ahead of time, and switch over?

For one thing, I don’t know how much that would lower the complexity. At the end of the day, we still have to coordinate on something, and we still have to agree where the end is and where to start. And once you have to do that, a day is probably not enough at all.

If you actually wanted to do that — to stop, then everyone upgrades their nodes and then it starts again — I would say three days minimum, probably more like a week in terms of actually having success and coordinating. Maybe if you really give lead time [and] everyone knows it is going to happen, it could be 48 or 72 hours. I don’t think it would be just a day anyway.

So the question becomes: what is lost in that day? Probably a lot. I know the DeFi bros would be very upset. It is a working economy. A lot is happening on Ethereum all day, every day. People expect it to be up. And that is the expectation we are trying to preserve.

Again, I don’t know, maybe you can cut the complexity by 20% if you do not do it live, but that is probably not worth the loss of being offline for three days — both in terms of the transaction volume on those days and also in terms of what people expect from Ethereum. I think we would break that a little, but I do not know. It is the way it will be done unless there is a coordinated miner attack beforehand, and I do not think it adds too much complexity. There was a clear path for how to do it that way, so I think it made sense.

Read the second half of conversation with Danny Ryan to find out what kinds of upgrades developers want to see after the shift to proof of stake.

This interview has been edited and shortened.